Name: References: \n - [Semgrep Rule](https://semgrep.dev/r/bash.curl.security.curl-pipe-bash.curl-pipe-bash)\n - [https://owasp.org/Top10/A03_2021-Injection](https://owasp.org/Top10/A03_2021-Injection)\n","text":"Data is being piped into `bash` from a `curl` command. An attacker with control of the server in the `curl` command could inject malicious code into the pipe, resulting in a system compromise. Avoid piping untrusted data into `bash` or any other shell if you can. If you must do this, consider checking the SHA sum of the content returned by the server to verify its integrity."},"helpUri":"https://semgrep.dev/r/bash.curl.security.curl-pipe-bash.curl-pipe-bash","id":"bash.curl.security.curl-pipe-bash.curl-pipe-bash","name":"bash.curl.security.curl-pipe-bash.curl-pipe-bash","properties":{"precision":"very-high","tags":["CWE-95: Improper Neutralization of Directives in Dynamically Evaluated Code ('Eval Injection')","LOW CONFIDENCE","OWASP-A03:2021 - Injection","security"]},"shortDescription":{"text":"Semgrep Finding: bash.curl.security.curl-pipe-bash.curl-pipe-bash"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"The special variable IFS affects how splitting takes place when expanding unquoted variables. Don't set it globally. Prefer a dedicated utility such as 'cut' or 'awk' if you need to split input data. If you must use 'read', set IFS locally using e.g. 'IFS=\",\" read -a my_array'."},"help":{"markdown":"The special variable IFS affects how splitting takes place when expanding unquoted variables. Don't set it globally. Prefer a dedicated utility such as 'cut' or 'awk' if you need to split input data. If you must use 'read', set IFS locally using e.g. 'IFS=\",\" read -a my_array'.\n\nReferences: \n - [Semgrep Rule](https://semgrep.dev/r/bash.lang.security.ifs-tampering.ifs-tampering)\n - [https://owasp.org/Top10/A03_2021-Injection](https://owasp.org/Top10/A03_2021-Injection)\n","text":"The special variable IFS affects how splitting takes place when expanding unquoted variables. Don't set it globally. Prefer a dedicated utility such as 'cut' or 'awk' if you need to split input data. If you must use 'read', set IFS locally using e.g. 'IFS=\",\" read -a my_array'."},"helpUri":"https://semgrep.dev/r/bash.lang.security.ifs-tampering.ifs-tampering","id":"bash.lang.security.ifs-tampering.ifs-tampering","name":"bash.lang.security.ifs-tampering.ifs-tampering","properties":{"precision":"very-high","tags":["CWE-20: Improper Input Validation","LOW CONFIDENCE","OWASP-A03:2021 - Injection","security"]},"shortDescription":{"text":"Semgrep Finding: bash.lang.security.ifs-tampering.ifs-tampering"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"Avoid 'gets()'. This function does not consider buffer boundaries and can lead to buffer overflows. Use 'fgets()' or 'gets_s()' instead."},"help":{"markdown":"Avoid 'gets()'. This function does not consider buffer boundaries and can lead to buffer overflows. Use 'fgets()' or 'gets_s()' instead.\n\nReferences: \n - [Semgrep Rule](https://semgrep.dev/r/c.lang.security.insecure-use-gets-fn.insecure-use-gets-fn)\n - [https://us-cert.cisa.gov/bsi/articles/knowledge/coding-practices/fgets-and-gets_s](https://us-cert.cisa.gov/bsi/articles/knowledge/coding-practices/fgets-and-gets_s)\n","text":"Avoid 'gets()'. This function does not consider buffer boundaries and can lead to buffer overflows. Use 'fgets()' or 'gets_s()' instead."},"helpUri":"https://semgrep.dev/r/c.lang.security.insecure-use-gets-fn.insecure-use-gets-fn","id":"c.lang.security.insecure-use-gets-fn.insecure-use-gets-fn","name":"c.lang.security.insecure-use-gets-fn.insecure-use-gets-fn","properties":{"precision":"very-high","tags":["CWE-676: Use of Potentially Dangerous Function","MEDIUM CONFIDENCE","security"]},"shortDescription":{"text":"Semgrep Finding: c.lang.security.insecure-use-gets-fn.insecure-use-gets-fn"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"Avoid using 'scanf()'. This function, when used improperly, does not consider buffer boundaries and can lead to buffer overflows. Use 'fgets()' instead for reading input."},"help":{"markdown":"Avoid using 'scanf()'. This function, when used improperly, does not consider buffer boundaries and can lead to buffer overflows. Use 'fgets()' instead for reading input.\n\nReferences: \n - [Semgrep Rule](https://semgrep.dev/r/c.lang.security.insecure-use-scanf-fn.insecure-use-scanf-fn)\n - [http://sekrit.de/webdocs/c/beginners-guide-away-from-scanf.html](http://sekrit.de/webdocs/c/beginners-guide-away-from-scanf.html)\n","text":"Avoid using 'scanf()'. This function, when used improperly, does not consider buffer boundaries and can lead to buffer overflows. Use 'fgets()' instead for reading input."},"helpUri":"https://semgrep.dev/r/c.lang.security.insecure-use-scanf-fn.insecure-use-scanf-fn","id":"c.lang.security.insecure-use-scanf-fn.insecure-use-scanf-fn","name":"c.lang.security.insecure-use-scanf-fn.insecure-use-scanf-fn","properties":{"precision":"very-high","tags":["CWE-676: Use of Potentially Dangerous Function","LOW CONFIDENCE","security"]},"shortDescription":{"text":"Semgrep Finding: c.lang.security.insecure-use-scanf-fn.insecure-use-scanf-fn"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"Avoid using 'strtok()'. This function directly modifies the first argument buffer, permanently erasing the delimiter character. Use 'strtok_r()' instead."},"help":{"markdown":"Avoid using 'strtok()'. This function directly modifies the first argument buffer, permanently erasing the delimiter character. Use 'strtok_r()' instead.\n\nReferences: \n - [Semgrep Rule](https://semgrep.dev/r/c.lang.security.insecure-use-strtok-fn.insecure-use-strtok-fn)\n - [https://wiki.sei.cmu.edu/confluence/display/c/STR06-C.+Do+not+assume+that+strtok%28%29+leaves+the+parse+string+unchanged](https://wiki.sei.cmu.edu/confluence/display/c/STR06-C.+Do+not+assume+that+strtok%28%29+leaves+the+parse+string+unchanged)\n - [https://man7.org/linux/man-pages/man3/strtok.3.html#BUGS](https://man7.org/linux/man-pages/man3/strtok.3.html#BUGS)\n - [https://stackoverflow.com/a/40335556](https://stackoverflow.com/a/40335556)\n","text":"Avoid using 'strtok()'. This function directly modifies the first argument buffer, permanently erasing the delimiter character. Use 'strtok_r()' instead."},"helpUri":"https://semgrep.dev/r/c.lang.security.insecure-use-strtok-fn.insecure-use-strtok-fn","id":"c.lang.security.insecure-use-strtok-fn.insecure-use-strtok-fn","name":"c.lang.security.insecure-use-strtok-fn.insecure-use-strtok-fn","properties":{"precision":"very-high","tags":["CWE-676: Use of Potentially Dangerous Function","LOW CONFIDENCE","security"]},"shortDescription":{"text":"Semgrep Finding: c.lang.security.insecure-use-strtok-fn.insecure-use-strtok-fn"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"Call to 'read()' without error checking is susceptible to file descriptor exhaustion. Consider using the 'getrandom()' function."},"help":{"markdown":"Call to 'read()' without error checking is susceptible to file descriptor exhaustion. Consider using the 'getrandom()' function.\n\nReferences: \n - [Semgrep Rule](https://semgrep.dev/r/c.lang.security.random-fd-exhaustion.random-fd-exhaustion)\n - [https://lwn.net/Articles/606141/](https://lwn.net/Articles/606141/)\n","text":"Call to 'read()' without error checking is susceptible to file descriptor exhaustion. Consider using the 'getrandom()' function."},"helpUri":"https://semgrep.dev/r/c.lang.security.random-fd-exhaustion.random-fd-exhaustion","id":"c.lang.security.random-fd-exhaustion.random-fd-exhaustion","name":"c.lang.security.random-fd-exhaustion.random-fd-exhaustion","properties":{"precision":"very-high","tags":["CWE-774: Allocation of File Descriptors or Handles Without Limits or Throttling","MEDIUM CONFIDENCE","security"]},"shortDescription":{"text":"Semgrep Finding: c.lang.security.random-fd-exhaustion.random-fd-exhaustion"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"DOCTYPE declarations are enabled for javax.xml.parsers.SAXParserFactory. Without prohibiting external entity declarations, this is vulnerable to XML external entity attacks. Disable this by setting the feature \"http://apache.org/xml/features/disallow-doctype-decl\" to true. Alternatively, allow DOCTYPE declarations and only prohibit external entities declarations. This can be done by setting the features \"http://xml.org/sax/features/external-general-entities\" and \"http://xml.org/sax/features/external-parameter-entities\" to false."},"help":{"markdown":"DOCTYPE declarations are enabled for javax.xml.parsers.SAXParserFactory. Without prohibiting external entity declarations, this is vulnerable to XML external entity attacks. Disable this by setting the feature \"http://apache.org/xml/features/disallow-doctype-decl\" to true. Alternatively, allow DOCTYPE declarations and only prohibit external entities declarations. This can be done by setting the features \"http://xml.org/sax/features/external-general-entities\" and \"http://xml.org/sax/features/external-parameter-entities\" to false.\n\nReferences: \n - [Semgrep Rule](https://semgrep.dev/r/clojure.lang.security.documentbuilderfactory-xxe.documentbuilderfactory-xxe)\n - [https://semgrep.dev/blog/2022/xml-security-in-java](https://semgrep.dev/blog/2022/xml-security-in-java)\n - [https://semgrep.dev/docs/cheat-sheets/java-xxe/](https://semgrep.dev/docs/cheat-sheets/java-xxe/)\n - [https://xerces.apache.org/xerces2-j/features.html](https://xerces.apache.org/xerces2-j/features.html)\n","text":"DOCTYPE declarations are enabled for javax.xml.parsers.SAXParserFactory. Without prohibiting external entity declarations, this is vulnerable to XML external entity attacks. Disable this by setting the feature \"http://apache.org/xml/features/disallow-doctype-decl\" to true. Alternatively, allow DOCTYPE declarations and only prohibit external entities declarations. This can be done by setting the features \"http://xml.org/sax/features/external-general-entities\" and \"http://xml.org/sax/features/external-parameter-entities\" to false."},"helpUri":"https://semgrep.dev/r/clojure.lang.security.documentbuilderfactory-xxe.documentbuilderfactory-xxe","id":"clojure.lang.security.documentbuilderfactory-xxe.documentbuilderfactory-xxe","name":"clojure.lang.security.documentbuilderfactory-xxe.documentbuilderfactory-xxe","properties":{"precision":"very-high","tags":["CWE-611: Improper Restriction of XML External Entity Reference","HIGH CONFIDENCE","OWASP-A04:2017 - XML External Entities (XXE)","OWASP-A05:2021 - Security Misconfiguration","security"]},"shortDescription":{"text":"Semgrep Finding: clojure.lang.security.documentbuilderfactory-xxe.documentbuilderfactory-xxe"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"MD5 hash algorithm detected. This is not collision resistant and leads to easily-cracked password hashes. Replace with current recommended hashing algorithms."},"help":{"markdown":"MD5 hash algorithm detected. This is not collision resistant and leads to easily-cracked password hashes. Replace with current recommended hashing algorithms.\n\nReferences: \n - [Semgrep Rule](https://semgrep.dev/r/clojure.lang.security.use-of-md5.use-of-md5)\n - [https://cheatsheetseries.owasp.org/cheatsheets/Cryptographic_Storage_Cheat_Sheet.html](https://cheatsheetseries.owasp.org/cheatsheets/Cryptographic_Storage_Cheat_Sheet.html)\n - [https://cheatsheetseries.owasp.org/cheatsheets/Password_Storage_Cheat_Sheet.html](https://cheatsheetseries.owasp.org/cheatsheets/Password_Storage_Cheat_Sheet.html)\n","text":"MD5 hash algorithm detected. This is not collision resistant and leads to easily-cracked password hashes. Replace with current recommended hashing algorithms."},"helpUri":"https://semgrep.dev/r/clojure.lang.security.use-of-md5.use-of-md5","id":"clojure.lang.security.use-of-md5.use-of-md5","name":"clojure.lang.security.use-of-md5.use-of-md5","properties":{"precision":"very-high","tags":["CWE-328: Use of Weak Hash","HIGH CONFIDENCE","OWASP-A02:2021 - Cryptographic Failures","OWASP-A03:2017 - Sensitive Data Exposure","security"]},"shortDescription":{"text":"Semgrep Finding: clojure.lang.security.use-of-md5.use-of-md5"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"Detected SHA1 hash algorithm which is considered insecure. SHA1 is not collision resistant and is therefore not suitable as a cryptographic signature. Instead, use PBKDF2 for password hashing or SHA256 or SHA512 for other hash function applications."},"help":{"markdown":"Detected SHA1 hash algorithm which is considered insecure. SHA1 is not collision resistant and is therefore not suitable as a cryptographic signature. Instead, use PBKDF2 for password hashing or SHA256 or SHA512 for other hash function applications.\n\nReferences: \n - [Semgrep Rule](https://semgrep.dev/r/clojure.lang.security.use-of-sha1.use-of-sha1)\n - [https://cheatsheetseries.owasp.org/cheatsheets/Cryptographic_Storage_Cheat_Sheet.html](https://cheatsheetseries.owasp.org/cheatsheets/Cryptographic_Storage_Cheat_Sheet.html)\n - [https://cheatsheetseries.owasp.org/cheatsheets/Password_Storage_Cheat_Sheet.html](https://cheatsheetseries.owasp.org/cheatsheets/Password_Storage_Cheat_Sheet.html)\n","text":"Detected SHA1 hash algorithm which is considered insecure. SHA1 is not collision resistant and is therefore not suitable as a cryptographic signature. Instead, use PBKDF2 for password hashing or SHA256 or SHA512 for other hash function applications."},"helpUri":"https://semgrep.dev/r/clojure.lang.security.use-of-sha1.use-of-sha1","id":"clojure.lang.security.use-of-sha1.use-of-sha1","name":"clojure.lang.security.use-of-sha1.use-of-sha1","properties":{"precision":"very-high","tags":["CWE-327: Use of a Broken or Risky Cryptographic Algorithm","CWE-328: Use of Weak Hash","HIGH CONFIDENCE","OWASP-A02:2021 - Cryptographic Failures","OWASP-A03:2017 - Sensitive Data Exposure","security"]},"shortDescription":{"text":"Semgrep Finding: clojure.lang.security.use-of-sha1.use-of-sha1"}},{"defaultConfiguration":{"level":"note"},"fullDescription":{"text":"This call to `$MEMSET` may be optimized out by the compiler because the buffer is not accessed later in the function. This could be an issue if `$BUF` contains sensitive data, such as passwords or cryptographic keys. Applications should use functions such as `memset_s` or `memset_explicit` to ensure that the sensitive data is cleared."},"help":{"markdown":"This call to `$MEMSET` may be optimized out by the compiler because the buffer is not accessed later in the function. This could be an issue if `$BUF` contains sensitive data, such as passwords or cryptographic keys. Applications should use functions such as `memset_s` or `memset_explicit` to ensure that the sensitive data is cleared.\n\nReferences: \n - [Semgrep Rule](https://semgrep.dev/r/cpp.lang.correctness.memset-removal.memset-removal)\n - [https://wiki.sei.cmu.edu/confluence/display/c/MSC06-C.+Beware+of+compiler+optimizations](https://wiki.sei.cmu.edu/confluence/display/c/MSC06-C.+Beware+of+compiler+optimizations)\n","text":"This call to `$MEMSET` may be optimized out by the compiler because the buffer is not accessed later in the function. This could be an issue if `$BUF` contains sensitive data, such as passwords or cryptographic keys. Applications should use functions such as `memset_s` or `memset_explicit` to ensure that the sensitive data is cleared."},"helpUri":"https://semgrep.dev/r/cpp.lang.correctness.memset-removal.memset-removal","id":"cpp.lang.correctness.memset-removal.memset-removal","name":"cpp.lang.correctness.memset-removal.memset-removal","properties":{"precision":"very-high","tags":["CWE-14: Compiler Removal of Code to Clear Buffers","MEDIUM CONFIDENCE","security"]},"shortDescription":{"text":"Semgrep Finding: cpp.lang.correctness.memset-removal.memset-removal"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"Using `sizeof(...)` on a pointer type is error prone and can lead to memory corruption if the incorrect size is used to allocate memory. An explicit length should be used instead of using `sizeof(...)`."},"help":{"markdown":"Using `sizeof(...)` on a pointer type is error prone and can lead to memory corruption if the incorrect size is used to allocate memory. An explicit length should be used instead of using `sizeof(...)`.\n\nReferences: \n - [Semgrep Rule](https://semgrep.dev/r/cpp.lang.correctness.sizeof-pointer-type.sizeof-pointer-type)\n - [https://wiki.sei.cmu.edu/confluence/display/c/ARR01-C.+Do+not+apply+the+sizeof+operator+to+a+pointer+when+taking+the+size+of+an+array](https://wiki.sei.cmu.edu/confluence/display/c/ARR01-C.+Do+not+apply+the+sizeof+operator+to+a+pointer+when+taking+the+size+of+an+array)\n","text":"Using `sizeof(...)` on a pointer type is error prone and can lead to memory corruption if the incorrect size is used to allocate memory. An explicit length should be used instead of using `sizeof(...)`."},"helpUri":"https://semgrep.dev/r/cpp.lang.correctness.sizeof-pointer-type.sizeof-pointer-type","id":"cpp.lang.correctness.sizeof-pointer-type.sizeof-pointer-type","name":"cpp.lang.correctness.sizeof-pointer-type.sizeof-pointer-type","properties":{"precision":"very-high","tags":["CWE-467: Use of sizeof() on a Pointer Type","MEDIUM CONFIDENCE","security"]},"shortDescription":{"text":"Semgrep Finding: cpp.lang.correctness.sizeof-pointer-type.sizeof-pointer-type"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"Do not use `sizeof(this)` to get the number of bytes of the object in memory. It returns the size of the pointer, not the size of the object."},"help":{"markdown":"Do not use `sizeof(this)` to get the number of bytes of the object in memory. It returns the size of the pointer, not the size of the object.\n\nReferences: \n - [Semgrep Rule](https://semgrep.dev/r/cpp.lang.correctness.sizeof-this.sizeof-this)\n - [https://wiki.sei.cmu.edu/confluence/display/c/ARR01-C.+Do+not+apply+the+sizeof+operator+to+a+pointer+when+taking+the+size+of+an+array](https://wiki.sei.cmu.edu/confluence/display/c/ARR01-C.+Do+not+apply+the+sizeof+operator+to+a+pointer+when+taking+the+size+of+an+array)\n","text":"Do not use `sizeof(this)` to get the number of bytes of the object in memory. It returns the size of the pointer, not the size of the object."},"helpUri":"https://semgrep.dev/r/cpp.lang.correctness.sizeof-this.sizeof-this","id":"cpp.lang.correctness.sizeof-this.sizeof-this","name":"cpp.lang.correctness.sizeof-this.sizeof-this","properties":{"precision":"very-high","tags":["CWE-467: Use of sizeof() on a Pointer Type","HIGH CONFIDENCE","security"]},"shortDescription":{"text":"Semgrep Finding: cpp.lang.correctness.sizeof-this.sizeof-this"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"`$FUNC` returns a pointer to the memory owned by `$VAR`. This pointer is invalid after `$VAR` goes out of scope, which can trigger a use after free."},"help":{"markdown":"`$FUNC` returns a pointer to the memory owned by `$VAR`. This pointer is invalid after `$VAR` goes out of scope, which can trigger a use after free.\n\nReferences: \n - [Semgrep Rule](https://semgrep.dev/r/cpp.lang.security.containers.std-return-data.std-return-data)\n - [https://wiki.sei.cmu.edu/confluence/display/c/DCL30-C.+Declare+objects+with+appropriate+storage+durations](https://wiki.sei.cmu.edu/confluence/display/c/DCL30-C.+Declare+objects+with+appropriate+storage+durations)\n - [https://wiki.sei.cmu.edu/confluence/display/cplusplus/EXP54-CPP.+Do+not+access+an+object+outside+of+its+lifetime](https://wiki.sei.cmu.edu/confluence/display/cplusplus/EXP54-CPP.+Do+not+access+an+object+outside+of+its+lifetime)\n","text":"`$FUNC` returns a pointer to the memory owned by `$VAR`. This pointer is invalid after `$VAR` goes out of scope, which can trigger a use after free."},"helpUri":"https://semgrep.dev/r/cpp.lang.security.containers.std-return-data.std-return-data","id":"cpp.lang.security.containers.std-return-data.std-return-data","name":"cpp.lang.security.containers.std-return-data.std-return-data","properties":{"precision":"very-high","tags":["CWE-416: Use After Free","HIGH CONFIDENCE","security"]},"shortDescription":{"text":"Semgrep Finding: cpp.lang.security.containers.std-return-data.std-return-data"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"Modifying an `std::vector` while iterating over it could cause the container to reallocate, triggering memory corruption."},"help":{"markdown":"Modifying an `std::vector` while iterating over it could cause the container to reallocate, triggering memory corruption.\n\nReferences: \n - [Semgrep Rule](https://semgrep.dev/r/cpp.lang.security.containers.std-vector-invalidation.std-vector-invalidation)\n - [https://wiki.sei.cmu.edu/confluence/display/c/MEM30-C.+Do+not+access+freed+memory](https://wiki.sei.cmu.edu/confluence/display/c/MEM30-C.+Do+not+access+freed+memory)\n - [https://wiki.sei.cmu.edu/confluence/display/cplusplus/EXP54-CPP.+Do+not+access+an+object+outside+of+its+lifetime](https://wiki.sei.cmu.edu/confluence/display/cplusplus/EXP54-CPP.+Do+not+access+an+object+outside+of+its+lifetime)\n","text":"Modifying an `std::vector` while iterating over it could cause the container to reallocate, triggering memory corruption."},"helpUri":"https://semgrep.dev/r/cpp.lang.security.containers.std-vector-invalidation.std-vector-invalidation","id":"cpp.lang.security.containers.std-vector-invalidation.std-vector-invalidation","name":"cpp.lang.security.containers.std-vector-invalidation.std-vector-invalidation","properties":{"precision":"very-high","tags":["CWE-416: Use After Free","HIGH CONFIDENCE","security"]},"shortDescription":{"text":"Semgrep Finding: cpp.lang.security.containers.std-vector-invalidation.std-vector-invalidation"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"TLS ceritificate validation is disabled. This could lead to a potential man-in-the-middle attack. This may be used for testing purposes but it is not considered safe in production deployments."},"help":{"markdown":"TLS ceritificate validation is disabled. This could lead to a potential man-in-the-middle attack. This may be used for testing purposes but it is not considered safe in production deployments.\n\nReferences: \n - [Semgrep Rule](https://semgrep.dev/r/cpp.lang.security.crypto.certificate.curl-disabled-cert-validation.curl-disabled-cert-validation)\n - [https://owasp.org/Top10/A02_2021-Cryptographic_Failures](https://owasp.org/Top10/A02_2021-Cryptographic_Failures)\n - [https://owasp.org/Top10/A07_2021-Identification_and_Authentication_Failures](https://owasp.org/Top10/A07_2021-Identification_and_Authentication_Failures)\n","text":"TLS ceritificate validation is disabled. This could lead to a potential man-in-the-middle attack. This may be used for testing purposes but it is not considered safe in production deployments."},"helpUri":"https://semgrep.dev/r/cpp.lang.security.crypto.certificate.curl-disabled-cert-validation.curl-disabled-cert-validation","id":"cpp.lang.security.crypto.certificate.curl-disabled-cert-validation.curl-disabled-cert-validation","name":"cpp.lang.security.crypto.certificate.curl-disabled-cert-validation.curl-disabled-cert-validation","properties":{"precision":"very-high","tags":["CWE-295: Improper Certificate Validation","MEDIUM CONFIDENCE","OWASP-A03:2017 - Sensitive Data Exposure","OWASP-A07:2021 - Identification and Authentication Failures","security"]},"shortDescription":{"text":"Semgrep Finding: cpp.lang.security.crypto.certificate.curl-disabled-cert-validation.curl-disabled-cert-validation"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"Detected use of an insecure SSL/TLS algorithm. This could allow an attacker to peform a man-in-the-middle-attack. Applications should prefer a secure algorithm such as TLS 1.2 or 1.3."},"help":{"markdown":"Detected use of an insecure SSL/TLS algorithm. This could allow an attacker to peform a man-in-the-middle-attack. Applications should prefer a secure algorithm such as TLS 1.2 or 1.3.\n\nReferences: \n - [Semgrep Rule](https://semgrep.dev/r/cpp.lang.security.crypto.certificate.curl-insecure-required-version.curl-insecure-required-version)\n - [https://owasp.org/Top10/A02_2021-Cryptographic_Failures](https://owasp.org/Top10/A02_2021-Cryptographic_Failures)\n","text":"Detected use of an insecure SSL/TLS algorithm. This could allow an attacker to peform a man-in-the-middle-attack. Applications should prefer a secure algorithm such as TLS 1.2 or 1.3."},"helpUri":"https://semgrep.dev/r/cpp.lang.security.crypto.certificate.curl-insecure-required-version.curl-insecure-required-version","id":"cpp.lang.security.crypto.certificate.curl-insecure-required-version.curl-insecure-required-version","name":"cpp.lang.security.crypto.certificate.curl-insecure-required-version.curl-insecure-required-version","properties":{"precision":"very-high","tags":["CWE-327: Use of a Broken or Risky Cryptographic Algorithm","MEDIUM CONFIDENCE","OWASP-A02:2021 - Cryptographic Failures","OWASP-A03:2017 - Sensitive Data Exposure","security"]},"shortDescription":{"text":"Semgrep Finding: cpp.lang.security.crypto.certificate.curl-insecure-required-version.curl-insecure-required-version"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"TLS ceritificate validation is disabled. This could lead to a potential man-in-the-middle attack. This may be used for testing purposes but it is not considered safe in production deployments."},"help":{"markdown":"TLS ceritificate validation is disabled. This could lead to a potential man-in-the-middle attack. This may be used for testing purposes but it is not considered safe in production deployments.\n\nReferences: \n - [Semgrep Rule](https://semgrep.dev/r/cpp.lang.security.crypto.certificate.openssl-disabled-cert-validation.openssl-disabled-cert-validation)\n - [https://owasp.org/Top10/A02_2021-Cryptographic_Failures](https://owasp.org/Top10/A02_2021-Cryptographic_Failures)\n - [https://owasp.org/Top10/A07_2021-Identification_and_Authentication_Failures](https://owasp.org/Top10/A07_2021-Identification_and_Authentication_Failures)\n","text":"TLS ceritificate validation is disabled. This could lead to a potential man-in-the-middle attack. This may be used for testing purposes but it is not considered safe in production deployments."},"helpUri":"https://semgrep.dev/r/cpp.lang.security.crypto.certificate.openssl-disabled-cert-validation.openssl-disabled-cert-validation","id":"cpp.lang.security.crypto.certificate.openssl-disabled-cert-validation.openssl-disabled-cert-validation","name":"cpp.lang.security.crypto.certificate.openssl-disabled-cert-validation.openssl-disabled-cert-validation","properties":{"precision":"very-high","tags":["CWE-295: Improper Certificate Validation","HIGH CONFIDENCE","OWASP-A03:2017 - Sensitive Data Exposure","OWASP-A07:2021 - Identification and Authentication Failures","security"]},"shortDescription":{"text":"Semgrep Finding: cpp.lang.security.crypto.certificate.openssl-disabled-cert-validation.openssl-disabled-cert-validation"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"Detected use of an insecure SSL/TLS algorithm. This could allow an attacker to peform a man-in-the-middle-attack. Applications should prefer a secure algorithm such as TLS 1.2 or 1.3."},"help":{"markdown":"Detected use of an insecure SSL/TLS algorithm. This could allow an attacker to peform a man-in-the-middle-attack. Applications should prefer a secure algorithm such as TLS 1.2 or 1.3.\n\nReferences: \n - [Semgrep Rule](https://semgrep.dev/r/cpp.lang.security.crypto.certificate.openssl-insecure-required-version.openssl-insecure-required-version)\n - [https://owasp.org/Top10/A02_2021-Cryptographic_Failures](https://owasp.org/Top10/A02_2021-Cryptographic_Failures)\n","text":"Detected use of an insecure SSL/TLS algorithm. This could allow an attacker to peform a man-in-the-middle-attack. Applications should prefer a secure algorithm such as TLS 1.2 or 1.3."},"helpUri":"https://semgrep.dev/r/cpp.lang.security.crypto.certificate.openssl-insecure-required-version.openssl-insecure-required-version","id":"cpp.lang.security.crypto.certificate.openssl-insecure-required-version.openssl-insecure-required-version","name":"cpp.lang.security.crypto.certificate.openssl-insecure-required-version.openssl-insecure-required-version","properties":{"precision":"very-high","tags":["CWE-327: Use of a Broken or Risky Cryptographic Algorithm","MEDIUM CONFIDENCE","OWASP-A02:2021 - Cryptographic Failures","OWASP-A03:2017 - Sensitive Data Exposure","security"]},"shortDescription":{"text":"Semgrep Finding: cpp.lang.security.crypto.certificate.openssl-insecure-required-version.openssl-insecure-required-version"}},{"defaultConfiguration":{"level":"note"},"fullDescription":{"text":"This hashing algorithm is insecure. If this hash is used in a security context, such as password hashing, it should be converted to a stronger hashing algorithm."},"help":{"markdown":"This hashing algorithm is insecure. If this hash is used in a security context, such as password hashing, it should be converted to a stronger hashing algorithm.\n\nReferences: \n - [Semgrep Rule](https://semgrep.dev/r/cpp.lang.security.crypto.insecure-hash.insecure-hash)\n - [https://owasp.org/Top10/A02_2021-Cryptographic_Failures](https://owasp.org/Top10/A02_2021-Cryptographic_Failures)\n","text":"This hashing algorithm is insecure. If this hash is used in a security context, such as password hashing, it should be converted to a stronger hashing algorithm."},"helpUri":"https://semgrep.dev/r/cpp.lang.security.crypto.insecure-hash.insecure-hash","id":"cpp.lang.security.crypto.insecure-hash.insecure-hash","name":"cpp.lang.security.crypto.insecure-hash.insecure-hash","properties":{"precision":"very-high","tags":["CWE-328: Use of Weak Hash","HIGH CONFIDENCE","OWASP-A02:2021 - Cryptographic Failures","OWASP-A03:2017 - Sensitive Data Exposure","security"]},"shortDescription":{"text":"Semgrep Finding: cpp.lang.security.crypto.insecure-hash.insecure-hash"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"`$KEY_FUNCTION` is using a key size of only $KEY_BITS bits. This is less than the recommended key size of 2048 bits."},"help":{"markdown":"`$KEY_FUNCTION` is using a key size of only $KEY_BITS bits. This is less than the recommended key size of 2048 bits.\n\nReferences: \n - [Semgrep Rule](https://semgrep.dev/r/cpp.lang.security.crypto.key.small-key-size.small-key-size)\n - [https://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-131Ar2.pdf](https://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-131Ar2.pdf)\n - [https://owasp.org/Top10/A02_2021-Cryptographic_Failures](https://owasp.org/Top10/A02_2021-Cryptographic_Failures)\n","text":"`$KEY_FUNCTION` is using a key size of only $KEY_BITS bits. This is less than the recommended key size of 2048 bits."},"helpUri":"https://semgrep.dev/r/cpp.lang.security.crypto.key.small-key-size.small-key-size","id":"cpp.lang.security.crypto.key.small-key-size.small-key-size","name":"cpp.lang.security.crypto.key.small-key-size.small-key-size","properties":{"precision":"very-high","tags":["CWE-326: Inadequate Encryption Strength","HIGH CONFIDENCE","OWASP-A02:2021 - Cryptographic Failures","OWASP-A03:2017 - Sensitive Data Exposure","security"]},"shortDescription":{"text":"Semgrep Finding: cpp.lang.security.crypto.key.small-key-size.small-key-size"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"A check is done with `access` and then the file is later used. There is no guarantee that the status of the file has not changed since the call to `access` which may allow attackers to bypass permission checks."},"help":{"markdown":"A check is done with `access` and then the file is later used. There is no guarantee that the status of the file has not changed since the call to `access` which may allow attackers to bypass permission checks.\n\nReferences: \n - [Semgrep Rule](https://semgrep.dev/r/cpp.lang.security.filesystem.file-access-before-action.file-access-before-action)\n - [https://wiki.sei.cmu.edu/confluence/display/c/FIO45-C.+Avoid+TOCTOU+race+conditions+while+accessing+files](https://wiki.sei.cmu.edu/confluence/display/c/FIO45-C.+Avoid+TOCTOU+race+conditions+while+accessing+files)\n","text":"A check is done with `access` and then the file is later used. There is no guarantee that the status of the file has not changed since the call to `access` which may allow attackers to bypass permission checks."},"helpUri":"https://semgrep.dev/r/cpp.lang.security.filesystem.file-access-before-action.file-access-before-action","id":"cpp.lang.security.filesystem.file-access-before-action.file-access-before-action","name":"cpp.lang.security.filesystem.file-access-before-action.file-access-before-action","properties":{"precision":"very-high","tags":["CWE-367: Time-of-check Time-of-use (TOCTOU) Race Condition","HIGH CONFIDENCE","security"]},"shortDescription":{"text":"Semgrep Finding: cpp.lang.security.filesystem.file-access-before-action.file-access-before-action"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"A check is done with `stat` and then the file is used. There is no guarantee that the status of the file has not changed since the call to `stat` which may allow attackers to bypass permission checks."},"help":{"markdown":"A check is done with `stat` and then the file is used. There is no guarantee that the status of the file has not changed since the call to `stat` which may allow attackers to bypass permission checks.\n\nReferences: \n - [Semgrep Rule](https://semgrep.dev/r/cpp.lang.security.filesystem.file-stat-before-action.file-stat-before-action)\n - [https://wiki.sei.cmu.edu/confluence/display/c/FIO45-C.+Avoid+TOCTOU+race+conditions+while+accessing+files](https://wiki.sei.cmu.edu/confluence/display/c/FIO45-C.+Avoid+TOCTOU+race+conditions+while+accessing+files)\n","text":"A check is done with `stat` and then the file is used. There is no guarantee that the status of the file has not changed since the call to `stat` which may allow attackers to bypass permission checks."},"helpUri":"https://semgrep.dev/r/cpp.lang.security.filesystem.file-stat-before-action.file-stat-before-action","id":"cpp.lang.security.filesystem.file-stat-before-action.file-stat-before-action","name":"cpp.lang.security.filesystem.file-stat-before-action.file-stat-before-action","properties":{"precision":"very-high","tags":["CWE-367: Time-of-check Time-of-use (TOCTOU) Race Condition","HIGH CONFIDENCE","security"]},"shortDescription":{"text":"Semgrep Finding: cpp.lang.security.filesystem.file-stat-before-action.file-stat-before-action"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"The application builds a file path from potentially untrusted data, which can lead to a path traversal vulnerability. An attacker can manipulate the path which the application uses to access files. If the application does not validate user input and sanitize file paths, sensitive files such as configuration or user data can be accessed, potentially creating or overwriting files. To prevent this vulnerability, validate and sanitize any input that is used to create references to file paths. Also, enforce strict file access controls. For example, choose privileges allowing public-facing applications to access only the required files."},"help":{"markdown":"The application builds a file path from potentially untrusted data, which can lead to a path traversal vulnerability. An attacker can manipulate the path which the application uses to access files. If the application does not validate user input and sanitize file paths, sensitive files such as configuration or user data can be accessed, potentially creating or overwriting files. To prevent this vulnerability, validate and sanitize any input that is used to create references to file paths. Also, enforce strict file access controls. For example, choose privileges allowing public-facing applications to access only the required files.\n\nReferences: \n - [Semgrep Rule](https://semgrep.dev/r/cpp.lang.security.filesystem.path-manipulation.path-manipulation)\n - [https://owasp.org/Top10/A01_2021-Broken_Access_Control](https://owasp.org/Top10/A01_2021-Broken_Access_Control)\n - [https://owasp.org/www-community/attacks/Path_Traversal](https://owasp.org/www-community/attacks/Path_Traversal)\n - [https://portswigger.net/web-security/file-path-traversal](https://portswigger.net/web-security/file-path-traversal)\n - [https://wiki.sei.cmu.edu/confluence/display/c/FIO02-C.+Canonicalize+path+names+originating+from+tainted+sources](https://wiki.sei.cmu.edu/confluence/display/c/FIO02-C.+Canonicalize+path+names+originating+from+tainted+sources)\n","text":"The application builds a file path from potentially untrusted data, which can lead to a path traversal vulnerability. An attacker can manipulate the path which the application uses to access files. If the application does not validate user input and sanitize file paths, sensitive files such as configuration or user data can be accessed, potentially creating or overwriting files. To prevent this vulnerability, validate and sanitize any input that is used to create references to file paths. Also, enforce strict file access controls. For example, choose privileges allowing public-facing applications to access only the required files."},"helpUri":"https://semgrep.dev/r/cpp.lang.security.filesystem.path-manipulation.path-manipulation","id":"cpp.lang.security.filesystem.path-manipulation.path-manipulation","name":"cpp.lang.security.filesystem.path-manipulation.path-manipulation","properties":{"precision":"very-high","tags":["CWE-22: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')","MEDIUM CONFIDENCE","OWASP-A01:2021 - Broken Access Control","OWASP-A05:2017 - Broken Access Control","security"]},"shortDescription":{"text":"Semgrep Finding: cpp.lang.security.filesystem.path-manipulation.path-manipulation"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"This call makes a world-writable file which allows any user on a machine to write to the file. This may allow attackers to influence the behaviour of this process by writing to the file."},"help":{"markdown":"This call makes a world-writable file which allows any user on a machine to write to the file. This may allow attackers to influence the behaviour of this process by writing to the file.\n\nReferences: \n - [Semgrep Rule](https://semgrep.dev/r/cpp.lang.security.filesystem.world-writable-file.world-writable-file)\n - [https://cwe.mitre.org/data/definitions/732.html](https://cwe.mitre.org/data/definitions/732.html)\n - [https://wiki.sei.cmu.edu/confluence/display/c/FIO06-C.+Create+files+with+appropriate+access+permissions](https://wiki.sei.cmu.edu/confluence/display/c/FIO06-C.+Create+files+with+appropriate+access+permissions)\n","text":"This call makes a world-writable file which allows any user on a machine to write to the file. This may allow attackers to influence the behaviour of this process by writing to the file."},"helpUri":"https://semgrep.dev/r/cpp.lang.security.filesystem.world-writable-file.world-writable-file","id":"cpp.lang.security.filesystem.world-writable-file.world-writable-file","name":"cpp.lang.security.filesystem.world-writable-file.world-writable-file","properties":{"precision":"very-high","tags":["CWE-732: Incorrect Permission Assignment for Critical Resource","HIGH CONFIDENCE","security"]},"shortDescription":{"text":"Semgrep Finding: cpp.lang.security.filesystem.world-writable-file.world-writable-file"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"Externally controlled data influences a format string. This can allow an attacker to leak information from memory or trigger memory corruption. Format strings should be constant strings to prevent these issues. If you need to print a user-controlled string then you can use `%s`."},"help":{"markdown":"Externally controlled data influences a format string. This can allow an attacker to leak information from memory or trigger memory corruption. Format strings should be constant strings to prevent these issues. If you need to print a user-controlled string then you can use `%s`.\n\nReferences: \n - [Semgrep Rule](https://semgrep.dev/r/cpp.lang.security.format-string.format-string-injection.format-string-injection)\n - [https://wiki.sei.cmu.edu/confluence/display/c/FIO30-C.+Exclude+user+input+from+format+strings](https://wiki.sei.cmu.edu/confluence/display/c/FIO30-C.+Exclude+user+input+from+format+strings)\n","text":"Externally controlled data influences a format string. This can allow an attacker to leak information from memory or trigger memory corruption. Format strings should be constant strings to prevent these issues. If you need to print a user-controlled string then you can use `%s`."},"helpUri":"https://semgrep.dev/r/cpp.lang.security.format-string.format-string-injection.format-string-injection","id":"cpp.lang.security.format-string.format-string-injection.format-string-injection","name":"cpp.lang.security.format-string.format-string-injection.format-string-injection","properties":{"precision":"very-high","tags":["CWE-134: Use of Externally-Controlled Format String","MEDIUM CONFIDENCE","security"]},"shortDescription":{"text":"Semgrep Finding: cpp.lang.security.format-string.format-string-injection.format-string-injection"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"Untrusted input might be used to build an LDAP query, which can allow attackers to run arbitrary LDAP queries. If an LDAP query must contain untrusted input then it must be escaped."},"help":{"markdown":"Untrusted input might be used to build an LDAP query, which can allow attackers to run arbitrary LDAP queries. If an LDAP query must contain untrusted input then it must be escaped.\n\nReferences: \n - [Semgrep Rule](https://semgrep.dev/r/cpp.lang.security.ldap.ldap-injection-dn.ldap-injection-dn)\n - [https://owasp.org/Top10/A03_2021-Injection](https://owasp.org/Top10/A03_2021-Injection)\n - [https://wiki.sei.cmu.edu/confluence/display/c/STR02-C.+Sanitize+data+passed+to+complex+subsystems](https://wiki.sei.cmu.edu/confluence/display/c/STR02-C.+Sanitize+data+passed+to+complex+subsystems)\n","text":"Untrusted input might be used to build an LDAP query, which can allow attackers to run arbitrary LDAP queries. If an LDAP query must contain untrusted input then it must be escaped."},"helpUri":"https://semgrep.dev/r/cpp.lang.security.ldap.ldap-injection-dn.ldap-injection-dn","id":"cpp.lang.security.ldap.ldap-injection-dn.ldap-injection-dn","name":"cpp.lang.security.ldap.ldap-injection-dn.ldap-injection-dn","properties":{"precision":"very-high","tags":["CWE-90: Improper Neutralization of Special Elements used in an LDAP Query ('LDAP Injection')","HIGH CONFIDENCE","OWASP-A01:2017 - Injection","OWASP-A03:2021 - Injection","security"]},"shortDescription":{"text":"Semgrep Finding: cpp.lang.security.ldap.ldap-injection-dn.ldap-injection-dn"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"Untrusted input might be used to build an LDAP query, which can allow attackers to run arbitrary LDAP queries. If an LDAP query must contain untrusted input then it must be escaped."},"help":{"markdown":"Untrusted input might be used to build an LDAP query, which can allow attackers to run arbitrary LDAP queries. If an LDAP query must contain untrusted input then it must be escaped.\n\nReferences: \n - [Semgrep Rule](https://semgrep.dev/r/cpp.lang.security.ldap.ldap-injection-filter.ldap-injection-filter)\n - [https://owasp.org/Top10/A03_2021-Injection](https://owasp.org/Top10/A03_2021-Injection)\n - [https://wiki.sei.cmu.edu/confluence/display/c/STR02-C.+Sanitize+data+passed+to+complex+subsystems](https://wiki.sei.cmu.edu/confluence/display/c/STR02-C.+Sanitize+data+passed+to+complex+subsystems)\n","text":"Untrusted input might be used to build an LDAP query, which can allow attackers to run arbitrary LDAP queries. If an LDAP query must contain untrusted input then it must be escaped."},"helpUri":"https://semgrep.dev/r/cpp.lang.security.ldap.ldap-injection-filter.ldap-injection-filter","id":"cpp.lang.security.ldap.ldap-injection-filter.ldap-injection-filter","name":"cpp.lang.security.ldap.ldap-injection-filter.ldap-injection-filter","properties":{"precision":"very-high","tags":["CWE-90: Improper Neutralization of Special Elements used in an LDAP Query ('LDAP Injection')","HIGH CONFIDENCE","OWASP-A01:2017 - Injection","OWASP-A03:2021 - Injection","security"]},"shortDescription":{"text":"Semgrep Finding: cpp.lang.security.ldap.ldap-injection-filter.ldap-injection-filter"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"Externally controlled data influences the filename of a dynamically loaded library. This could trigger arbitrary code execution."},"help":{"markdown":"Externally controlled data influences the filename of a dynamically loaded library. This could trigger arbitrary code execution.\n\nReferences: \n - [Semgrep Rule](https://semgrep.dev/r/cpp.lang.security.libraries.dynamic-library-path.dynamic-library-path)\n - [https://wiki.sei.cmu.edu/confluence/display/c/STR02-C.+Sanitize+data+passed+to+complex+subsystems](https://wiki.sei.cmu.edu/confluence/display/c/STR02-C.+Sanitize+data+passed+to+complex+subsystems)\n","text":"Externally controlled data influences the filename of a dynamically loaded library. This could trigger arbitrary code execution."},"helpUri":"https://semgrep.dev/r/cpp.lang.security.libraries.dynamic-library-path.dynamic-library-path","id":"cpp.lang.security.libraries.dynamic-library-path.dynamic-library-path","name":"cpp.lang.security.libraries.dynamic-library-path.dynamic-library-path","properties":{"precision":"very-high","tags":["CWE-114: Process Control","MEDIUM CONFIDENCE","security"]},"shortDescription":{"text":"Semgrep Finding: cpp.lang.security.libraries.dynamic-library-path.dynamic-library-path"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"Externally controlled data influences the size of an allocation. This can usually lead to overflow or underflow and later trigger an out of bounds conditions."},"help":{"markdown":"Externally controlled data influences the size of an allocation. This can usually lead to overflow or underflow and later trigger an out of bounds conditions.\n\nReferences: \n - [Semgrep Rule](https://semgrep.dev/r/cpp.lang.security.memory.allocation.tainted-allocation-size.tainted-allocation-size)\n - [https://wiki.sei.cmu.edu/confluence/display/c/MEM05-C.+Avoid+large+stack+allocations](https://wiki.sei.cmu.edu/confluence/display/c/MEM05-C.+Avoid+large+stack+allocations)\n - [https://wiki.sei.cmu.edu/confluence/display/c/MEM35-C.+Allocate+sufficient+memory+for+an+object](https://wiki.sei.cmu.edu/confluence/display/c/MEM35-C.+Allocate+sufficient+memory+for+an+object)\n - [https://www.securecoding.cert.org/confluence/display/c/ARR32-C.+Ensure+size+arguments+for+variable+length+arrays+are+in+a+valid+range](https://www.securecoding.cert.org/confluence/display/c/ARR32-C.+Ensure+size+arguments+for+variable+length+arrays+are+in+a+valid+range)\n","text":"Externally controlled data influences the size of an allocation. This can usually lead to overflow or underflow and later trigger an out of bounds conditions."},"helpUri":"https://semgrep.dev/r/cpp.lang.security.memory.allocation.tainted-allocation-size.tainted-allocation-size","id":"cpp.lang.security.memory.allocation.tainted-allocation-size.tainted-allocation-size","name":"cpp.lang.security.memory.allocation.tainted-allocation-size.tainted-allocation-size","properties":{"precision":"very-high","tags":["CWE-125: Out-of-bounds Read","MEDIUM CONFIDENCE","security"]},"shortDescription":{"text":"Semgrep Finding: cpp.lang.security.memory.allocation.tainted-allocation-size.tainted-allocation-size"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"`$SINK_VAR` has previously been deleted which will trigger a double-free vulnerability. This may lead to memory corruption."},"help":{"markdown":"`$SINK_VAR` has previously been deleted which will trigger a double-free vulnerability. This may lead to memory corruption.\n\nReferences: \n - [Semgrep Rule](https://semgrep.dev/r/cpp.lang.security.memory.deallocation.double-delete.double-delete)\n - [https://wiki.sei.cmu.edu/confluence/display/cplusplus/MEM50-CPP.+Do+not+access+freed+memory](https://wiki.sei.cmu.edu/confluence/display/cplusplus/MEM50-CPP.+Do+not+access+freed+memory)\n","text":"`$SINK_VAR` has previously been deleted which will trigger a double-free vulnerability. This may lead to memory corruption."},"helpUri":"https://semgrep.dev/r/cpp.lang.security.memory.deallocation.double-delete.double-delete","id":"cpp.lang.security.memory.deallocation.double-delete.double-delete","name":"cpp.lang.security.memory.deallocation.double-delete.double-delete","properties":{"precision":"very-high","tags":["CWE-415: Double Free","MEDIUM CONFIDENCE","security"]},"shortDescription":{"text":"Semgrep Finding: cpp.lang.security.memory.deallocation.double-delete.double-delete"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"`$SINK_VAR` has previously been freed which will trigger a double-free vulnerability. This may lead to memory corruption."},"help":{"markdown":"`$SINK_VAR` has previously been freed which will trigger a double-free vulnerability. This may lead to memory corruption.\n\nReferences: \n - [Semgrep Rule](https://semgrep.dev/r/cpp.lang.security.memory.deallocation.double-free.double-free)\n - [https://wiki.sei.cmu.edu/confluence/display/c/MEM30-C.+Do+not+access+freed+memory](https://wiki.sei.cmu.edu/confluence/display/c/MEM30-C.+Do+not+access+freed+memory)\n - [https://wiki.sei.cmu.edu/confluence/display/cplusplus/MEM50-CPP.+Do+not+access+freed+memory](https://wiki.sei.cmu.edu/confluence/display/cplusplus/MEM50-CPP.+Do+not+access+freed+memory)\n","text":"`$SINK_VAR` has previously been freed which will trigger a double-free vulnerability. This may lead to memory corruption."},"helpUri":"https://semgrep.dev/r/cpp.lang.security.memory.deallocation.double-free.double-free","id":"cpp.lang.security.memory.deallocation.double-free.double-free","name":"cpp.lang.security.memory.deallocation.double-free.double-free","properties":{"precision":"very-high","tags":["CWE-415: Double Free","MEDIUM CONFIDENCE","security"]},"shortDescription":{"text":"Semgrep Finding: cpp.lang.security.memory.deallocation.double-free.double-free"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"The preceding call to `$SOURCE` can return a negative value when an error is encountered. This can lead to an out-of-bounds array access and possible memory corruption."},"help":{"markdown":"The preceding call to `$SOURCE` can return a negative value when an error is encountered. This can lead to an out-of-bounds array access and possible memory corruption.\n\nReferences: \n - [Semgrep Rule](https://semgrep.dev/r/cpp.lang.security.memory.negative-return-value-array-index.negative-return-value-array-index)\n - [https://cwe.mitre.org/data/definitions/787.html](https://cwe.mitre.org/data/definitions/787.html)\n","text":"The preceding call to `$SOURCE` can return a negative value when an error is encountered. This can lead to an out-of-bounds array access and possible memory corruption."},"helpUri":"https://semgrep.dev/r/cpp.lang.security.memory.negative-return-value-array-index.negative-return-value-array-index","id":"cpp.lang.security.memory.negative-return-value-array-index.negative-return-value-array-index","name":"cpp.lang.security.memory.negative-return-value-array-index.negative-return-value-array-index","properties":{"precision":"very-high","tags":["CWE-787: Out-of-bounds Write","HIGH CONFIDENCE","security"]},"shortDescription":{"text":"Semgrep Finding: cpp.lang.security.memory.negative-return-value-array-index.negative-return-value-array-index"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"The `$SOURCE` function returns NULL on error and this line dereferences the return value without checking for NULL."},"help":{"markdown":"The `$SOURCE` function returns NULL on error and this line dereferences the return value without checking for NULL.\n\nReferences: \n - [Semgrep Rule](https://semgrep.dev/r/cpp.lang.security.memory.null-deref.null-library-function.null-library-function)\n - [https://wiki.sei.cmu.edu/confluence/display/c/EXP34-C.+Do+not+dereference+null+pointers](https://wiki.sei.cmu.edu/confluence/display/c/EXP34-C.+Do+not+dereference+null+pointers)\n","text":"The `$SOURCE` function returns NULL on error and this line dereferences the return value without checking for NULL."},"helpUri":"https://semgrep.dev/r/cpp.lang.security.memory.null-deref.null-library-function.null-library-function","id":"cpp.lang.security.memory.null-deref.null-library-function.null-library-function","name":"cpp.lang.security.memory.null-deref.null-library-function.null-library-function","properties":{"precision":"very-high","tags":["CWE-476: NULL Pointer Dereference","HIGH CONFIDENCE","security"]},"shortDescription":{"text":"Semgrep Finding: cpp.lang.security.memory.null-deref.null-library-function.null-library-function"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"Externally controlled data is used to index a fixed-size array, `$BUFFER`. This could lead to an out-of-bounds read or write, triggering memory corruption."},"help":{"markdown":"Externally controlled data is used to index a fixed-size array, `$BUFFER`. This could lead to an out-of-bounds read or write, triggering memory corruption.\n\nReferences: \n - [Semgrep Rule](https://semgrep.dev/r/cpp.lang.security.memory.unvalidated-array-index.unvalidated-array-index)\n - [https://wiki.sei.cmu.edu/confluence/display/c/ARR30-C.+Do+not+form+or+use+out-of-bounds+pointers+or+array+subscripts](https://wiki.sei.cmu.edu/confluence/display/c/ARR30-C.+Do+not+form+or+use+out-of-bounds+pointers+or+array+subscripts)\n","text":"Externally controlled data is used to index a fixed-size array, `$BUFFER`. This could lead to an out-of-bounds read or write, triggering memory corruption."},"helpUri":"https://semgrep.dev/r/cpp.lang.security.memory.unvalidated-array-index.unvalidated-array-index","id":"cpp.lang.security.memory.unvalidated-array-index.unvalidated-array-index","name":"cpp.lang.security.memory.unvalidated-array-index.unvalidated-array-index","properties":{"precision":"very-high","tags":["CWE-120: Buffer Copy without Checking Size of Input ('Classic Buffer Overflow')","MEDIUM CONFIDENCE","security"]},"shortDescription":{"text":"Semgrep Finding: cpp.lang.security.memory.unvalidated-array-index.unvalidated-array-index"}},{"defaultConfiguration":{"level":"note"},"fullDescription":{"text":"The seed value of a Pseudo Random Number Generator (PRNG) is a constant value. Do not use values from this PRNG to derive a secrets, such as passwords or cryptographic keys."},"help":{"markdown":"The seed value of a Pseudo Random Number Generator (PRNG) is a constant value. Do not use values from this PRNG to derive a secrets, such as passwords or cryptographic keys.\n\nReferences: \n - [Semgrep Rule](https://semgrep.dev/r/cpp.lang.security.rng.predictable-seed-rng-constant.predictable-seed-rng-constant)\n - [https://owasp.org/Top10/A02_2021-Cryptographic_Failures](https://owasp.org/Top10/A02_2021-Cryptographic_Failures)\n - [https://wiki.sei.cmu.edu/confluence/display/cplusplus/MSC51-CPP.+Ensure+your+random+number+generator+is+properly+seeded](https://wiki.sei.cmu.edu/confluence/display/cplusplus/MSC51-CPP.+Ensure+your+random+number+generator+is+properly+seeded)\n","text":"The seed value of a Pseudo Random Number Generator (PRNG) is a constant value. Do not use values from this PRNG to derive a secrets, such as passwords or cryptographic keys."},"helpUri":"https://semgrep.dev/r/cpp.lang.security.rng.predictable-seed-rng-constant.predictable-seed-rng-constant","id":"cpp.lang.security.rng.predictable-seed-rng-constant.predictable-seed-rng-constant","name":"cpp.lang.security.rng.predictable-seed-rng-constant.predictable-seed-rng-constant","properties":{"precision":"very-high","tags":["CWE-337: Predictable Seed in Pseudo-Random Number Generator (PRNG)","HIGH CONFIDENCE","OWASP-A02:2021 - Cryptographic Failures","security"]},"shortDescription":{"text":"Semgrep Finding: cpp.lang.security.rng.predictable-seed-rng-constant.predictable-seed-rng-constant"}},{"defaultConfiguration":{"level":"note"},"fullDescription":{"text":"The seed value of a Pseudo Random Number Generator (PRNG) is directly derived from the time, which is highly predictable. Do not use values from this PRNG to derive a secrets, such as passwords or cryptographic keys."},"help":{"markdown":"The seed value of a Pseudo Random Number Generator (PRNG) is directly derived from the time, which is highly predictable. Do not use values from this PRNG to derive a secrets, such as passwords or cryptographic keys.\n\nReferences: \n - [Semgrep Rule](https://semgrep.dev/r/cpp.lang.security.rng.predictable-seed-rng-time.predictable-seed-rng-time)\n - [https://owasp.org/Top10/A02_2021-Cryptographic_Failures](https://owasp.org/Top10/A02_2021-Cryptographic_Failures)\n - [https://wiki.sei.cmu.edu/confluence/display/cplusplus/MSC51-CPP.+Ensure+your+random+number+generator+is+properly+seeded](https://wiki.sei.cmu.edu/confluence/display/cplusplus/MSC51-CPP.+Ensure+your+random+number+generator+is+properly+seeded)\n","text":"The seed value of a Pseudo Random Number Generator (PRNG) is directly derived from the time, which is highly predictable. Do not use values from this PRNG to derive a secrets, such as passwords or cryptographic keys."},"helpUri":"https://semgrep.dev/r/cpp.lang.security.rng.predictable-seed-rng-time.predictable-seed-rng-time","id":"cpp.lang.security.rng.predictable-seed-rng-time.predictable-seed-rng-time","name":"cpp.lang.security.rng.predictable-seed-rng-time.predictable-seed-rng-time","properties":{"precision":"very-high","tags":["CWE-337: Predictable Seed in Pseudo-Random Number Generator (PRNG)","HIGH CONFIDENCE","OWASP-A02:2021 - Cryptographic Failures","security"]},"shortDescription":{"text":"Semgrep Finding: cpp.lang.security.rng.predictable-seed-rng-time.predictable-seed-rng-time"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"Untrusted input might be used to build a database query, which can lead to a SQL injection vulnerability. An attacker can execute malicious SQL statements and gain unauthorized access to sensitive data, modify, delete data, or execute arbitrary system commands. To prevent this vulnerability, use prepared statements that do not concatenate user-controllable strings and use parameterized queries where SQL commands and user data are strictly separated. Also, consider using an object-relational (ORM) framework to operate with safer abstractions."},"help":{"markdown":"Untrusted input might be used to build a database query, which can lead to a SQL injection vulnerability. An attacker can execute malicious SQL statements and gain unauthorized access to sensitive data, modify, delete data, or execute arbitrary system commands. To prevent this vulnerability, use prepared statements that do not concatenate user-controllable strings and use parameterized queries where SQL commands and user data are strictly separated. Also, consider using an object-relational (ORM) framework to operate with safer abstractions.\n\nReferences: \n - [Semgrep Rule](https://semgrep.dev/r/cpp.lang.security.sql.sql-injection.sql-injection)\n - [https://owasp.org/Top10/A03_2021-Injection](https://owasp.org/Top10/A03_2021-Injection)\n - [https://wiki.sei.cmu.edu/confluence/display/c/STR02-C.+Sanitize+data+passed+to+complex+subsystems](https://wiki.sei.cmu.edu/confluence/display/c/STR02-C.+Sanitize+data+passed+to+complex+subsystems)\n","text":"Untrusted input might be used to build a database query, which can lead to a SQL injection vulnerability. An attacker can execute malicious SQL statements and gain unauthorized access to sensitive data, modify, delete data, or execute arbitrary system commands. To prevent this vulnerability, use prepared statements that do not concatenate user-controllable strings and use parameterized queries where SQL commands and user data are strictly separated. Also, consider using an object-relational (ORM) framework to operate with safer abstractions."},"helpUri":"https://semgrep.dev/r/cpp.lang.security.sql.sql-injection.sql-injection","id":"cpp.lang.security.sql.sql-injection.sql-injection","name":"cpp.lang.security.sql.sql-injection.sql-injection","properties":{"precision":"very-high","tags":["CWE-89: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')","MEDIUM CONFIDENCE","OWASP-A01:2017 - Injection","OWASP-A03:2021 - Injection","security"]},"shortDescription":{"text":"Semgrep Finding: cpp.lang.security.sql.sql-injection.sql-injection"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"`strlen(...)` returns the number of characters in a string, excluding the NUL terminator. If a string is later copied into this allocated buffer, it will trigger memory corruption."},"help":{"markdown":"`strlen(...)` returns the number of characters in a string, excluding the NUL terminator. If a string is later copied into this allocated buffer, it will trigger memory corruption.\n\nReferences: \n - [Semgrep Rule](https://semgrep.dev/r/cpp.lang.security.strings.alloc-strlen.alloc-strlen)\n - [https://wiki.sei.cmu.edu/confluence/display/c/STR31-C.+Guarantee+that+storage+for+strings+has+sufficient+space+for+character+data+and+the+null+terminator](https://wiki.sei.cmu.edu/confluence/display/c/STR31-C.+Guarantee+that+storage+for+strings+has+sufficient+space+for+character+data+and+the+null+terminator)\n","text":"`strlen(...)` returns the number of characters in a string, excluding the NUL terminator. If a string is later copied into this allocated buffer, it will trigger memory corruption."},"helpUri":"https://semgrep.dev/r/cpp.lang.security.strings.alloc-strlen.alloc-strlen","id":"cpp.lang.security.strings.alloc-strlen.alloc-strlen","name":"cpp.lang.security.strings.alloc-strlen.alloc-strlen","properties":{"precision":"very-high","tags":["CWE-131: Incorrect Calculation of Buffer Size","MEDIUM CONFIDENCE","security"]},"shortDescription":{"text":"Semgrep Finding: cpp.lang.security.strings.alloc-strlen.alloc-strlen"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"The number of bytes copied from `$STR` does not include the NUL terminator. This can lead to an out-of-bounds read and information disclosure. One extra byte should be added to the length to ensure that the NUL terminator is copied."},"help":{"markdown":"The number of bytes copied from `$STR` does not include the NUL terminator. This can lead to an out-of-bounds read and information disclosure. One extra byte should be added to the length to ensure that the NUL terminator is copied.\n\nReferences: \n - [Semgrep Rule](https://semgrep.dev/r/cpp.lang.security.strings.missing-nul-cpp-string-memcpy.missing-nul-cpp-string-memcpy)\n - [https://wiki.sei.cmu.edu/confluence/display/c/STR31-C.+Guarantee+that+storage+for+strings+has+sufficient+space+for+character+data+and+the+null+terminator](https://wiki.sei.cmu.edu/confluence/display/c/STR31-C.+Guarantee+that+storage+for+strings+has+sufficient+space+for+character+data+and+the+null+terminator)\n","text":"The number of bytes copied from `$STR` does not include the NUL terminator. This can lead to an out-of-bounds read and information disclosure. One extra byte should be added to the length to ensure that the NUL terminator is copied."},"helpUri":"https://semgrep.dev/r/cpp.lang.security.strings.missing-nul-cpp-string-memcpy.missing-nul-cpp-string-memcpy","id":"cpp.lang.security.strings.missing-nul-cpp-string-memcpy.missing-nul-cpp-string-memcpy","name":"cpp.lang.security.strings.missing-nul-cpp-string-memcpy.missing-nul-cpp-string-memcpy","properties":{"precision":"very-high","tags":["CWE-125: Out-of-bounds Read","HIGH CONFIDENCE","security"]},"shortDescription":{"text":"Semgrep Finding: cpp.lang.security.strings.missing-nul-cpp-string-memcpy.missing-nul-cpp-string-memcpy"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"A byte-string (narrow string) is used in an API that expects a wide-string. This can trigger an out-of-bounds read."},"help":{"markdown":"A byte-string (narrow string) is used in an API that expects a wide-string. This can trigger an out-of-bounds read.\n\nReferences: \n - [Semgrep Rule](https://semgrep.dev/r/cpp.lang.security.strings.narrow-to-wide-string-mismatch.narrow-to-wide-string-mismatch)\n - [https://wiki.sei.cmu.edu/confluence/display/c/STR38-C.+Do+not+confuse+narrow+and+wide+character+strings+and+functions](https://wiki.sei.cmu.edu/confluence/display/c/STR38-C.+Do+not+confuse+narrow+and+wide+character+strings+and+functions)\n","text":"A byte-string (narrow string) is used in an API that expects a wide-string. This can trigger an out-of-bounds read."},"helpUri":"https://semgrep.dev/r/cpp.lang.security.strings.narrow-to-wide-string-mismatch.narrow-to-wide-string-mismatch","id":"cpp.lang.security.strings.narrow-to-wide-string-mismatch.narrow-to-wide-string-mismatch","name":"cpp.lang.security.strings.narrow-to-wide-string-mismatch.narrow-to-wide-string-mismatch","properties":{"precision":"very-high","tags":["CWE-125: Out-of-bounds Read","HIGH CONFIDENCE","security"]},"shortDescription":{"text":"Semgrep Finding: cpp.lang.security.strings.narrow-to-wide-string-mismatch.narrow-to-wide-string-mismatch"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"`readlink` does not NULL terminate the output buffer. This expression expects a NULL terminated string and will trigger an out-of-bounds read."},"help":{"markdown":"`readlink` does not NULL terminate the output buffer. This expression expects a NULL terminated string and will trigger an out-of-bounds read.\n\nReferences: \n - [Semgrep Rule](https://semgrep.dev/r/cpp.lang.security.strings.readlink-null-terminator.readlink-null-terminator)\n - [https://wiki.sei.cmu.edu/confluence/display/c/STR32-C.+Do+not+pass+a+non-null-terminated+character+sequence+to+a+library+function+that+expects+a+string](https://wiki.sei.cmu.edu/confluence/display/c/STR32-C.+Do+not+pass+a+non-null-terminated+character+sequence+to+a+library+function+that+expects+a+string)\n","text":"`readlink` does not NULL terminate the output buffer. This expression expects a NULL terminated string and will trigger an out-of-bounds read."},"helpUri":"https://semgrep.dev/r/cpp.lang.security.strings.readlink-null-terminator.readlink-null-terminator","id":"cpp.lang.security.strings.readlink-null-terminator.readlink-null-terminator","name":"cpp.lang.security.strings.readlink-null-terminator.readlink-null-terminator","properties":{"precision":"very-high","tags":["CWE-125: Out-of-bounds Read","HIGH CONFIDENCE","security"]},"shortDescription":{"text":"Semgrep Finding: cpp.lang.security.strings.readlink-null-terminator.readlink-null-terminator"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"`$FUNC` returns a pointer to the memory owned by `$STR`. This pointer is invalid after `$STR` goes out of scope, which can trigger a use after free."},"help":{"markdown":"`$FUNC` returns a pointer to the memory owned by `$STR`. This pointer is invalid after `$STR` goes out of scope, which can trigger a use after free.\n\nReferences: \n - [Semgrep Rule](https://semgrep.dev/r/cpp.lang.security.strings.return-c-str.return-c-str)\n - [https://wiki.sei.cmu.edu/confluence/display/c/DCL30-C.+Declare+objects+with+appropriate+storage+durations](https://wiki.sei.cmu.edu/confluence/display/c/DCL30-C.+Declare+objects+with+appropriate+storage+durations)\n - [https://wiki.sei.cmu.edu/confluence/display/cplusplus/EXP54-CPP.+Do+not+access+an+object+outside+of+its+lifetime](https://wiki.sei.cmu.edu/confluence/display/cplusplus/EXP54-CPP.+Do+not+access+an+object+outside+of+its+lifetime)\n","text":"`$FUNC` returns a pointer to the memory owned by `$STR`. This pointer is invalid after `$STR` goes out of scope, which can trigger a use after free."},"helpUri":"https://semgrep.dev/r/cpp.lang.security.strings.return-c-str.return-c-str","id":"cpp.lang.security.strings.return-c-str.return-c-str","name":"cpp.lang.security.strings.return-c-str.return-c-str","properties":{"precision":"very-high","tags":["CWE-416: Use After Free","HIGH CONFIDENCE","security"]},"shortDescription":{"text":"Semgrep Finding: cpp.lang.security.strings.return-c-str.return-c-str"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"The return value of `snprintf` is the number of characters that would be written, excluding the NUL terminator. The return value must be validated before using it as a buffer index or buffer length."},"help":{"markdown":"The return value of `snprintf` is the number of characters that would be written, excluding the NUL terminator. The return value must be validated before using it as a buffer index or buffer length.\n\nReferences: \n - [Semgrep Rule](https://semgrep.dev/r/cpp.lang.security.strings.snprintf-return-value-length.snprintf-return-value-length)\n - [https://cwe.mitre.org/data/definitions/787.html](https://cwe.mitre.org/data/definitions/787.html)\n - [https://wiki.sei.cmu.edu/confluence/display/c/ARR30-C.+Do+not+form+or+use+out-of-bounds+pointers+or+array+subscripts](https://wiki.sei.cmu.edu/confluence/display/c/ARR30-C.+Do+not+form+or+use+out-of-bounds+pointers+or+array+subscripts)\n","text":"The return value of `snprintf` is the number of characters that would be written, excluding the NUL terminator. The return value must be validated before using it as a buffer index or buffer length."},"helpUri":"https://semgrep.dev/r/cpp.lang.security.strings.snprintf-return-value-length.snprintf-return-value-length","id":"cpp.lang.security.strings.snprintf-return-value-length.snprintf-return-value-length","name":"cpp.lang.security.strings.snprintf-return-value-length.snprintf-return-value-length","properties":{"precision":"very-high","tags":["CWE-787: Out-of-bounds Write","MEDIUM CONFIDENCE","security"]},"shortDescription":{"text":"Semgrep Finding: cpp.lang.security.strings.snprintf-return-value-length.snprintf-return-value-length"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"The return value of `snprintf` is the number of characters that would be written, excluding the NUL terminator. The return value must be validated before using it as a buffer index or buffer length in this following `snprintf` call."},"help":{"markdown":"The return value of `snprintf` is the number of characters that would be written, excluding the NUL terminator. The return value must be validated before using it as a buffer index or buffer length in this following `snprintf` call.\n\nReferences: \n - [Semgrep Rule](https://semgrep.dev/r/cpp.lang.security.strings.snprintf-return-value-snprintf.snprintf-return-value-snprintf)\n - [https://cwe.mitre.org/data/definitions/787.html](https://cwe.mitre.org/data/definitions/787.html)\n - [https://wiki.sei.cmu.edu/confluence/display/c/ARR30-C.+Do+not+form+or+use+out-of-bounds+pointers+or+array+subscripts](https://wiki.sei.cmu.edu/confluence/display/c/ARR30-C.+Do+not+form+or+use+out-of-bounds+pointers+or+array+subscripts)\n","text":"The return value of `snprintf` is the number of characters that would be written, excluding the NUL terminator. The return value must be validated before using it as a buffer index or buffer length in this following `snprintf` call."},"helpUri":"https://semgrep.dev/r/cpp.lang.security.strings.snprintf-return-value-snprintf.snprintf-return-value-snprintf","id":"cpp.lang.security.strings.snprintf-return-value-snprintf.snprintf-return-value-snprintf","name":"cpp.lang.security.strings.snprintf-return-value-snprintf.snprintf-return-value-snprintf","properties":{"precision":"very-high","tags":["CWE-787: Out-of-bounds Write","MEDIUM CONFIDENCE","security"]},"shortDescription":{"text":"Semgrep Finding: cpp.lang.security.strings.snprintf-return-value-snprintf.snprintf-return-value-snprintf"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"The size parameter to `snprintf` is derived from the source data, not the destination buffer. This may trigger a buffer overflow and memory corruption if `$SRC` is larger than `$DEST`."},"help":{"markdown":"The size parameter to `snprintf` is derived from the source data, not the destination buffer. This may trigger a buffer overflow and memory corruption if `$SRC` is larger than `$DEST`.\n\nReferences: \n - [Semgrep Rule](https://semgrep.dev/r/cpp.lang.security.strings.snprintf-source-size.snprintf-source-size)\n - [https://cwe.mitre.org/data/definitions/787.html](https://cwe.mitre.org/data/definitions/787.html)\n - [https://wiki.sei.cmu.edu/confluence/display/c/STR31-C.+Guarantee+that+storage+for+strings+has+sufficient+space+for+character+data+and+the+null+terminator](https://wiki.sei.cmu.edu/confluence/display/c/STR31-C.+Guarantee+that+storage+for+strings+has+sufficient+space+for+character+data+and+the+null+terminator)\n","text":"The size parameter to `snprintf` is derived from the source data, not the destination buffer. This may trigger a buffer overflow and memory corruption if `$SRC` is larger than `$DEST`."},"helpUri":"https://semgrep.dev/r/cpp.lang.security.strings.snprintf-source-size.snprintf-source-size","id":"cpp.lang.security.strings.snprintf-source-size.snprintf-source-size","name":"cpp.lang.security.strings.snprintf-source-size.snprintf-source-size","properties":{"precision":"very-high","tags":["CWE-787: Out-of-bounds Write","MEDIUM CONFIDENCE","security"]},"shortDescription":{"text":"Semgrep Finding: cpp.lang.security.strings.snprintf-source-size.snprintf-source-size"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"The return value of `$VAR.$NPOS_CALL(...)` has been modified so it can never equal `std::string::npos`. This could lead to an `std::out_of_range` exception being thrown or trigger an out-of-bounds read if the position is used as an array index."},"help":{"markdown":"The return value of `$VAR.$NPOS_CALL(...)` has been modified so it can never equal `std::string::npos`. This could lead to an `std::out_of_range` exception being thrown or trigger an out-of-bounds read if the position is used as an array index.\n\nReferences: \n - [Semgrep Rule](https://semgrep.dev/r/cpp.lang.security.strings.std-string-npos.std-string-npos)\n - [https://wiki.sei.cmu.edu/confluence/display/cplusplus/CTR55-CPP.+Do+not+use+an+additive+operator+on+an+iterator+if+the+result+would+overflow](https://wiki.sei.cmu.edu/confluence/display/cplusplus/CTR55-CPP.+Do+not+use+an+additive+operator+on+an+iterator+if+the+result+would+overflow)\n","text":"The return value of `$VAR.$NPOS_CALL(...)` has been modified so it can never equal `std::string::npos`. This could lead to an `std::out_of_range` exception being thrown or trigger an out-of-bounds read if the position is used as an array index."},"helpUri":"https://semgrep.dev/r/cpp.lang.security.strings.std-string-npos.std-string-npos","id":"cpp.lang.security.strings.std-string-npos.std-string-npos","name":"cpp.lang.security.strings.std-string-npos.std-string-npos","properties":{"precision":"very-high","tags":["CWE-125: Out-of-bounds Read","HIGH CONFIDENCE","security"]},"shortDescription":{"text":"Semgrep Finding: cpp.lang.security.strings.std-string-npos.std-string-npos"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"The string returned from `std::string_view.data()` is not guaranteed to be NULL terminated. This expression expects a NULL terminated string and will trigger an out-of-bounds read."},"help":{"markdown":"The string returned from `std::string_view.data()` is not guaranteed to be NULL terminated. This expression expects a NULL terminated string and will trigger an out-of-bounds read.\n\nReferences: \n - [Semgrep Rule](https://semgrep.dev/r/cpp.lang.security.strings.string-view-data-null-terminator.string-view-data-null-terminator)\n - [https://wiki.sei.cmu.edu/confluence/display/c/STR32-C.+Do+not+pass+a+non-null-terminated+character+sequence+to+a+library+function+that+expects+a+string](https://wiki.sei.cmu.edu/confluence/display/c/STR32-C.+Do+not+pass+a+non-null-terminated+character+sequence+to+a+library+function+that+expects+a+string)\n","text":"The string returned from `std::string_view.data()` is not guaranteed to be NULL terminated. This expression expects a NULL terminated string and will trigger an out-of-bounds read."},"helpUri":"https://semgrep.dev/r/cpp.lang.security.strings.string-view-data-null-terminator.string-view-data-null-terminator","id":"cpp.lang.security.strings.string-view-data-null-terminator.string-view-data-null-terminator","name":"cpp.lang.security.strings.string-view-data-null-terminator.string-view-data-null-terminator","properties":{"precision":"very-high","tags":["CWE-125: Out-of-bounds Read","HIGH CONFIDENCE","security"]},"shortDescription":{"text":"Semgrep Finding: cpp.lang.security.strings.string-view-data-null-terminator.string-view-data-null-terminator"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"This `std::string_view` is constructed from a temporary `std::string`. The `std::string` value is immeadiately destroyed after assignment and accessing data through the `std::string_view` will trigger a use-after-free."},"help":{"markdown":"This `std::string_view` is constructed from a temporary `std::string`. The `std::string` value is immeadiately destroyed after assignment and accessing data through the `std::string_view` will trigger a use-after-free.\n\nReferences: \n - [Semgrep Rule](https://semgrep.dev/r/cpp.lang.security.strings.string-view-temporary-string.string-view-temporary-string)\n - [https://wiki.sei.cmu.edu/confluence/display/cplusplus/MEM50-CPP.+Do+not+access+freed+memory](https://wiki.sei.cmu.edu/confluence/display/cplusplus/MEM50-CPP.+Do+not+access+freed+memory)\n","text":"This `std::string_view` is constructed from a temporary `std::string`. The `std::string` value is immeadiately destroyed after assignment and accessing data through the `std::string_view` will trigger a use-after-free."},"helpUri":"https://semgrep.dev/r/cpp.lang.security.strings.string-view-temporary-string.string-view-temporary-string","id":"cpp.lang.security.strings.string-view-temporary-string.string-view-temporary-string","name":"cpp.lang.security.strings.string-view-temporary-string.string-view-temporary-string","properties":{"precision":"very-high","tags":["CWE-416: Use After Free","HIGH CONFIDENCE","security"]},"shortDescription":{"text":"Semgrep Finding: cpp.lang.security.strings.string-view-temporary-string.string-view-temporary-string"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"The function `$FUN` does not impose any size limitation to what it writes to `$BUF`. That may lead to a stack buffer overflow if there is no validation on the size of the input."},"help":{"markdown":"The function `$FUN` does not impose any size limitation to what it writes to `$BUF`. That may lead to a stack buffer overflow if there is no validation on the size of the input.\n\nReferences: \n - [Semgrep Rule](https://semgrep.dev/r/cpp.lang.security.strings.unbounded-copy-to-stack-buffer.unbounded-copy-to-stack-buffer)\n - [https://wiki.sei.cmu.edu/confluence/display/c/STR31-C.+Guarantee+that+storage+for+strings+has+sufficient+space+for+character+data+and+the+null+terminator](https://wiki.sei.cmu.edu/confluence/display/c/STR31-C.+Guarantee+that+storage+for+strings+has+sufficient+space+for+character+data+and+the+null+terminator)\n","text":"The function `$FUN` does not impose any size limitation to what it writes to `$BUF`. That may lead to a stack buffer overflow if there is no validation on the size of the input."},"helpUri":"https://semgrep.dev/r/cpp.lang.security.strings.unbounded-copy-to-stack-buffer.unbounded-copy-to-stack-buffer","id":"cpp.lang.security.strings.unbounded-copy-to-stack-buffer.unbounded-copy-to-stack-buffer","name":"cpp.lang.security.strings.unbounded-copy-to-stack-buffer.unbounded-copy-to-stack-buffer","properties":{"precision":"very-high","tags":["CWE-120: Buffer Copy without Checking Size of Input ('Classic Buffer Overflow')","MEDIUM CONFIDENCE","security"]},"shortDescription":{"text":"Semgrep Finding: cpp.lang.security.strings.unbounded-copy-to-stack-buffer.unbounded-copy-to-stack-buffer"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"A wide-string is used in an API that should consume byte-string (narrow string). This can trigger an out-of-bounds read."},"help":{"markdown":"A wide-string is used in an API that should consume byte-string (narrow string). This can trigger an out-of-bounds read.\n\nReferences: \n - [Semgrep Rule](https://semgrep.dev/r/cpp.lang.security.strings.wide-to-narrow-string-mismatch.wide-to-narrow-string-mismatch)\n - [https://wiki.sei.cmu.edu/confluence/display/c/STR38-C.+Do+not+confuse+narrow+and+wide+character+strings+and+functions](https://wiki.sei.cmu.edu/confluence/display/c/STR38-C.+Do+not+confuse+narrow+and+wide+character+strings+and+functions)\n","text":"A wide-string is used in an API that should consume byte-string (narrow string). This can trigger an out-of-bounds read."},"helpUri":"https://semgrep.dev/r/cpp.lang.security.strings.wide-to-narrow-string-mismatch.wide-to-narrow-string-mismatch","id":"cpp.lang.security.strings.wide-to-narrow-string-mismatch.wide-to-narrow-string-mismatch","name":"cpp.lang.security.strings.wide-to-narrow-string-mismatch.wide-to-narrow-string-mismatch","properties":{"precision":"very-high","tags":["CWE-125: Out-of-bounds Read","HIGH CONFIDENCE","security"]},"shortDescription":{"text":"Semgrep Finding: cpp.lang.security.strings.wide-to-narrow-string-mismatch.wide-to-narrow-string-mismatch"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"Untrusted input might be injected into a command executed by the application, which can lead to a command injection vulnerability. An attacker can execute arbitrary commands, potentially gaining complete control of the system. To prevent this vulnerability, avoid executing OS commands with user input. If this is unavoidable, validate and sanitize the input, and use safe methods for executing the commands."},"help":{"markdown":"Untrusted input might be injected into a command executed by the application, which can lead to a command injection vulnerability. An attacker can execute arbitrary commands, potentially gaining complete control of the system. To prevent this vulnerability, avoid executing OS commands with user input. If this is unavoidable, validate and sanitize the input, and use safe methods for executing the commands.\n\nReferences: \n - [Semgrep Rule](https://semgrep.dev/r/cpp.lang.security.system-command.command-injection-path.command-injection-path)\n - [https://owasp.org/Top10/A03_2021-Injection](https://owasp.org/Top10/A03_2021-Injection)\n - [https://wiki.sei.cmu.edu/confluence/display/c/STR02-C.+Sanitize+data+passed+to+complex+subsystems](https://wiki.sei.cmu.edu/confluence/display/c/STR02-C.+Sanitize+data+passed+to+complex+subsystems)\n","text":"Untrusted input might be injected into a command executed by the application, which can lead to a command injection vulnerability. An attacker can execute arbitrary commands, potentially gaining complete control of the system. To prevent this vulnerability, avoid executing OS commands with user input. If this is unavoidable, validate and sanitize the input, and use safe methods for executing the commands."},"helpUri":"https://semgrep.dev/r/cpp.lang.security.system-command.command-injection-path.command-injection-path","id":"cpp.lang.security.system-command.command-injection-path.command-injection-path","name":"cpp.lang.security.system-command.command-injection-path.command-injection-path","properties":{"precision":"very-high","tags":["CWE-78: Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')","MEDIUM CONFIDENCE","OWASP-A01:2017 - Injection","OWASP-A03:2021 - Injection","security"]},"shortDescription":{"text":"Semgrep Finding: cpp.lang.security.system-command.command-injection-path.command-injection-path"}},{"defaultConfiguration":{"level":"note"},"fullDescription":{"text":"Don't call `system`. It's a high-level wrapper that allows for stacking multiple commands. Always prefer a more restrictive API such as calling `execve` from the `exec` family."},"help":{"markdown":"Don't call `system`. It's a high-level wrapper that allows for stacking multiple commands. Always prefer a more restrictive API such as calling `execve` from the `exec` family.\n\nReferences: \n - [Semgrep Rule](https://semgrep.dev/r/cpp.lang.security.system-command.dont-call-system.dont-call-system)\n - [https://owasp.org/Top10/A03_2021-Injection](https://owasp.org/Top10/A03_2021-Injection)\n","text":"Don't call `system`. It's a high-level wrapper that allows for stacking multiple commands. Always prefer a more restrictive API such as calling `execve` from the `exec` family."},"helpUri":"https://semgrep.dev/r/cpp.lang.security.system-command.dont-call-system.dont-call-system","id":"cpp.lang.security.system-command.dont-call-system.dont-call-system","name":"cpp.lang.security.system-command.dont-call-system.dont-call-system","properties":{"precision":"very-high","tags":["CWE-78: Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')","HIGH CONFIDENCE","OWASP-A01:2017 - Injection","OWASP-A03:2021 - Injection","security"]},"shortDescription":{"text":"Semgrep Finding: cpp.lang.security.system-command.dont-call-system.dont-call-system"}},{"defaultConfiguration":{"level":"note"},"fullDescription":{"text":"The application may be making an insecure HTTP request which may allow attackers to intercept plaintext information. Instead, the URL should use HTTPS to ensure that the request is encrypted."},"help":{"markdown":"The application may be making an insecure HTTP request which may allow attackers to intercept plaintext information. Instead, the URL should use HTTPS to ensure that the request is encrypted.\n\nReferences: \n - [Semgrep Rule](https://semgrep.dev/r/cpp.lang.security.uri.http-url.http-url)\n - [https://owasp.org/Top10/A02_2021-Cryptographic_Failures](https://owasp.org/Top10/A02_2021-Cryptographic_Failures)\n","text":"The application may be making an insecure HTTP request which may allow attackers to intercept plaintext information. Instead, the URL should use HTTPS to ensure that the request is encrypted."},"helpUri":"https://semgrep.dev/r/cpp.lang.security.uri.http-url.http-url","id":"cpp.lang.security.uri.http-url.http-url","name":"cpp.lang.security.uri.http-url.http-url","properties":{"precision":"very-high","tags":["CWE-319: Cleartext Transmission of Sensitive Information","MEDIUM CONFIDENCE","OWASP-A02:2021 - Cryptographic Failures","OWASP-A03:2017 - Sensitive Data Exposure","security"]},"shortDescription":{"text":"Semgrep Finding: cpp.lang.security.uri.http-url.http-url"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"Untrusted input might be used to build an HTTP request, which can lead to a Server-side request forgery (SSRF) vulnerability. SSRF allows an attacker to send crafted requests from the server side to other internal or external systems. SSRF can lead to unauthorized access to sensitive data and, in some cases, allow the attacker to control applications or systems that trust the vulnerable service. To prevent this vulnerability, avoid allowing user input to craft the base request. Instead, treat it as part of the path or query parameter and encode it appropriately. When user input is necessary to prepare the HTTP request, perform strict input validation. Additionally, whenever possible, use allowlists to only interact with expected, trusted domains."},"help":{"markdown":"Untrusted input might be used to build an HTTP request, which can lead to a Server-side request forgery (SSRF) vulnerability. SSRF allows an attacker to send crafted requests from the server side to other internal or external systems. SSRF can lead to unauthorized access to sensitive data and, in some cases, allow the attacker to control applications or systems that trust the vulnerable service. To prevent this vulnerability, avoid allowing user input to craft the base request. Instead, treat it as part of the path or query parameter and encode it appropriately. When user input is necessary to prepare the HTTP request, perform strict input validation. Additionally, whenever possible, use allowlists to only interact with expected, trusted domains.\n\nReferences: \n - [Semgrep Rule](https://semgrep.dev/r/cpp.lang.security.uri.url-manipulation-generic.url-manipulation-generic)\n - [https://owasp.org/Top10/A10_2021-Server-Side_Request_Forgery_%28SSRF%29](https://owasp.org/Top10/A10_2021-Server-Side_Request_Forgery_%28SSRF%29)\n - [https://wiki.sei.cmu.edu/confluence/display/c/STR02-C.+Sanitize+data+passed+to+complex+subsystems](https://wiki.sei.cmu.edu/confluence/display/c/STR02-C.+Sanitize+data+passed+to+complex+subsystems)\n","text":"Untrusted input might be used to build an HTTP request, which can lead to a Server-side request forgery (SSRF) vulnerability. SSRF allows an attacker to send crafted requests from the server side to other internal or external systems. SSRF can lead to unauthorized access to sensitive data and, in some cases, allow the attacker to control applications or systems that trust the vulnerable service. To prevent this vulnerability, avoid allowing user input to craft the base request. Instead, treat it as part of the path or query parameter and encode it appropriately. When user input is necessary to prepare the HTTP request, perform strict input validation. Additionally, whenever possible, use allowlists to only interact with expected, trusted domains."},"helpUri":"https://semgrep.dev/r/cpp.lang.security.uri.url-manipulation-generic.url-manipulation-generic","id":"cpp.lang.security.uri.url-manipulation-generic.url-manipulation-generic","name":"cpp.lang.security.uri.url-manipulation-generic.url-manipulation-generic","properties":{"precision":"very-high","tags":["CWE-918: Server-Side Request Forgery (SSRF)","MEDIUM CONFIDENCE","OWASP-A10:2021 - Server-Side Request Forgery (SSRF)","security"]},"shortDescription":{"text":"Semgrep Finding: cpp.lang.security.uri.url-manipulation-generic.url-manipulation-generic"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"This expression points to memory that has been freed. This can lead to a segmentation fault or memory corruption."},"help":{"markdown":"This expression points to memory that has been freed. This can lead to a segmentation fault or memory corruption.\n\nReferences: \n - [Semgrep Rule](https://semgrep.dev/r/cpp.lang.security.use-after-free.local-variable-malloc-free.local-variable-malloc-free)\n - [https://wiki.sei.cmu.edu/confluence/display/c/MEM30-C.+Do+not+access+freed+memory](https://wiki.sei.cmu.edu/confluence/display/c/MEM30-C.+Do+not+access+freed+memory)\n - [https://wiki.sei.cmu.edu/confluence/display/cplusplus/EXP54-CPP.+Do+not+access+an+object+outside+of+its+lifetime](https://wiki.sei.cmu.edu/confluence/display/cplusplus/EXP54-CPP.+Do+not+access+an+object+outside+of+its+lifetime)\n","text":"This expression points to memory that has been freed. This can lead to a segmentation fault or memory corruption."},"helpUri":"https://semgrep.dev/r/cpp.lang.security.use-after-free.local-variable-malloc-free.local-variable-malloc-free","id":"cpp.lang.security.use-after-free.local-variable-malloc-free.local-variable-malloc-free","name":"cpp.lang.security.use-after-free.local-variable-malloc-free.local-variable-malloc-free","properties":{"precision":"very-high","tags":["CWE-416: Use After Free","MEDIUM CONFIDENCE","security"]},"shortDescription":{"text":"Semgrep Finding: cpp.lang.security.use-after-free.local-variable-malloc-free.local-variable-malloc-free"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"This expression points to memory that has been freed. This can lead to a segmentation fault or memory corruption."},"help":{"markdown":"This expression points to memory that has been freed. This can lead to a segmentation fault or memory corruption.\n\nReferences: \n - [Semgrep Rule](https://semgrep.dev/r/cpp.lang.security.use-after-free.local-variable-new-delete.local-variable-new-delete)\n - [https://wiki.sei.cmu.edu/confluence/display/c/MEM30-C.+Do+not+access+freed+memory](https://wiki.sei.cmu.edu/confluence/display/c/MEM30-C.+Do+not+access+freed+memory)\n - [https://wiki.sei.cmu.edu/confluence/display/cplusplus/EXP54-CPP.+Do+not+access+an+object+outside+of+its+lifetime](https://wiki.sei.cmu.edu/confluence/display/cplusplus/EXP54-CPP.+Do+not+access+an+object+outside+of+its+lifetime)\n","text":"This expression points to memory that has been freed. This can lead to a segmentation fault or memory corruption."},"helpUri":"https://semgrep.dev/r/cpp.lang.security.use-after-free.local-variable-new-delete.local-variable-new-delete","id":"cpp.lang.security.use-after-free.local-variable-new-delete.local-variable-new-delete","name":"cpp.lang.security.use-after-free.local-variable-new-delete.local-variable-new-delete","properties":{"precision":"very-high","tags":["CWE-416: Use After Free","MEDIUM CONFIDENCE","security"]},"shortDescription":{"text":"Semgrep Finding: cpp.lang.security.use-after-free.local-variable-new-delete.local-variable-new-delete"}},{"defaultConfiguration":{"level":"note"},"fullDescription":{"text":"The libxml2 library is used to parse XML. When auditing such code, make sure that either the document being parsed is trusted or that the parsing options are safe to consume untrusted documents. In such case make sure DTD or XInclude documents cannot be loaded and there is no network access."},"help":{"markdown":"The libxml2 library is used to parse XML. When auditing such code, make sure that either the document being parsed is trusted or that the parsing options are safe to consume untrusted documents. In such case make sure DTD or XInclude documents cannot be loaded and there is no network access.\n\nReferences: \n - [Semgrep Rule](https://semgrep.dev/r/cpp.libxml2.security.libxml2-audit-parser.libxml2-audit-parser)\n - [https://owasp.org/Top10/A05_2021-Security_Misconfiguration](https://owasp.org/Top10/A05_2021-Security_Misconfiguration)\n","text":"The libxml2 library is used to parse XML. When auditing such code, make sure that either the document being parsed is trusted or that the parsing options are safe to consume untrusted documents. In such case make sure DTD or XInclude documents cannot be loaded and there is no network access."},"helpUri":"https://semgrep.dev/r/cpp.libxml2.security.libxml2-audit-parser.libxml2-audit-parser","id":"cpp.libxml2.security.libxml2-audit-parser.libxml2-audit-parser","name":"cpp.libxml2.security.libxml2-audit-parser.libxml2-audit-parser","properties":{"precision":"very-high","tags":["CWE-611: Improper Restriction of XML External Entity Reference","HIGH CONFIDENCE","OWASP-A04:2017 - XML External Entities (XXE)","OWASP-A05:2021 - Security Misconfiguration","security"]},"shortDescription":{"text":"Semgrep Finding: cpp.libxml2.security.libxml2-audit-parser.libxml2-audit-parser"}},{"defaultConfiguration":{"level":"note"},"fullDescription":{"text":"The libxml2 parser is configured to process entities. Without other options such as processing DTDs or accessing remote entities from the network, it should not pose a risk except for memory exhaustion."},"help":{"markdown":"The libxml2 parser is configured to process entities. Without other options such as processing DTDs or accessing remote entities from the network, it should not pose a risk except for memory exhaustion.\n\nReferences: \n - [Semgrep Rule](https://semgrep.dev/r/cpp.libxml2.security.libxml2-expand-local-entities.libxml2-expand-local-entities)\n - [https://owasp.org/Top10/A05_2021-Security_Misconfiguration](https://owasp.org/Top10/A05_2021-Security_Misconfiguration)\n - [https://wiki.sei.cmu.edu/confluence/display/c/STR02-C.+Sanitize+data+passed+to+complex+subsystems](https://wiki.sei.cmu.edu/confluence/display/c/STR02-C.+Sanitize+data+passed+to+complex+subsystems)\n","text":"The libxml2 parser is configured to process entities. Without other options such as processing DTDs or accessing remote entities from the network, it should not pose a risk except for memory exhaustion."},"helpUri":"https://semgrep.dev/r/cpp.libxml2.security.libxml2-expand-local-entities.libxml2-expand-local-entities","id":"cpp.libxml2.security.libxml2-expand-local-entities.libxml2-expand-local-entities","name":"cpp.libxml2.security.libxml2-expand-local-entities.libxml2-expand-local-entities","properties":{"precision":"very-high","tags":["CWE-611: Improper Restriction of XML External Entity Reference","MEDIUM CONFIDENCE","OWASP-A04:2017 - XML External Entities (XXE)","OWASP-A05:2021 - Security Misconfiguration","security"]},"shortDescription":{"text":"Semgrep Finding: cpp.libxml2.security.libxml2-expand-local-entities.libxml2-expand-local-entities"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"The application is using an XML parser that has not been safely configured. This might lead to XML External Entity (XXE) vulnerabilities when parsing user-controlled input. An attacker can include document type definitions (DTDs) or XIncludes which can interact with internal or external hosts. XXE can lead to other vulnerabilities, such as Local File Inclusion (LFI), Remote Code Execution (RCE), and Server-side request forgery (SSRF), depending on the application configuration. An attacker can also use DTDs to expand recursively, leading to a Denial-of-Service (DoS) attack, also known as a `Billion Laughs Attack`. If DTD is required for local files then pass the `XML_PARSE_NONET` option which will disable network access."},"help":{"markdown":"The application is using an XML parser that has not been safely configured. This might lead to XML External Entity (XXE) vulnerabilities when parsing user-controlled input. An attacker can include document type definitions (DTDs) or XIncludes which can interact with internal or external hosts. XXE can lead to other vulnerabilities, such as Local File Inclusion (LFI), Remote Code Execution (RCE), and Server-side request forgery (SSRF), depending on the application configuration. An attacker can also use DTDs to expand recursively, leading to a Denial-of-Service (DoS) attack, also known as a `Billion Laughs Attack`. If DTD is required for local files then pass the `XML_PARSE_NONET` option which will disable network access.\n\nReferences: \n - [Semgrep Rule](https://semgrep.dev/r/cpp.libxml2.security.libxml2-expand-remote-dtd.libxml2-expand-remote-dtd)\n - [https://owasp.org/Top10/A05_2021-Security_Misconfiguration](https://owasp.org/Top10/A05_2021-Security_Misconfiguration)\n - [https://wiki.sei.cmu.edu/confluence/display/c/STR02-C.+Sanitize+data+passed+to+complex+subsystems](https://wiki.sei.cmu.edu/confluence/display/c/STR02-C.+Sanitize+data+passed+to+complex+subsystems)\n","text":"The application is using an XML parser that has not been safely configured. This might lead to XML External Entity (XXE) vulnerabilities when parsing user-controlled input. An attacker can include document type definitions (DTDs) or XIncludes which can interact with internal or external hosts. XXE can lead to other vulnerabilities, such as Local File Inclusion (LFI), Remote Code Execution (RCE), and Server-side request forgery (SSRF), depending on the application configuration. An attacker can also use DTDs to expand recursively, leading to a Denial-of-Service (DoS) attack, also known as a `Billion Laughs Attack`. If DTD is required for local files then pass the `XML_PARSE_NONET` option which will disable network access."},"helpUri":"https://semgrep.dev/r/cpp.libxml2.security.libxml2-expand-remote-dtd.libxml2-expand-remote-dtd","id":"cpp.libxml2.security.libxml2-expand-remote-dtd.libxml2-expand-remote-dtd","name":"cpp.libxml2.security.libxml2-expand-remote-dtd.libxml2-expand-remote-dtd","properties":{"precision":"very-high","tags":["CWE-611: Improper Restriction of XML External Entity Reference","MEDIUM CONFIDENCE","OWASP-A04:2017 - XML External Entities (XXE)","OWASP-A05:2021 - Security Misconfiguration","security"]},"shortDescription":{"text":"Semgrep Finding: cpp.libxml2.security.libxml2-expand-remote-dtd.libxml2-expand-remote-dtd"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"The application is using an XML parser that has not been safely configured. This might lead to XML External Entity (XXE) vulnerabilities when parsing user-controlled input. An attacker can include document type definitions (DTDs) or XIncludes which can interact with internal or external hosts. XXE can lead to other vulnerabilities, such as Local File Inclusion (LFI), Remote Code Execution (RCE), and Server-side request forgery (SSRF), depending on the application configuration. An attacker can also use DTDs to expand recursively, leading to a Denial-of-Service (DoS) attack, also known as a `Billion Laughs Attack`. The best defense against XXE is to have an XML parser that supports disabling DTDs. Limiting the use of external entities from the start can prevent the parser from being used to process untrusted XML files. Reducing dependencies on external resources is also a good practice for performance reasons. It is difficult to guarantee that even a trusted XML file on your server or during transmission has not been tampered with by a malicious third-party."},"help":{"markdown":"The application is using an XML parser that has not been safely configured. This might lead to XML External Entity (XXE) vulnerabilities when parsing user-controlled input. An attacker can include document type definitions (DTDs) or XIncludes which can interact with internal or external hosts. XXE can lead to other vulnerabilities, such as Local File Inclusion (LFI), Remote Code Execution (RCE), and Server-side request forgery (SSRF), depending on the application configuration. An attacker can also use DTDs to expand recursively, leading to a Denial-of-Service (DoS) attack, also known as a `Billion Laughs Attack`. The best defense against XXE is to have an XML parser that supports disabling DTDs. Limiting the use of external entities from the start can prevent the parser from being used to process untrusted XML files. Reducing dependencies on external resources is also a good practice for performance reasons. It is difficult to guarantee that even a trusted XML file on your server or during transmission has not been tampered with by a malicious third-party.\n\nReferences: \n - [Semgrep Rule](https://semgrep.dev/r/cpp.libxml2.security.libxml2-expand-xinclude.libxml2-expand-xinclude)\n - [https://owasp.org/Top10/A05_2021-Security_Misconfiguration](https://owasp.org/Top10/A05_2021-Security_Misconfiguration)\n - [https://wiki.sei.cmu.edu/confluence/display/c/STR02-C.+Sanitize+data+passed+to+complex+subsystems](https://wiki.sei.cmu.edu/confluence/display/c/STR02-C.+Sanitize+data+passed+to+complex+subsystems)\n","text":"The application is using an XML parser that has not been safely configured. This might lead to XML External Entity (XXE) vulnerabilities when parsing user-controlled input. An attacker can include document type definitions (DTDs) or XIncludes which can interact with internal or external hosts. XXE can lead to other vulnerabilities, such as Local File Inclusion (LFI), Remote Code Execution (RCE), and Server-side request forgery (SSRF), depending on the application configuration. An attacker can also use DTDs to expand recursively, leading to a Denial-of-Service (DoS) attack, also known as a `Billion Laughs Attack`. The best defense against XXE is to have an XML parser that supports disabling DTDs. Limiting the use of external entities from the start can prevent the parser from being used to process untrusted XML files. Reducing dependencies on external resources is also a good practice for performance reasons. It is difficult to guarantee that even a trusted XML file on your server or during transmission has not been tampered with by a malicious third-party."},"helpUri":"https://semgrep.dev/r/cpp.libxml2.security.libxml2-expand-xinclude.libxml2-expand-xinclude","id":"cpp.libxml2.security.libxml2-expand-xinclude.libxml2-expand-xinclude","name":"cpp.libxml2.security.libxml2-expand-xinclude.libxml2-expand-xinclude","properties":{"precision":"very-high","tags":["CWE-611: Improper Restriction of XML External Entity Reference","MEDIUM CONFIDENCE","OWASP-A04:2017 - XML External Entities (XXE)","OWASP-A05:2021 - Security Misconfiguration","security"]},"shortDescription":{"text":"Semgrep Finding: cpp.libxml2.security.libxml2-expand-xinclude.libxml2-expand-xinclude"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"The application might dynamically evaluate untrusted input, which can lead to a code injection vulnerability. An attacker can execute arbitrary code, potentially gaining complete control of the system. To prevent this vulnerability, avoid executing code containing user input. If this is unavoidable, validate and sanitize the input, and use safe alternatives for evaluating user input."},"help":{"markdown":"The application might dynamically evaluate untrusted input, which can lead to a code injection vulnerability. An attacker can execute arbitrary code, potentially gaining complete control of the system. To prevent this vulnerability, avoid executing code containing user input. If this is unavoidable, validate and sanitize the input, and use safe alternatives for evaluating user input.\n\nReferences: \n - [Semgrep Rule](https://semgrep.dev/r/csharp.dotnet-core.code-injection.compile-taint-grpc.compile-taint-grpc)\n - [https://owasp.org/Top10/A03_2021-Injection](https://owasp.org/Top10/A03_2021-Injection)\n","text":"The application might dynamically evaluate untrusted input, which can lead to a code injection vulnerability. An attacker can execute arbitrary code, potentially gaining complete control of the system. To prevent this vulnerability, avoid executing code containing user input. If this is unavoidable, validate and sanitize the input, and use safe alternatives for evaluating user input."},"helpUri":"https://semgrep.dev/r/csharp.dotnet-core.code-injection.compile-taint-grpc.compile-taint-grpc","id":"csharp.dotnet-core.code-injection.compile-taint-grpc.compile-taint-grpc","name":"csharp.dotnet-core.code-injection.compile-taint-grpc.compile-taint-grpc","properties":{"precision":"very-high","tags":["CWE-94: Improper Control of Generation of Code ('Code Injection')","HIGH CONFIDENCE","OWASP-A03:2021 - Injection","security"]},"shortDescription":{"text":"Semgrep Finding: csharp.dotnet-core.code-injection.compile-taint-grpc.compile-taint-grpc"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"The application might dynamically evaluate untrusted input, which can lead to a code injection vulnerability. An attacker can execute arbitrary code, potentially gaining complete control of the system. To prevent this vulnerability, avoid executing code containing user input. If this is unavoidable, validate and sanitize the input, and use safe alternatives for evaluating user input."},"help":{"markdown":"The application might dynamically evaluate untrusted input, which can lead to a code injection vulnerability. An attacker can execute arbitrary code, potentially gaining complete control of the system. To prevent this vulnerability, avoid executing code containing user input. If this is unavoidable, validate and sanitize the input, and use safe alternatives for evaluating user input.\n\nReferences: \n - [Semgrep Rule](https://semgrep.dev/r/csharp.dotnet-core.code-injection.compile-taint.compile-taint)\n - [https://owasp.org/Top10/A03_2021-Injection](https://owasp.org/Top10/A03_2021-Injection)\n","text":"The application might dynamically evaluate untrusted input, which can lead to a code injection vulnerability. An attacker can execute arbitrary code, potentially gaining complete control of the system. To prevent this vulnerability, avoid executing code containing user input. If this is unavoidable, validate and sanitize the input, and use safe alternatives for evaluating user input."},"helpUri":"https://semgrep.dev/r/csharp.dotnet-core.code-injection.compile-taint.compile-taint","id":"csharp.dotnet-core.code-injection.compile-taint.compile-taint","name":"csharp.dotnet-core.code-injection.compile-taint.compile-taint","properties":{"precision":"very-high","tags":["CWE-94: Improper Control of Generation of Code ('Code Injection')","HIGH CONFIDENCE","OWASP-A03:2021 - Injection","security"]},"shortDescription":{"text":"Semgrep Finding: csharp.dotnet-core.code-injection.compile-taint.compile-taint"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"Untrusted input might be injected into a command executed by the application, which can lead to a command injection vulnerability. An attacker can execute arbitrary commands, potentially gaining complete control of the system. To prevent this vulnerability, avoid executing OS commands with user input. If this is unavoidable, validate and sanitize the input, and use safe methods for executing the commands."},"help":{"markdown":"Untrusted input might be injected into a command executed by the application, which can lead to a command injection vulnerability. An attacker can execute arbitrary commands, potentially gaining complete control of the system. To prevent this vulnerability, avoid executing OS commands with user input. If this is unavoidable, validate and sanitize the input, and use safe methods for executing the commands.\n\nReferences: \n - [Semgrep Rule](https://semgrep.dev/r/csharp.dotnet-core.command-injection.process-taint-grpc.process-taint-grpc)\n - [https://owasp.org/Top10/A03_2021-Injection](https://owasp.org/Top10/A03_2021-Injection)\n","text":"Untrusted input might be injected into a command executed by the application, which can lead to a command injection vulnerability. An attacker can execute arbitrary commands, potentially gaining complete control of the system. To prevent this vulnerability, avoid executing OS commands with user input. If this is unavoidable, validate and sanitize the input, and use safe methods for executing the commands."},"helpUri":"https://semgrep.dev/r/csharp.dotnet-core.command-injection.process-taint-grpc.process-taint-grpc","id":"csharp.dotnet-core.command-injection.process-taint-grpc.process-taint-grpc","name":"csharp.dotnet-core.command-injection.process-taint-grpc.process-taint-grpc","properties":{"precision":"very-high","tags":["CWE-78: Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')","HIGH CONFIDENCE","OWASP-A01:2017 - Injection","OWASP-A03:2021 - Injection","security"]},"shortDescription":{"text":"Semgrep Finding: csharp.dotnet-core.command-injection.process-taint-grpc.process-taint-grpc"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"Untrusted input might be injected into a command executed by the application, which can lead to a command injection vulnerability. An attacker can execute arbitrary commands, potentially gaining complete control of the system. To prevent this vulnerability, avoid executing OS commands with user input. If this is unavoidable, validate and sanitize the input, and use safe methods for executing the commands."},"help":{"markdown":"Untrusted input might be injected into a command executed by the application, which can lead to a command injection vulnerability. An attacker can execute arbitrary commands, potentially gaining complete control of the system. To prevent this vulnerability, avoid executing OS commands with user input. If this is unavoidable, validate and sanitize the input, and use safe methods for executing the commands.\n\nReferences: \n - [Semgrep Rule](https://semgrep.dev/r/csharp.dotnet-core.command-injection.process-taint.process-taint)\n - [https://owasp.org/Top10/A03_2021-Injection](https://owasp.org/Top10/A03_2021-Injection)\n","text":"Untrusted input might be injected into a command executed by the application, which can lead to a command injection vulnerability. An attacker can execute arbitrary commands, potentially gaining complete control of the system. To prevent this vulnerability, avoid executing OS commands with user input. If this is unavoidable, validate and sanitize the input, and use safe methods for executing the commands."},"helpUri":"https://semgrep.dev/r/csharp.dotnet-core.command-injection.process-taint.process-taint","id":"csharp.dotnet-core.command-injection.process-taint.process-taint","name":"csharp.dotnet-core.command-injection.process-taint.process-taint","properties":{"precision":"very-high","tags":["CWE-78: Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')","HIGH CONFIDENCE","OWASP-A01:2017 - Injection","OWASP-A03:2021 - Injection","security"]},"shortDescription":{"text":"Semgrep Finding: csharp.dotnet-core.command-injection.process-taint.process-taint"}},{"defaultConfiguration":{"level":"note"},"fullDescription":{"text":"Detected a cookie options with the `SameSite` flag set to \"None\". This is a potential security risk that arises from the way web browsers manage cookies. In a typical web application, cookies are used to store and transmit session-related data between a client and a server. To enhance security, cookies can be marked with the \"SameSite\" attribute, which restricts their usage based on the origin of the page that set them. This attribute can have three values: \"Strict,\" \"Lax,\" or \"None\". If this wasn't intentional, it's recommended to set the the `SameSite` attribute of the important cookies (e.g., session cookie) to either `Strict` or `Lax`. When `SameSite` is set to \"Strict\", no 3rd party cookie will be sent with outgoing requests, this is the most secure and private setting but harder to deploy with good usability. Setting it to \"Lax\" is the minimum requirement. You can use the Cookie Policy Middleware to globally set the `SameSite` attribute. You can then use the CookieOptions class when instantiating the cookie, which inherits these settings and will require future developers to have to explicitly override them on a case-by-case basis if needed. This approach ensures cookies are secure by default."},"help":{"markdown":"Detected a cookie options with the `SameSite` flag set to \"None\". This is a potential security risk that arises from the way web browsers manage cookies. In a typical web application, cookies are used to store and transmit session-related data between a client and a server. To enhance security, cookies can be marked with the \"SameSite\" attribute, which restricts their usage based on the origin of the page that set them. This attribute can have three values: \"Strict,\" \"Lax,\" or \"None\". If this wasn't intentional, it's recommended to set the the `SameSite` attribute of the important cookies (e.g., session cookie) to either `Strict` or `Lax`. When `SameSite` is set to \"Strict\", no 3rd party cookie will be sent with outgoing requests, this is the most secure and private setting but harder to deploy with good usability. Setting it to \"Lax\" is the minimum requirement. You can use the Cookie Policy Middleware to globally set the `SameSite` attribute. You can then use the CookieOptions class when instantiating the cookie, which inherits these settings and will require future developers to have to explicitly override them on a case-by-case basis if needed. This approach ensures cookies are secure by default.\n\nReferences: \n - [Semgrep Rule](https://semgrep.dev/r/csharp.dotnet-core.cookies.cookie-samesite-none.cookie-samesite-none)\n - [https://learn.microsoft.com/en-us/aspnet/core/security/authentication/cookie?view=aspnetcore-8.0#cookie-policy-middleware](https://learn.microsoft.com/en-us/aspnet/core/security/authentication/cookie?view=aspnetcore-8.0#cookie-policy-middleware)\n - [https://learn.microsoft.com/en-us/dotnet/api/microsoft.aspnetcore.http.cookieoptions](https://learn.microsoft.com/en-us/dotnet/api/microsoft.aspnetcore.http.cookieoptions)\n - [https://owasp.org/Top10/A01_2021-Broken_Access_Control](https://owasp.org/Top10/A01_2021-Broken_Access_Control)\n - [https://web.dev/articles/samesite-cookies-explained](https://web.dev/articles/samesite-cookies-explained)\n","text":"Detected a cookie options with the `SameSite` flag set to \"None\". This is a potential security risk that arises from the way web browsers manage cookies. In a typical web application, cookies are used to store and transmit session-related data between a client and a server. To enhance security, cookies can be marked with the \"SameSite\" attribute, which restricts their usage based on the origin of the page that set them. This attribute can have three values: \"Strict,\" \"Lax,\" or \"None\". If this wasn't intentional, it's recommended to set the the `SameSite` attribute of the important cookies (e.g., session cookie) to either `Strict` or `Lax`. When `SameSite` is set to \"Strict\", no 3rd party cookie will be sent with outgoing requests, this is the most secure and private setting but harder to deploy with good usability. Setting it to \"Lax\" is the minimum requirement. You can use the Cookie Policy Middleware to globally set the `SameSite` attribute. You can then use the CookieOptions class when instantiating the cookie, which inherits these settings and will require future developers to have to explicitly override them on a case-by-case basis if needed. This approach ensures cookies are secure by default."},"helpUri":"https://semgrep.dev/r/csharp.dotnet-core.cookies.cookie-samesite-none.cookie-samesite-none","id":"csharp.dotnet-core.cookies.cookie-samesite-none.cookie-samesite-none","name":"csharp.dotnet-core.cookies.cookie-samesite-none.cookie-samesite-none","properties":{"precision":"very-high","tags":["CWE-1275: Sensitive Cookie with Improper SameSite Attribute","MEDIUM CONFIDENCE","OWASP-A01:2021 - Broken Access Control","security"]},"shortDescription":{"text":"Semgrep Finding: csharp.dotnet-core.cookies.cookie-samesite-none.cookie-samesite-none"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"Detected the decoding of a JWT token without a verify step. JWT tokens must be verified before use, otherwise the token's integrity is unknown. This means a malicious actor could forge a JWT token with any claims. Validate the token before using it."},"help":{"markdown":"Detected the decoding of a JWT token without a verify step. JWT tokens must be verified before use, otherwise the token's integrity is unknown. This means a malicious actor could forge a JWT token with any claims. Validate the token before using it.\n\nReferences: \n - [Semgrep Rule](https://semgrep.dev/r/csharp.dotnet-core.jwt.jwt-decode-without-verify.jwt-decode-without-verify)\n - [https://owasp.org/Top10/A08_2021-Software_and_Data_Integrity_Failures](https://owasp.org/Top10/A08_2021-Software_and_Data_Integrity_Failures)\n","text":"Detected the decoding of a JWT token without a verify step. JWT tokens must be verified before use, otherwise the token's integrity is unknown. This means a malicious actor could forge a JWT token with any claims. Validate the token before using it."},"helpUri":"https://semgrep.dev/r/csharp.dotnet-core.jwt.jwt-decode-without-verify.jwt-decode-without-verify","id":"csharp.dotnet-core.jwt.jwt-decode-without-verify.jwt-decode-without-verify","name":"csharp.dotnet-core.jwt.jwt-decode-without-verify.jwt-decode-without-verify","properties":{"precision":"very-high","tags":["CWE-345: Insufficient Verification of Data Authenticity","HIGH CONFIDENCE","OWASP-A08:2021 - Software and Data Integrity Failures","security"]},"shortDescription":{"text":"Semgrep Finding: csharp.dotnet-core.jwt.jwt-decode-without-verify.jwt-decode-without-verify"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"A secret is hard-coded in the application. Secrets stored in source code, such as credentials, identifiers, and other types of sensitive data, can be leaked and used by internal or external malicious actors. It is recommended to rotate the secret and retrieve them from a secure secret vault or Hardware Security Module (HSM), alternatively environment variables can be used if allowed by your company policy."},"help":{"markdown":"A secret is hard-coded in the application. Secrets stored in source code, such as credentials, identifiers, and other types of sensitive data, can be leaked and used by internal or external malicious actors. It is recommended to rotate the secret and retrieve them from a secure secret vault or Hardware Security Module (HSM), alternatively environment variables can be used if allowed by your company policy.\n\nReferences: \n - [Semgrep Rule](https://semgrep.dev/r/csharp.dotnet-core.jwt.jwt-hardcoded-secret.jwt-hardcoded-secret)\n - [https://owasp.org/Top10/A07_2021-Identification_and_Authentication_Failures](https://owasp.org/Top10/A07_2021-Identification_and_Authentication_Failures)\n","text":"A secret is hard-coded in the application. Secrets stored in source code, such as credentials, identifiers, and other types of sensitive data, can be leaked and used by internal or external malicious actors. It is recommended to rotate the secret and retrieve them from a secure secret vault or Hardware Security Module (HSM), alternatively environment variables can be used if allowed by your company policy."},"helpUri":"https://semgrep.dev/r/csharp.dotnet-core.jwt.jwt-hardcoded-secret.jwt-hardcoded-secret","id":"csharp.dotnet-core.jwt.jwt-hardcoded-secret.jwt-hardcoded-secret","name":"csharp.dotnet-core.jwt.jwt-hardcoded-secret.jwt-hardcoded-secret","properties":{"precision":"very-high","tags":["CWE-798: Use of Hard-coded Credentials","HIGH CONFIDENCE","OWASP-A07:2021 - Identification and Authentication Failures","security"]},"shortDescription":{"text":"Semgrep Finding: csharp.dotnet-core.jwt.jwt-hardcoded-secret.jwt-hardcoded-secret"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"Untrusted input might be used to build a database query, which can lead to a NoSQL injection vulnerability. An attacker can execute malicious NoSQL statements and gain unauthorized access to sensitive data, modify, delete data, or execute arbitrary system commands. Make sure all user input is validated and sanitized, and avoid using tainted user input to construct NoSQL statements if possible. Ideally, avoid raw queries and instead use parameterized queries."},"help":{"markdown":"Untrusted input might be used to build a database query, which can lead to a NoSQL injection vulnerability. An attacker can execute malicious NoSQL statements and gain unauthorized access to sensitive data, modify, delete data, or execute arbitrary system commands. Make sure all user input is validated and sanitized, and avoid using tainted user input to construct NoSQL statements if possible. Ideally, avoid raw queries and instead use parameterized queries.\n\nReferences: \n - [Semgrep Rule](https://semgrep.dev/r/csharp.dotnet-core.nosqli.mongodb-taint-grpc.mongodb-taint-grpc)\n - [https://owasp.org/Top10/A03_2021-Injection](https://owasp.org/Top10/A03_2021-Injection)\n","text":"Untrusted input might be used to build a database query, which can lead to a NoSQL injection vulnerability. An attacker can execute malicious NoSQL statements and gain unauthorized access to sensitive data, modify, delete data, or execute arbitrary system commands. Make sure all user input is validated and sanitized, and avoid using tainted user input to construct NoSQL statements if possible. Ideally, avoid raw queries and instead use parameterized queries."},"helpUri":"https://semgrep.dev/r/csharp.dotnet-core.nosqli.mongodb-taint-grpc.mongodb-taint-grpc","id":"csharp.dotnet-core.nosqli.mongodb-taint-grpc.mongodb-taint-grpc","name":"csharp.dotnet-core.nosqli.mongodb-taint-grpc.mongodb-taint-grpc","properties":{"precision":"very-high","tags":["CWE-943: Improper Neutralization of Special Elements in Data Query Logic","HIGH CONFIDENCE","OWASP-A01:2017 - Injection","security"]},"shortDescription":{"text":"Semgrep Finding: csharp.dotnet-core.nosqli.mongodb-taint-grpc.mongodb-taint-grpc"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"Untrusted input might be used to build a database query, which can lead to a NoSQL injection vulnerability. An attacker can execute malicious NoSQL statements and gain unauthorized access to sensitive data, modify, delete data, or execute arbitrary system commands. Make sure all user input is validated and sanitized, and avoid using tainted user input to construct NoSQL statements if possible. Ideally, avoid raw queries and instead use parameterized queries."},"help":{"markdown":"Untrusted input might be used to build a database query, which can lead to a NoSQL injection vulnerability. An attacker can execute malicious NoSQL statements and gain unauthorized access to sensitive data, modify, delete data, or execute arbitrary system commands. Make sure all user input is validated and sanitized, and avoid using tainted user input to construct NoSQL statements if possible. Ideally, avoid raw queries and instead use parameterized queries.\n\nReferences: \n - [Semgrep Rule](https://semgrep.dev/r/csharp.dotnet-core.nosqli.mongodb-taint.mongodb-taint)\n - [https://owasp.org/Top10/A03_2021-Injection](https://owasp.org/Top10/A03_2021-Injection)\n","text":"Untrusted input might be used to build a database query, which can lead to a NoSQL injection vulnerability. An attacker can execute malicious NoSQL statements and gain unauthorized access to sensitive data, modify, delete data, or execute arbitrary system commands. Make sure all user input is validated and sanitized, and avoid using tainted user input to construct NoSQL statements if possible. Ideally, avoid raw queries and instead use parameterized queries."},"helpUri":"https://semgrep.dev/r/csharp.dotnet-core.nosqli.mongodb-taint.mongodb-taint","id":"csharp.dotnet-core.nosqli.mongodb-taint.mongodb-taint","name":"csharp.dotnet-core.nosqli.mongodb-taint.mongodb-taint","properties":{"precision":"very-high","tags":["CWE-943: Improper Neutralization of Special Elements in Data Query Logic","HIGH CONFIDENCE","OWASP-A01:2017 - Injection","security"]},"shortDescription":{"text":"Semgrep Finding: csharp.dotnet-core.nosqli.mongodb-taint.mongodb-taint"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"The application builds a file path from potentially untrusted data, which can lead to a path traversal vulnerability. An attacker can manipulate the path which the application uses to access files. If the application does not validate user input and sanitize file paths, sensitive files such as configuration or user data can be accessed, potentially creating or overwriting files. To prevent this vulnerability, validate and sanitize any input that is used to create references to file paths. Also, enforce strict file access controls. For example, choose privileges allowing public-facing applications to access only the required files."},"help":{"markdown":"The application builds a file path from potentially untrusted data, which can lead to a path traversal vulnerability. An attacker can manipulate the path which the application uses to access files. If the application does not validate user input and sanitize file paths, sensitive files such as configuration or user data can be accessed, potentially creating or overwriting files. To prevent this vulnerability, validate and sanitize any input that is used to create references to file paths. Also, enforce strict file access controls. For example, choose privileges allowing public-facing applications to access only the required files.\n\nReferences: \n - [Semgrep Rule](https://semgrep.dev/r/csharp.dotnet-core.path-traversal.file-taint-grpc.file-taint-grpc)\n - [https://owasp.org/Top10/A01_2021-Broken_Access_Control](https://owasp.org/Top10/A01_2021-Broken_Access_Control)\n - [https://owasp.org/www-community/attacks/Path_Traversal](https://owasp.org/www-community/attacks/Path_Traversal)\n - [https://portswigger.net/web-security/file-path-traversal](https://portswigger.net/web-security/file-path-traversal)\n","text":"The application builds a file path from potentially untrusted data, which can lead to a path traversal vulnerability. An attacker can manipulate the path which the application uses to access files. If the application does not validate user input and sanitize file paths, sensitive files such as configuration or user data can be accessed, potentially creating or overwriting files. To prevent this vulnerability, validate and sanitize any input that is used to create references to file paths. Also, enforce strict file access controls. For example, choose privileges allowing public-facing applications to access only the required files."},"helpUri":"https://semgrep.dev/r/csharp.dotnet-core.path-traversal.file-taint-grpc.file-taint-grpc","id":"csharp.dotnet-core.path-traversal.file-taint-grpc.file-taint-grpc","name":"csharp.dotnet-core.path-traversal.file-taint-grpc.file-taint-grpc","properties":{"precision":"very-high","tags":["CWE-22: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')","HIGH CONFIDENCE","OWASP-A01:2021 - Broken Access Control","OWASP-A05:2017 - Broken Access Control","security"]},"shortDescription":{"text":"Semgrep Finding: csharp.dotnet-core.path-traversal.file-taint-grpc.file-taint-grpc"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"The application builds a file path from potentially untrusted data, which can lead to a path traversal vulnerability. An attacker can manipulate the path which the application uses to access files. If the application does not validate user input and sanitize file paths, sensitive files such as configuration or user data can be accessed, potentially creating or overwriting files. To prevent this vulnerability, validate and sanitize any input that is used to create references to file paths. Also, enforce strict file access controls. For example, choose privileges allowing public-facing applications to access only the required files."},"help":{"markdown":"The application builds a file path from potentially untrusted data, which can lead to a path traversal vulnerability. An attacker can manipulate the path which the application uses to access files. If the application does not validate user input and sanitize file paths, sensitive files such as configuration or user data can be accessed, potentially creating or overwriting files. To prevent this vulnerability, validate and sanitize any input that is used to create references to file paths. Also, enforce strict file access controls. For example, choose privileges allowing public-facing applications to access only the required files.\n\nReferences: \n - [Semgrep Rule](https://semgrep.dev/r/csharp.dotnet-core.path-traversal.file-taint.file-taint)\n - [https://owasp.org/Top10/A01_2021-Broken_Access_Control](https://owasp.org/Top10/A01_2021-Broken_Access_Control)\n - [https://owasp.org/www-community/attacks/Path_Traversal](https://owasp.org/www-community/attacks/Path_Traversal)\n - [https://portswigger.net/web-security/file-path-traversal](https://portswigger.net/web-security/file-path-traversal)\n","text":"The application builds a file path from potentially untrusted data, which can lead to a path traversal vulnerability. An attacker can manipulate the path which the application uses to access files. If the application does not validate user input and sanitize file paths, sensitive files such as configuration or user data can be accessed, potentially creating or overwriting files. To prevent this vulnerability, validate and sanitize any input that is used to create references to file paths. Also, enforce strict file access controls. For example, choose privileges allowing public-facing applications to access only the required files."},"helpUri":"https://semgrep.dev/r/csharp.dotnet-core.path-traversal.file-taint.file-taint","id":"csharp.dotnet-core.path-traversal.file-taint.file-taint","name":"csharp.dotnet-core.path-traversal.file-taint.file-taint","properties":{"precision":"very-high","tags":["CWE-22: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')","HIGH CONFIDENCE","OWASP-A01:2021 - Broken Access Control","OWASP-A05:2017 - Broken Access Control","security"]},"shortDescription":{"text":"Semgrep Finding: csharp.dotnet-core.path-traversal.file-taint.file-taint"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"Untrusted input might be used to build a database query, which can lead to a SQL injection vulnerability. An attacker can execute malicious SQL statements and gain unauthorized access to sensitive data, modify, delete data, or execute arbitrary system commands. To prevent this vulnerability, use prepared statements that do not concatenate user-controllable strings and use parameterized queries where SQL commands and user data are strictly separated. Also, consider using an object-relational (ORM) framework to operate with safer abstractions."},"help":{"markdown":"Untrusted input might be used to build a database query, which can lead to a SQL injection vulnerability. An attacker can execute malicious SQL statements and gain unauthorized access to sensitive data, modify, delete data, or execute arbitrary system commands. To prevent this vulnerability, use prepared statements that do not concatenate user-controllable strings and use parameterized queries where SQL commands and user data are strictly separated. Also, consider using an object-relational (ORM) framework to operate with safer abstractions.\n\nReferences: \n - [Semgrep Rule](https://semgrep.dev/r/csharp.dotnet-core.sqli.entityframework-taint-grpc.entityframework-taint-grpc)\n - [https://owasp.org/Top10/A03_2021-Injection](https://owasp.org/Top10/A03_2021-Injection)\n","text":"Untrusted input might be used to build a database query, which can lead to a SQL injection vulnerability. An attacker can execute malicious SQL statements and gain unauthorized access to sensitive data, modify, delete data, or execute arbitrary system commands. To prevent this vulnerability, use prepared statements that do not concatenate user-controllable strings and use parameterized queries where SQL commands and user data are strictly separated. Also, consider using an object-relational (ORM) framework to operate with safer abstractions."},"helpUri":"https://semgrep.dev/r/csharp.dotnet-core.sqli.entityframework-taint-grpc.entityframework-taint-grpc","id":"csharp.dotnet-core.sqli.entityframework-taint-grpc.entityframework-taint-grpc","name":"csharp.dotnet-core.sqli.entityframework-taint-grpc.entityframework-taint-grpc","properties":{"precision":"very-high","tags":["CWE-89: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')","HIGH CONFIDENCE","OWASP-A01:2017 - Injection","OWASP-A03:2021 - Injection","security"]},"shortDescription":{"text":"Semgrep Finding: csharp.dotnet-core.sqli.entityframework-taint-grpc.entityframework-taint-grpc"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"Untrusted input might be used to build a database query, which can lead to a SQL injection vulnerability. An attacker can execute malicious SQL statements and gain unauthorized access to sensitive data, modify, delete data, or execute arbitrary system commands. To prevent this vulnerability, use prepared statements that do not concatenate user-controllable strings and use parameterized queries where SQL commands and user data are strictly separated. Also, consider using an object-relational (ORM) framework to operate with safer abstractions."},"help":{"markdown":"Untrusted input might be used to build a database query, which can lead to a SQL injection vulnerability. An attacker can execute malicious SQL statements and gain unauthorized access to sensitive data, modify, delete data, or execute arbitrary system commands. To prevent this vulnerability, use prepared statements that do not concatenate user-controllable strings and use parameterized queries where SQL commands and user data are strictly separated. Also, consider using an object-relational (ORM) framework to operate with safer abstractions.\n\nReferences: \n - [Semgrep Rule](https://semgrep.dev/r/csharp.dotnet-core.sqli.entityframework-taint.entityframework-taint)\n - [https://owasp.org/Top10/A03_2021-Injection](https://owasp.org/Top10/A03_2021-Injection)\n","text":"Untrusted input might be used to build a database query, which can lead to a SQL injection vulnerability. An attacker can execute malicious SQL statements and gain unauthorized access to sensitive data, modify, delete data, or execute arbitrary system commands. To prevent this vulnerability, use prepared statements that do not concatenate user-controllable strings and use parameterized queries where SQL commands and user data are strictly separated. Also, consider using an object-relational (ORM) framework to operate with safer abstractions."},"helpUri":"https://semgrep.dev/r/csharp.dotnet-core.sqli.entityframework-taint.entityframework-taint","id":"csharp.dotnet-core.sqli.entityframework-taint.entityframework-taint","name":"csharp.dotnet-core.sqli.entityframework-taint.entityframework-taint","properties":{"precision":"very-high","tags":["CWE-89: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')","HIGH CONFIDENCE","OWASP-A01:2017 - Injection","OWASP-A03:2021 - Injection","security"]},"shortDescription":{"text":"Semgrep Finding: csharp.dotnet-core.sqli.entityframework-taint.entityframework-taint"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"Untrusted input might be used to build a database query, which can lead to a SQL injection vulnerability. An attacker can execute malicious SQL statements and gain unauthorized access to sensitive data, modify, delete data, or execute arbitrary system commands. To prevent this vulnerability, use prepared statements that do not concatenate user-controllable strings and use parameterized queries where SQL commands and user data are strictly separated. Also, consider using an object-relational (ORM) framework to operate with safer abstractions."},"help":{"markdown":"Untrusted input might be used to build a database query, which can lead to a SQL injection vulnerability. An attacker can execute malicious SQL statements and gain unauthorized access to sensitive data, modify, delete data, or execute arbitrary system commands. To prevent this vulnerability, use prepared statements that do not concatenate user-controllable strings and use parameterized queries where SQL commands and user data are strictly separated. Also, consider using an object-relational (ORM) framework to operate with safer abstractions.\n\nReferences: \n - [Semgrep Rule](https://semgrep.dev/r/csharp.dotnet-core.sqli.systemdata-taint-grpc.systemdata-taint-grpc)\n - [https://owasp.org/Top10/A03_2021-Injection](https://owasp.org/Top10/A03_2021-Injection)\n","text":"Untrusted input might be used to build a database query, which can lead to a SQL injection vulnerability. An attacker can execute malicious SQL statements and gain unauthorized access to sensitive data, modify, delete data, or execute arbitrary system commands. To prevent this vulnerability, use prepared statements that do not concatenate user-controllable strings and use parameterized queries where SQL commands and user data are strictly separated. Also, consider using an object-relational (ORM) framework to operate with safer abstractions."},"helpUri":"https://semgrep.dev/r/csharp.dotnet-core.sqli.systemdata-taint-grpc.systemdata-taint-grpc","id":"csharp.dotnet-core.sqli.systemdata-taint-grpc.systemdata-taint-grpc","name":"csharp.dotnet-core.sqli.systemdata-taint-grpc.systemdata-taint-grpc","properties":{"precision":"very-high","tags":["CWE-89: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')","HIGH CONFIDENCE","OWASP-A01:2017 - Injection","OWASP-A03:2021 - Injection","security"]},"shortDescription":{"text":"Semgrep Finding: csharp.dotnet-core.sqli.systemdata-taint-grpc.systemdata-taint-grpc"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"Untrusted input might be used to build a database query, which can lead to a SQL injection vulnerability. An attacker can execute malicious SQL statements and gain unauthorized access to sensitive data, modify, delete data, or execute arbitrary system commands. To prevent this vulnerability, use prepared statements that do not concatenate user-controllable strings and use parameterized queries where SQL commands and user data are strictly separated. Also, consider using an object-relational (ORM) framework to operate with safer abstractions."},"help":{"markdown":"Untrusted input might be used to build a database query, which can lead to a SQL injection vulnerability. An attacker can execute malicious SQL statements and gain unauthorized access to sensitive data, modify, delete data, or execute arbitrary system commands. To prevent this vulnerability, use prepared statements that do not concatenate user-controllable strings and use parameterized queries where SQL commands and user data are strictly separated. Also, consider using an object-relational (ORM) framework to operate with safer abstractions.\n\nReferences: \n - [Semgrep Rule](https://semgrep.dev/r/csharp.dotnet-core.sqli.systemdata-taint.systemdata-taint)\n - [https://owasp.org/Top10/A03_2021-Injection](https://owasp.org/Top10/A03_2021-Injection)\n","text":"Untrusted input might be used to build a database query, which can lead to a SQL injection vulnerability. An attacker can execute malicious SQL statements and gain unauthorized access to sensitive data, modify, delete data, or execute arbitrary system commands. To prevent this vulnerability, use prepared statements that do not concatenate user-controllable strings and use parameterized queries where SQL commands and user data are strictly separated. Also, consider using an object-relational (ORM) framework to operate with safer abstractions."},"helpUri":"https://semgrep.dev/r/csharp.dotnet-core.sqli.systemdata-taint.systemdata-taint","id":"csharp.dotnet-core.sqli.systemdata-taint.systemdata-taint","name":"csharp.dotnet-core.sqli.systemdata-taint.systemdata-taint","properties":{"precision":"very-high","tags":["CWE-89: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')","HIGH CONFIDENCE","OWASP-A01:2017 - Injection","OWASP-A03:2021 - Injection","security"]},"shortDescription":{"text":"Semgrep Finding: csharp.dotnet-core.sqli.systemdata-taint.systemdata-taint"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"Untrusted input might be used to build an HTTP request, which can lead to a Server-side request forgery (SSRF) vulnerability. SSRF allows an attacker to send crafted requests from the server side to other internal or external systems. SSRF can lead to unauthorized access to sensitive data and, in some cases, allow the attacker to control applications or systems that trust the vulnerable service. To prevent this vulnerability, avoid allowing user input to craft the base request. Instead, treat it as part of the path or query parameter and encode it appropriately. When user input is necessary to prepare the HTTP request, perform strict input validation. Additionally, whenever possible, use allowlists to only interact with expected, trusted domains."},"help":{"markdown":"Untrusted input might be used to build an HTTP request, which can lead to a Server-side request forgery (SSRF) vulnerability. SSRF allows an attacker to send crafted requests from the server side to other internal or external systems. SSRF can lead to unauthorized access to sensitive data and, in some cases, allow the attacker to control applications or systems that trust the vulnerable service. To prevent this vulnerability, avoid allowing user input to craft the base request. Instead, treat it as part of the path or query parameter and encode it appropriately. When user input is necessary to prepare the HTTP request, perform strict input validation. Additionally, whenever possible, use allowlists to only interact with expected, trusted domains.\n\nReferences: \n - [Semgrep Rule](https://semgrep.dev/r/csharp.dotnet-core.ssrf.httpclient-taint-format-grpc.httpclient-taint-format-grpc)\n - [https://owasp.org/Top10/A10_2021-Server-Side_Request_Forgery_%28SSRF%29](https://owasp.org/Top10/A10_2021-Server-Side_Request_Forgery_%28SSRF%29)\n","text":"Untrusted input might be used to build an HTTP request, which can lead to a Server-side request forgery (SSRF) vulnerability. SSRF allows an attacker to send crafted requests from the server side to other internal or external systems. SSRF can lead to unauthorized access to sensitive data and, in some cases, allow the attacker to control applications or systems that trust the vulnerable service. To prevent this vulnerability, avoid allowing user input to craft the base request. Instead, treat it as part of the path or query parameter and encode it appropriately. When user input is necessary to prepare the HTTP request, perform strict input validation. Additionally, whenever possible, use allowlists to only interact with expected, trusted domains."},"helpUri":"https://semgrep.dev/r/csharp.dotnet-core.ssrf.httpclient-taint-format-grpc.httpclient-taint-format-grpc","id":"csharp.dotnet-core.ssrf.httpclient-taint-format-grpc.httpclient-taint-format-grpc","name":"csharp.dotnet-core.ssrf.httpclient-taint-format-grpc.httpclient-taint-format-grpc","properties":{"precision":"very-high","tags":["CWE-918: Server-Side Request Forgery (SSRF)","HIGH CONFIDENCE","OWASP-A10:2021 - Server-Side Request Forgery (SSRF)","security"]},"shortDescription":{"text":"Semgrep Finding: csharp.dotnet-core.ssrf.httpclient-taint-format-grpc.httpclient-taint-format-grpc"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"Untrusted input might be used to build an HTTP request, which can lead to a Server-side request forgery (SSRF) vulnerability. SSRF allows an attacker to send crafted requests from the server side to other internal or external systems. SSRF can lead to unauthorized access to sensitive data and, in some cases, allow the attacker to control applications or systems that trust the vulnerable service. To prevent this vulnerability, avoid allowing user input to craft the base request. Instead, treat it as part of the path or query parameter and encode it appropriately. When user input is necessary to prepare the HTTP request, perform strict input validation. Additionally, whenever possible, use allowlists to only interact with expected, trusted domains."},"help":{"markdown":"Untrusted input might be used to build an HTTP request, which can lead to a Server-side request forgery (SSRF) vulnerability. SSRF allows an attacker to send crafted requests from the server side to other internal or external systems. SSRF can lead to unauthorized access to sensitive data and, in some cases, allow the attacker to control applications or systems that trust the vulnerable service. To prevent this vulnerability, avoid allowing user input to craft the base request. Instead, treat it as part of the path or query parameter and encode it appropriately. When user input is necessary to prepare the HTTP request, perform strict input validation. Additionally, whenever possible, use allowlists to only interact with expected, trusted domains.\n\nReferences: \n - [Semgrep Rule](https://semgrep.dev/r/csharp.dotnet-core.ssrf.httpclient-taint-format.httpclient-taint-format)\n - [https://owasp.org/Top10/A10_2021-Server-Side_Request_Forgery_%28SSRF%29](https://owasp.org/Top10/A10_2021-Server-Side_Request_Forgery_%28SSRF%29)\n","text":"Untrusted input might be used to build an HTTP request, which can lead to a Server-side request forgery (SSRF) vulnerability. SSRF allows an attacker to send crafted requests from the server side to other internal or external systems. SSRF can lead to unauthorized access to sensitive data and, in some cases, allow the attacker to control applications or systems that trust the vulnerable service. To prevent this vulnerability, avoid allowing user input to craft the base request. Instead, treat it as part of the path or query parameter and encode it appropriately. When user input is necessary to prepare the HTTP request, perform strict input validation. Additionally, whenever possible, use allowlists to only interact with expected, trusted domains."},"helpUri":"https://semgrep.dev/r/csharp.dotnet-core.ssrf.httpclient-taint-format.httpclient-taint-format","id":"csharp.dotnet-core.ssrf.httpclient-taint-format.httpclient-taint-format","name":"csharp.dotnet-core.ssrf.httpclient-taint-format.httpclient-taint-format","properties":{"precision":"very-high","tags":["CWE-918: Server-Side Request Forgery (SSRF)","HIGH CONFIDENCE","OWASP-A10:2021 - Server-Side Request Forgery (SSRF)","security"]},"shortDescription":{"text":"Semgrep Finding: csharp.dotnet-core.ssrf.httpclient-taint-format.httpclient-taint-format"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"Untrusted input might be used to build an HTTP request, which can lead to a Server-side request forgery (SSRF) vulnerability. SSRF allows an attacker to send crafted requests from the server side to other internal or external systems. SSRF can lead to unauthorized access to sensitive data and, in some cases, allow the attacker to control applications or systems that trust the vulnerable service. To prevent this vulnerability, avoid allowing user input to craft the base request. Instead, treat it as part of the path or query parameter and encode it appropriately. When user input is necessary to prepare the HTTP request, perform strict input validation. Additionally, whenever possible, use allowlists to only interact with expected, trusted domains."},"help":{"markdown":"Untrusted input might be used to build an HTTP request, which can lead to a Server-side request forgery (SSRF) vulnerability. SSRF allows an attacker to send crafted requests from the server side to other internal or external systems. SSRF can lead to unauthorized access to sensitive data and, in some cases, allow the attacker to control applications or systems that trust the vulnerable service. To prevent this vulnerability, avoid allowing user input to craft the base request. Instead, treat it as part of the path or query parameter and encode it appropriately. When user input is necessary to prepare the HTTP request, perform strict input validation. Additionally, whenever possible, use allowlists to only interact with expected, trusted domains.\n\nReferences: \n - [Semgrep Rule](https://semgrep.dev/r/csharp.dotnet-core.ssrf.httpclient-taint-grpc.httpclient-taint-grpc)\n - [https://owasp.org/Top10/A10_2021-Server-Side_Request_Forgery_%28SSRF%29](https://owasp.org/Top10/A10_2021-Server-Side_Request_Forgery_%28SSRF%29)\n","text":"Untrusted input might be used to build an HTTP request, which can lead to a Server-side request forgery (SSRF) vulnerability. SSRF allows an attacker to send crafted requests from the server side to other internal or external systems. SSRF can lead to unauthorized access to sensitive data and, in some cases, allow the attacker to control applications or systems that trust the vulnerable service. To prevent this vulnerability, avoid allowing user input to craft the base request. Instead, treat it as part of the path or query parameter and encode it appropriately. When user input is necessary to prepare the HTTP request, perform strict input validation. Additionally, whenever possible, use allowlists to only interact with expected, trusted domains."},"helpUri":"https://semgrep.dev/r/csharp.dotnet-core.ssrf.httpclient-taint-grpc.httpclient-taint-grpc","id":"csharp.dotnet-core.ssrf.httpclient-taint-grpc.httpclient-taint-grpc","name":"csharp.dotnet-core.ssrf.httpclient-taint-grpc.httpclient-taint-grpc","properties":{"precision":"very-high","tags":["CWE-918: Server-Side Request Forgery (SSRF)","HIGH CONFIDENCE","OWASP-A10:2021 - Server-Side Request Forgery (SSRF)","security"]},"shortDescription":{"text":"Semgrep Finding: csharp.dotnet-core.ssrf.httpclient-taint-grpc.httpclient-taint-grpc"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"Untrusted input might be used to build an HTTP request, which can lead to a Server-side request forgery (SSRF) vulnerability. SSRF allows an attacker to send crafted requests from the server side to other internal or external systems. SSRF can lead to unauthorized access to sensitive data and, in some cases, allow the attacker to control applications or systems that trust the vulnerable service. To prevent this vulnerability, avoid allowing user input to craft the base request. Instead, treat it as part of the path or query parameter and encode it appropriately. When user input is necessary to prepare the HTTP request, perform strict input validation. Additionally, whenever possible, use allowlists to only interact with expected, trusted domains."},"help":{"markdown":"Untrusted input might be used to build an HTTP request, which can lead to a Server-side request forgery (SSRF) vulnerability. SSRF allows an attacker to send crafted requests from the server side to other internal or external systems. SSRF can lead to unauthorized access to sensitive data and, in some cases, allow the attacker to control applications or systems that trust the vulnerable service. To prevent this vulnerability, avoid allowing user input to craft the base request. Instead, treat it as part of the path or query parameter and encode it appropriately. When user input is necessary to prepare the HTTP request, perform strict input validation. Additionally, whenever possible, use allowlists to only interact with expected, trusted domains.\n\nReferences: \n - [Semgrep Rule](https://semgrep.dev/r/csharp.dotnet-core.ssrf.httpclient-taint.httpclient-taint)\n - [https://owasp.org/Top10/A10_2021-Server-Side_Request_Forgery_%28SSRF%29](https://owasp.org/Top10/A10_2021-Server-Side_Request_Forgery_%28SSRF%29)\n","text":"Untrusted input might be used to build an HTTP request, which can lead to a Server-side request forgery (SSRF) vulnerability. SSRF allows an attacker to send crafted requests from the server side to other internal or external systems. SSRF can lead to unauthorized access to sensitive data and, in some cases, allow the attacker to control applications or systems that trust the vulnerable service. To prevent this vulnerability, avoid allowing user input to craft the base request. Instead, treat it as part of the path or query parameter and encode it appropriately. When user input is necessary to prepare the HTTP request, perform strict input validation. Additionally, whenever possible, use allowlists to only interact with expected, trusted domains."},"helpUri":"https://semgrep.dev/r/csharp.dotnet-core.ssrf.httpclient-taint.httpclient-taint","id":"csharp.dotnet-core.ssrf.httpclient-taint.httpclient-taint","name":"csharp.dotnet-core.ssrf.httpclient-taint.httpclient-taint","properties":{"precision":"very-high","tags":["CWE-918: Server-Side Request Forgery (SSRF)","HIGH CONFIDENCE","OWASP-A10:2021 - Server-Side Request Forgery (SSRF)","security"]},"shortDescription":{"text":"Semgrep Finding: csharp.dotnet-core.ssrf.httpclient-taint.httpclient-taint"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"XPath queries are constructed dynamically on user-controlled input. This could lead to XPath injection if variables passed into the evaluate or compile commands are not properly sanitized. Xpath injection could lead to unauthorized access to sensitive information in XML documents. Thoroughly sanitize user input or use parameterized XPath queries if you can."},"help":{"markdown":"XPath queries are constructed dynamically on user-controlled input. This could lead to XPath injection if variables passed into the evaluate or compile commands are not properly sanitized. Xpath injection could lead to unauthorized access to sensitive information in XML documents. Thoroughly sanitize user input or use parameterized XPath queries if you can.\n\nReferences: \n - [Semgrep Rule](https://semgrep.dev/r/csharp.dotnet-core.xpath-injection.xpath-taint-grpc.xpath-taint-grpc)\n - [https://owasp.org/Top10/A03_2021-Injection](https://owasp.org/Top10/A03_2021-Injection)\n","text":"XPath queries are constructed dynamically on user-controlled input. This could lead to XPath injection if variables passed into the evaluate or compile commands are not properly sanitized. Xpath injection could lead to unauthorized access to sensitive information in XML documents. Thoroughly sanitize user input or use parameterized XPath queries if you can."},"helpUri":"https://semgrep.dev/r/csharp.dotnet-core.xpath-injection.xpath-taint-grpc.xpath-taint-grpc","id":"csharp.dotnet-core.xpath-injection.xpath-taint-grpc.xpath-taint-grpc","name":"csharp.dotnet-core.xpath-injection.xpath-taint-grpc.xpath-taint-grpc","properties":{"precision":"very-high","tags":["CWE-643: Improper Neutralization of Data within XPath Expressions ('XPath Injection')","HIGH CONFIDENCE","OWASP-A03:2021 - Injection","security"]},"shortDescription":{"text":"Semgrep Finding: csharp.dotnet-core.xpath-injection.xpath-taint-grpc.xpath-taint-grpc"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"XPath queries are constructed dynamically on user-controlled input. This could lead to XPath injection if variables passed into the evaluate or compile commands are not properly sanitized. Xpath injection could lead to unauthorized access to sensitive information in XML documents. Thoroughly sanitize user input or use parameterized XPath queries if you can."},"help":{"markdown":"XPath queries are constructed dynamically on user-controlled input. This could lead to XPath injection if variables passed into the evaluate or compile commands are not properly sanitized. Xpath injection could lead to unauthorized access to sensitive information in XML documents. Thoroughly sanitize user input or use parameterized XPath queries if you can.\n\nReferences: \n - [Semgrep Rule](https://semgrep.dev/r/csharp.dotnet-core.xpath-injection.xpath-taint.xpath-taint)\n - [https://owasp.org/Top10/A03_2021-Injection](https://owasp.org/Top10/A03_2021-Injection)\n","text":"XPath queries are constructed dynamically on user-controlled input. This could lead to XPath injection if variables passed into the evaluate or compile commands are not properly sanitized. Xpath injection could lead to unauthorized access to sensitive information in XML documents. Thoroughly sanitize user input or use parameterized XPath queries if you can."},"helpUri":"https://semgrep.dev/r/csharp.dotnet-core.xpath-injection.xpath-taint.xpath-taint","id":"csharp.dotnet-core.xpath-injection.xpath-taint.xpath-taint","name":"csharp.dotnet-core.xpath-injection.xpath-taint.xpath-taint","properties":{"precision":"very-high","tags":["CWE-643: Improper Neutralization of Data within XPath Expressions ('XPath Injection')","HIGH CONFIDENCE","OWASP-A03:2021 - Injection","security"]},"shortDescription":{"text":"Semgrep Finding: csharp.dotnet-core.xpath-injection.xpath-taint.xpath-taint"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"The application is using an XML parser that has not been safely configured. This might lead to XML External Entity (XXE) vulnerabilities when parsing user-controlled input. An attacker can include document type definitions (DTDs) or XIncludes which can interact with internal or external hosts. XXE can lead to other vulnerabilities, such as Local File Inclusion (LFI), Remote Code Execution (RCE), and Server-side request forgery (SSRF), depending on the application configuration. An attacker can also use DTDs to expand recursively, leading to a Denial-of-Service (DoS) attack, also known as a `Billion Laughs Attack`. The best defense against XXE is to have an XML parser that supports disabling DTDs. Limiting the use of external entities from the start can prevent the parser from being used to process untrusted XML files. Reducing dependencies on external resources is also a good practice for performance reasons. It is difficult to guarantee that even a trusted XML file on your server or during transmission has not been tampered with by a malicious third-party."},"help":{"markdown":"The application is using an XML parser that has not been safely configured. This might lead to XML External Entity (XXE) vulnerabilities when parsing user-controlled input. An attacker can include document type definitions (DTDs) or XIncludes which can interact with internal or external hosts. XXE can lead to other vulnerabilities, such as Local File Inclusion (LFI), Remote Code Execution (RCE), and Server-side request forgery (SSRF), depending on the application configuration. An attacker can also use DTDs to expand recursively, leading to a Denial-of-Service (DoS) attack, also known as a `Billion Laughs Attack`. The best defense against XXE is to have an XML parser that supports disabling DTDs. Limiting the use of external entities from the start can prevent the parser from being used to process untrusted XML files. Reducing dependencies on external resources is also a good practice for performance reasons. It is difficult to guarantee that even a trusted XML file on your server or during transmission has not been tampered with by a malicious third-party.\n\nReferences: \n - [Semgrep Rule](https://semgrep.dev/r/csharp.dotnet-core.xxe.xml-dtd-allowed.xml-dtd-allowed)\n - [https://owasp.org/Top10/A05_2021-Security_Misconfiguration](https://owasp.org/Top10/A05_2021-Security_Misconfiguration)\n","text":"The application is using an XML parser that has not been safely configured. This might lead to XML External Entity (XXE) vulnerabilities when parsing user-controlled input. An attacker can include document type definitions (DTDs) or XIncludes which can interact with internal or external hosts. XXE can lead to other vulnerabilities, such as Local File Inclusion (LFI), Remote Code Execution (RCE), and Server-side request forgery (SSRF), depending on the application configuration. An attacker can also use DTDs to expand recursively, leading to a Denial-of-Service (DoS) attack, also known as a `Billion Laughs Attack`. The best defense against XXE is to have an XML parser that supports disabling DTDs. Limiting the use of external entities from the start can prevent the parser from being used to process untrusted XML files. Reducing dependencies on external resources is also a good practice for performance reasons. It is difficult to guarantee that even a trusted XML file on your server or during transmission has not been tampered with by a malicious third-party."},"helpUri":"https://semgrep.dev/r/csharp.dotnet-core.xxe.xml-dtd-allowed.xml-dtd-allowed","id":"csharp.dotnet-core.xxe.xml-dtd-allowed.xml-dtd-allowed","name":"csharp.dotnet-core.xxe.xml-dtd-allowed.xml-dtd-allowed","properties":{"precision":"very-high","tags":["CWE-611: Improper Restriction of XML External Entity Reference","MEDIUM CONFIDENCE","OWASP-A04:2017 - XML External Entities (XXE)","OWASP-A05:2021 - Security Misconfiguration","security"]},"shortDescription":{"text":"Semgrep Finding: csharp.dotnet-core.xxe.xml-dtd-allowed.xml-dtd-allowed"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"`$TY` is setup to use the CBC cipher mode. This mode is insecure because it is vulnerable to padding oracle attacks. Use a more secure scheme like `AesGcm` or a mode like `CipherMode.CTS`."},"help":{"markdown":"`$TY` is setup to use the CBC cipher mode. This mode is insecure because it is vulnerable to padding oracle attacks. Use a more secure scheme like `AesGcm` or a mode like `CipherMode.CTS`.\n\nReferences: \n - [Semgrep Rule](https://semgrep.dev/r/csharp.dotnet.crypto.ciphers.cbc-mode.cbc-mode)\n - [https://cwe.mitre.org/data/definitions/327.html](https://cwe.mitre.org/data/definitions/327.html)\n - [https://learn.microsoft.com/en-us/dotnet/fundamentals/code-analysis/quality-rules/ca5358](https://learn.microsoft.com/en-us/dotnet/fundamentals/code-analysis/quality-rules/ca5358)\n - [https://owasp.org/Top10/A02_2021-Cryptographic_Failures](https://owasp.org/Top10/A02_2021-Cryptographic_Failures)\n","text":"`$TY` is setup to use the CBC cipher mode. This mode is insecure because it is vulnerable to padding oracle attacks. Use a more secure scheme like `AesGcm` or a mode like `CipherMode.CTS`."},"helpUri":"https://semgrep.dev/r/csharp.dotnet.crypto.ciphers.cbc-mode.cbc-mode","id":"csharp.dotnet.crypto.ciphers.cbc-mode.cbc-mode","name":"csharp.dotnet.crypto.ciphers.cbc-mode.cbc-mode","properties":{"precision":"very-high","tags":["CWE-327: Use of a Broken or Risky Cryptographic Algorithm","MEDIUM CONFIDENCE","OWASP-A02:2021 - Cryptographic Failures","OWASP-A03:2017 - Sensitive Data Exposure","security"]},"shortDescription":{"text":"Semgrep Finding: csharp.dotnet.crypto.ciphers.cbc-mode.cbc-mode"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"`$TY` is setup to use the CFB cipher mode. This mode is insecure because it does not protect against an IV reuse. Use a more secure scheme like `AesGcm` or a mode like `CipherMode.CTS`."},"help":{"markdown":"`$TY` is setup to use the CFB cipher mode. This mode is insecure because it does not protect against an IV reuse. Use a more secure scheme like `AesGcm` or a mode like `CipherMode.CTS`.\n\nReferences: \n - [Semgrep Rule](https://semgrep.dev/r/csharp.dotnet.crypto.ciphers.cfb-mode.cfb-mode)\n - [https://cwe.mitre.org/data/definitions/327.html](https://cwe.mitre.org/data/definitions/327.html)\n - [https://learn.microsoft.com/en-us/dotnet/fundamentals/code-analysis/quality-rules/ca5358](https://learn.microsoft.com/en-us/dotnet/fundamentals/code-analysis/quality-rules/ca5358)\n - [https://owasp.org/Top10/A02_2021-Cryptographic_Failures](https://owasp.org/Top10/A02_2021-Cryptographic_Failures)\n","text":"`$TY` is setup to use the CFB cipher mode. This mode is insecure because it does not protect against an IV reuse. Use a more secure scheme like `AesGcm` or a mode like `CipherMode.CTS`."},"helpUri":"https://semgrep.dev/r/csharp.dotnet.crypto.ciphers.cfb-mode.cfb-mode","id":"csharp.dotnet.crypto.ciphers.cfb-mode.cfb-mode","name":"csharp.dotnet.crypto.ciphers.cfb-mode.cfb-mode","properties":{"precision":"very-high","tags":["CWE-327: Use of a Broken or Risky Cryptographic Algorithm","MEDIUM CONFIDENCE","OWASP-A02:2021 - Cryptographic Failures","OWASP-A03:2017 - Sensitive Data Exposure","security"]},"shortDescription":{"text":"Semgrep Finding: csharp.dotnet.crypto.ciphers.cfb-mode.cfb-mode"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"`$TY` is setup to use the ECB cipher mode. This mode is insecure because it does not use an initialization vector (IV) and can leak information about the plaintext. Use a more secure scheme like `AesGcm` or a mode like `CipherMode.CTS`."},"help":{"markdown":"`$TY` is setup to use the ECB cipher mode. This mode is insecure because it does not use an initialization vector (IV) and can leak information about the plaintext. Use a more secure scheme like `AesGcm` or a mode like `CipherMode.CTS`.\n\nReferences: \n - [Semgrep Rule](https://semgrep.dev/r/csharp.dotnet.crypto.ciphers.ecb-mode.ecb-mode)\n - [https://cwe.mitre.org/data/definitions/327.html](https://cwe.mitre.org/data/definitions/327.html)\n - [https://learn.microsoft.com/en-us/dotnet/fundamentals/code-analysis/quality-rules/ca5358](https://learn.microsoft.com/en-us/dotnet/fundamentals/code-analysis/quality-rules/ca5358)\n - [https://owasp.org/Top10/A02_2021-Cryptographic_Failures](https://owasp.org/Top10/A02_2021-Cryptographic_Failures)\n","text":"`$TY` is setup to use the ECB cipher mode. This mode is insecure because it does not use an initialization vector (IV) and can leak information about the plaintext. Use a more secure scheme like `AesGcm` or a mode like `CipherMode.CTS`."},"helpUri":"https://semgrep.dev/r/csharp.dotnet.crypto.ciphers.ecb-mode.ecb-mode","id":"csharp.dotnet.crypto.ciphers.ecb-mode.ecb-mode","name":"csharp.dotnet.crypto.ciphers.ecb-mode.ecb-mode","properties":{"precision":"very-high","tags":["CWE-327: Use of a Broken or Risky Cryptographic Algorithm","MEDIUM CONFIDENCE","OWASP-A02:2021 - Cryptographic Failures","OWASP-A03:2017 - Sensitive Data Exposure","security"]},"shortDescription":{"text":"Semgrep Finding: csharp.dotnet.crypto.ciphers.ecb-mode.ecb-mode"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"`$TY` is setup to use the OFB cipher mode. This mode is insecure it is vulnerable to replay attacks, predictable outputs if IVs are reused. Use a more secure scheme like `AesGcm` or a mode like `CipherMode.CTS`."},"help":{"markdown":"`$TY` is setup to use the OFB cipher mode. This mode is insecure it is vulnerable to replay attacks, predictable outputs if IVs are reused. Use a more secure scheme like `AesGcm` or a mode like `CipherMode.CTS`.\n\nReferences: \n - [Semgrep Rule](https://semgrep.dev/r/csharp.dotnet.crypto.ciphers.ofb-mode.ofb-mode)\n - [https://cwe.mitre.org/data/definitions/327.html](https://cwe.mitre.org/data/definitions/327.html)\n - [https://learn.microsoft.com/en-us/dotnet/fundamentals/code-analysis/quality-rules/ca5358](https://learn.microsoft.com/en-us/dotnet/fundamentals/code-analysis/quality-rules/ca5358)\n - [https://owasp.org/Top10/A02_2021-Cryptographic_Failures](https://owasp.org/Top10/A02_2021-Cryptographic_Failures)\n","text":"`$TY` is setup to use the OFB cipher mode. This mode is insecure it is vulnerable to replay attacks, predictable outputs if IVs are reused. Use a more secure scheme like `AesGcm` or a mode like `CipherMode.CTS`."},"helpUri":"https://semgrep.dev/r/csharp.dotnet.crypto.ciphers.ofb-mode.ofb-mode","id":"csharp.dotnet.crypto.ciphers.ofb-mode.ofb-mode","name":"csharp.dotnet.crypto.ciphers.ofb-mode.ofb-mode","properties":{"precision":"very-high","tags":["CWE-327: Use of a Broken or Risky Cryptographic Algorithm","MEDIUM CONFIDENCE","OWASP-A02:2021 - Cryptographic Failures","OWASP-A03:2017 - Sensitive Data Exposure","security"]},"shortDescription":{"text":"Semgrep Finding: csharp.dotnet.crypto.ciphers.ofb-mode.ofb-mode"}},{"defaultConfiguration":{"level":"note"},"fullDescription":{"text":"Insecure cryptographic hash algorithms should not be used, they often have known vulnerabilities like collision. Use a more secure hash algorithm instead such as `HMACSHA256`. If you hash passwords, use a slow hash function like `Argon2` or `scrypt`."},"help":{"markdown":"Insecure cryptographic hash algorithms should not be used, they often have known vulnerabilities like collision. Use a more secure hash algorithm instead such as `HMACSHA256`. If you hash passwords, use a slow hash function like `Argon2` or `scrypt`.\n\nReferences: \n - [Semgrep Rule](https://semgrep.dev/r/csharp.dotnet.crypto.hash.insecure-crypto-hash.insecure-crypto-hash)\n - [https://cwe.mitre.org/data/definitions/328.html](https://cwe.mitre.org/data/definitions/328.html)\n - [https://owasp.org/Top10/A02_2021-Cryptographic_Failures](https://owasp.org/Top10/A02_2021-Cryptographic_Failures)\n","text":"Insecure cryptographic hash algorithms should not be used, they often have known vulnerabilities like collision. Use a more secure hash algorithm instead such as `HMACSHA256`. If you hash passwords, use a slow hash function like `Argon2` or `scrypt`."},"helpUri":"https://semgrep.dev/r/csharp.dotnet.crypto.hash.insecure-crypto-hash.insecure-crypto-hash","id":"csharp.dotnet.crypto.hash.insecure-crypto-hash.insecure-crypto-hash","name":"csharp.dotnet.crypto.hash.insecure-crypto-hash.insecure-crypto-hash","properties":{"precision":"very-high","tags":["CWE-328: Use of Weak Hash","MEDIUM CONFIDENCE","OWASP-A02:2021 - Cryptographic Failures","OWASP-A03:2017 - Sensitive Data Exposure","security"]},"shortDescription":{"text":"Semgrep Finding: csharp.dotnet.crypto.hash.insecure-crypto-hash.insecure-crypto-hash"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"Mass assignment or Autobinding vulnerability in code allows an attacker to execute over-posting attacks, which could create a new parameter in the binding request and manipulate the underlying object in the application."},"help":{"markdown":"Mass assignment or Autobinding vulnerability in code allows an attacker to execute over-posting attacks, which could create a new parameter in the binding request and manipulate the underlying object in the application.\n\nReferences: \n - [Semgrep Rule](https://semgrep.dev/r/csharp.dotnet.security.audit.mass-assignment.mass-assignment)\n - [https://cwe.mitre.org/data/definitions/915.html](https://cwe.mitre.org/data/definitions/915.html)\n - [https://github.com/OWASP/API-Security/blob/master/2019/en/src/0xa6-mass-assignment.md](https://github.com/OWASP/API-Security/blob/master/2019/en/src/0xa6-mass-assignment.md)\n","text":"Mass assignment or Autobinding vulnerability in code allows an attacker to execute over-posting attacks, which could create a new parameter in the binding request and manipulate the underlying object in the application."},"helpUri":"https://semgrep.dev/r/csharp.dotnet.security.audit.mass-assignment.mass-assignment","id":"csharp.dotnet.security.audit.mass-assignment.mass-assignment","name":"csharp.dotnet.security.audit.mass-assignment.mass-assignment","properties":{"precision":"very-high","tags":["CWE-915: Improperly Controlled Modification of Dynamically-Determined Object Attributes","MEDIUM CONFIDENCE","OWASP-A08:2021 - Software and Data Integrity Failures","security"]},"shortDescription":{"text":"Semgrep Finding: csharp.dotnet.security.audit.mass-assignment.mass-assignment"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"$METHOD is a state-changing MVC method that does not validate the antiforgery token or do strict content-type checking. State-changing controller methods should either enforce antiforgery tokens or do strict content-type checking to prevent simple HTTP request types from bypassing CORS preflight controls."},"help":{"markdown":"$METHOD is a state-changing MVC method that does not validate the antiforgery token or do strict content-type checking. State-changing controller methods should either enforce antiforgery tokens or do strict content-type checking to prevent simple HTTP request types from bypassing CORS preflight controls.\n\nReferences: \n - [Semgrep Rule](https://semgrep.dev/r/csharp.dotnet.security.mvc-missing-antiforgery.mvc-missing-antiforgery)\n - [https://cheatsheetseries.owasp.org/cheatsheets/DotNet_Security_Cheat_Sheet.html#cross-site-request-forgery](https://cheatsheetseries.owasp.org/cheatsheets/DotNet_Security_Cheat_Sheet.html#cross-site-request-forgery)\n - [https://developer.mozilla.org/en-US/docs/Web/HTTP/CORS#simple_requests](https://developer.mozilla.org/en-US/docs/Web/HTTP/CORS#simple_requests)\n","text":"$METHOD is a state-changing MVC method that does not validate the antiforgery token or do strict content-type checking. State-changing controller methods should either enforce antiforgery tokens or do strict content-type checking to prevent simple HTTP request types from bypassing CORS preflight controls."},"helpUri":"https://semgrep.dev/r/csharp.dotnet.security.mvc-missing-antiforgery.mvc-missing-antiforgery","id":"csharp.dotnet.security.mvc-missing-antiforgery.mvc-missing-antiforgery","name":"csharp.dotnet.security.mvc-missing-antiforgery.mvc-missing-antiforgery","properties":{"precision":"very-high","tags":["CWE-352: Cross-Site Request Forgery (CSRF)","LOW CONFIDENCE","OWASP-A01:2021 - Broken Access Control","security"]},"shortDescription":{"text":"Semgrep Finding: csharp.dotnet.security.mvc-missing-antiforgery.mvc-missing-antiforgery"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"ASP.NET applications built with `debug` set to true in production may leak debug information to attackers. Debug mode also affects performance and reliability. Set `debug` to `false` or remove it from `References: \n - [Semgrep Rule](https://semgrep.dev/r/csharp.dotnet.security.net-webconfig-debug.net-webconfig-debug)\n - [https://web.archive.org/web/20190919105353/https://blogs.msdn.microsoft.com/prashant_upadhyay/2011/07/14/why-debugfalse-in-asp-net-applications-in-production-environment/](https://web.archive.org/web/20190919105353/https://blogs.msdn.microsoft.com/prashant_upadhyay/2011/07/14/why-debugfalse-in-asp-net-applications-in-production-environment/)\n - [https://msdn.microsoft.com/en-us/library/e8z01xdh.aspx](https://msdn.microsoft.com/en-us/library/e8z01xdh.aspx)\n","text":"ASP.NET applications built with `debug` set to true in production may leak debug information to attackers. Debug mode also affects performance and reliability. Set `debug` to `false` or remove it from `References: \n - [Semgrep Rule](https://semgrep.dev/r/csharp.dotnet.security.net-webconfig-trace-enabled.net-webconfig-trace-enabled)\n - [https://cheatsheetseries.owasp.org/cheatsheets/DotNet_Security_Cheat_Sheet.html#asp-net-web-forms-guidance](https://cheatsheetseries.owasp.org/cheatsheets/DotNet_Security_Cheat_Sheet.html#asp-net-web-forms-guidance)\n - [https://msdn.microsoft.com/en-us/library/e8z01xdh.aspx](https://msdn.microsoft.com/en-us/library/e8z01xdh.aspx)\n","text":"OWASP guidance recommends disabling tracing for production applications to prevent accidental leakage of sensitive application information."},"helpUri":"https://semgrep.dev/r/csharp.dotnet.security.net-webconfig-trace-enabled.net-webconfig-trace-enabled","id":"csharp.dotnet.security.net-webconfig-trace-enabled.net-webconfig-trace-enabled","name":"csharp.dotnet.security.net-webconfig-trace-enabled.net-webconfig-trace-enabled","properties":{"precision":"very-high","tags":["CWE-1323: Improper Management of Sensitive Trace Data","LOW CONFIDENCE","OWASP-A05:2021 - Security Misconfiguration","security"]},"shortDescription":{"text":"Semgrep Finding: csharp.dotnet.security.net-webconfig-trace-enabled.net-webconfig-trace-enabled"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"User-controllable string passed to Razor.Parse. This leads directly to code execution in the context of the process."},"help":{"markdown":"User-controllable string passed to Razor.Parse. This leads directly to code execution in the context of the process.\n\nReferences: \n - [Semgrep Rule](https://semgrep.dev/r/csharp.dotnet.security.razor-template-injection.razor-template-injection)\n - [https://clement.notin.org/blog/2020/04/15/Server-Side-Template-Injection-(SSTI)-in-ASP.NET-Razor/](https://clement.notin.org/blog/2020/04/15/Server-Side-Template-Injection-(SSTI)-in-ASP.NET-Razor/)\n","text":"User-controllable string passed to Razor.Parse. This leads directly to code execution in the context of the process."},"helpUri":"https://semgrep.dev/r/csharp.dotnet.security.razor-template-injection.razor-template-injection","id":"csharp.dotnet.security.razor-template-injection.razor-template-injection","name":"csharp.dotnet.security.razor-template-injection.razor-template-injection","properties":{"precision":"very-high","tags":["CWE-94: Improper Control of Generation of Code ('Code Injection')","MEDIUM CONFIDENCE","OWASP-A03:2021 - Injection","security"]},"shortDescription":{"text":"Semgrep Finding: csharp.dotnet.security.razor-template-injection.razor-template-injection"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"Usage of the insecure ECB mode detected. You should use an authenticated encryption mode instead, which is implemented by the classes AesGcm or ChaCha20Poly1305."},"help":{"markdown":"Usage of the insecure ECB mode detected. You should use an authenticated encryption mode instead, which is implemented by the classes AesGcm or ChaCha20Poly1305.\n\nReferences: \n - [Semgrep Rule](https://semgrep.dev/r/csharp.dotnet.security.use_ecb_mode.use_ecb_mode)\n - [https://learn.microsoft.com/en-gb/dotnet/api/system.security.cryptography.chacha20poly1305?view=net-6.0](https://learn.microsoft.com/en-gb/dotnet/api/system.security.cryptography.chacha20poly1305?view=net-6.0)\n - [https://learn.microsoft.com/en-gb/dotnet/api/system.security.cryptography.aesgcm?view=net-6.0](https://learn.microsoft.com/en-gb/dotnet/api/system.security.cryptography.aesgcm?view=net-6.0)\n - [https://learn.microsoft.com/en-gb/dotnet/api/system.security.cryptography.ciphermode?view=net-6.0](https://learn.microsoft.com/en-gb/dotnet/api/system.security.cryptography.ciphermode?view=net-6.0)\n - [https://cheatsheetseries.owasp.org/cheatsheets/Cryptographic_Storage_Cheat_Sheet.html#cipher-modes](https://cheatsheetseries.owasp.org/cheatsheets/Cryptographic_Storage_Cheat_Sheet.html#cipher-modes)\n","text":"Usage of the insecure ECB mode detected. You should use an authenticated encryption mode instead, which is implemented by the classes AesGcm or ChaCha20Poly1305."},"helpUri":"https://semgrep.dev/r/csharp.dotnet.security.use_ecb_mode.use_ecb_mode","id":"csharp.dotnet.security.use_ecb_mode.use_ecb_mode","name":"csharp.dotnet.security.use_ecb_mode.use_ecb_mode","properties":{"precision":"very-high","tags":["CWE-327: Use of a Broken or Risky Cryptographic Algorithm","HIGH CONFIDENCE","OWASP-A02:2021 - Cryptographic Failures","security"]},"shortDescription":{"text":"Semgrep Finding: csharp.dotnet.security.use_ecb_mode.use_ecb_mode"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"You are using an insecure random number generator (RNG) to create a cryptographic key. System.Random must never be used for cryptographic purposes. Use System.Security.Cryptography.RandomNumberGenerator instead."},"help":{"markdown":"You are using an insecure random number generator (RNG) to create a cryptographic key. System.Random must never be used for cryptographic purposes. Use System.Security.Cryptography.RandomNumberGenerator instead.\n\nReferences: \n - [Semgrep Rule](https://semgrep.dev/r/csharp.dotnet.security.use_weak_rng_for_keygeneration.use_weak_rng_for_keygeneration)\n - [https://learn.microsoft.com/en-us/dotnet/api/system.random?view=net-6.0#remarks](https://learn.microsoft.com/en-us/dotnet/api/system.random?view=net-6.0#remarks)\n - [https://learn.microsoft.com/en-us/dotnet/api/system.security.cryptography.randomnumbergenerator?view=net-6.0](https://learn.microsoft.com/en-us/dotnet/api/system.security.cryptography.randomnumbergenerator?view=net-6.0)\n - [https://learn.microsoft.com/en-us/dotnet/api/system.security.cryptography.aesgcm?view=net-6.0#constructors](https://learn.microsoft.com/en-us/dotnet/api/system.security.cryptography.aesgcm?view=net-6.0#constructors)\n - [https://learn.microsoft.com/en-us/dotnet/api/system.security.cryptography.symmetricalgorithm.key?view=net-6.0#system-security-cryptography-symmetricalgorithm-key](https://learn.microsoft.com/en-us/dotnet/api/system.security.cryptography.symmetricalgorithm.key?view=net-6.0#system-security-cryptography-symmetricalgorithm-key)\n","text":"You are using an insecure random number generator (RNG) to create a cryptographic key. System.Random must never be used for cryptographic purposes. Use System.Security.Cryptography.RandomNumberGenerator instead."},"helpUri":"https://semgrep.dev/r/csharp.dotnet.security.use_weak_rng_for_keygeneration.use_weak_rng_for_keygeneration","id":"csharp.dotnet.security.use_weak_rng_for_keygeneration.use_weak_rng_for_keygeneration","name":"csharp.dotnet.security.use_weak_rng_for_keygeneration.use_weak_rng_for_keygeneration","properties":{"precision":"very-high","tags":["CWE-338: Use of Cryptographically Weak Pseudo-Random Number Generator (PRNG)","HIGH CONFIDENCE","OWASP-A02:2021 - Cryptographic Failures","security"]},"shortDescription":{"text":"Semgrep Finding: csharp.dotnet.security.use_weak_rng_for_keygeneration.use_weak_rng_for_keygeneration"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"Cookie Secure flag is explicitly disabled. You should enforce this value to avoid accidentally presenting sensitive cookie values over plaintext HTTP connections."},"help":{"markdown":"Cookie Secure flag is explicitly disabled. You should enforce this value to avoid accidentally presenting sensitive cookie values over plaintext HTTP connections.\n\nReferences: \n - [Semgrep Rule](https://semgrep.dev/r/csharp.dotnet.security.web-config-insecure-cookie-settings.web-config-insecure-cookie-settings)\n - [https://docs.microsoft.com/en-us/aspnet/web-api/overview/advanced/http-cookies](https://docs.microsoft.com/en-us/aspnet/web-api/overview/advanced/http-cookies)\n - [https://docs.microsoft.com/en-us/dotnet/api/system.web.security.formsauthentication.requiressl?redirectedfrom=MSDN&view=netframework-4.8#System_Web_Security_FormsAuthentication_RequireSSL](https://docs.microsoft.com/en-us/dotnet/api/system.web.security.formsauthentication.requiressl?redirectedfrom=MSDN&view=netframework-4.8#System_Web_Security_FormsAuthentication_RequireSSL)\n - [https://docs.microsoft.com/en-us/dotnet/api/system.web.security.roles.cookierequiressl?redirectedfrom=MSDN&view=netframework-4.8#System_Web_Security_Roles_CookieRequireSSL](https://docs.microsoft.com/en-us/dotnet/api/system.web.security.roles.cookierequiressl?redirectedfrom=MSDN&view=netframework-4.8#System_Web_Security_Roles_CookieRequireSSL)\n","text":"Cookie Secure flag is explicitly disabled. You should enforce this value to avoid accidentally presenting sensitive cookie values over plaintext HTTP connections."},"helpUri":"https://semgrep.dev/r/csharp.dotnet.security.web-config-insecure-cookie-settings.web-config-insecure-cookie-settings","id":"csharp.dotnet.security.web-config-insecure-cookie-settings.web-config-insecure-cookie-settings","name":"csharp.dotnet.security.web-config-insecure-cookie-settings.web-config-insecure-cookie-settings","properties":{"precision":"very-high","tags":["CWE-614: Sensitive Cookie in HTTPS Session Without 'Secure' Attribute","LOW CONFIDENCE","OWASP-A05:2021 - Security Misconfiguration","security"]},"shortDescription":{"text":"Semgrep Finding: csharp.dotnet.security.web-config-insecure-cookie-settings.web-config-insecure-cookie-settings"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"A secret is hard-coded in the application. Secrets stored in source code, such as credentials, identifiers, and other types of sensitive data, can be leaked and used by internal or external malicious actors. Use environment variables to securely provide credentials and other secrets or retrieve them from a secure vault or Hardware Security Module (HSM)."},"help":{"markdown":"A secret is hard-coded in the application. Secrets stored in source code, such as credentials, identifiers, and other types of sensitive data, can be leaked and used by internal or external malicious actors. Use environment variables to securely provide credentials and other secrets or retrieve them from a secure vault or Hardware Security Module (HSM).\n\nReferences: \n - [Semgrep Rule](https://semgrep.dev/r/csharp.jwt-dotnet.jwt-dotnet-hardcoded-secret.jwt-dotnet-hardcoded-secret)\n - [https://cheatsheetseries.owasp.org/cheatsheets/Secrets_Management_Cheat_Sheet.html](https://cheatsheetseries.owasp.org/cheatsheets/Secrets_Management_Cheat_Sheet.html)\n","text":"A secret is hard-coded in the application. Secrets stored in source code, such as credentials, identifiers, and other types of sensitive data, can be leaked and used by internal or external malicious actors. Use environment variables to securely provide credentials and other secrets or retrieve them from a secure vault or Hardware Security Module (HSM)."},"helpUri":"https://semgrep.dev/r/csharp.jwt-dotnet.jwt-dotnet-hardcoded-secret.jwt-dotnet-hardcoded-secret","id":"csharp.jwt-dotnet.jwt-dotnet-hardcoded-secret.jwt-dotnet-hardcoded-secret","name":"csharp.jwt-dotnet.jwt-dotnet-hardcoded-secret.jwt-dotnet-hardcoded-secret","properties":{"precision":"very-high","tags":["CWE-798: Use of Hard-coded Credentials","HIGH CONFIDENCE","OWASP-A07:2021 - Identification and Authentication Failures","security"]},"shortDescription":{"text":"Semgrep Finding: csharp.jwt-dotnet.jwt-dotnet-hardcoded-secret.jwt-dotnet-hardcoded-secret"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"Detected a cookie where the `HttpOnly` flag is either missing or disabled. The `HttpOnly` cookie flag instructs the browser to forbid client-side JavaScript to read the cookie. If JavaScript interaction is required, you can ignore this finding. However, set the `HttpOnly` flag to `true` in all other cases. If this wasn't intentional, it's recommended to set the HttpOnly flag to true so the cookie will not be accessible through client-side scripts or to use the Cookie Policy Middleware to globally set the HttpOnly flag. You can then use the CookieOptions class when instantiating the cookie, which inherits these settings and will require future developers to have to explicitly override them on a case-by-case basis if needed. This approach ensures cookies are secure by default."},"help":{"markdown":"Detected a cookie where the `HttpOnly` flag is either missing or disabled. The `HttpOnly` cookie flag instructs the browser to forbid client-side JavaScript to read the cookie. If JavaScript interaction is required, you can ignore this finding. However, set the `HttpOnly` flag to `true` in all other cases. If this wasn't intentional, it's recommended to set the HttpOnly flag to true so the cookie will not be accessible through client-side scripts or to use the Cookie Policy Middleware to globally set the HttpOnly flag. You can then use the CookieOptions class when instantiating the cookie, which inherits these settings and will require future developers to have to explicitly override them on a case-by-case basis if needed. This approach ensures cookies are secure by default.\n\nReferences: \n - [Semgrep Rule](https://semgrep.dev/r/csharp.lang.audit.cookies.httponly-false.httponly-false)\n - [https://learn.microsoft.com/en-us/aspnet/core/security/authentication/cookie?view=aspnetcore-8.0#cookie-policy-middleware](https://learn.microsoft.com/en-us/aspnet/core/security/authentication/cookie?view=aspnetcore-8.0#cookie-policy-middleware)\n - [https://learn.microsoft.com/en-us/dotnet/api/microsoft.aspnetcore.http.cookieoptions](https://learn.microsoft.com/en-us/dotnet/api/microsoft.aspnetcore.http.cookieoptions)\n - [https://owasp.org/Top10/A05_2021-Security_Misconfiguration](https://owasp.org/Top10/A05_2021-Security_Misconfiguration)\n","text":"Detected a cookie where the `HttpOnly` flag is either missing or disabled. The `HttpOnly` cookie flag instructs the browser to forbid client-side JavaScript to read the cookie. If JavaScript interaction is required, you can ignore this finding. However, set the `HttpOnly` flag to `true` in all other cases. If this wasn't intentional, it's recommended to set the HttpOnly flag to true so the cookie will not be accessible through client-side scripts or to use the Cookie Policy Middleware to globally set the HttpOnly flag. You can then use the CookieOptions class when instantiating the cookie, which inherits these settings and will require future developers to have to explicitly override them on a case-by-case basis if needed. This approach ensures cookies are secure by default."},"helpUri":"https://semgrep.dev/r/csharp.lang.audit.cookies.httponly-false.httponly-false","id":"csharp.lang.audit.cookies.httponly-false.httponly-false","name":"csharp.lang.audit.cookies.httponly-false.httponly-false","properties":{"precision":"very-high","tags":["CWE-1004: Sensitive Cookie Without 'HttpOnly' Flag","HIGH CONFIDENCE","OWASP-A05:2021 - Security Misconfiguration","security"]},"shortDescription":{"text":"Semgrep Finding: csharp.lang.audit.cookies.httponly-false.httponly-false"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"Detected a cookie where the `HttpOnly` flag is either missing or disabled. The `HttpOnly` cookie flag instructs the browser to forbid client-side JavaScript to read the cookie. If JavaScript interaction is required, you can ignore this finding. However, set the `HttpOnly` flag to `true` in all other cases. If this wasn't intentional, it's recommended to set the HttpOnly flag to true so the cookie will not be accessible through client-side scripts or to use the Cookie Policy Middleware to globally set the HttpOnly flag. You can then use the CookieOptions class when instantiating the cookie, which inherits these settings and will require future developers to have to explicitly override them on a case-by-case basis if needed. This approach ensures cookies are secure by default."},"help":{"markdown":"Detected a cookie where the `HttpOnly` flag is either missing or disabled. The `HttpOnly` cookie flag instructs the browser to forbid client-side JavaScript to read the cookie. If JavaScript interaction is required, you can ignore this finding. However, set the `HttpOnly` flag to `true` in all other cases. If this wasn't intentional, it's recommended to set the HttpOnly flag to true so the cookie will not be accessible through client-side scripts or to use the Cookie Policy Middleware to globally set the HttpOnly flag. You can then use the CookieOptions class when instantiating the cookie, which inherits these settings and will require future developers to have to explicitly override them on a case-by-case basis if needed. This approach ensures cookies are secure by default.\n\nReferences: \n - [Semgrep Rule](https://semgrep.dev/r/csharp.lang.audit.cookies.missing-httponly.missing-httponly)\n - [https://learn.microsoft.com/en-us/aspnet/core/security/authentication/cookie?view=aspnetcore-8.0#cookie-policy-middleware](https://learn.microsoft.com/en-us/aspnet/core/security/authentication/cookie?view=aspnetcore-8.0#cookie-policy-middleware)\n - [https://learn.microsoft.com/en-us/dotnet/api/microsoft.aspnetcore.http.cookieoptions](https://learn.microsoft.com/en-us/dotnet/api/microsoft.aspnetcore.http.cookieoptions)\n - [https://owasp.org/Top10/A05_2021-Security_Misconfiguration](https://owasp.org/Top10/A05_2021-Security_Misconfiguration)\n","text":"Detected a cookie where the `HttpOnly` flag is either missing or disabled. The `HttpOnly` cookie flag instructs the browser to forbid client-side JavaScript to read the cookie. If JavaScript interaction is required, you can ignore this finding. However, set the `HttpOnly` flag to `true` in all other cases. If this wasn't intentional, it's recommended to set the HttpOnly flag to true so the cookie will not be accessible through client-side scripts or to use the Cookie Policy Middleware to globally set the HttpOnly flag. You can then use the CookieOptions class when instantiating the cookie, which inherits these settings and will require future developers to have to explicitly override them on a case-by-case basis if needed. This approach ensures cookies are secure by default."},"helpUri":"https://semgrep.dev/r/csharp.lang.audit.cookies.missing-httponly.missing-httponly","id":"csharp.lang.audit.cookies.missing-httponly.missing-httponly","name":"csharp.lang.audit.cookies.missing-httponly.missing-httponly","properties":{"precision":"very-high","tags":["CWE-1004: Sensitive Cookie Without 'HttpOnly' Flag","HIGH CONFIDENCE","OWASP-A05:2021 - Security Misconfiguration","security"]},"shortDescription":{"text":"Semgrep Finding: csharp.lang.audit.cookies.missing-httponly.missing-httponly"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"Detected a cookie where the `Secure` flag is either missing or disabled. The `Secure` cookie flag instructs the browser to forbid sending the cookie over an insecure HTTP request. Set the `Secure` flag to `true` so the cookie will only be sent over HTTPS. If this wasn't intentional, it's recommended to set the Secure flag to true so the cookie will only be sent over HTTPS or to use the Cookie Policy Middleware to globally set the Secure flag. You can then use the CookieOptions class when instantiating the cookie, which inherits these settings and will require future developers to have to explicitly override them on a case-by-case basis if needed. This approach ensures cookies are secure by default."},"help":{"markdown":"Detected a cookie where the `Secure` flag is either missing or disabled. The `Secure` cookie flag instructs the browser to forbid sending the cookie over an insecure HTTP request. Set the `Secure` flag to `true` so the cookie will only be sent over HTTPS. If this wasn't intentional, it's recommended to set the Secure flag to true so the cookie will only be sent over HTTPS or to use the Cookie Policy Middleware to globally set the Secure flag. You can then use the CookieOptions class when instantiating the cookie, which inherits these settings and will require future developers to have to explicitly override them on a case-by-case basis if needed. This approach ensures cookies are secure by default.\n\nReferences: \n - [Semgrep Rule](https://semgrep.dev/r/csharp.lang.audit.cookies.missing-secure.missing-secure)\n - [https://learn.microsoft.com/en-us/aspnet/core/security/authentication/cookie?view=aspnetcore-8.0#cookie-policy-middleware](https://learn.microsoft.com/en-us/aspnet/core/security/authentication/cookie?view=aspnetcore-8.0#cookie-policy-middleware)\n - [https://learn.microsoft.com/en-us/dotnet/api/microsoft.aspnetcore.http.cookieoptions](https://learn.microsoft.com/en-us/dotnet/api/microsoft.aspnetcore.http.cookieoptions)\n - [https://owasp.org/Top10/A05_2021-Security_Misconfiguration](https://owasp.org/Top10/A05_2021-Security_Misconfiguration)\n","text":"Detected a cookie where the `Secure` flag is either missing or disabled. The `Secure` cookie flag instructs the browser to forbid sending the cookie over an insecure HTTP request. Set the `Secure` flag to `true` so the cookie will only be sent over HTTPS. If this wasn't intentional, it's recommended to set the Secure flag to true so the cookie will only be sent over HTTPS or to use the Cookie Policy Middleware to globally set the Secure flag. You can then use the CookieOptions class when instantiating the cookie, which inherits these settings and will require future developers to have to explicitly override them on a case-by-case basis if needed. This approach ensures cookies are secure by default."},"helpUri":"https://semgrep.dev/r/csharp.lang.audit.cookies.missing-secure.missing-secure","id":"csharp.lang.audit.cookies.missing-secure.missing-secure","name":"csharp.lang.audit.cookies.missing-secure.missing-secure","properties":{"precision":"very-high","tags":["CWE-614: Sensitive Cookie in HTTPS Session Without 'Secure' Attribute","HIGH CONFIDENCE","OWASP-A05:2021 - Security Misconfiguration","security"]},"shortDescription":{"text":"Semgrep Finding: csharp.lang.audit.cookies.missing-secure.missing-secure"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"Detected a cookie where the `Secure` flag is either missing or disabled. The `Secure` cookie flag instructs the browser to forbid sending the cookie over an insecure HTTP request. Set the `Secure` flag to `true` so the cookie will only be sent over HTTPS. If this wasn't intentional, it's recommended to set the Secure flag to true so the cookie will only be sent over HTTPS or to use the Cookie Policy Middleware to globally set the Secure flag. You can then use the CookieOptions class when instantiating the cookie, which inherits these settings and will require future developers to have to explicitly override them on a case-by-case basis if needed. This approach ensures cookies are secure by default."},"help":{"markdown":"Detected a cookie where the `Secure` flag is either missing or disabled. The `Secure` cookie flag instructs the browser to forbid sending the cookie over an insecure HTTP request. Set the `Secure` flag to `true` so the cookie will only be sent over HTTPS. If this wasn't intentional, it's recommended to set the Secure flag to true so the cookie will only be sent over HTTPS or to use the Cookie Policy Middleware to globally set the Secure flag. You can then use the CookieOptions class when instantiating the cookie, which inherits these settings and will require future developers to have to explicitly override them on a case-by-case basis if needed. This approach ensures cookies are secure by default.\n\nReferences: \n - [Semgrep Rule](https://semgrep.dev/r/csharp.lang.audit.cookies.secure-false.secure-false)\n - [https://learn.microsoft.com/en-us/aspnet/core/security/authentication/cookie?view=aspnetcore-8.0#cookie-policy-middleware](https://learn.microsoft.com/en-us/aspnet/core/security/authentication/cookie?view=aspnetcore-8.0#cookie-policy-middleware)\n - [https://learn.microsoft.com/en-us/dotnet/api/microsoft.aspnetcore.http.cookieoptions](https://learn.microsoft.com/en-us/dotnet/api/microsoft.aspnetcore.http.cookieoptions)\n - [https://owasp.org/Top10/A05_2021-Security_Misconfiguration](https://owasp.org/Top10/A05_2021-Security_Misconfiguration)\n","text":"Detected a cookie where the `Secure` flag is either missing or disabled. The `Secure` cookie flag instructs the browser to forbid sending the cookie over an insecure HTTP request. Set the `Secure` flag to `true` so the cookie will only be sent over HTTPS. If this wasn't intentional, it's recommended to set the Secure flag to true so the cookie will only be sent over HTTPS or to use the Cookie Policy Middleware to globally set the Secure flag. You can then use the CookieOptions class when instantiating the cookie, which inherits these settings and will require future developers to have to explicitly override them on a case-by-case basis if needed. This approach ensures cookies are secure by default."},"helpUri":"https://semgrep.dev/r/csharp.lang.audit.cookies.secure-false.secure-false","id":"csharp.lang.audit.cookies.secure-false.secure-false","name":"csharp.lang.audit.cookies.secure-false.secure-false","properties":{"precision":"very-high","tags":["CWE-614: Sensitive Cookie in HTTPS Session Without 'Secure' Attribute","HIGH CONFIDENCE","OWASP-A05:2021 - Security Misconfiguration","security"]},"shortDescription":{"text":"Semgrep Finding: csharp.lang.audit.cookies.secure-false.secure-false"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"The TokenValidationParameters.$LIFETIME is set to $FALSE, this means the JWT tokens lifetime is not validated. This can lead to an JWT token being used after it has expired, which has security implications. It is recommended to validate the JWT lifetime to ensure only valid tokens are used."},"help":{"markdown":"The TokenValidationParameters.$LIFETIME is set to $FALSE, this means the JWT tokens lifetime is not validated. This can lead to an JWT token being used after it has expired, which has security implications. It is recommended to validate the JWT lifetime to ensure only valid tokens are used.\n\nReferences: \n - [Semgrep Rule](https://semgrep.dev/r/csharp.lang.security.ad.jwt-tokenvalidationparameters-no-expiry-validation.jwt-tokenvalidationparameters-no-expiry-validation)\n - [https://owasp.org/Top10/A07_2021-Identification_and_Authentication_Failures/](https://owasp.org/Top10/A07_2021-Identification_and_Authentication_Failures/)\n - [https://cwe.mitre.org/data/definitions/613.html](https://cwe.mitre.org/data/definitions/613.html)\n - [https://docs.microsoft.com/en-us/dotnet/api/microsoft.identitymodel.tokens.tokenvalidationparameters?view=azure-dotnet](https://docs.microsoft.com/en-us/dotnet/api/microsoft.identitymodel.tokens.tokenvalidationparameters?view=azure-dotnet)\n","text":"The TokenValidationParameters.$LIFETIME is set to $FALSE, this means the JWT tokens lifetime is not validated. This can lead to an JWT token being used after it has expired, which has security implications. It is recommended to validate the JWT lifetime to ensure only valid tokens are used."},"helpUri":"https://semgrep.dev/r/csharp.lang.security.ad.jwt-tokenvalidationparameters-no-expiry-validation.jwt-tokenvalidationparameters-no-expiry-validation","id":"csharp.lang.security.ad.jwt-tokenvalidationparameters-no-expiry-validation.jwt-tokenvalidationparameters-no-expiry-validation","name":"csharp.lang.security.ad.jwt-tokenvalidationparameters-no-expiry-validation.jwt-tokenvalidationparameters-no-expiry-validation","properties":{"precision":"very-high","tags":["CWE-613: Insufficient Session Expiration","HIGH CONFIDENCE","OWASP-A02:2017 - Broken Authentication","OWASP-A07:2021 - Identification and Authentication Failures","security"]},"shortDescription":{"text":"Semgrep Finding: csharp.lang.security.ad.jwt-tokenvalidationparameters-no-expiry-validation.jwt-tokenvalidationparameters-no-expiry-validation"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"Validating certificates based on subject name is bad practice. Use the X509Certificate2.Verify() method instead."},"help":{"markdown":"Validating certificates based on subject name is bad practice. Use the X509Certificate2.Verify() method instead.\n\nReferences: \n - [Semgrep Rule](https://semgrep.dev/r/csharp.lang.security.cryptography.x509-subject-name-validation.X509-subject-name-validation)\n - [https://docs.microsoft.com/en-us/dotnet/api/system.identitymodel.tokens.issuernameregistry?view=netframework-4.8](https://docs.microsoft.com/en-us/dotnet/api/system.identitymodel.tokens.issuernameregistry?view=netframework-4.8)\n","text":"Validating certificates based on subject name is bad practice. Use the X509Certificate2.Verify() method instead."},"helpUri":"https://semgrep.dev/r/csharp.lang.security.cryptography.x509-subject-name-validation.X509-subject-name-validation","id":"csharp.lang.security.cryptography.x509-subject-name-validation.X509-subject-name-validation","name":"csharp.lang.security.cryptography.x509-subject-name-validation.X509-subject-name-validation","properties":{"precision":"very-high","tags":["CWE-295: Improper Certificate Validation","MEDIUM CONFIDENCE","OWASP-A03:2017 - Sensitive Data Exposure","OWASP-A07:2021 - Identification and Authentication Failures","security"]},"shortDescription":{"text":"Semgrep Finding: csharp.lang.security.cryptography.x509-subject-name-validation.X509-subject-name-validation"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"String argument $A is used to read or write data from a file via Path.Combine without direct sanitization via Path.GetFileName. If the path is user-supplied data this can lead to path traversal."},"help":{"markdown":"String argument $A is used to read or write data from a file via Path.Combine without direct sanitization via Path.GetFileName. If the path is user-supplied data this can lead to path traversal.\n\nReferences: \n - [Semgrep Rule](https://semgrep.dev/r/csharp.lang.security.filesystem.unsafe-path-combine.unsafe-path-combine)\n - [https://www.praetorian.com/blog/pathcombine-security-issues-in-aspnet-applications/](https://www.praetorian.com/blog/pathcombine-security-issues-in-aspnet-applications/)\n - [https://docs.microsoft.com/en-us/dotnet/api/system.io.path.combine?view=net-6.0#remarks](https://docs.microsoft.com/en-us/dotnet/api/system.io.path.combine?view=net-6.0#remarks)\n","text":"String argument $A is used to read or write data from a file via Path.Combine without direct sanitization via Path.GetFileName. If the path is user-supplied data this can lead to path traversal."},"helpUri":"https://semgrep.dev/r/csharp.lang.security.filesystem.unsafe-path-combine.unsafe-path-combine","id":"csharp.lang.security.filesystem.unsafe-path-combine.unsafe-path-combine","name":"csharp.lang.security.filesystem.unsafe-path-combine.unsafe-path-combine","properties":{"precision":"very-high","tags":["CWE-22: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')","MEDIUM CONFIDENCE","OWASP-A01:2021 - Broken Access Control","OWASP-A05:2017 - Broken Access Control","security"]},"shortDescription":{"text":"Semgrep Finding: csharp.lang.security.filesystem.unsafe-path-combine.unsafe-path-combine"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"The top level wildcard bindings $PREFIX leaves your application open to security vulnerabilities and give attackers more control over where traffic is routed. If you must use wildcards, consider using subdomain wildcard binding. For example, you can use \"*.asdf.gov\" if you own all of \"asdf.gov\"."},"help":{"markdown":"The top level wildcard bindings $PREFIX leaves your application open to security vulnerabilities and give attackers more control over where traffic is routed. If you must use wildcards, consider using subdomain wildcard binding. For example, you can use \"*.asdf.gov\" if you own all of \"asdf.gov\".\n\nReferences: \n - [Semgrep Rule](https://semgrep.dev/r/csharp.lang.security.http.http-listener-wildcard-bindings.http-listener-wildcard-bindings)\n - [https://docs.microsoft.com/en-us/dotnet/api/system.net.httplistener?view=net-6.0](https://docs.microsoft.com/en-us/dotnet/api/system.net.httplistener?view=net-6.0)\n","text":"The top level wildcard bindings $PREFIX leaves your application open to security vulnerabilities and give attackers more control over where traffic is routed. If you must use wildcards, consider using subdomain wildcard binding. For example, you can use \"*.asdf.gov\" if you own all of \"asdf.gov\"."},"helpUri":"https://semgrep.dev/r/csharp.lang.security.http.http-listener-wildcard-bindings.http-listener-wildcard-bindings","id":"csharp.lang.security.http.http-listener-wildcard-bindings.http-listener-wildcard-bindings","name":"csharp.lang.security.http.http-listener-wildcard-bindings.http-listener-wildcard-bindings","properties":{"precision":"very-high","tags":["CWE-706: Use of Incorrectly-Resolved Name or Reference","MEDIUM CONFIDENCE","OWASP-A01:2021 - Broken Access Control","security"]},"shortDescription":{"text":"Semgrep Finding: csharp.lang.security.http.http-listener-wildcard-bindings.http-listener-wildcard-bindings"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"The software constructs all or part of an OS command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended OS command when it is sent to a downstream component."},"help":{"markdown":"The software constructs all or part of an OS command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended OS command when it is sent to a downstream component.\n\nReferences: \n - [Semgrep Rule](https://semgrep.dev/r/csharp.lang.security.injections.os-command.os-command-injection)\n - [https://owasp.org/www-community/attacks/Command_Injection](https://owasp.org/www-community/attacks/Command_Injection)\n","text":"The software constructs all or part of an OS command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended OS command when it is sent to a downstream component."},"helpUri":"https://semgrep.dev/r/csharp.lang.security.injections.os-command.os-command-injection","id":"csharp.lang.security.injections.os-command.os-command-injection","name":"csharp.lang.security.injections.os-command.os-command-injection","properties":{"precision":"very-high","tags":["CWE-78: Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')","LOW CONFIDENCE","OWASP-A01:2017 - Injection","OWASP-A03:2021 - Injection","security"]},"shortDescription":{"text":"Semgrep Finding: csharp.lang.security.injections.os-command.os-command-injection"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"The BinaryFormatter type is dangerous and is not recommended for data processing. Applications should stop using BinaryFormatter as soon as possible, even if they believe the data they're processing to be trustworthy. BinaryFormatter is insecure and can't be made secure"},"help":{"markdown":"The BinaryFormatter type is dangerous and is not recommended for data processing. Applications should stop using BinaryFormatter as soon as possible, even if they believe the data they're processing to be trustworthy. BinaryFormatter is insecure and can't be made secure\n\nReferences: \n - [Semgrep Rule](https://semgrep.dev/r/csharp.lang.security.insecure-deserialization.binary-formatter.insecure-binaryformatter-deserialization)\n - [https://docs.microsoft.com/en-us/dotnet/standard/serialization/binaryformatter-security-guide](https://docs.microsoft.com/en-us/dotnet/standard/serialization/binaryformatter-security-guide)\n","text":"The BinaryFormatter type is dangerous and is not recommended for data processing. Applications should stop using BinaryFormatter as soon as possible, even if they believe the data they're processing to be trustworthy. BinaryFormatter is insecure and can't be made secure"},"helpUri":"https://semgrep.dev/r/csharp.lang.security.insecure-deserialization.binary-formatter.insecure-binaryformatter-deserialization","id":"csharp.lang.security.insecure-deserialization.binary-formatter.insecure-binaryformatter-deserialization","name":"csharp.lang.security.insecure-deserialization.binary-formatter.insecure-binaryformatter-deserialization","properties":{"precision":"very-high","tags":["CWE-502: Deserialization of Untrusted Data","HIGH CONFIDENCE","OWASP-A08:2017 - Insecure Deserialization","OWASP-A08:2021 - Software and Data Integrity Failures","security"]},"shortDescription":{"text":"Semgrep Finding: csharp.lang.security.insecure-deserialization.binary-formatter.insecure-binaryformatter-deserialization"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"Only use DataContractResolver if you are completely sure of what information is being serialized. Malicious types can cause unexpected behavior."},"help":{"markdown":"Only use DataContractResolver if you are completely sure of what information is being serialized. Malicious types can cause unexpected behavior.\n\nReferences: \n - [Semgrep Rule](https://semgrep.dev/r/csharp.lang.security.insecure-deserialization.data-contract-resolver.data-contract-resolver)\n - [https://docs.microsoft.com/en-us/dotnet/standard/serialization/binaryformatter-security-guide](https://docs.microsoft.com/en-us/dotnet/standard/serialization/binaryformatter-security-guide)\n","text":"Only use DataContractResolver if you are completely sure of what information is being serialized. Malicious types can cause unexpected behavior."},"helpUri":"https://semgrep.dev/r/csharp.lang.security.insecure-deserialization.data-contract-resolver.data-contract-resolver","id":"csharp.lang.security.insecure-deserialization.data-contract-resolver.data-contract-resolver","name":"csharp.lang.security.insecure-deserialization.data-contract-resolver.data-contract-resolver","properties":{"precision":"very-high","tags":["CWE-502: Deserialization of Untrusted Data","LOW CONFIDENCE","OWASP-A08:2017 - Insecure Deserialization","OWASP-A08:2021 - Software and Data Integrity Failures","security"]},"shortDescription":{"text":"Semgrep Finding: csharp.lang.security.insecure-deserialization.data-contract-resolver.data-contract-resolver"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"$type extension has the potential to be unsafe, so use it with common sense and known json sources and not public facing ones to be safe"},"help":{"markdown":"$type extension has the potential to be unsafe, so use it with common sense and known json sources and not public facing ones to be safe\n\nReferences: \n - [Semgrep Rule](https://semgrep.dev/r/csharp.lang.security.insecure-deserialization.fast-json.insecure-fastjson-deserialization)\n - [https://github.com/mgholam/fastJSON#security-warning-update](https://github.com/mgholam/fastJSON#security-warning-update)\n","text":"$type extension has the potential to be unsafe, so use it with common sense and known json sources and not public facing ones to be safe"},"helpUri":"https://semgrep.dev/r/csharp.lang.security.insecure-deserialization.fast-json.insecure-fastjson-deserialization","id":"csharp.lang.security.insecure-deserialization.fast-json.insecure-fastjson-deserialization","name":"csharp.lang.security.insecure-deserialization.fast-json.insecure-fastjson-deserialization","properties":{"precision":"very-high","tags":["CWE-502: Deserialization of Untrusted Data","LOW CONFIDENCE","OWASP-A08:2017 - Insecure Deserialization","OWASP-A08:2021 - Software and Data Integrity Failures","security"]},"shortDescription":{"text":"Semgrep Finding: csharp.lang.security.insecure-deserialization.fast-json.insecure-fastjson-deserialization"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"The FsPickler is dangerous and is not recommended for data processing. Default configuration tend to insecure deserialization vulnerability."},"help":{"markdown":"The FsPickler is dangerous and is not recommended for data processing. Default configuration tend to insecure deserialization vulnerability.\n\nReferences: \n - [Semgrep Rule](https://semgrep.dev/r/csharp.lang.security.insecure-deserialization.fs-pickler.insecure-fspickler-deserialization)\n - [https://mbraceproject.github.io/FsPickler/tutorial.html#Disabling-Subtype-Resolution](https://mbraceproject.github.io/FsPickler/tutorial.html#Disabling-Subtype-Resolution)\n","text":"The FsPickler is dangerous and is not recommended for data processing. Default configuration tend to insecure deserialization vulnerability."},"helpUri":"https://semgrep.dev/r/csharp.lang.security.insecure-deserialization.fs-pickler.insecure-fspickler-deserialization","id":"csharp.lang.security.insecure-deserialization.fs-pickler.insecure-fspickler-deserialization","name":"csharp.lang.security.insecure-deserialization.fs-pickler.insecure-fspickler-deserialization","properties":{"precision":"very-high","tags":["CWE-502: Deserialization of Untrusted Data","MEDIUM CONFIDENCE","OWASP-A08:2017 - Insecure Deserialization","OWASP-A08:2021 - Software and Data Integrity Failures","security"]},"shortDescription":{"text":"Semgrep Finding: csharp.lang.security.insecure-deserialization.fs-pickler.insecure-fspickler-deserialization"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"Using a .NET remoting service can lead to RCE, even if you try to configure TypeFilterLevel. Recommended to switch from .NET Remoting to WCF https://docs.microsoft.com/en-us/dotnet/framework/wcf/migrating-from-net-remoting-to-wcf"},"help":{"markdown":"Using a .NET remoting service can lead to RCE, even if you try to configure TypeFilterLevel. Recommended to switch from .NET Remoting to WCF https://docs.microsoft.com/en-us/dotnet/framework/wcf/migrating-from-net-remoting-to-wcf\n\nReferences: \n - [Semgrep Rule](https://semgrep.dev/r/csharp.lang.security.insecure-deserialization.insecure-typefilterlevel-full.insecure-typefilterlevel-full)\n - [https://docs.microsoft.com/en-us/dotnet/api/system.runtime.serialization.formatters.typefilterlevel?view=net-6.0](https://docs.microsoft.com/en-us/dotnet/api/system.runtime.serialization.formatters.typefilterlevel?view=net-6.0)\n - [https://www.synacktiv.com/en/publications/izi-izi-pwn2own-ics-miami.html](https://www.synacktiv.com/en/publications/izi-izi-pwn2own-ics-miami.html)\n","text":"Using a .NET remoting service can lead to RCE, even if you try to configure TypeFilterLevel. Recommended to switch from .NET Remoting to WCF https://docs.microsoft.com/en-us/dotnet/framework/wcf/migrating-from-net-remoting-to-wcf"},"helpUri":"https://semgrep.dev/r/csharp.lang.security.insecure-deserialization.insecure-typefilterlevel-full.insecure-typefilterlevel-full","id":"csharp.lang.security.insecure-deserialization.insecure-typefilterlevel-full.insecure-typefilterlevel-full","name":"csharp.lang.security.insecure-deserialization.insecure-typefilterlevel-full.insecure-typefilterlevel-full","properties":{"precision":"very-high","tags":["CWE-502: Deserialization of Untrusted Data","LOW CONFIDENCE","OWASP-A08:2017 - Insecure Deserialization","OWASP-A08:2021 - Software and Data Integrity Failures","security"]},"shortDescription":{"text":"Semgrep Finding: csharp.lang.security.insecure-deserialization.insecure-typefilterlevel-full.insecure-typefilterlevel-full"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"The SimpleTypeResolver class is insecure and should not be used. Using SimpleTypeResolver to deserialize JSON could allow the remote client to execute malicious code within the app and take control of the web server."},"help":{"markdown":"The SimpleTypeResolver class is insecure and should not be used. Using SimpleTypeResolver to deserialize JSON could allow the remote client to execute malicious code within the app and take control of the web server.\n\nReferences: \n - [Semgrep Rule](https://semgrep.dev/r/csharp.lang.security.insecure-deserialization.javascript-serializer.insecure-javascriptserializer-deserialization)\n - [https://docs.microsoft.com/en-us/dotnet/api/system.web.script.serialization.simpletyperesolver?view=netframework-4.8#remarks](https://docs.microsoft.com/en-us/dotnet/api/system.web.script.serialization.simpletyperesolver?view=netframework-4.8#remarks)\n","text":"The SimpleTypeResolver class is insecure and should not be used. Using SimpleTypeResolver to deserialize JSON could allow the remote client to execute malicious code within the app and take control of the web server."},"helpUri":"https://semgrep.dev/r/csharp.lang.security.insecure-deserialization.javascript-serializer.insecure-javascriptserializer-deserialization","id":"csharp.lang.security.insecure-deserialization.javascript-serializer.insecure-javascriptserializer-deserialization","name":"csharp.lang.security.insecure-deserialization.javascript-serializer.insecure-javascriptserializer-deserialization","properties":{"precision":"very-high","tags":["CWE-502: Deserialization of Untrusted Data","LOW CONFIDENCE","OWASP-A08:2017 - Insecure Deserialization","OWASP-A08:2021 - Software and Data Integrity Failures","security"]},"shortDescription":{"text":"Semgrep Finding: csharp.lang.security.insecure-deserialization.javascript-serializer.insecure-javascriptserializer-deserialization"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"The LosFormatter type is dangerous and is not recommended for data processing. Applications should stop using LosFormatter as soon as possible, even if they believe the data they're processing to be trustworthy. LosFormatter is insecure and can't be made secure"},"help":{"markdown":"The LosFormatter type is dangerous and is not recommended for data processing. Applications should stop using LosFormatter as soon as possible, even if they believe the data they're processing to be trustworthy. LosFormatter is insecure and can't be made secure\n\nReferences: \n - [Semgrep Rule](https://semgrep.dev/r/csharp.lang.security.insecure-deserialization.los-formatter.insecure-losformatter-deserialization)\n - [https://docs.microsoft.com/en-us/dotnet/api/system.web.ui.losformatter?view=netframework-4.8](https://docs.microsoft.com/en-us/dotnet/api/system.web.ui.losformatter?view=netframework-4.8)\n","text":"The LosFormatter type is dangerous and is not recommended for data processing. Applications should stop using LosFormatter as soon as possible, even if they believe the data they're processing to be trustworthy. LosFormatter is insecure and can't be made secure"},"helpUri":"https://semgrep.dev/r/csharp.lang.security.insecure-deserialization.los-formatter.insecure-losformatter-deserialization","id":"csharp.lang.security.insecure-deserialization.los-formatter.insecure-losformatter-deserialization","name":"csharp.lang.security.insecure-deserialization.los-formatter.insecure-losformatter-deserialization","properties":{"precision":"very-high","tags":["CWE-502: Deserialization of Untrusted Data","MEDIUM CONFIDENCE","OWASP-A08:2017 - Insecure Deserialization","OWASP-A08:2021 - Software and Data Integrity Failures","security"]},"shortDescription":{"text":"Semgrep Finding: csharp.lang.security.insecure-deserialization.los-formatter.insecure-losformatter-deserialization"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"The NetDataContractSerializer type is dangerous and is not recommended for data processing. Applications should stop using NetDataContractSerializer as soon as possible, even if they believe the data they're processing to be trustworthy. NetDataContractSerializer is insecure and can't be made secure"},"help":{"markdown":"The NetDataContractSerializer type is dangerous and is not recommended for data processing. Applications should stop using NetDataContractSerializer as soon as possible, even if they believe the data they're processing to be trustworthy. NetDataContractSerializer is insecure and can't be made secure\n\nReferences: \n - [Semgrep Rule](https://semgrep.dev/r/csharp.lang.security.insecure-deserialization.net-data-contract.insecure-netdatacontract-deserialization)\n - [https://docs.microsoft.com/en-us/dotnet/api/system.runtime.serialization.netdatacontractserializer?view=netframework-4.8#security](https://docs.microsoft.com/en-us/dotnet/api/system.runtime.serialization.netdatacontractserializer?view=netframework-4.8#security)\n","text":"The NetDataContractSerializer type is dangerous and is not recommended for data processing. Applications should stop using NetDataContractSerializer as soon as possible, even if they believe the data they're processing to be trustworthy. NetDataContractSerializer is insecure and can't be made secure"},"helpUri":"https://semgrep.dev/r/csharp.lang.security.insecure-deserialization.net-data-contract.insecure-netdatacontract-deserialization","id":"csharp.lang.security.insecure-deserialization.net-data-contract.insecure-netdatacontract-deserialization","name":"csharp.lang.security.insecure-deserialization.net-data-contract.insecure-netdatacontract-deserialization","properties":{"precision":"very-high","tags":["CWE-502: Deserialization of Untrusted Data","MEDIUM CONFIDENCE","OWASP-A08:2017 - Insecure Deserialization","OWASP-A08:2021 - Software and Data Integrity Failures","security"]},"shortDescription":{"text":"Semgrep Finding: csharp.lang.security.insecure-deserialization.net-data-contract.insecure-netdatacontract-deserialization"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"TypeNameHandling $TYPEHANDLER is unsafe and can lead to arbitrary code execution in the context of the process. Use a custom SerializationBinder whenever using a setting other than TypeNameHandling.None."},"help":{"markdown":"TypeNameHandling $TYPEHANDLER is unsafe and can lead to arbitrary code execution in the context of the process. Use a custom SerializationBinder whenever using a setting other than TypeNameHandling.None.\n\nReferences: \n - [Semgrep Rule](https://semgrep.dev/r/csharp.lang.security.insecure-deserialization.newtonsoft.insecure-newtonsoft-deserialization)\n - [https://www.newtonsoft.com/json/help/html/T_Newtonsoft_Json_TypeNameHandling.htm#remarks](https://www.newtonsoft.com/json/help/html/T_Newtonsoft_Json_TypeNameHandling.htm#remarks)\n","text":"TypeNameHandling $TYPEHANDLER is unsafe and can lead to arbitrary code execution in the context of the process. Use a custom SerializationBinder whenever using a setting other than TypeNameHandling.None."},"helpUri":"https://semgrep.dev/r/csharp.lang.security.insecure-deserialization.newtonsoft.insecure-newtonsoft-deserialization","id":"csharp.lang.security.insecure-deserialization.newtonsoft.insecure-newtonsoft-deserialization","name":"csharp.lang.security.insecure-deserialization.newtonsoft.insecure-newtonsoft-deserialization","properties":{"precision":"very-high","tags":["CWE-502: Deserialization of Untrusted Data","LOW CONFIDENCE","OWASP-A08:2017 - Insecure Deserialization","OWASP-A08:2021 - Software and Data Integrity Failures","security"]},"shortDescription":{"text":"Semgrep Finding: csharp.lang.security.insecure-deserialization.newtonsoft.insecure-newtonsoft-deserialization"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"The SoapFormatter type is dangerous and is not recommended for data processing. Applications should stop using SoapFormatter as soon as possible, even if they believe the data they're processing to be trustworthy. SoapFormatter is insecure and can't be made secure"},"help":{"markdown":"The SoapFormatter type is dangerous and is not recommended for data processing. Applications should stop using SoapFormatter as soon as possible, even if they believe the data they're processing to be trustworthy. SoapFormatter is insecure and can't be made secure\n\nReferences: \n - [Semgrep Rule](https://semgrep.dev/r/csharp.lang.security.insecure-deserialization.soap-formatter.insecure-soapformatter-deserialization)\n - [https://docs.microsoft.com/en-us/dotnet/api/system.runtime.serialization.formatters.soap.soapformatter?view=netframework-4.8#remarks](https://docs.microsoft.com/en-us/dotnet/api/system.runtime.serialization.formatters.soap.soapformatter?view=netframework-4.8#remarks)\n","text":"The SoapFormatter type is dangerous and is not recommended for data processing. Applications should stop using SoapFormatter as soon as possible, even if they believe the data they're processing to be trustworthy. SoapFormatter is insecure and can't be made secure"},"helpUri":"https://semgrep.dev/r/csharp.lang.security.insecure-deserialization.soap-formatter.insecure-soapformatter-deserialization","id":"csharp.lang.security.insecure-deserialization.soap-formatter.insecure-soapformatter-deserialization","name":"csharp.lang.security.insecure-deserialization.soap-formatter.insecure-soapformatter-deserialization","properties":{"precision":"very-high","tags":["CWE-502: Deserialization of Untrusted Data","MEDIUM CONFIDENCE","OWASP-A08:2017 - Insecure Deserialization","OWASP-A08:2021 - Software and Data Integrity Failures","security"]},"shortDescription":{"text":"Semgrep Finding: csharp.lang.security.insecure-deserialization.soap-formatter.insecure-soapformatter-deserialization"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"MemoryMarshal.CreateSpan and MemoryMarshal.CreateReadOnlySpan should be used with caution, as the length argument is not checked."},"help":{"markdown":"MemoryMarshal.CreateSpan and MemoryMarshal.CreateReadOnlySpan should be used with caution, as the length argument is not checked.\n\nReferences: \n - [Semgrep Rule](https://semgrep.dev/r/csharp.lang.security.memory.memory-marshal-create-span.memory-marshal-create-span)\n - [https://docs.microsoft.com/en-us/dotnet/api/system.runtime.interopservices.memorymarshal.createspan?view=net-6.0](https://docs.microsoft.com/en-us/dotnet/api/system.runtime.interopservices.memorymarshal.createspan?view=net-6.0)\n - [https://docs.microsoft.com/en-us/dotnet/api/system.runtime.interopservices.memorymarshal.createreadonlyspan?view=net-6.0](https://docs.microsoft.com/en-us/dotnet/api/system.runtime.interopservices.memorymarshal.createreadonlyspan?view=net-6.0)\n","text":"MemoryMarshal.CreateSpan and MemoryMarshal.CreateReadOnlySpan should be used with caution, as the length argument is not checked."},"helpUri":"https://semgrep.dev/r/csharp.lang.security.memory.memory-marshal-create-span.memory-marshal-create-span","id":"csharp.lang.security.memory.memory-marshal-create-span.memory-marshal-create-span","name":"csharp.lang.security.memory.memory-marshal-create-span.memory-marshal-create-span","properties":{"precision":"very-high","tags":["CWE-125: Out-of-bounds Read","LOW CONFIDENCE","OWASP-A04:2021 - Insecure Design","security"]},"shortDescription":{"text":"Semgrep Finding: csharp.lang.security.memory.memory-marshal-create-span.memory-marshal-create-span"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"Specifying the regex timeout leaves the system vulnerable to a regex-based Denial of Service (DoS) attack. Consider setting the timeout to a short amount of time like 2 or 3 seconds. If you are sure you need an infinite timeout, double check that your context meets the conditions outlined in the \"Notes to Callers\" section at the bottom of this page: https://docs.microsoft.com/en-us/dotnet/api/system.text.regularexpressions.regex.-ctor?view=net-6.0"},"help":{"markdown":"Specifying the regex timeout leaves the system vulnerable to a regex-based Denial of Service (DoS) attack. Consider setting the timeout to a short amount of time like 2 or 3 seconds. If you are sure you need an infinite timeout, double check that your context meets the conditions outlined in the \"Notes to Callers\" section at the bottom of this page: https://docs.microsoft.com/en-us/dotnet/api/system.text.regularexpressions.regex.-ctor?view=net-6.0\n\nReferences: \n - [Semgrep Rule](https://semgrep.dev/r/csharp.lang.security.regular-expression-dos.regular-expression-dos-infinite-timeout.regular-expression-dos-infinite-timeout)\n - [https://owasp.org/www-community/attacks/Regular_expression_Denial_of_Service_-_ReDoS](https://owasp.org/www-community/attacks/Regular_expression_Denial_of_Service_-_ReDoS)\n - [https://docs.microsoft.com/en-us/dotnet/api/system.text.regularexpressions.regex.infinitematchtimeout](https://docs.microsoft.com/en-us/dotnet/api/system.text.regularexpressions.regex.infinitematchtimeout)\n - [https://docs.microsoft.com/en-us/dotnet/api/system.text.regularexpressions.regex.-ctor?view=net-6.0](https://docs.microsoft.com/en-us/dotnet/api/system.text.regularexpressions.regex.-ctor?view=net-6.0)\n","text":"Specifying the regex timeout leaves the system vulnerable to a regex-based Denial of Service (DoS) attack. Consider setting the timeout to a short amount of time like 2 or 3 seconds. If you are sure you need an infinite timeout, double check that your context meets the conditions outlined in the \"Notes to Callers\" section at the bottom of this page: https://docs.microsoft.com/en-us/dotnet/api/system.text.regularexpressions.regex.-ctor?view=net-6.0"},"helpUri":"https://semgrep.dev/r/csharp.lang.security.regular-expression-dos.regular-expression-dos-infinite-timeout.regular-expression-dos-infinite-timeout","id":"csharp.lang.security.regular-expression-dos.regular-expression-dos-infinite-timeout.regular-expression-dos-infinite-timeout","name":"csharp.lang.security.regular-expression-dos.regular-expression-dos-infinite-timeout.regular-expression-dos-infinite-timeout","properties":{"precision":"very-high","tags":["CWE-1333: Inefficient Regular Expression Complexity","MEDIUM CONFIDENCE","OWASP-A01:2017 - Injection","security"]},"shortDescription":{"text":"Semgrep Finding: csharp.lang.security.regular-expression-dos.regular-expression-dos-infinite-timeout.regular-expression-dos-infinite-timeout"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"When using `System.Text.RegularExpressions` to process untrusted input, pass a timeout. A malicious user can provide input to `RegularExpressions` that abuses the backtracking behaviour of this regular expression engine. This will lead to excessive CPU usage, causing a Denial-of-Service attack"},"help":{"markdown":"When using `System.Text.RegularExpressions` to process untrusted input, pass a timeout. A malicious user can provide input to `RegularExpressions` that abuses the backtracking behaviour of this regular expression engine. This will lead to excessive CPU usage, causing a Denial-of-Service attack\n\nReferences: \n - [Semgrep Rule](https://semgrep.dev/r/csharp.lang.security.regular-expression-dos.regular-expression-dos.regular-expression-dos)\n - [https://owasp.org/www-community/attacks/Regular_expression_Denial_of_Service_-_ReDoS](https://owasp.org/www-community/attacks/Regular_expression_Denial_of_Service_-_ReDoS)\n - [https://docs.microsoft.com/en-us/dotnet/standard/base-types/regular-expressions#regular-expression-examples](https://docs.microsoft.com/en-us/dotnet/standard/base-types/regular-expressions#regular-expression-examples)\n","text":"When using `System.Text.RegularExpressions` to process untrusted input, pass a timeout. A malicious user can provide input to `RegularExpressions` that abuses the backtracking behaviour of this regular expression engine. This will lead to excessive CPU usage, causing a Denial-of-Service attack"},"helpUri":"https://semgrep.dev/r/csharp.lang.security.regular-expression-dos.regular-expression-dos.regular-expression-dos","id":"csharp.lang.security.regular-expression-dos.regular-expression-dos.regular-expression-dos","name":"csharp.lang.security.regular-expression-dos.regular-expression-dos.regular-expression-dos","properties":{"precision":"very-high","tags":["CWE-1333: Inefficient Regular Expression Complexity","MEDIUM CONFIDENCE","OWASP-A01:2017 - Injection","security"]},"shortDescription":{"text":"Semgrep Finding: csharp.lang.security.regular-expression-dos.regular-expression-dos.regular-expression-dos"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"Detected a formatted string in a SQL statement. This could lead to SQL injection if variables in the SQL statement are not properly sanitized. Use a prepared statements instead. You can obtain a PreparedStatement using 'SqlCommand' and 'SqlParameter'."},"help":{"markdown":"Detected a formatted string in a SQL statement. This could lead to SQL injection if variables in the SQL statement are not properly sanitized. Use a prepared statements instead. You can obtain a PreparedStatement using 'SqlCommand' and 'SqlParameter'.\n\nReferences: \n - [Semgrep Rule](https://semgrep.dev/r/csharp.lang.security.sqli.csharp-sqli.csharp-sqli)\n - [https://owasp.org/Top10/A03_2021-Injection](https://owasp.org/Top10/A03_2021-Injection)\n","text":"Detected a formatted string in a SQL statement. This could lead to SQL injection if variables in the SQL statement are not properly sanitized. Use a prepared statements instead. You can obtain a PreparedStatement using 'SqlCommand' and 'SqlParameter'."},"helpUri":"https://semgrep.dev/r/csharp.lang.security.sqli.csharp-sqli.csharp-sqli","id":"csharp.lang.security.sqli.csharp-sqli.csharp-sqli","name":"csharp.lang.security.sqli.csharp-sqli.csharp-sqli","properties":{"precision":"very-high","tags":["CWE-89: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')","MEDIUM CONFIDENCE","OWASP-A01:2017 - Injection","OWASP-A03:2021 - Injection","security"]},"shortDescription":{"text":"Semgrep Finding: csharp.lang.security.sqli.csharp-sqli.csharp-sqli"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"SSRF is an attack vector that abuses an application to interact with the internal/external network or the machine itself."},"help":{"markdown":"SSRF is an attack vector that abuses an application to interact with the internal/external network or the machine itself.\n\nReferences: \n - [Semgrep Rule](https://semgrep.dev/r/csharp.lang.security.ssrf.http-client.ssrf)\n - [https://cheatsheetseries.owasp.org/cheatsheets/Server_Side_Request_Forgery_Prevention_Cheat_Sheet.html](https://cheatsheetseries.owasp.org/cheatsheets/Server_Side_Request_Forgery_Prevention_Cheat_Sheet.html)\n","text":"SSRF is an attack vector that abuses an application to interact with the internal/external network or the machine itself."},"helpUri":"https://semgrep.dev/r/csharp.lang.security.ssrf.http-client.ssrf","id":"csharp.lang.security.ssrf.http-client.ssrf","name":"csharp.lang.security.ssrf.http-client.ssrf","properties":{"precision":"very-high","tags":["CWE-918: Server-Side Request Forgery (SSRF)","LOW CONFIDENCE","OWASP-A10:2021 - Server-Side Request Forgery (SSRF)","security"]},"shortDescription":{"text":"Semgrep Finding: csharp.lang.security.ssrf.http-client.ssrf"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"SSRF is an attack vector that abuses an application to interact with the internal/external network or the machine itself."},"help":{"markdown":"SSRF is an attack vector that abuses an application to interact with the internal/external network or the machine itself.\n\nReferences: \n - [Semgrep Rule](https://semgrep.dev/r/csharp.lang.security.ssrf.rest-client.ssrf)\n - [https://cheatsheetseries.owasp.org/cheatsheets/Server_Side_Request_Forgery_Prevention_Cheat_Sheet.html](https://cheatsheetseries.owasp.org/cheatsheets/Server_Side_Request_Forgery_Prevention_Cheat_Sheet.html)\n","text":"SSRF is an attack vector that abuses an application to interact with the internal/external network or the machine itself."},"helpUri":"https://semgrep.dev/r/csharp.lang.security.ssrf.rest-client.ssrf","id":"csharp.lang.security.ssrf.rest-client.ssrf","name":"csharp.lang.security.ssrf.rest-client.ssrf","properties":{"precision":"very-high","tags":["CWE-918: Server-Side Request Forgery (SSRF)","LOW CONFIDENCE","OWASP-A10:2021 - Server-Side Request Forgery (SSRF)","security"]},"shortDescription":{"text":"Semgrep Finding: csharp.lang.security.ssrf.rest-client.ssrf"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"SSRF is an attack vector that abuses an application to interact with the internal/external network or the machine itself."},"help":{"markdown":"SSRF is an attack vector that abuses an application to interact with the internal/external network or the machine itself.\n\nReferences: \n - [Semgrep Rule](https://semgrep.dev/r/csharp.lang.security.ssrf.web-client.ssrf)\n - [https://cheatsheetseries.owasp.org/cheatsheets/Server_Side_Request_Forgery_Prevention_Cheat_Sheet.html](https://cheatsheetseries.owasp.org/cheatsheets/Server_Side_Request_Forgery_Prevention_Cheat_Sheet.html)\n","text":"SSRF is an attack vector that abuses an application to interact with the internal/external network or the machine itself."},"helpUri":"https://semgrep.dev/r/csharp.lang.security.ssrf.web-client.ssrf","id":"csharp.lang.security.ssrf.web-client.ssrf","name":"csharp.lang.security.ssrf.web-client.ssrf","properties":{"precision":"very-high","tags":["CWE-918: Server-Side Request Forgery (SSRF)","LOW CONFIDENCE","OWASP-A10:2021 - Server-Side Request Forgery (SSRF)","security"]},"shortDescription":{"text":"Semgrep Finding: csharp.lang.security.ssrf.web-client.ssrf"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"The web server receives a URL or similar request from an upstream component and retrieves the contents of this URL, but it does not sufficiently ensure that the request is being sent to the expected destination. Many different options exist to fix this issue depending the use case (Application can send request only to identified and trusted applications, Application can send requests to ANY external IP address or domain name)."},"help":{"markdown":"The web server receives a URL or similar request from an upstream component and retrieves the contents of this URL, but it does not sufficiently ensure that the request is being sent to the expected destination. Many different options exist to fix this issue depending the use case (Application can send request only to identified and trusted applications, Application can send requests to ANY external IP address or domain name).\n\nReferences: \n - [Semgrep Rule](https://semgrep.dev/r/csharp.lang.security.ssrf.web-request.ssrf)\n - [https://cwe.mitre.org/data/definitions/918.html](https://cwe.mitre.org/data/definitions/918.html)\n - [https://cheatsheetseries.owasp.org/cheatsheets/Server_Side_Request_Forgery_Prevention_Cheat_Sheet.html](https://cheatsheetseries.owasp.org/cheatsheets/Server_Side_Request_Forgery_Prevention_Cheat_Sheet.html)\n","text":"The web server receives a URL or similar request from an upstream component and retrieves the contents of this URL, but it does not sufficiently ensure that the request is being sent to the expected destination. Many different options exist to fix this issue depending the use case (Application can send request only to identified and trusted applications, Application can send requests to ANY external IP address or domain name)."},"helpUri":"https://semgrep.dev/r/csharp.lang.security.ssrf.web-request.ssrf","id":"csharp.lang.security.ssrf.web-request.ssrf","name":"csharp.lang.security.ssrf.web-request.ssrf","properties":{"precision":"very-high","tags":["CWE-918: Server-Side Request Forgery (SSRF)","LOW CONFIDENCE","OWASP-A10:2021 - Server-Side Request Forgery (SSRF)","security"]},"shortDescription":{"text":"Semgrep Finding: csharp.lang.security.ssrf.web-request.ssrf"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"Stacktrace information is displayed in a non-Development environment. Accidentally disclosing sensitive stack trace information in a production environment aids an attacker in reconnaissance and information gathering."},"help":{"markdown":"Stacktrace information is displayed in a non-Development environment. Accidentally disclosing sensitive stack trace information in a production environment aids an attacker in reconnaissance and information gathering.\n\nReferences: \n - [Semgrep Rule](https://semgrep.dev/r/csharp.lang.security.stacktrace-disclosure.stacktrace-disclosure)\n - [https://cwe.mitre.org/data/definitions/209.html](https://cwe.mitre.org/data/definitions/209.html)\n - [https://owasp.org/Top10/A04_2021-Insecure_Design/](https://owasp.org/Top10/A04_2021-Insecure_Design/)\n","text":"Stacktrace information is displayed in a non-Development environment. Accidentally disclosing sensitive stack trace information in a production environment aids an attacker in reconnaissance and information gathering."},"helpUri":"https://semgrep.dev/r/csharp.lang.security.stacktrace-disclosure.stacktrace-disclosure","id":"csharp.lang.security.stacktrace-disclosure.stacktrace-disclosure","name":"csharp.lang.security.stacktrace-disclosure.stacktrace-disclosure","properties":{"precision":"very-high","tags":["CWE-209: Generation of Error Message Containing Sensitive Information","HIGH CONFIDENCE","OWASP-A04:2021 - Insecure Design","OWASP-A06:2017 - Security Misconfiguration","security"]},"shortDescription":{"text":"Semgrep Finding: csharp.lang.security.stacktrace-disclosure.stacktrace-disclosure"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"A secret is hard-coded in the application. Secrets stored in source code, such as credentials, identifiers, and other types of sensitive data, can be leaked and used by internal or external malicious actors. Use environment variables to securely provide credentials and other secrets or retrieve them from a secure vault or Hardware Security Module (HSM)."},"help":{"markdown":"A secret is hard-coded in the application. Secrets stored in source code, such as credentials, identifiers, and other types of sensitive data, can be leaked and used by internal or external malicious actors. Use environment variables to securely provide credentials and other secrets or retrieve them from a secure vault or Hardware Security Module (HSM).\n\nReferences: \n - [Semgrep Rule](https://semgrep.dev/r/csharp.lang.security.system.directoryentry-hardcoded-secret.directoryentry-hardcoded-secret)\n - [https://cheatsheetseries.owasp.org/cheatsheets/Secrets_Management_Cheat_Sheet.html](https://cheatsheetseries.owasp.org/cheatsheets/Secrets_Management_Cheat_Sheet.html)\n","text":"A secret is hard-coded in the application. Secrets stored in source code, such as credentials, identifiers, and other types of sensitive data, can be leaked and used by internal or external malicious actors. Use environment variables to securely provide credentials and other secrets or retrieve them from a secure vault or Hardware Security Module (HSM)."},"helpUri":"https://semgrep.dev/r/csharp.lang.security.system.directoryentry-hardcoded-secret.directoryentry-hardcoded-secret","id":"csharp.lang.security.system.directoryentry-hardcoded-secret.directoryentry-hardcoded-secret","name":"csharp.lang.security.system.directoryentry-hardcoded-secret.directoryentry-hardcoded-secret","properties":{"precision":"very-high","tags":["CWE-798: Use of Hard-coded Credentials","HIGH CONFIDENCE","OWASP-A07:2021 - Identification and Authentication Failures","security"]},"shortDescription":{"text":"Semgrep Finding: csharp.lang.security.system.directoryentry-hardcoded-secret.directoryentry-hardcoded-secret"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"A secret is hard-coded in the application. Secrets stored in source code, such as credentials, identifiers, and other types of sensitive data, can be leaked and used by internal or external malicious actors. Use environment variables to securely provide credentials and other secrets or retrieve them from a secure vault or Hardware Security Module (HSM)."},"help":{"markdown":"A secret is hard-coded in the application. Secrets stored in source code, such as credentials, identifiers, and other types of sensitive data, can be leaked and used by internal or external malicious actors. Use environment variables to securely provide credentials and other secrets or retrieve them from a secure vault or Hardware Security Module (HSM).\n\nReferences: \n - [Semgrep Rule](https://semgrep.dev/r/csharp.lang.security.system.networkcredential-hardcoded-secret.networkcredential-hardcoded-secret)\n - [https://cheatsheetseries.owasp.org/cheatsheets/Secrets_Management_Cheat_Sheet.html](https://cheatsheetseries.owasp.org/cheatsheets/Secrets_Management_Cheat_Sheet.html)\n","text":"A secret is hard-coded in the application. Secrets stored in source code, such as credentials, identifiers, and other types of sensitive data, can be leaked and used by internal or external malicious actors. Use environment variables to securely provide credentials and other secrets or retrieve them from a secure vault or Hardware Security Module (HSM)."},"helpUri":"https://semgrep.dev/r/csharp.lang.security.system.networkcredential-hardcoded-secret.networkcredential-hardcoded-secret","id":"csharp.lang.security.system.networkcredential-hardcoded-secret.networkcredential-hardcoded-secret","name":"csharp.lang.security.system.networkcredential-hardcoded-secret.networkcredential-hardcoded-secret","properties":{"precision":"very-high","tags":["CWE-798: Use of Hard-coded Credentials","HIGH CONFIDENCE","OWASP-A07:2021 - Identification and Authentication Failures","security"]},"shortDescription":{"text":"Semgrep Finding: csharp.lang.security.system.networkcredential-hardcoded-secret.networkcredential-hardcoded-secret"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"A secret is hard-coded in the application. Secrets stored in source code, such as credentials, identifiers, and other types of sensitive data, can be leaked and used by internal or external malicious actors. Use environment variables to securely provide credentials and other secrets or retrieve them from a secure vault or Hardware Security Module (HSM)."},"help":{"markdown":"A secret is hard-coded in the application. Secrets stored in source code, such as credentials, identifiers, and other types of sensitive data, can be leaked and used by internal or external malicious actors. Use environment variables to securely provide credentials and other secrets or retrieve them from a secure vault or Hardware Security Module (HSM).\n\nReferences: \n - [Semgrep Rule](https://semgrep.dev/r/csharp.lang.security.system.oracleconnectionstringbuilder-hardcoded-secret.oracleconnectionstringbuilder-hardcoded-secret)\n - [https://cheatsheetseries.owasp.org/cheatsheets/Secrets_Management_Cheat_Sheet.html](https://cheatsheetseries.owasp.org/cheatsheets/Secrets_Management_Cheat_Sheet.html)\n","text":"A secret is hard-coded in the application. Secrets stored in source code, such as credentials, identifiers, and other types of sensitive data, can be leaked and used by internal or external malicious actors. Use environment variables to securely provide credentials and other secrets or retrieve them from a secure vault or Hardware Security Module (HSM)."},"helpUri":"https://semgrep.dev/r/csharp.lang.security.system.oracleconnectionstringbuilder-hardcoded-secret.oracleconnectionstringbuilder-hardcoded-secret","id":"csharp.lang.security.system.oracleconnectionstringbuilder-hardcoded-secret.oracleconnectionstringbuilder-hardcoded-secret","name":"csharp.lang.security.system.oracleconnectionstringbuilder-hardcoded-secret.oracleconnectionstringbuilder-hardcoded-secret","properties":{"precision":"very-high","tags":["CWE-798: Use of Hard-coded Credentials","HIGH CONFIDENCE","OWASP-A07:2021 - Identification and Authentication Failures","security"]},"shortDescription":{"text":"Semgrep Finding: csharp.lang.security.system.oracleconnectionstringbuilder-hardcoded-secret.oracleconnectionstringbuilder-hardcoded-secret"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"A secret is hard-coded in the application. Secrets stored in source code, such as credentials, identifiers, and other types of sensitive data, can be leaked and used by internal or external malicious actors. Use environment variables to securely provide credentials and other secrets or retrieve them from a secure vault or Hardware Security Module (HSM)."},"help":{"markdown":"A secret is hard-coded in the application. Secrets stored in source code, such as credentials, identifiers, and other types of sensitive data, can be leaked and used by internal or external malicious actors. Use environment variables to securely provide credentials and other secrets or retrieve them from a secure vault or Hardware Security Module (HSM).\n\nReferences: \n - [Semgrep Rule](https://semgrep.dev/r/csharp.lang.security.system.passwordauthenticationmethod-hardcoded-secret.passwordauthenticationmethod-hardcoded-secret)\n - [https://cheatsheetseries.owasp.org/cheatsheets/Secrets_Management_Cheat_Sheet.html](https://cheatsheetseries.owasp.org/cheatsheets/Secrets_Management_Cheat_Sheet.html)\n","text":"A secret is hard-coded in the application. Secrets stored in source code, such as credentials, identifiers, and other types of sensitive data, can be leaked and used by internal or external malicious actors. Use environment variables to securely provide credentials and other secrets or retrieve them from a secure vault or Hardware Security Module (HSM)."},"helpUri":"https://semgrep.dev/r/csharp.lang.security.system.passwordauthenticationmethod-hardcoded-secret.passwordauthenticationmethod-hardcoded-secret","id":"csharp.lang.security.system.passwordauthenticationmethod-hardcoded-secret.passwordauthenticationmethod-hardcoded-secret","name":"csharp.lang.security.system.passwordauthenticationmethod-hardcoded-secret.passwordauthenticationmethod-hardcoded-secret","properties":{"precision":"very-high","tags":["CWE-798: Use of Hard-coded Credentials","HIGH CONFIDENCE","OWASP-A07:2021 - Identification and Authentication Failures","security"]},"shortDescription":{"text":"Semgrep Finding: csharp.lang.security.system.passwordauthenticationmethod-hardcoded-secret.passwordauthenticationmethod-hardcoded-secret"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"A secret is hard-coded in the application. Secrets stored in source code, such as credentials, identifiers, and other types of sensitive data, can be leaked and used by internal or external malicious actors. Use environment variables to securely provide credentials and other secrets or retrieve them from a secure vault or Hardware Security Module (HSM)."},"help":{"markdown":"A secret is hard-coded in the application. Secrets stored in source code, such as credentials, identifiers, and other types of sensitive data, can be leaked and used by internal or external malicious actors. Use environment variables to securely provide credentials and other secrets or retrieve them from a secure vault or Hardware Security Module (HSM).\n\nReferences: \n - [Semgrep Rule](https://semgrep.dev/r/csharp.lang.security.system.sqlconnection-hardcoded-secret.sqlconnection-hardcoded-secret)\n - [https://cheatsheetseries.owasp.org/cheatsheets/Secrets_Management_Cheat_Sheet.html](https://cheatsheetseries.owasp.org/cheatsheets/Secrets_Management_Cheat_Sheet.html)\n","text":"A secret is hard-coded in the application. Secrets stored in source code, such as credentials, identifiers, and other types of sensitive data, can be leaked and used by internal or external malicious actors. Use environment variables to securely provide credentials and other secrets or retrieve them from a secure vault or Hardware Security Module (HSM)."},"helpUri":"https://semgrep.dev/r/csharp.lang.security.system.sqlconnection-hardcoded-secret.sqlconnection-hardcoded-secret","id":"csharp.lang.security.system.sqlconnection-hardcoded-secret.sqlconnection-hardcoded-secret","name":"csharp.lang.security.system.sqlconnection-hardcoded-secret.sqlconnection-hardcoded-secret","properties":{"precision":"very-high","tags":["CWE-798: Use of Hard-coded Credentials","HIGH CONFIDENCE","OWASP-A07:2021 - Identification and Authentication Failures","security"]},"shortDescription":{"text":"Semgrep Finding: csharp.lang.security.system.sqlconnection-hardcoded-secret.sqlconnection-hardcoded-secret"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"A secret is hard-coded in the application. Secrets stored in source code, such as credentials, identifiers, and other types of sensitive data, can be leaked and used by internal or external malicious actors. Use environment variables to securely provide credentials and other secrets or retrieve them from a secure vault or Hardware Security Module (HSM)."},"help":{"markdown":"A secret is hard-coded in the application. Secrets stored in source code, such as credentials, identifiers, and other types of sensitive data, can be leaked and used by internal or external malicious actors. Use environment variables to securely provide credentials and other secrets or retrieve them from a secure vault or Hardware Security Module (HSM).\n\nReferences: \n - [Semgrep Rule](https://semgrep.dev/r/csharp.lang.security.system.sqlconnectionstringbuilder-hardcoded-secret.sqlconnectionstringbuilder-hardcoded-secret)\n - [https://cheatsheetseries.owasp.org/cheatsheets/Secrets_Management_Cheat_Sheet.html](https://cheatsheetseries.owasp.org/cheatsheets/Secrets_Management_Cheat_Sheet.html)\n","text":"A secret is hard-coded in the application. Secrets stored in source code, such as credentials, identifiers, and other types of sensitive data, can be leaked and used by internal or external malicious actors. Use environment variables to securely provide credentials and other secrets or retrieve them from a secure vault or Hardware Security Module (HSM)."},"helpUri":"https://semgrep.dev/r/csharp.lang.security.system.sqlconnectionstringbuilder-hardcoded-secret.sqlconnectionstringbuilder-hardcoded-secret","id":"csharp.lang.security.system.sqlconnectionstringbuilder-hardcoded-secret.sqlconnectionstringbuilder-hardcoded-secret","name":"csharp.lang.security.system.sqlconnectionstringbuilder-hardcoded-secret.sqlconnectionstringbuilder-hardcoded-secret","properties":{"precision":"very-high","tags":["CWE-798: Use of Hard-coded Credentials","HIGH CONFIDENCE","OWASP-A07:2021 - Identification and Authentication Failures","security"]},"shortDescription":{"text":"Semgrep Finding: csharp.lang.security.system.sqlconnectionstringbuilder-hardcoded-secret.sqlconnectionstringbuilder-hardcoded-secret"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"XmlReaderSettings found with DtdProcessing.Parse on an XmlReader handling a string argument from a public method. Enabling Document Type Definition (DTD) parsing may cause XML External Entity (XXE) injection if supplied with user-controllable data."},"help":{"markdown":"XmlReaderSettings found with DtdProcessing.Parse on an XmlReader handling a string argument from a public method. Enabling Document Type Definition (DTD) parsing may cause XML External Entity (XXE) injection if supplied with user-controllable data.\n\nReferences: \n - [Semgrep Rule](https://semgrep.dev/r/csharp.lang.security.xxe.xmldocument-unsafe-parser-override.xmldocument-unsafe-parser-override)\n - [https://www.jardinesoftware.net/2016/05/26/xxe-and-net/](https://www.jardinesoftware.net/2016/05/26/xxe-and-net/)\n - [https://docs.microsoft.com/en-us/dotnet/api/system.xml.xmldocument.xmlresolver?view=net-6.0#remarks](https://docs.microsoft.com/en-us/dotnet/api/system.xml.xmldocument.xmlresolver?view=net-6.0#remarks)\n","text":"XmlReaderSettings found with DtdProcessing.Parse on an XmlReader handling a string argument from a public method. Enabling Document Type Definition (DTD) parsing may cause XML External Entity (XXE) injection if supplied with user-controllable data."},"helpUri":"https://semgrep.dev/r/csharp.lang.security.xxe.xmldocument-unsafe-parser-override.xmldocument-unsafe-parser-override","id":"csharp.lang.security.xxe.xmldocument-unsafe-parser-override.xmldocument-unsafe-parser-override","name":"csharp.lang.security.xxe.xmldocument-unsafe-parser-override.xmldocument-unsafe-parser-override","properties":{"precision":"very-high","tags":["CWE-611: Improper Restriction of XML External Entity Reference","MEDIUM CONFIDENCE","OWASP-A04:2017 - XML External Entities (XXE)","OWASP-A05:2021 - Security Misconfiguration","security"]},"shortDescription":{"text":"Semgrep Finding: csharp.lang.security.xxe.xmldocument-unsafe-parser-override.xmldocument-unsafe-parser-override"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"XmlReaderSettings found with DtdProcessing.Parse on an XmlReader handling a string argument from a public method. Enabling Document Type Definition (DTD) parsing may cause XML External Entity (XXE) injection if supplied with user-controllable data."},"help":{"markdown":"XmlReaderSettings found with DtdProcessing.Parse on an XmlReader handling a string argument from a public method. Enabling Document Type Definition (DTD) parsing may cause XML External Entity (XXE) injection if supplied with user-controllable data.\n\nReferences: \n - [Semgrep Rule](https://semgrep.dev/r/csharp.lang.security.xxe.xmlreadersettings-unsafe-parser-override.xmlreadersettings-unsafe-parser-override)\n - [https://www.jardinesoftware.net/2016/05/26/xxe-and-net/](https://www.jardinesoftware.net/2016/05/26/xxe-and-net/)\n - [https://docs.microsoft.com/en-us/dotnet/api/system.xml.xmldocument.xmlresolver?view=net-6.0#remarks](https://docs.microsoft.com/en-us/dotnet/api/system.xml.xmldocument.xmlresolver?view=net-6.0#remarks)\n","text":"XmlReaderSettings found with DtdProcessing.Parse on an XmlReader handling a string argument from a public method. Enabling Document Type Definition (DTD) parsing may cause XML External Entity (XXE) injection if supplied with user-controllable data."},"helpUri":"https://semgrep.dev/r/csharp.lang.security.xxe.xmlreadersettings-unsafe-parser-override.xmlreadersettings-unsafe-parser-override","id":"csharp.lang.security.xxe.xmlreadersettings-unsafe-parser-override.xmlreadersettings-unsafe-parser-override","name":"csharp.lang.security.xxe.xmlreadersettings-unsafe-parser-override.xmlreadersettings-unsafe-parser-override","properties":{"precision":"very-high","tags":["CWE-611: Improper Restriction of XML External Entity Reference","MEDIUM CONFIDENCE","OWASP-A04:2017 - XML External Entities (XXE)","OWASP-A05:2021 - Security Misconfiguration","security"]},"shortDescription":{"text":"Semgrep Finding: csharp.lang.security.xxe.xmlreadersettings-unsafe-parser-override.xmlreadersettings-unsafe-parser-override"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"XmlReaderSettings found with DtdProcessing.Parse on an XmlReader handling a string argument from a public method. Enabling Document Type Definition (DTD) parsing may cause XML External Entity (XXE) injection if supplied with user-controllable data."},"help":{"markdown":"XmlReaderSettings found with DtdProcessing.Parse on an XmlReader handling a string argument from a public method. Enabling Document Type Definition (DTD) parsing may cause XML External Entity (XXE) injection if supplied with user-controllable data.\n\nReferences: \n - [Semgrep Rule](https://semgrep.dev/r/csharp.lang.security.xxe.xmltextreader-unsafe-defaults.xmltextreader-unsafe-defaults)\n - [https://www.jardinesoftware.net/2016/05/26/xxe-and-net/](https://www.jardinesoftware.net/2016/05/26/xxe-and-net/)\n - [https://docs.microsoft.com/en-us/dotnet/api/system.xml.xmldocument.xmlresolver?view=net-6.0#remarks](https://docs.microsoft.com/en-us/dotnet/api/system.xml.xmldocument.xmlresolver?view=net-6.0#remarks)\n","text":"XmlReaderSettings found with DtdProcessing.Parse on an XmlReader handling a string argument from a public method. Enabling Document Type Definition (DTD) parsing may cause XML External Entity (XXE) injection if supplied with user-controllable data."},"helpUri":"https://semgrep.dev/r/csharp.lang.security.xxe.xmltextreader-unsafe-defaults.xmltextreader-unsafe-defaults","id":"csharp.lang.security.xxe.xmltextreader-unsafe-defaults.xmltextreader-unsafe-defaults","name":"csharp.lang.security.xxe.xmltextreader-unsafe-defaults.xmltextreader-unsafe-defaults","properties":{"precision":"very-high","tags":["CWE-611: Improper Restriction of XML External Entity Reference","MEDIUM CONFIDENCE","OWASP-A04:2017 - XML External Entities (XXE)","OWASP-A05:2021 - Security Misconfiguration","security"]},"shortDescription":{"text":"Semgrep Finding: csharp.lang.security.xxe.xmltextreader-unsafe-defaults.xmltextreader-unsafe-defaults"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"A secret is hard-coded in the application. Secrets stored in source code, such as credentials, identifiers, and other types of sensitive data, can be leaked and used by internal or external malicious actors. Use environment variables to securely provide credentials and other secrets or retrieve them from a secure vault or Hardware Security Module (HSM)."},"help":{"markdown":"A secret is hard-coded in the application. Secrets stored in source code, such as credentials, identifiers, and other types of sensitive data, can be leaked and used by internal or external malicious actors. Use environment variables to securely provide credentials and other secrets or retrieve them from a secure vault or Hardware Security Module (HSM).\n\nReferences: \n - [Semgrep Rule](https://semgrep.dev/r/csharp.mongo.csharp-mongo-hardcoded-secret.csharp-mongo-hardcoded-secret)\n - [https://cheatsheetseries.owasp.org/cheatsheets/Secrets_Management_Cheat_Sheet.html](https://cheatsheetseries.owasp.org/cheatsheets/Secrets_Management_Cheat_Sheet.html)\n","text":"A secret is hard-coded in the application. Secrets stored in source code, such as credentials, identifiers, and other types of sensitive data, can be leaked and used by internal or external malicious actors. Use environment variables to securely provide credentials and other secrets or retrieve them from a secure vault or Hardware Security Module (HSM)."},"helpUri":"https://semgrep.dev/r/csharp.mongo.csharp-mongo-hardcoded-secret.csharp-mongo-hardcoded-secret","id":"csharp.mongo.csharp-mongo-hardcoded-secret.csharp-mongo-hardcoded-secret","name":"csharp.mongo.csharp-mongo-hardcoded-secret.csharp-mongo-hardcoded-secret","properties":{"precision":"very-high","tags":["CWE-798: Use of Hard-coded Credentials","HIGH CONFIDENCE","OWASP-A07:2021 - Identification and Authentication Failures","security"]},"shortDescription":{"text":"Semgrep Finding: csharp.mongo.csharp-mongo-hardcoded-secret.csharp-mongo-hardcoded-secret"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"A secret is hard-coded in the application. Secrets stored in source code, such as credentials, identifiers, and other types of sensitive data, can be leaked and used by internal or external malicious actors. Use environment variables to securely provide credentials and other secrets or retrieve them from a secure vault or Hardware Security Module (HSM)."},"help":{"markdown":"A secret is hard-coded in the application. Secrets stored in source code, such as credentials, identifiers, and other types of sensitive data, can be leaked and used by internal or external malicious actors. Use environment variables to securely provide credentials and other secrets or retrieve them from a secure vault or Hardware Security Module (HSM).\n\nReferences: \n - [Semgrep Rule](https://semgrep.dev/r/csharp.postgres.npgsqlconnectionstringbuilder-hardcoded-secret.npgsqlconnectionstringbuilder-hardcoded-secret)\n - [https://cheatsheetseries.owasp.org/cheatsheets/Secrets_Management_Cheat_Sheet.html](https://cheatsheetseries.owasp.org/cheatsheets/Secrets_Management_Cheat_Sheet.html)\n","text":"A secret is hard-coded in the application. Secrets stored in source code, such as credentials, identifiers, and other types of sensitive data, can be leaked and used by internal or external malicious actors. Use environment variables to securely provide credentials and other secrets or retrieve them from a secure vault or Hardware Security Module (HSM)."},"helpUri":"https://semgrep.dev/r/csharp.postgres.npgsqlconnectionstringbuilder-hardcoded-secret.npgsqlconnectionstringbuilder-hardcoded-secret","id":"csharp.postgres.npgsqlconnectionstringbuilder-hardcoded-secret.npgsqlconnectionstringbuilder-hardcoded-secret","name":"csharp.postgres.npgsqlconnectionstringbuilder-hardcoded-secret.npgsqlconnectionstringbuilder-hardcoded-secret","properties":{"precision":"very-high","tags":["CWE-798: Use of Hard-coded Credentials","HIGH CONFIDENCE","OWASP-A07:2021 - Identification and Authentication Failures","security"]},"shortDescription":{"text":"Semgrep Finding: csharp.postgres.npgsqlconnectionstringbuilder-hardcoded-secret.npgsqlconnectionstringbuilder-hardcoded-secret"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"Unencoded JSON in HTML context is vulnerable to cross-site scripting, because `` is not properly encoded."},"help":{"markdown":"Unencoded JSON in HTML context is vulnerable to cross-site scripting, because `` is not properly encoded.\n\nReferences: \n - [Semgrep Rule](https://semgrep.dev/r/csharp.razor.security.html-raw-json.html-raw-json)\n - [https://owasp.org/Top10/A03_2021-Injection](https://owasp.org/Top10/A03_2021-Injection)\n","text":"Unencoded JSON in HTML context is vulnerable to cross-site scripting, because `` is not properly encoded."},"helpUri":"https://semgrep.dev/r/csharp.razor.security.html-raw-json.html-raw-json","id":"csharp.razor.security.html-raw-json.html-raw-json","name":"csharp.razor.security.html-raw-json.html-raw-json","properties":{"precision":"very-high","tags":["CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')","LOW CONFIDENCE","OWASP-A03:2021 - Injection","OWASP-A07:2017 - Cross-Site Scripting (XSS)","security"]},"shortDescription":{"text":"Semgrep Finding: csharp.razor.security.html-raw-json.html-raw-json"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"The Dockerfile(image) mounts docker.sock to the container which may allow an attacker already inside of the container to escape container and execute arbitrary commands on the host machine."},"help":{"markdown":"The Dockerfile(image) mounts docker.sock to the container which may allow an attacker already inside of the container to escape container and execute arbitrary commands on the host machine.\n\nReferences: \n - [Semgrep Rule](https://semgrep.dev/r/dockerfile.security.dockerd-socket-mount.dockerfile-dockerd-socket-mount)\n - [https://cheatsheetseries.owasp.org/cheatsheets/Docker_Security_Cheat_Sheet.html](https://cheatsheetseries.owasp.org/cheatsheets/Docker_Security_Cheat_Sheet.html)\n - [https://redfoxsec.com/blog/insecure-volume-mounts-in-docker/](https://redfoxsec.com/blog/insecure-volume-mounts-in-docker/)\n - [https://blog.quarkslab.com/why-is-exposing-the-docker-socket-a-really-bad-idea.html](https://blog.quarkslab.com/why-is-exposing-the-docker-socket-a-really-bad-idea.html)\n","text":"The Dockerfile(image) mounts docker.sock to the container which may allow an attacker already inside of the container to escape container and execute arbitrary commands on the host machine."},"helpUri":"https://semgrep.dev/r/dockerfile.security.dockerd-socket-mount.dockerfile-dockerd-socket-mount","id":"dockerfile.security.dockerd-socket-mount.dockerfile-dockerd-socket-mount","name":"dockerfile.security.dockerd-socket-mount.dockerfile-dockerd-socket-mount","properties":{"precision":"very-high","tags":["CWE-269: Improper Privilege Management","CWE-862: Missing Authorization","HIGH CONFIDENCE","security"]},"shortDescription":{"text":"Semgrep Finding: dockerfile.security.dockerd-socket-mount.dockerfile-dockerd-socket-mount"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"The last user in the container is 'root'. This is a security hazard because if an attacker gains control of the container they will have root access. Switch back to another user after running commands as 'root'."},"help":{"markdown":"The last user in the container is 'root'. This is a security hazard because if an attacker gains control of the container they will have root access. Switch back to another user after running commands as 'root'.\n\nReferences: \n - [Semgrep Rule](https://semgrep.dev/r/dockerfile.security.last-user-is-root.last-user-is-root)\n - [https://github.com/hadolint/hadolint/wiki/DL3002](https://github.com/hadolint/hadolint/wiki/DL3002)\n","text":"The last user in the container is 'root'. This is a security hazard because if an attacker gains control of the container they will have root access. Switch back to another user after running commands as 'root'."},"helpUri":"https://semgrep.dev/r/dockerfile.security.last-user-is-root.last-user-is-root","id":"dockerfile.security.last-user-is-root.last-user-is-root","name":"dockerfile.security.last-user-is-root.last-user-is-root","properties":{"precision":"very-high","tags":["CWE-269: Improper Privilege Management","MEDIUM CONFIDENCE","OWASP-A04:2021 - Insecure Design","security"]},"shortDescription":{"text":"Semgrep Finding: dockerfile.security.last-user-is-root.last-user-is-root"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"By not specifying a USER, a program in the container may run as 'root'. This is a security hazard. If an attacker can control a process running as root, they may have control over the container. Ensure that the last USER in a Dockerfile is a USER other than 'root'."},"help":{"markdown":"By not specifying a USER, a program in the container may run as 'root'. This is a security hazard. If an attacker can control a process running as root, they may have control over the container. Ensure that the last USER in a Dockerfile is a USER other than 'root'.\n\nReferences: \n - [Semgrep Rule](https://semgrep.dev/r/dockerfile.security.missing-user-entrypoint.missing-user-entrypoint)\n - [https://owasp.org/Top10/A04_2021-Insecure_Design](https://owasp.org/Top10/A04_2021-Insecure_Design)\n","text":"By not specifying a USER, a program in the container may run as 'root'. This is a security hazard. If an attacker can control a process running as root, they may have control over the container. Ensure that the last USER in a Dockerfile is a USER other than 'root'."},"helpUri":"https://semgrep.dev/r/dockerfile.security.missing-user-entrypoint.missing-user-entrypoint","id":"dockerfile.security.missing-user-entrypoint.missing-user-entrypoint","name":"dockerfile.security.missing-user-entrypoint.missing-user-entrypoint","properties":{"precision":"very-high","tags":["CWE-269: Improper Privilege Management","MEDIUM CONFIDENCE","OWASP-A04:2021 - Insecure Design","security"]},"shortDescription":{"text":"Semgrep Finding: dockerfile.security.missing-user-entrypoint.missing-user-entrypoint"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"By not specifying a USER, a program in the container may run as 'root'. This is a security hazard. If an attacker can control a process running as root, they may have control over the container. Ensure that the last USER in a Dockerfile is a USER other than 'root'."},"help":{"markdown":"By not specifying a USER, a program in the container may run as 'root'. This is a security hazard. If an attacker can control a process running as root, they may have control over the container. Ensure that the last USER in a Dockerfile is a USER other than 'root'.\n\nReferences: \n - [Semgrep Rule](https://semgrep.dev/r/dockerfile.security.missing-user.missing-user)\n - [https://owasp.org/Top10/A04_2021-Insecure_Design](https://owasp.org/Top10/A04_2021-Insecure_Design)\n","text":"By not specifying a USER, a program in the container may run as 'root'. This is a security hazard. If an attacker can control a process running as root, they may have control over the container. Ensure that the last USER in a Dockerfile is a USER other than 'root'."},"helpUri":"https://semgrep.dev/r/dockerfile.security.missing-user.missing-user","id":"dockerfile.security.missing-user.missing-user","name":"dockerfile.security.missing-user.missing-user","properties":{"precision":"very-high","tags":["CWE-269: Improper Privilege Management","MEDIUM CONFIDENCE","OWASP-A04:2021 - Insecure Design","security"]},"shortDescription":{"text":"Semgrep Finding: dockerfile.security.missing-user.missing-user"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"Avoid using sudo in Dockerfiles. Running processes as a non-root user can help reduce the potential impact of configuration errors and security vulnerabilities."},"help":{"markdown":"Avoid using sudo in Dockerfiles. Running processes as a non-root user can help reduce the potential impact of configuration errors and security vulnerabilities.\n\nReferences: \n - [Semgrep Rule](https://semgrep.dev/r/dockerfile.security.no-sudo-in-dockerfile.no-sudo-in-dockerfile)\n - [https://cwe.mitre.org/data/definitions/250.html](https://cwe.mitre.org/data/definitions/250.html)\n - [https://docs.docker.com/develop/develop-images/dockerfile_best-practices/#user](https://docs.docker.com/develop/develop-images/dockerfile_best-practices/#user)\n","text":"Avoid using sudo in Dockerfiles. Running processes as a non-root user can help reduce the potential impact of configuration errors and security vulnerabilities."},"helpUri":"https://semgrep.dev/r/dockerfile.security.no-sudo-in-dockerfile.no-sudo-in-dockerfile","id":"dockerfile.security.no-sudo-in-dockerfile.no-sudo-in-dockerfile","name":"dockerfile.security.no-sudo-in-dockerfile.no-sudo-in-dockerfile","properties":{"precision":"very-high","tags":["CWE-250: Execution with Unnecessary Privileges","HIGH CONFIDENCE","OWASP-A05:2021 - Security Misconfiguration","security"]},"shortDescription":{"text":"Semgrep Finding: dockerfile.security.no-sudo-in-dockerfile.no-sudo-in-dockerfile"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"Semgrep found a bash reverse shell"},"help":{"markdown":"Semgrep found a bash reverse shell\n\nReferences: \n - [Semgrep Rule](https://semgrep.dev/r/generic.ci.security.bash-reverse-shell.bash_reverse_shell)\n - [https://owasp.org/Top10/A03_2021-Injection](https://owasp.org/Top10/A03_2021-Injection)\n","text":"Semgrep found a bash reverse shell"},"helpUri":"https://semgrep.dev/r/generic.ci.security.bash-reverse-shell.bash_reverse_shell","id":"generic.ci.security.bash-reverse-shell.bash_reverse_shell","name":"generic.ci.security.bash-reverse-shell.bash_reverse_shell","properties":{"precision":"very-high","tags":["CWE-94: Improper Control of Generation of Code ('Code Injection')","HIGH CONFIDENCE","OWASP-A03:2021 - Injection","security"]},"shortDescription":{"text":"Semgrep Finding: generic.ci.security.bash-reverse-shell.bash_reverse_shell"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"The alias in this location block is subject to a path traversal because the location path does not end in a path separator (e.g., '/'). To fix, add a path separator to the end of the path."},"help":{"markdown":"The alias in this location block is subject to a path traversal because the location path does not end in a path separator (e.g., '/'). To fix, add a path separator to the end of the path.\n\nReferences: \n - [Semgrep Rule](https://semgrep.dev/r/generic.nginx.security.alias-path-traversal.alias-path-traversal)\n - [https://owasp.org/Top10/A01_2021-Broken_Access_Control](https://owasp.org/Top10/A01_2021-Broken_Access_Control)\n - [https://www.acunetix.com/vulnerabilities/web/path-traversal-via-misconfigured-nginx-alias/](https://www.acunetix.com/vulnerabilities/web/path-traversal-via-misconfigured-nginx-alias/)\n - [https://www.youtube.com/watch?v=CIhHpkybYsY](https://www.youtube.com/watch?v=CIhHpkybYsY)\n - [https://github.com/orangetw/My-Presentation-Slides/blob/main/data/2018-Breaking-Parser-Logic-Take-Your-Path-Normalization-Off-And-Pop-0days-Out.pdf](https://github.com/orangetw/My-Presentation-Slides/blob/main/data/2018-Breaking-Parser-Logic-Take-Your-Path-Normalization-Off-And-Pop-0days-Out.pdf)\n","text":"The alias in this location block is subject to a path traversal because the location path does not end in a path separator (e.g., '/'). To fix, add a path separator to the end of the path."},"helpUri":"https://semgrep.dev/r/generic.nginx.security.alias-path-traversal.alias-path-traversal","id":"generic.nginx.security.alias-path-traversal.alias-path-traversal","name":"generic.nginx.security.alias-path-traversal.alias-path-traversal","properties":{"precision":"very-high","tags":["CWE-22: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')","LOW CONFIDENCE","OWASP-A01:2021 - Broken Access Control","OWASP-A05:2017 - Broken Access Control","security"]},"shortDescription":{"text":"Semgrep Finding: generic.nginx.security.alias-path-traversal.alias-path-traversal"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"The host for this proxy URL is dynamically determined. This can be dangerous if the host can be injected by an attacker because it may forcibly alter destination of the proxy. Consider hardcoding acceptable destinations and retrieving them with 'map' or something similar."},"help":{"markdown":"The host for this proxy URL is dynamically determined. This can be dangerous if the host can be injected by an attacker because it may forcibly alter destination of the proxy. Consider hardcoding acceptable destinations and retrieving them with 'map' or something similar.\n\nReferences: \n - [Semgrep Rule](https://semgrep.dev/r/generic.nginx.security.dynamic-proxy-host.dynamic-proxy-host)\n - [https://nginx.org/en/docs/http/ngx_http_map_module.html](https://nginx.org/en/docs/http/ngx_http_map_module.html)\n","text":"The host for this proxy URL is dynamically determined. This can be dangerous if the host can be injected by an attacker because it may forcibly alter destination of the proxy. Consider hardcoding acceptable destinations and retrieving them with 'map' or something similar."},"helpUri":"https://semgrep.dev/r/generic.nginx.security.dynamic-proxy-host.dynamic-proxy-host","id":"generic.nginx.security.dynamic-proxy-host.dynamic-proxy-host","name":"generic.nginx.security.dynamic-proxy-host.dynamic-proxy-host","properties":{"precision":"very-high","tags":["CWE-441: Unintended Proxy or Intermediary ('Confused Deputy')","MEDIUM CONFIDENCE","OWASP-A01:2021 - Broken Access Control","security"]},"shortDescription":{"text":"Semgrep Finding: generic.nginx.security.dynamic-proxy-host.dynamic-proxy-host"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"The protocol scheme for this proxy is dynamically determined. This can be dangerous if the scheme can be injected by an attacker because it may forcibly alter the connection scheme. Consider hardcoding a scheme for this proxy."},"help":{"markdown":"The protocol scheme for this proxy is dynamically determined. This can be dangerous if the scheme can be injected by an attacker because it may forcibly alter the connection scheme. Consider hardcoding a scheme for this proxy.\n\nReferences: \n - [Semgrep Rule](https://semgrep.dev/r/generic.nginx.security.dynamic-proxy-scheme.dynamic-proxy-scheme)\n - [https://github.com/yandex/gixy/blob/master/docs/en/plugins/ssrf.md](https://github.com/yandex/gixy/blob/master/docs/en/plugins/ssrf.md)\n","text":"The protocol scheme for this proxy is dynamically determined. This can be dangerous if the scheme can be injected by an attacker because it may forcibly alter the connection scheme. Consider hardcoding a scheme for this proxy."},"helpUri":"https://semgrep.dev/r/generic.nginx.security.dynamic-proxy-scheme.dynamic-proxy-scheme","id":"generic.nginx.security.dynamic-proxy-scheme.dynamic-proxy-scheme","name":"generic.nginx.security.dynamic-proxy-scheme.dynamic-proxy-scheme","properties":{"precision":"very-high","tags":["CWE-16: CWE CATEGORY: Configuration","MEDIUM CONFIDENCE","OWASP-A05:2021 - Security Misconfiguration","OWASP-A06:2017 - Security Misconfiguration","security"]},"shortDescription":{"text":"Semgrep Finding: generic.nginx.security.dynamic-proxy-scheme.dynamic-proxy-scheme"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"The $$VARIABLE path parameter is added as a header in the response. This could allow an attacker to inject a newline and add a new header into the response. This is called HTTP response splitting. To fix, do not allow whitespace in the path parameter: '[^\\s]+'."},"help":{"markdown":"The $$VARIABLE path parameter is added as a header in the response. This could allow an attacker to inject a newline and add a new header into the response. This is called HTTP response splitting. To fix, do not allow whitespace in the path parameter: '[^\\s]+'.\n\nReferences: \n - [Semgrep Rule](https://semgrep.dev/r/generic.nginx.security.header-injection.header-injection)\n - [https://github.com/yandex/gixy/blob/master/docs/en/plugins/httpsplitting.md](https://github.com/yandex/gixy/blob/master/docs/en/plugins/httpsplitting.md)\n - [https://owasp.org/www-community/attacks/HTTP_Response_Splitting](https://owasp.org/www-community/attacks/HTTP_Response_Splitting)\n","text":"The $$VARIABLE path parameter is added as a header in the response. This could allow an attacker to inject a newline and add a new header into the response. This is called HTTP response splitting. To fix, do not allow whitespace in the path parameter: '[^\\s]+'."},"helpUri":"https://semgrep.dev/r/generic.nginx.security.header-injection.header-injection","id":"generic.nginx.security.header-injection.header-injection","name":"generic.nginx.security.header-injection.header-injection","properties":{"precision":"very-high","tags":["CWE-113: Improper Neutralization of CRLF Sequences in HTTP Headers ('HTTP Request/Response Splitting')","MEDIUM CONFIDENCE","OWASP-A03:2021 - Injection","security"]},"shortDescription":{"text":"Semgrep Finding: generic.nginx.security.header-injection.header-injection"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"The 'add_header' directive is called in a 'location' block after headers have been set at the server block. Calling 'add_header' in the location block will actually overwrite the headers defined in the server block, no matter which headers are set. To fix this, explicitly set all headers or set all headers in the server block."},"help":{"markdown":"The 'add_header' directive is called in a 'location' block after headers have been set at the server block. Calling 'add_header' in the location block will actually overwrite the headers defined in the server block, no matter which headers are set. To fix this, explicitly set all headers or set all headers in the server block.\n\nReferences: \n - [Semgrep Rule](https://semgrep.dev/r/generic.nginx.security.header-redefinition.header-redefinition)\n - [https://github.com/yandex/gixy/blob/master/docs/en/plugins/addheaderredefinition.md](https://github.com/yandex/gixy/blob/master/docs/en/plugins/addheaderredefinition.md)\n","text":"The 'add_header' directive is called in a 'location' block after headers have been set at the server block. Calling 'add_header' in the location block will actually overwrite the headers defined in the server block, no matter which headers are set. To fix this, explicitly set all headers or set all headers in the server block."},"helpUri":"https://semgrep.dev/r/generic.nginx.security.header-redefinition.header-redefinition","id":"generic.nginx.security.header-redefinition.header-redefinition","name":"generic.nginx.security.header-redefinition.header-redefinition","properties":{"precision":"very-high","tags":["CWE-16: CWE CATEGORY: Configuration","LOW CONFIDENCE","OWASP-A05:2021 - Security Misconfiguration","OWASP-A06:2017 - Security Misconfiguration","security"]},"shortDescription":{"text":"Semgrep Finding: generic.nginx.security.header-redefinition.header-redefinition"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"Detected an insecure redirect in this nginx configuration. If no scheme is specified, nginx will forward the request with the incoming scheme. This could result in unencrypted communications. To fix this, include the 'https' scheme."},"help":{"markdown":"Detected an insecure redirect in this nginx configuration. If no scheme is specified, nginx will forward the request with the incoming scheme. This could result in unencrypted communications. To fix this, include the 'https' scheme.\n\nReferences: \n - [Semgrep Rule](https://semgrep.dev/r/generic.nginx.security.insecure-redirect.insecure-redirect)\n - [https://owasp.org/Top10/A02_2021-Cryptographic_Failures](https://owasp.org/Top10/A02_2021-Cryptographic_Failures)\n","text":"Detected an insecure redirect in this nginx configuration. If no scheme is specified, nginx will forward the request with the incoming scheme. This could result in unencrypted communications. To fix this, include the 'https' scheme."},"helpUri":"https://semgrep.dev/r/generic.nginx.security.insecure-redirect.insecure-redirect","id":"generic.nginx.security.insecure-redirect.insecure-redirect","name":"generic.nginx.security.insecure-redirect.insecure-redirect","properties":{"precision":"very-high","tags":["CWE-319: Cleartext Transmission of Sensitive Information","LOW CONFIDENCE","OWASP-A02:2021 - Cryptographic Failures","OWASP-A03:2017 - Sensitive Data Exposure","security"]},"shortDescription":{"text":"Semgrep Finding: generic.nginx.security.insecure-redirect.insecure-redirect"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"Detected use of an insecure SSL version. Secure SSL versions are TLSv1.2 and TLS1.3; older versions are known to be broken and are susceptible to attacks. Prefer use of TLSv1.2 or later."},"help":{"markdown":"Detected use of an insecure SSL version. Secure SSL versions are TLSv1.2 and TLS1.3; older versions are known to be broken and are susceptible to attacks. Prefer use of TLSv1.2 or later.\n\nReferences: \n - [Semgrep Rule](https://semgrep.dev/r/generic.nginx.security.insecure-ssl-version.insecure-ssl-version)\n - [https://www.acunetix.com/blog/web-security-zone/hardening-nginx/](https://www.acunetix.com/blog/web-security-zone/hardening-nginx/)\n - [https://www.acunetix.com/blog/articles/tls-ssl-cipher-hardening/](https://www.acunetix.com/blog/articles/tls-ssl-cipher-hardening/)\n","text":"Detected use of an insecure SSL version. Secure SSL versions are TLSv1.2 and TLS1.3; older versions are known to be broken and are susceptible to attacks. Prefer use of TLSv1.2 or later."},"helpUri":"https://semgrep.dev/r/generic.nginx.security.insecure-ssl-version.insecure-ssl-version","id":"generic.nginx.security.insecure-ssl-version.insecure-ssl-version","name":"generic.nginx.security.insecure-ssl-version.insecure-ssl-version","properties":{"precision":"very-high","tags":["CWE-326: Inadequate Encryption Strength","HIGH CONFIDENCE","OWASP-A02:2021 - Cryptographic Failures","OWASP-A03:2017 - Sensitive Data Exposure","security"]},"shortDescription":{"text":"Semgrep Finding: generic.nginx.security.insecure-ssl-version.insecure-ssl-version"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"This location block contains a 'proxy_pass' directive but does not contain the 'internal' directive. The 'internal' directive restricts access to this location to internal requests. Without 'internal', an attacker could use your server for server-side request forgeries (SSRF). Include the 'internal' directive in this block to limit exposure."},"help":{"markdown":"This location block contains a 'proxy_pass' directive but does not contain the 'internal' directive. The 'internal' directive restricts access to this location to internal requests. Without 'internal', an attacker could use your server for server-side request forgeries (SSRF). Include the 'internal' directive in this block to limit exposure.\n\nReferences: \n - [Semgrep Rule](https://semgrep.dev/r/generic.nginx.security.missing-internal.missing-internal)\n - [https://github.com/yandex/gixy/blob/master/docs/en/plugins/ssrf.md](https://github.com/yandex/gixy/blob/master/docs/en/plugins/ssrf.md)\n - [https://nginx.org/en/docs/http/ngx_http_core_module.html#internal](https://nginx.org/en/docs/http/ngx_http_core_module.html#internal)\n","text":"This location block contains a 'proxy_pass' directive but does not contain the 'internal' directive. The 'internal' directive restricts access to this location to internal requests. Without 'internal', an attacker could use your server for server-side request forgeries (SSRF). Include the 'internal' directive in this block to limit exposure."},"helpUri":"https://semgrep.dev/r/generic.nginx.security.missing-internal.missing-internal","id":"generic.nginx.security.missing-internal.missing-internal","name":"generic.nginx.security.missing-internal.missing-internal","properties":{"precision":"very-high","tags":["CWE-16: CWE CATEGORY: Configuration","LOW CONFIDENCE","OWASP-A05:2021 - Security Misconfiguration","OWASP-A06:2017 - Security Misconfiguration","security"]},"shortDescription":{"text":"Semgrep Finding: generic.nginx.security.missing-internal.missing-internal"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"This server configuration is missing the 'ssl_protocols' directive. By default, this server will use 'ssl_protocols TLSv1 TLSv1.1 TLSv1.2', and versions older than TLSv1.2 are known to be broken. Explicitly specify 'ssl_protocols TLSv1.2 TLSv1.3' to use secure TLS versions."},"help":{"markdown":"This server configuration is missing the 'ssl_protocols' directive. By default, this server will use 'ssl_protocols TLSv1 TLSv1.1 TLSv1.2', and versions older than TLSv1.2 are known to be broken. Explicitly specify 'ssl_protocols TLSv1.2 TLSv1.3' to use secure TLS versions.\n\nReferences: \n - [Semgrep Rule](https://semgrep.dev/r/generic.nginx.security.missing-ssl-version.missing-ssl-version)\n - [https://www.acunetix.com/blog/web-security-zone/hardening-nginx/](https://www.acunetix.com/blog/web-security-zone/hardening-nginx/)\n - [https://nginx.org/en/docs/http/configuring_https_servers.html](https://nginx.org/en/docs/http/configuring_https_servers.html)\n","text":"This server configuration is missing the 'ssl_protocols' directive. By default, this server will use 'ssl_protocols TLSv1 TLSv1.1 TLSv1.2', and versions older than TLSv1.2 are known to be broken. Explicitly specify 'ssl_protocols TLSv1.2 TLSv1.3' to use secure TLS versions."},"helpUri":"https://semgrep.dev/r/generic.nginx.security.missing-ssl-version.missing-ssl-version","id":"generic.nginx.security.missing-ssl-version.missing-ssl-version","name":"generic.nginx.security.missing-ssl-version.missing-ssl-version","properties":{"precision":"very-high","tags":["CWE-326: Inadequate Encryption Strength","MEDIUM CONFIDENCE","OWASP-A02:2021 - Cryptographic Failures","OWASP-A03:2017 - Sensitive Data Exposure","security"]},"shortDescription":{"text":"Semgrep Finding: generic.nginx.security.missing-ssl-version.missing-ssl-version"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"Conditions for Nginx H2C smuggling identified. H2C smuggling allows upgrading HTTP/1.1 connections to lesser-known HTTP/2 over cleartext (h2c) connections which can allow a bypass of reverse proxy access controls, and lead to long-lived, unrestricted HTTP traffic directly to back-end servers. To mitigate: WebSocket support required: Allow only the value websocket for HTTP/1.1 upgrade headers (e.g., Upgrade: websocket). WebSocket support not required: Do not forward Upgrade headers."},"help":{"markdown":"Conditions for Nginx H2C smuggling identified. H2C smuggling allows upgrading HTTP/1.1 connections to lesser-known HTTP/2 over cleartext (h2c) connections which can allow a bypass of reverse proxy access controls, and lead to long-lived, unrestricted HTTP traffic directly to back-end servers. To mitigate: WebSocket support required: Allow only the value websocket for HTTP/1.1 upgrade headers (e.g., Upgrade: websocket). WebSocket support not required: Do not forward Upgrade headers.\n\nReferences: \n - [Semgrep Rule](https://semgrep.dev/r/generic.nginx.security.possible-h2c-smuggling.possible-nginx-h2c-smuggling)\n - [https://labs.bishopfox.com/tech-blog/h2c-smuggling-request-smuggling-via-http/2-cleartext-h2c](https://labs.bishopfox.com/tech-blog/h2c-smuggling-request-smuggling-via-http/2-cleartext-h2c)\n","text":"Conditions for Nginx H2C smuggling identified. H2C smuggling allows upgrading HTTP/1.1 connections to lesser-known HTTP/2 over cleartext (h2c) connections which can allow a bypass of reverse proxy access controls, and lead to long-lived, unrestricted HTTP traffic directly to back-end servers. To mitigate: WebSocket support required: Allow only the value websocket for HTTP/1.1 upgrade headers (e.g., Upgrade: websocket). WebSocket support not required: Do not forward Upgrade headers."},"helpUri":"https://semgrep.dev/r/generic.nginx.security.possible-h2c-smuggling.possible-nginx-h2c-smuggling","id":"generic.nginx.security.possible-h2c-smuggling.possible-nginx-h2c-smuggling","name":"generic.nginx.security.possible-h2c-smuggling.possible-nginx-h2c-smuggling","properties":{"precision":"very-high","tags":["CWE-444: Inconsistent Interpretation of HTTP Requests ('HTTP Request/Response Smuggling')","MEDIUM CONFIDENCE","OWASP-A04:2021 - Insecure Design","security"]},"shortDescription":{"text":"Semgrep Finding: generic.nginx.security.possible-h2c-smuggling.possible-nginx-h2c-smuggling"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"Amazon MWS Auth Token detected"},"help":{"markdown":"Amazon MWS Auth Token detected\n\nReferences: \n - [Semgrep Rule](https://semgrep.dev/r/generic.secrets.security.detected-amazon-mws-auth-token.detected-amazon-mws-auth-token)\n - [https://owasp.org/Top10/A07_2021-Identification_and_Authentication_Failures](https://owasp.org/Top10/A07_2021-Identification_and_Authentication_Failures)\n","text":"Amazon MWS Auth Token detected"},"helpUri":"https://semgrep.dev/r/generic.secrets.security.detected-amazon-mws-auth-token.detected-amazon-mws-auth-token","id":"generic.secrets.security.detected-amazon-mws-auth-token.detected-amazon-mws-auth-token","name":"generic.secrets.security.detected-amazon-mws-auth-token.detected-amazon-mws-auth-token","properties":{"precision":"very-high","tags":["CWE-798: Use of Hard-coded Credentials","LOW CONFIDENCE","OWASP-A07:2021 - Identification and Authentication Failures","security"]},"shortDescription":{"text":"Semgrep Finding: generic.secrets.security.detected-amazon-mws-auth-token.detected-amazon-mws-auth-token"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"Artifactory token detected"},"help":{"markdown":"Artifactory token detected\n\nReferences: \n - [Semgrep Rule](https://semgrep.dev/r/generic.secrets.security.detected-artifactory-password.detected-artifactory-password)\n - [https://owasp.org/Top10/A07_2021-Identification_and_Authentication_Failures](https://owasp.org/Top10/A07_2021-Identification_and_Authentication_Failures)\n","text":"Artifactory token detected"},"helpUri":"https://semgrep.dev/r/generic.secrets.security.detected-artifactory-password.detected-artifactory-password","id":"generic.secrets.security.detected-artifactory-password.detected-artifactory-password","name":"generic.secrets.security.detected-artifactory-password.detected-artifactory-password","properties":{"precision":"very-high","tags":["CWE-798: Use of Hard-coded Credentials","LOW CONFIDENCE","OWASP-A07:2021 - Identification and Authentication Failures","security"]},"shortDescription":{"text":"Semgrep Finding: generic.secrets.security.detected-artifactory-password.detected-artifactory-password"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"Artifactory token detected"},"help":{"markdown":"Artifactory token detected\n\nReferences: \n - [Semgrep Rule](https://semgrep.dev/r/generic.secrets.security.detected-artifactory-token.detected-artifactory-token)\n - [https://owasp.org/Top10/A07_2021-Identification_and_Authentication_Failures](https://owasp.org/Top10/A07_2021-Identification_and_Authentication_Failures)\n","text":"Artifactory token detected"},"helpUri":"https://semgrep.dev/r/generic.secrets.security.detected-artifactory-token.detected-artifactory-token","id":"generic.secrets.security.detected-artifactory-token.detected-artifactory-token","name":"generic.secrets.security.detected-artifactory-token.detected-artifactory-token","properties":{"precision":"very-high","tags":["CWE-798: Use of Hard-coded Credentials","LOW CONFIDENCE","OWASP-A07:2021 - Identification and Authentication Failures","security"]},"shortDescription":{"text":"Semgrep Finding: generic.secrets.security.detected-artifactory-token.detected-artifactory-token"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"AWS Access Key ID Value detected. This is a sensitive credential and should not be hardcoded here. Instead, read this value from an environment variable or keep it in a separate, private file."},"help":{"markdown":"AWS Access Key ID Value detected. This is a sensitive credential and should not be hardcoded here. Instead, read this value from an environment variable or keep it in a separate, private file.\n\nReferences: \n - [Semgrep Rule](https://semgrep.dev/r/generic.secrets.security.detected-aws-access-key-id-value.detected-aws-access-key-id-value)\n - [https://owasp.org/Top10/A07_2021-Identification_and_Authentication_Failures](https://owasp.org/Top10/A07_2021-Identification_and_Authentication_Failures)\n","text":"AWS Access Key ID Value detected. This is a sensitive credential and should not be hardcoded here. Instead, read this value from an environment variable or keep it in a separate, private file."},"helpUri":"https://semgrep.dev/r/generic.secrets.security.detected-aws-access-key-id-value.detected-aws-access-key-id-value","id":"generic.secrets.security.detected-aws-access-key-id-value.detected-aws-access-key-id-value","name":"generic.secrets.security.detected-aws-access-key-id-value.detected-aws-access-key-id-value","properties":{"precision":"very-high","tags":["CWE-798: Use of Hard-coded Credentials","LOW CONFIDENCE","OWASP-A07:2021 - Identification and Authentication Failures","security"]},"shortDescription":{"text":"Semgrep Finding: generic.secrets.security.detected-aws-access-key-id-value.detected-aws-access-key-id-value"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"AWS Account ID detected. While not considered sensitive information, it is important to use them and share them carefully. For that reason it would be preferrable avoiding to hardcoded it here. Instead, read the value from an environment variable or keep the value in a separate, private file."},"help":{"markdown":"AWS Account ID detected. While not considered sensitive information, it is important to use them and share them carefully. For that reason it would be preferrable avoiding to hardcoded it here. Instead, read the value from an environment variable or keep the value in a separate, private file.\n\nReferences: \n - [Semgrep Rule](https://semgrep.dev/r/generic.secrets.security.detected-aws-account-id.detected-aws-account-id)\n - [https://owasp.org/Top10/A07_2021-Identification_and_Authentication_Failures](https://owasp.org/Top10/A07_2021-Identification_and_Authentication_Failures)\n","text":"AWS Account ID detected. While not considered sensitive information, it is important to use them and share them carefully. For that reason it would be preferrable avoiding to hardcoded it here. Instead, read the value from an environment variable or keep the value in a separate, private file."},"helpUri":"https://semgrep.dev/r/generic.secrets.security.detected-aws-account-id.detected-aws-account-id","id":"generic.secrets.security.detected-aws-account-id.detected-aws-account-id","name":"generic.secrets.security.detected-aws-account-id.detected-aws-account-id","properties":{"precision":"very-high","tags":["CWE-798: Use of Hard-coded Credentials","LOW CONFIDENCE","OWASP-A07:2021 - Identification and Authentication Failures","security"]},"shortDescription":{"text":"Semgrep Finding: generic.secrets.security.detected-aws-account-id.detected-aws-account-id"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"AWS AppSync GraphQL Key detected"},"help":{"markdown":"AWS AppSync GraphQL Key detected\n\nReferences: \n - [Semgrep Rule](https://semgrep.dev/r/generic.secrets.security.detected-aws-appsync-graphql-key.detected-aws-appsync-graphql-key)\n - [https://owasp.org/Top10/A07_2021-Identification_and_Authentication_Failures](https://owasp.org/Top10/A07_2021-Identification_and_Authentication_Failures)\n","text":"AWS AppSync GraphQL Key detected"},"helpUri":"https://semgrep.dev/r/generic.secrets.security.detected-aws-appsync-graphql-key.detected-aws-appsync-graphql-key","id":"generic.secrets.security.detected-aws-appsync-graphql-key.detected-aws-appsync-graphql-key","name":"generic.secrets.security.detected-aws-appsync-graphql-key.detected-aws-appsync-graphql-key","properties":{"precision":"very-high","tags":["CWE-798: Use of Hard-coded Credentials","LOW CONFIDENCE","OWASP-A07:2021 - Identification and Authentication Failures","security"]},"shortDescription":{"text":"Semgrep Finding: generic.secrets.security.detected-aws-appsync-graphql-key.detected-aws-appsync-graphql-key"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"AWS Secret Access Key detected"},"help":{"markdown":"AWS Secret Access Key detected\n\nReferences: \n - [Semgrep Rule](https://semgrep.dev/r/generic.secrets.security.detected-aws-secret-access-key.detected-aws-secret-access-key)\n - [https://owasp.org/Top10/A07_2021-Identification_and_Authentication_Failures](https://owasp.org/Top10/A07_2021-Identification_and_Authentication_Failures)\n","text":"AWS Secret Access Key detected"},"helpUri":"https://semgrep.dev/r/generic.secrets.security.detected-aws-secret-access-key.detected-aws-secret-access-key","id":"generic.secrets.security.detected-aws-secret-access-key.detected-aws-secret-access-key","name":"generic.secrets.security.detected-aws-secret-access-key.detected-aws-secret-access-key","properties":{"precision":"very-high","tags":["CWE-798: Use of Hard-coded Credentials","LOW CONFIDENCE","OWASP-A07:2021 - Identification and Authentication Failures","security"]},"shortDescription":{"text":"Semgrep Finding: generic.secrets.security.detected-aws-secret-access-key.detected-aws-secret-access-key"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"AWS Session Token detected"},"help":{"markdown":"AWS Session Token detected\n\nReferences: \n - [Semgrep Rule](https://semgrep.dev/r/generic.secrets.security.detected-aws-session-token.detected-aws-session-token)\n - [https://owasp.org/Top10/A07_2021-Identification_and_Authentication_Failures](https://owasp.org/Top10/A07_2021-Identification_and_Authentication_Failures)\n","text":"AWS Session Token detected"},"helpUri":"https://semgrep.dev/r/generic.secrets.security.detected-aws-session-token.detected-aws-session-token","id":"generic.secrets.security.detected-aws-session-token.detected-aws-session-token","name":"generic.secrets.security.detected-aws-session-token.detected-aws-session-token","properties":{"precision":"very-high","tags":["CWE-798: Use of Hard-coded Credentials","LOW CONFIDENCE","OWASP-A07:2021 - Identification and Authentication Failures","security"]},"shortDescription":{"text":"Semgrep Finding: generic.secrets.security.detected-aws-session-token.detected-aws-session-token"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"bcrypt hash detected"},"help":{"markdown":"bcrypt hash detected\n\nReferences: \n - [Semgrep Rule](https://semgrep.dev/r/generic.secrets.security.detected-bcrypt-hash.detected-bcrypt-hash)\n - [https://owasp.org/Top10/A07_2021-Identification_and_Authentication_Failures](https://owasp.org/Top10/A07_2021-Identification_and_Authentication_Failures)\n","text":"bcrypt hash detected"},"helpUri":"https://semgrep.dev/r/generic.secrets.security.detected-bcrypt-hash.detected-bcrypt-hash","id":"generic.secrets.security.detected-bcrypt-hash.detected-bcrypt-hash","name":"generic.secrets.security.detected-bcrypt-hash.detected-bcrypt-hash","properties":{"precision":"very-high","tags":["CWE-798: Use of Hard-coded Credentials","LOW CONFIDENCE","OWASP-A07:2021 - Identification and Authentication Failures","security"]},"shortDescription":{"text":"Semgrep Finding: generic.secrets.security.detected-bcrypt-hash.detected-bcrypt-hash"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"CodeClimate detected"},"help":{"markdown":"CodeClimate detected\n\nReferences: \n - [Semgrep Rule](https://semgrep.dev/r/generic.secrets.security.detected-codeclimate.detected-codeclimate)\n - [https://owasp.org/Top10/A07_2021-Identification_and_Authentication_Failures](https://owasp.org/Top10/A07_2021-Identification_and_Authentication_Failures)\n","text":"CodeClimate detected"},"helpUri":"https://semgrep.dev/r/generic.secrets.security.detected-codeclimate.detected-codeclimate","id":"generic.secrets.security.detected-codeclimate.detected-codeclimate","name":"generic.secrets.security.detected-codeclimate.detected-codeclimate","properties":{"precision":"very-high","tags":["CWE-798: Use of Hard-coded Credentials","LOW CONFIDENCE","OWASP-A07:2021 - Identification and Authentication Failures","security"]},"shortDescription":{"text":"Semgrep Finding: generic.secrets.security.detected-codeclimate.detected-codeclimate"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"linux shadow file detected"},"help":{"markdown":"linux shadow file detected\n\nReferences: \n - [Semgrep Rule](https://semgrep.dev/r/generic.secrets.security.detected-etc-shadow.detected-etc-shadow)\n - [https://owasp.org/Top10/A07_2021-Identification_and_Authentication_Failures](https://owasp.org/Top10/A07_2021-Identification_and_Authentication_Failures)\n","text":"linux shadow file detected"},"helpUri":"https://semgrep.dev/r/generic.secrets.security.detected-etc-shadow.detected-etc-shadow","id":"generic.secrets.security.detected-etc-shadow.detected-etc-shadow","name":"generic.secrets.security.detected-etc-shadow.detected-etc-shadow","properties":{"precision":"very-high","tags":["CWE-798: Use of Hard-coded Credentials","LOW CONFIDENCE","OWASP-A07:2021 - Identification and Authentication Failures","security"]},"shortDescription":{"text":"Semgrep Finding: generic.secrets.security.detected-etc-shadow.detected-etc-shadow"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"Facebook Access Token detected"},"help":{"markdown":"Facebook Access Token detected\n\nReferences: \n - [Semgrep Rule](https://semgrep.dev/r/generic.secrets.security.detected-facebook-access-token.detected-facebook-access-token)\n - [https://owasp.org/Top10/A07_2021-Identification_and_Authentication_Failures](https://owasp.org/Top10/A07_2021-Identification_and_Authentication_Failures)\n","text":"Facebook Access Token detected"},"helpUri":"https://semgrep.dev/r/generic.secrets.security.detected-facebook-access-token.detected-facebook-access-token","id":"generic.secrets.security.detected-facebook-access-token.detected-facebook-access-token","name":"generic.secrets.security.detected-facebook-access-token.detected-facebook-access-token","properties":{"precision":"very-high","tags":["CWE-798: Use of Hard-coded Credentials","LOW CONFIDENCE","OWASP-A07:2021 - Identification and Authentication Failures","security"]},"shortDescription":{"text":"Semgrep Finding: generic.secrets.security.detected-facebook-access-token.detected-facebook-access-token"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"Facebook OAuth detected"},"help":{"markdown":"Facebook OAuth detected\n\nReferences: \n - [Semgrep Rule](https://semgrep.dev/r/generic.secrets.security.detected-facebook-oauth.detected-facebook-oauth)\n - [https://owasp.org/Top10/A07_2021-Identification_and_Authentication_Failures](https://owasp.org/Top10/A07_2021-Identification_and_Authentication_Failures)\n","text":"Facebook OAuth detected"},"helpUri":"https://semgrep.dev/r/generic.secrets.security.detected-facebook-oauth.detected-facebook-oauth","id":"generic.secrets.security.detected-facebook-oauth.detected-facebook-oauth","name":"generic.secrets.security.detected-facebook-oauth.detected-facebook-oauth","properties":{"precision":"very-high","tags":["CWE-798: Use of Hard-coded Credentials","LOW CONFIDENCE","OWASP-A07:2021 - Identification and Authentication Failures","security"]},"shortDescription":{"text":"Semgrep Finding: generic.secrets.security.detected-facebook-oauth.detected-facebook-oauth"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"Generic API Key detected"},"help":{"markdown":"Generic API Key detected\n\nReferences: \n - [Semgrep Rule](https://semgrep.dev/r/generic.secrets.security.detected-generic-api-key.detected-generic-api-key)\n - [https://github.com/dxa4481/truffleHogRegexes/blob/master/truffleHogRegexes/regexes.json](https://github.com/dxa4481/truffleHogRegexes/blob/master/truffleHogRegexes/regexes.json)\n","text":"Generic API Key detected"},"helpUri":"https://semgrep.dev/r/generic.secrets.security.detected-generic-api-key.detected-generic-api-key","id":"generic.secrets.security.detected-generic-api-key.detected-generic-api-key","name":"generic.secrets.security.detected-generic-api-key.detected-generic-api-key","properties":{"precision":"very-high","tags":["CWE-798: Use of Hard-coded Credentials","LOW CONFIDENCE","OWASP-A07:2021 - Identification and Authentication Failures","security"]},"shortDescription":{"text":"Semgrep Finding: generic.secrets.security.detected-generic-api-key.detected-generic-api-key"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"Generic Secret detected"},"help":{"markdown":"Generic Secret detected\n\nReferences: \n - [Semgrep Rule](https://semgrep.dev/r/generic.secrets.security.detected-generic-secret.detected-generic-secret)\n - [https://owasp.org/Top10/A07_2021-Identification_and_Authentication_Failures](https://owasp.org/Top10/A07_2021-Identification_and_Authentication_Failures)\n","text":"Generic Secret detected"},"helpUri":"https://semgrep.dev/r/generic.secrets.security.detected-generic-secret.detected-generic-secret","id":"generic.secrets.security.detected-generic-secret.detected-generic-secret","name":"generic.secrets.security.detected-generic-secret.detected-generic-secret","properties":{"precision":"very-high","tags":["CWE-798: Use of Hard-coded Credentials","LOW CONFIDENCE","OWASP-A07:2021 - Identification and Authentication Failures","security"]},"shortDescription":{"text":"Semgrep Finding: generic.secrets.security.detected-generic-secret.detected-generic-secret"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"GitHub Token detected"},"help":{"markdown":"GitHub Token detected\n\nReferences: \n - [Semgrep Rule](https://semgrep.dev/r/generic.secrets.security.detected-github-token.detected-github-token)\n - [https://owasp.org/Top10/A07_2021-Identification_and_Authentication_Failures](https://owasp.org/Top10/A07_2021-Identification_and_Authentication_Failures)\n","text":"GitHub Token detected"},"helpUri":"https://semgrep.dev/r/generic.secrets.security.detected-github-token.detected-github-token","id":"generic.secrets.security.detected-github-token.detected-github-token","name":"generic.secrets.security.detected-github-token.detected-github-token","properties":{"precision":"very-high","tags":["CWE-798: Use of Hard-coded Credentials","LOW CONFIDENCE","OWASP-A07:2021 - Identification and Authentication Failures","security"]},"shortDescription":{"text":"Semgrep Finding: generic.secrets.security.detected-github-token.detected-github-token"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"Google OAuth Access Token detected"},"help":{"markdown":"Google OAuth Access Token detected\n\nReferences: \n - [Semgrep Rule](https://semgrep.dev/r/generic.secrets.security.detected-google-oauth-access-token.detected-google-oauth-access-token)\n - [https://owasp.org/Top10/A07_2021-Identification_and_Authentication_Failures](https://owasp.org/Top10/A07_2021-Identification_and_Authentication_Failures)\n","text":"Google OAuth Access Token detected"},"helpUri":"https://semgrep.dev/r/generic.secrets.security.detected-google-oauth-access-token.detected-google-oauth-access-token","id":"generic.secrets.security.detected-google-oauth-access-token.detected-google-oauth-access-token","name":"generic.secrets.security.detected-google-oauth-access-token.detected-google-oauth-access-token","properties":{"precision":"very-high","tags":["CWE-798: Use of Hard-coded Credentials","LOW CONFIDENCE","OWASP-A07:2021 - Identification and Authentication Failures","security"]},"shortDescription":{"text":"Semgrep Finding: generic.secrets.security.detected-google-oauth-access-token.detected-google-oauth-access-token"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"Heroku API Key detected"},"help":{"markdown":"Heroku API Key detected\n\nReferences: \n - [Semgrep Rule](https://semgrep.dev/r/generic.secrets.security.detected-heroku-api-key.detected-heroku-api-key)\n - [https://owasp.org/Top10/A07_2021-Identification_and_Authentication_Failures](https://owasp.org/Top10/A07_2021-Identification_and_Authentication_Failures)\n","text":"Heroku API Key detected"},"helpUri":"https://semgrep.dev/r/generic.secrets.security.detected-heroku-api-key.detected-heroku-api-key","id":"generic.secrets.security.detected-heroku-api-key.detected-heroku-api-key","name":"generic.secrets.security.detected-heroku-api-key.detected-heroku-api-key","properties":{"precision":"very-high","tags":["CWE-798: Use of Hard-coded Credentials","LOW CONFIDENCE","OWASP-A07:2021 - Identification and Authentication Failures","security"]},"shortDescription":{"text":"Semgrep Finding: generic.secrets.security.detected-heroku-api-key.detected-heroku-api-key"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"HockeyApp detected"},"help":{"markdown":"HockeyApp detected\n\nReferences: \n - [Semgrep Rule](https://semgrep.dev/r/generic.secrets.security.detected-hockeyapp.detected-hockeyapp)\n - [https://owasp.org/Top10/A07_2021-Identification_and_Authentication_Failures](https://owasp.org/Top10/A07_2021-Identification_and_Authentication_Failures)\n","text":"HockeyApp detected"},"helpUri":"https://semgrep.dev/r/generic.secrets.security.detected-hockeyapp.detected-hockeyapp","id":"generic.secrets.security.detected-hockeyapp.detected-hockeyapp","name":"generic.secrets.security.detected-hockeyapp.detected-hockeyapp","properties":{"precision":"very-high","tags":["CWE-798: Use of Hard-coded Credentials","LOW CONFIDENCE","OWASP-A07:2021 - Identification and Authentication Failures","security"]},"shortDescription":{"text":"Semgrep Finding: generic.secrets.security.detected-hockeyapp.detected-hockeyapp"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"JWT token detected"},"help":{"markdown":"JWT token detected\n\nReferences: \n - [Semgrep Rule](https://semgrep.dev/r/generic.secrets.security.detected-jwt-token.detected-jwt-token)\n - [https://semgrep.dev/blog/2020/hardcoded-secrets-unverified-tokens-and-other-common-jwt-mistakes/](https://semgrep.dev/blog/2020/hardcoded-secrets-unverified-tokens-and-other-common-jwt-mistakes/)\n","text":"JWT token detected"},"helpUri":"https://semgrep.dev/r/generic.secrets.security.detected-jwt-token.detected-jwt-token","id":"generic.secrets.security.detected-jwt-token.detected-jwt-token","name":"generic.secrets.security.detected-jwt-token.detected-jwt-token","properties":{"precision":"very-high","tags":["CWE-321: Use of Hard-coded Cryptographic Key","LOW CONFIDENCE","OWASP-A02:2021 - Cryptographic Failures","security"]},"shortDescription":{"text":"Semgrep Finding: generic.secrets.security.detected-jwt-token.detected-jwt-token"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"Kolide API Key detected"},"help":{"markdown":"Kolide API Key detected\n\nReferences: \n - [Semgrep Rule](https://semgrep.dev/r/generic.secrets.security.detected-kolide-api-key.detected-kolide-api-key)\n - [https://owasp.org/Top10/A07_2021-Identification_and_Authentication_Failures](https://owasp.org/Top10/A07_2021-Identification_and_Authentication_Failures)\n","text":"Kolide API Key detected"},"helpUri":"https://semgrep.dev/r/generic.secrets.security.detected-kolide-api-key.detected-kolide-api-key","id":"generic.secrets.security.detected-kolide-api-key.detected-kolide-api-key","name":"generic.secrets.security.detected-kolide-api-key.detected-kolide-api-key","properties":{"precision":"very-high","tags":["CWE-798: Use of Hard-coded Credentials","LOW CONFIDENCE","OWASP-A07:2021 - Identification and Authentication Failures","security"]},"shortDescription":{"text":"Semgrep Finding: generic.secrets.security.detected-kolide-api-key.detected-kolide-api-key"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"MailChimp API Key detected"},"help":{"markdown":"MailChimp API Key detected\n\nReferences: \n - [Semgrep Rule](https://semgrep.dev/r/generic.secrets.security.detected-mailchimp-api-key.detected-mailchimp-api-key)\n - [https://owasp.org/Top10/A07_2021-Identification_and_Authentication_Failures](https://owasp.org/Top10/A07_2021-Identification_and_Authentication_Failures)\n","text":"MailChimp API Key detected"},"helpUri":"https://semgrep.dev/r/generic.secrets.security.detected-mailchimp-api-key.detected-mailchimp-api-key","id":"generic.secrets.security.detected-mailchimp-api-key.detected-mailchimp-api-key","name":"generic.secrets.security.detected-mailchimp-api-key.detected-mailchimp-api-key","properties":{"precision":"very-high","tags":["CWE-798: Use of Hard-coded Credentials","LOW CONFIDENCE","OWASP-A07:2021 - Identification and Authentication Failures","security"]},"shortDescription":{"text":"Semgrep Finding: generic.secrets.security.detected-mailchimp-api-key.detected-mailchimp-api-key"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"Mailgun API Key detected"},"help":{"markdown":"Mailgun API Key detected\n\nReferences: \n - [Semgrep Rule](https://semgrep.dev/r/generic.secrets.security.detected-mailgun-api-key.detected-mailgun-api-key)\n - [https://owasp.org/Top10/A07_2021-Identification_and_Authentication_Failures](https://owasp.org/Top10/A07_2021-Identification_and_Authentication_Failures)\n","text":"Mailgun API Key detected"},"helpUri":"https://semgrep.dev/r/generic.secrets.security.detected-mailgun-api-key.detected-mailgun-api-key","id":"generic.secrets.security.detected-mailgun-api-key.detected-mailgun-api-key","name":"generic.secrets.security.detected-mailgun-api-key.detected-mailgun-api-key","properties":{"precision":"very-high","tags":["CWE-798: Use of Hard-coded Credentials","LOW CONFIDENCE","OWASP-A07:2021 - Identification and Authentication Failures","security"]},"shortDescription":{"text":"Semgrep Finding: generic.secrets.security.detected-mailgun-api-key.detected-mailgun-api-key"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"NPM registry authentication token detected"},"help":{"markdown":"NPM registry authentication token detected\n\nReferences: \n - [Semgrep Rule](https://semgrep.dev/r/generic.secrets.security.detected-npm-registry-auth-token.detected-npm-registry-auth-token)\n - [https://owasp.org/Top10/A07_2021-Identification_and_Authentication_Failures](https://owasp.org/Top10/A07_2021-Identification_and_Authentication_Failures)\n","text":"NPM registry authentication token detected"},"helpUri":"https://semgrep.dev/r/generic.secrets.security.detected-npm-registry-auth-token.detected-npm-registry-auth-token","id":"generic.secrets.security.detected-npm-registry-auth-token.detected-npm-registry-auth-token","name":"generic.secrets.security.detected-npm-registry-auth-token.detected-npm-registry-auth-token","properties":{"precision":"very-high","tags":["CWE-798: Use of Hard-coded Credentials","LOW CONFIDENCE","OWASP-A07:2021 - Identification and Authentication Failures","security"]},"shortDescription":{"text":"Semgrep Finding: generic.secrets.security.detected-npm-registry-auth-token.detected-npm-registry-auth-token"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"Onfido live API Token detected"},"help":{"markdown":"Onfido live API Token detected\n\nReferences: \n - [Semgrep Rule](https://semgrep.dev/r/generic.secrets.security.detected-onfido-live-api-token.detected-onfido-live-api-token)\n - [https://documentation.onfido.com/api/latest/#api-tokens](https://documentation.onfido.com/api/latest/#api-tokens)\n","text":"Onfido live API Token detected"},"helpUri":"https://semgrep.dev/r/generic.secrets.security.detected-onfido-live-api-token.detected-onfido-live-api-token","id":"generic.secrets.security.detected-onfido-live-api-token.detected-onfido-live-api-token","name":"generic.secrets.security.detected-onfido-live-api-token.detected-onfido-live-api-token","properties":{"precision":"very-high","tags":["CWE-798: Use of Hard-coded Credentials","HIGH CONFIDENCE","security"]},"shortDescription":{"text":"Semgrep Finding: generic.secrets.security.detected-onfido-live-api-token.detected-onfido-live-api-token"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"Outlook Team detected"},"help":{"markdown":"Outlook Team detected\n\nReferences: \n - [Semgrep Rule](https://semgrep.dev/r/generic.secrets.security.detected-outlook-team.detected-outlook-team)\n - [https://owasp.org/Top10/A07_2021-Identification_and_Authentication_Failures](https://owasp.org/Top10/A07_2021-Identification_and_Authentication_Failures)\n","text":"Outlook Team detected"},"helpUri":"https://semgrep.dev/r/generic.secrets.security.detected-outlook-team.detected-outlook-team","id":"generic.secrets.security.detected-outlook-team.detected-outlook-team","name":"generic.secrets.security.detected-outlook-team.detected-outlook-team","properties":{"precision":"very-high","tags":["CWE-798: Use of Hard-coded Credentials","LOW CONFIDENCE","OWASP-A07:2021 - Identification and Authentication Failures","security"]},"shortDescription":{"text":"Semgrep Finding: generic.secrets.security.detected-outlook-team.detected-outlook-team"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"PayPal Braintree Access Token detected"},"help":{"markdown":"PayPal Braintree Access Token detected\n\nReferences: \n - [Semgrep Rule](https://semgrep.dev/r/generic.secrets.security.detected-paypal-braintree-access-token.detected-paypal-braintree-access-token)\n - [https://owasp.org/Top10/A07_2021-Identification_and_Authentication_Failures](https://owasp.org/Top10/A07_2021-Identification_and_Authentication_Failures)\n","text":"PayPal Braintree Access Token detected"},"helpUri":"https://semgrep.dev/r/generic.secrets.security.detected-paypal-braintree-access-token.detected-paypal-braintree-access-token","id":"generic.secrets.security.detected-paypal-braintree-access-token.detected-paypal-braintree-access-token","name":"generic.secrets.security.detected-paypal-braintree-access-token.detected-paypal-braintree-access-token","properties":{"precision":"very-high","tags":["CWE-798: Use of Hard-coded Credentials","LOW CONFIDENCE","OWASP-A07:2021 - Identification and Authentication Failures","security"]},"shortDescription":{"text":"Semgrep Finding: generic.secrets.security.detected-paypal-braintree-access-token.detected-paypal-braintree-access-token"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"Something that looks like a PGP private key block is detected. This is a potential hardcoded secret that could be leaked if this code is committed. Instead, remove this code block from the commit."},"help":{"markdown":"Something that looks like a PGP private key block is detected. This is a potential hardcoded secret that could be leaked if this code is committed. Instead, remove this code block from the commit.\n\nReferences: \n - [Semgrep Rule](https://semgrep.dev/r/generic.secrets.security.detected-pgp-private-key-block.detected-pgp-private-key-block)\n - [https://owasp.org/Top10/A07_2021-Identification_and_Authentication_Failures](https://owasp.org/Top10/A07_2021-Identification_and_Authentication_Failures)\n","text":"Something that looks like a PGP private key block is detected. This is a potential hardcoded secret that could be leaked if this code is committed. Instead, remove this code block from the commit."},"helpUri":"https://semgrep.dev/r/generic.secrets.security.detected-pgp-private-key-block.detected-pgp-private-key-block","id":"generic.secrets.security.detected-pgp-private-key-block.detected-pgp-private-key-block","name":"generic.secrets.security.detected-pgp-private-key-block.detected-pgp-private-key-block","properties":{"precision":"very-high","tags":["CWE-798: Use of Hard-coded Credentials","LOW CONFIDENCE","OWASP-A07:2021 - Identification and Authentication Failures","security"]},"shortDescription":{"text":"Semgrep Finding: generic.secrets.security.detected-pgp-private-key-block.detected-pgp-private-key-block"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"Picatic API Key detected"},"help":{"markdown":"Picatic API Key detected\n\nReferences: \n - [Semgrep Rule](https://semgrep.dev/r/generic.secrets.security.detected-picatic-api-key.detected-picatic-api-key)\n - [https://owasp.org/Top10/A07_2021-Identification_and_Authentication_Failures](https://owasp.org/Top10/A07_2021-Identification_and_Authentication_Failures)\n","text":"Picatic API Key detected"},"helpUri":"https://semgrep.dev/r/generic.secrets.security.detected-picatic-api-key.detected-picatic-api-key","id":"generic.secrets.security.detected-picatic-api-key.detected-picatic-api-key","name":"generic.secrets.security.detected-picatic-api-key.detected-picatic-api-key","properties":{"precision":"very-high","tags":["CWE-798: Use of Hard-coded Credentials","LOW CONFIDENCE","OWASP-A07:2021 - Identification and Authentication Failures","security"]},"shortDescription":{"text":"Semgrep Finding: generic.secrets.security.detected-picatic-api-key.detected-picatic-api-key"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"Private Key detected. This is a sensitive credential and should not be hardcoded here. Instead, store this in a separate, private file."},"help":{"markdown":"Private Key detected. This is a sensitive credential and should not be hardcoded here. Instead, store this in a separate, private file.\n\nReferences: \n - [Semgrep Rule](https://semgrep.dev/r/generic.secrets.security.detected-private-key.detected-private-key)\n - [https://owasp.org/Top10/A07_2021-Identification_and_Authentication_Failures](https://owasp.org/Top10/A07_2021-Identification_and_Authentication_Failures)\n","text":"Private Key detected. This is a sensitive credential and should not be hardcoded here. Instead, store this in a separate, private file."},"helpUri":"https://semgrep.dev/r/generic.secrets.security.detected-private-key.detected-private-key","id":"generic.secrets.security.detected-private-key.detected-private-key","name":"generic.secrets.security.detected-private-key.detected-private-key","properties":{"precision":"very-high","tags":["CWE-798: Use of Hard-coded Credentials","LOW CONFIDENCE","OWASP-A07:2021 - Identification and Authentication Failures","security"]},"shortDescription":{"text":"Semgrep Finding: generic.secrets.security.detected-private-key.detected-private-key"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"Sauce Token detected"},"help":{"markdown":"Sauce Token detected\n\nReferences: \n - [Semgrep Rule](https://semgrep.dev/r/generic.secrets.security.detected-sauce-token.detected-sauce-token)\n - [https://owasp.org/Top10/A07_2021-Identification_and_Authentication_Failures](https://owasp.org/Top10/A07_2021-Identification_and_Authentication_Failures)\n","text":"Sauce Token detected"},"helpUri":"https://semgrep.dev/r/generic.secrets.security.detected-sauce-token.detected-sauce-token","id":"generic.secrets.security.detected-sauce-token.detected-sauce-token","name":"generic.secrets.security.detected-sauce-token.detected-sauce-token","properties":{"precision":"very-high","tags":["CWE-798: Use of Hard-coded Credentials","LOW CONFIDENCE","OWASP-A07:2021 - Identification and Authentication Failures","security"]},"shortDescription":{"text":"Semgrep Finding: generic.secrets.security.detected-sauce-token.detected-sauce-token"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"SendGrid API Key detected"},"help":{"markdown":"SendGrid API Key detected\n\nReferences: \n - [Semgrep Rule](https://semgrep.dev/r/generic.secrets.security.detected-sendgrid-api-key.detected-sendgrid-api-key)\n - [https://owasp.org/Top10/A07_2021-Identification_and_Authentication_Failures](https://owasp.org/Top10/A07_2021-Identification_and_Authentication_Failures)\n","text":"SendGrid API Key detected"},"helpUri":"https://semgrep.dev/r/generic.secrets.security.detected-sendgrid-api-key.detected-sendgrid-api-key","id":"generic.secrets.security.detected-sendgrid-api-key.detected-sendgrid-api-key","name":"generic.secrets.security.detected-sendgrid-api-key.detected-sendgrid-api-key","properties":{"precision":"very-high","tags":["CWE-798: Use of Hard-coded Credentials","LOW CONFIDENCE","OWASP-A07:2021 - Identification and Authentication Failures","security"]},"shortDescription":{"text":"Semgrep Finding: generic.secrets.security.detected-sendgrid-api-key.detected-sendgrid-api-key"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"Slack Token detected"},"help":{"markdown":"Slack Token detected\n\nReferences: \n - [Semgrep Rule](https://semgrep.dev/r/generic.secrets.security.detected-slack-token.detected-slack-token)\n - [https://github.com/davidburkitt/python-secret-scanner/blob/335a1f6dab8de59cf39063e57aea39a58951e939/patterns.txt#L58](https://github.com/davidburkitt/python-secret-scanner/blob/335a1f6dab8de59cf39063e57aea39a58951e939/patterns.txt#L58)\n","text":"Slack Token detected"},"helpUri":"https://semgrep.dev/r/generic.secrets.security.detected-slack-token.detected-slack-token","id":"generic.secrets.security.detected-slack-token.detected-slack-token","name":"generic.secrets.security.detected-slack-token.detected-slack-token","properties":{"precision":"very-high","tags":["CWE-798: Use of Hard-coded Credentials","LOW CONFIDENCE","OWASP-A07:2021 - Identification and Authentication Failures","security"]},"shortDescription":{"text":"Semgrep Finding: generic.secrets.security.detected-slack-token.detected-slack-token"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"Slack Webhook detected"},"help":{"markdown":"Slack Webhook detected\n\nReferences: \n - [Semgrep Rule](https://semgrep.dev/r/generic.secrets.security.detected-slack-webhook.detected-slack-webhook)\n - [https://api.slack.com/messaging/webhooks](https://api.slack.com/messaging/webhooks)\n","text":"Slack Webhook detected"},"helpUri":"https://semgrep.dev/r/generic.secrets.security.detected-slack-webhook.detected-slack-webhook","id":"generic.secrets.security.detected-slack-webhook.detected-slack-webhook","name":"generic.secrets.security.detected-slack-webhook.detected-slack-webhook","properties":{"precision":"very-high","tags":["CWE-798: Use of Hard-coded Credentials","LOW CONFIDENCE","OWASP-A07:2021 - Identification and Authentication Failures","security"]},"shortDescription":{"text":"Semgrep Finding: generic.secrets.security.detected-slack-webhook.detected-slack-webhook"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"Snyk API Key detected"},"help":{"markdown":"Snyk API Key detected\n\nReferences: \n - [Semgrep Rule](https://semgrep.dev/r/generic.secrets.security.detected-snyk-api-key.detected-snyk-api-key)\n - [https://owasp.org/Top10/A07_2021-Identification_and_Authentication_Failures](https://owasp.org/Top10/A07_2021-Identification_and_Authentication_Failures)\n","text":"Snyk API Key detected"},"helpUri":"https://semgrep.dev/r/generic.secrets.security.detected-snyk-api-key.detected-snyk-api-key","id":"generic.secrets.security.detected-snyk-api-key.detected-snyk-api-key","name":"generic.secrets.security.detected-snyk-api-key.detected-snyk-api-key","properties":{"precision":"very-high","tags":["CWE-798: Use of Hard-coded Credentials","LOW CONFIDENCE","OWASP-A07:2021 - Identification and Authentication Failures","security"]},"shortDescription":{"text":"Semgrep Finding: generic.secrets.security.detected-snyk-api-key.detected-snyk-api-key"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"SoftLayer API Key detected"},"help":{"markdown":"SoftLayer API Key detected\n\nReferences: \n - [Semgrep Rule](https://semgrep.dev/r/generic.secrets.security.detected-softlayer-api-key.detected-softlayer-api-key)\n - [https://owasp.org/Top10/A07_2021-Identification_and_Authentication_Failures](https://owasp.org/Top10/A07_2021-Identification_and_Authentication_Failures)\n","text":"SoftLayer API Key detected"},"helpUri":"https://semgrep.dev/r/generic.secrets.security.detected-softlayer-api-key.detected-softlayer-api-key","id":"generic.secrets.security.detected-softlayer-api-key.detected-softlayer-api-key","name":"generic.secrets.security.detected-softlayer-api-key.detected-softlayer-api-key","properties":{"precision":"very-high","tags":["CWE-798: Use of Hard-coded Credentials","LOW CONFIDENCE","OWASP-A07:2021 - Identification and Authentication Failures","security"]},"shortDescription":{"text":"Semgrep Finding: generic.secrets.security.detected-softlayer-api-key.detected-softlayer-api-key"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"SonarQube Docs API Key detected"},"help":{"markdown":"SonarQube Docs API Key detected\n\nReferences: \n - [Semgrep Rule](https://semgrep.dev/r/generic.secrets.security.detected-sonarqube-docs-api-key.detected-sonarqube-docs-api-key)\n - [https://owasp.org/Top10/A07_2021-Identification_and_Authentication_Failures](https://owasp.org/Top10/A07_2021-Identification_and_Authentication_Failures)\n","text":"SonarQube Docs API Key detected"},"helpUri":"https://semgrep.dev/r/generic.secrets.security.detected-sonarqube-docs-api-key.detected-sonarqube-docs-api-key","id":"generic.secrets.security.detected-sonarqube-docs-api-key.detected-sonarqube-docs-api-key","name":"generic.secrets.security.detected-sonarqube-docs-api-key.detected-sonarqube-docs-api-key","properties":{"precision":"very-high","tags":["CWE-798: Use of Hard-coded Credentials","LOW CONFIDENCE","OWASP-A07:2021 - Identification and Authentication Failures","security"]},"shortDescription":{"text":"Semgrep Finding: generic.secrets.security.detected-sonarqube-docs-api-key.detected-sonarqube-docs-api-key"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"Square Access Token detected"},"help":{"markdown":"Square Access Token detected\n\nReferences: \n - [Semgrep Rule](https://semgrep.dev/r/generic.secrets.security.detected-square-access-token.detected-square-access-token)\n - [https://owasp.org/Top10/A07_2021-Identification_and_Authentication_Failures](https://owasp.org/Top10/A07_2021-Identification_and_Authentication_Failures)\n","text":"Square Access Token detected"},"helpUri":"https://semgrep.dev/r/generic.secrets.security.detected-square-access-token.detected-square-access-token","id":"generic.secrets.security.detected-square-access-token.detected-square-access-token","name":"generic.secrets.security.detected-square-access-token.detected-square-access-token","properties":{"precision":"very-high","tags":["CWE-798: Use of Hard-coded Credentials","LOW CONFIDENCE","OWASP-A07:2021 - Identification and Authentication Failures","security"]},"shortDescription":{"text":"Semgrep Finding: generic.secrets.security.detected-square-access-token.detected-square-access-token"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"Square OAuth Secret detected"},"help":{"markdown":"Square OAuth Secret detected\n\nReferences: \n - [Semgrep Rule](https://semgrep.dev/r/generic.secrets.security.detected-square-oauth-secret.detected-square-oauth-secret)\n - [https://github.com/Yelp/detect-secrets/blob/master/tests/plugins/square_oauth_test.py](https://github.com/Yelp/detect-secrets/blob/master/tests/plugins/square_oauth_test.py)\n","text":"Square OAuth Secret detected"},"helpUri":"https://semgrep.dev/r/generic.secrets.security.detected-square-oauth-secret.detected-square-oauth-secret","id":"generic.secrets.security.detected-square-oauth-secret.detected-square-oauth-secret","name":"generic.secrets.security.detected-square-oauth-secret.detected-square-oauth-secret","properties":{"precision":"very-high","tags":["CWE-798: Use of Hard-coded Credentials","LOW CONFIDENCE","OWASP-A07:2021 - Identification and Authentication Failures","security"]},"shortDescription":{"text":"Semgrep Finding: generic.secrets.security.detected-square-oauth-secret.detected-square-oauth-secret"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"SSH Password detected"},"help":{"markdown":"SSH Password detected\n\nReferences: \n - [Semgrep Rule](https://semgrep.dev/r/generic.secrets.security.detected-ssh-password.detected-ssh-password)\n - [https://owasp.org/Top10/A07_2021-Identification_and_Authentication_Failures](https://owasp.org/Top10/A07_2021-Identification_and_Authentication_Failures)\n","text":"SSH Password detected"},"helpUri":"https://semgrep.dev/r/generic.secrets.security.detected-ssh-password.detected-ssh-password","id":"generic.secrets.security.detected-ssh-password.detected-ssh-password","name":"generic.secrets.security.detected-ssh-password.detected-ssh-password","properties":{"precision":"very-high","tags":["CWE-798: Use of Hard-coded Credentials","LOW CONFIDENCE","OWASP-A07:2021 - Identification and Authentication Failures","security"]},"shortDescription":{"text":"Semgrep Finding: generic.secrets.security.detected-ssh-password.detected-ssh-password"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"Stripe API Key detected"},"help":{"markdown":"Stripe API Key detected\n\nReferences: \n - [Semgrep Rule](https://semgrep.dev/r/generic.secrets.security.detected-stripe-api-key.detected-stripe-api-key)\n - [https://owasp.org/Top10/A07_2021-Identification_and_Authentication_Failures](https://owasp.org/Top10/A07_2021-Identification_and_Authentication_Failures)\n","text":"Stripe API Key detected"},"helpUri":"https://semgrep.dev/r/generic.secrets.security.detected-stripe-api-key.detected-stripe-api-key","id":"generic.secrets.security.detected-stripe-api-key.detected-stripe-api-key","name":"generic.secrets.security.detected-stripe-api-key.detected-stripe-api-key","properties":{"precision":"very-high","tags":["CWE-798: Use of Hard-coded Credentials","LOW CONFIDENCE","OWASP-A07:2021 - Identification and Authentication Failures","security"]},"shortDescription":{"text":"Semgrep Finding: generic.secrets.security.detected-stripe-api-key.detected-stripe-api-key"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"Stripe Restricted API Key detected"},"help":{"markdown":"Stripe Restricted API Key detected\n\nReferences: \n - [Semgrep Rule](https://semgrep.dev/r/generic.secrets.security.detected-stripe-restricted-api-key.detected-stripe-restricted-api-key)\n - [https://owasp.org/Top10/A07_2021-Identification_and_Authentication_Failures](https://owasp.org/Top10/A07_2021-Identification_and_Authentication_Failures)\n","text":"Stripe Restricted API Key detected"},"helpUri":"https://semgrep.dev/r/generic.secrets.security.detected-stripe-restricted-api-key.detected-stripe-restricted-api-key","id":"generic.secrets.security.detected-stripe-restricted-api-key.detected-stripe-restricted-api-key","name":"generic.secrets.security.detected-stripe-restricted-api-key.detected-stripe-restricted-api-key","properties":{"precision":"very-high","tags":["CWE-798: Use of Hard-coded Credentials","MEDIUM CONFIDENCE","OWASP-A07:2021 - Identification and Authentication Failures","security"]},"shortDescription":{"text":"Semgrep Finding: generic.secrets.security.detected-stripe-restricted-api-key.detected-stripe-restricted-api-key"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"Telegram Bot API Key detected"},"help":{"markdown":"Telegram Bot API Key detected\n\nReferences: \n - [Semgrep Rule](https://semgrep.dev/r/generic.secrets.security.detected-telegram-bot-api-key.detected-telegram-bot-api-key)\n - [https://owasp.org/Top10/A07_2021-Identification_and_Authentication_Failures](https://owasp.org/Top10/A07_2021-Identification_and_Authentication_Failures)\n","text":"Telegram Bot API Key detected"},"helpUri":"https://semgrep.dev/r/generic.secrets.security.detected-telegram-bot-api-key.detected-telegram-bot-api-key","id":"generic.secrets.security.detected-telegram-bot-api-key.detected-telegram-bot-api-key","name":"generic.secrets.security.detected-telegram-bot-api-key.detected-telegram-bot-api-key","properties":{"precision":"very-high","tags":["CWE-798: Use of Hard-coded Credentials","LOW CONFIDENCE","OWASP-A07:2021 - Identification and Authentication Failures","security"]},"shortDescription":{"text":"Semgrep Finding: generic.secrets.security.detected-telegram-bot-api-key.detected-telegram-bot-api-key"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"Twilio API Key detected"},"help":{"markdown":"Twilio API Key detected\n\nReferences: \n - [Semgrep Rule](https://semgrep.dev/r/generic.secrets.security.detected-twilio-api-key.detected-twilio-api-key)\n - [https://owasp.org/Top10/A07_2021-Identification_and_Authentication_Failures](https://owasp.org/Top10/A07_2021-Identification_and_Authentication_Failures)\n","text":"Twilio API Key detected"},"helpUri":"https://semgrep.dev/r/generic.secrets.security.detected-twilio-api-key.detected-twilio-api-key","id":"generic.secrets.security.detected-twilio-api-key.detected-twilio-api-key","name":"generic.secrets.security.detected-twilio-api-key.detected-twilio-api-key","properties":{"precision":"very-high","tags":["CWE-798: Use of Hard-coded Credentials","LOW CONFIDENCE","OWASP-A07:2021 - Identification and Authentication Failures","security"]},"shortDescription":{"text":"Semgrep Finding: generic.secrets.security.detected-twilio-api-key.detected-twilio-api-key"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"Detects potential Google Maps API keys in code"},"help":{"markdown":"Detects potential Google Maps API keys in code\n\nReferences: \n - [Semgrep Rule](https://semgrep.dev/r/generic.secrets.security.google-maps-apikeyleak.google-maps-apikeyleak)\n - [https://ozguralp.medium.com/unauthorized-google-maps-api-key-usage-cases-and-why-you-need-to-care-1ccb28bf21e](https://ozguralp.medium.com/unauthorized-google-maps-api-key-usage-cases-and-why-you-need-to-care-1ccb28bf21e)\n","text":"Detects potential Google Maps API keys in code"},"helpUri":"https://semgrep.dev/r/generic.secrets.security.google-maps-apikeyleak.google-maps-apikeyleak","id":"generic.secrets.security.google-maps-apikeyleak.google-maps-apikeyleak","name":"generic.secrets.security.google-maps-apikeyleak.google-maps-apikeyleak","properties":{"precision":"very-high","tags":["CWE-538: Insertion of Sensitive Information into Externally-Accessible File or Directory","MEDIUM CONFIDENCE","OWASP-A3:2017 Sensitive Data Exposure","security"]},"shortDescription":{"text":"Semgrep Finding: generic.secrets.security.google-maps-apikeyleak.google-maps-apikeyleak"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"This code contains bidirectional (bidi) characters. While this is useful for support of right-to-left languages such as Arabic or Hebrew, it can also be used to trick language parsers into executing code in a manner that is different from how it is displayed in code editing and review tools. If this is not what you were expecting, please review this code in an editor that can reveal hidden Unicode characters."},"help":{"markdown":"This code contains bidirectional (bidi) characters. While this is useful for support of right-to-left languages such as Arabic or Hebrew, it can also be used to trick language parsers into executing code in a manner that is different from how it is displayed in code editing and review tools. If this is not what you were expecting, please review this code in an editor that can reveal hidden Unicode characters.\n\nReferences: \n - [Semgrep Rule](https://semgrep.dev/r/generic.unicode.security.bidi.contains-bidirectional-characters)\n - [https://trojansource.codes/](https://trojansource.codes/)\n","text":"This code contains bidirectional (bidi) characters. While this is useful for support of right-to-left languages such as Arabic or Hebrew, it can also be used to trick language parsers into executing code in a manner that is different from how it is displayed in code editing and review tools. If this is not what you were expecting, please review this code in an editor that can reveal hidden Unicode characters."},"helpUri":"https://semgrep.dev/r/generic.unicode.security.bidi.contains-bidirectional-characters","id":"generic.unicode.security.bidi.contains-bidirectional-characters","name":"generic.unicode.security.bidi.contains-bidirectional-characters","properties":{"precision":"very-high","tags":["CWE-94: Improper Control of Generation of Code ('Code Injection')","LOW CONFIDENCE","OWASP-A03:2021 - Injection","security"]},"shortDescription":{"text":"Semgrep Finding: generic.unicode.security.bidi.contains-bidirectional-characters"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"Consuming CDNs without including a SubResource Integrity (SRI) can expose your application and its users to compromised code. SRIs allow you to consume specific versions of content where if even a single byte is compromised, the resource will not be loaded. Add an integrity attribute to your which would add the script to the page. Consider allowlisting appropriate values or using an approach which does not involve the URL."},"help":{"markdown":"Detected possible DOM-based XSS. This occurs because a portion of the URL is being used to construct an element added directly to the page. For example, a malicious actor could send someone a link like this: http://www.some.site/page.html?default= which would add the script to the page. Consider allowlisting appropriate values or using an approach which does not involve the URL.\n\nReferences: \n - [Semgrep Rule](https://semgrep.dev/r/javascript.browser.security.dom-based-xss.dom-based-xss)\n - [https://owasp.org/www-community/attacks/DOM_Based_XSS](https://owasp.org/www-community/attacks/DOM_Based_XSS)\n","text":"Detected possible DOM-based XSS. This occurs because a portion of the URL is being used to construct an element added directly to the page. For example, a malicious actor could send someone a link like this: http://www.some.site/page.html?default= which would add the script to the page. Consider allowlisting appropriate values or using an approach which does not involve the URL."},"helpUri":"https://semgrep.dev/r/javascript.browser.security.dom-based-xss.dom-based-xss","id":"javascript.browser.security.dom-based-xss.dom-based-xss","name":"javascript.browser.security.dom-based-xss.dom-based-xss","properties":{"precision":"very-high","tags":["CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')","LOW CONFIDENCE","OWASP-A03:2021 - Injection","OWASP-A07:2017 - Cross-Site Scripting (XSS)","security"]},"shortDescription":{"text":"Semgrep Finding: javascript.browser.security.dom-based-xss.dom-based-xss"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"Detected the use of eval(). eval() can be dangerous if used to evaluate dynamic content. If this content can be input from outside the program, this may be a code injection vulnerability. Ensure evaluated content is not definable by external sources."},"help":{"markdown":"Detected the use of eval(). eval() can be dangerous if used to evaluate dynamic content. If this content can be input from outside the program, this may be a code injection vulnerability. Ensure evaluated content is not definable by external sources.\n\nReferences: \n - [Semgrep Rule](https://semgrep.dev/r/javascript.browser.security.eval-detected.eval-detected)\n - [https://owasp.org/Top10/A03_2021-Injection](https://owasp.org/Top10/A03_2021-Injection)\n","text":"Detected the use of eval(). eval() can be dangerous if used to evaluate dynamic content. If this content can be input from outside the program, this may be a code injection vulnerability. Ensure evaluated content is not definable by external sources."},"helpUri":"https://semgrep.dev/r/javascript.browser.security.eval-detected.eval-detected","id":"javascript.browser.security.eval-detected.eval-detected","name":"javascript.browser.security.eval-detected.eval-detected","properties":{"precision":"very-high","tags":["CWE-95: Improper Neutralization of Directives in Dynamically Evaluated Code ('Eval Injection')","LOW CONFIDENCE","OWASP-A03:2021 - Injection","security"]},"shortDescription":{"text":"Semgrep Finding: javascript.browser.security.eval-detected.eval-detected"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"User controlled data in methods like `innerHTML`, `outerHTML` or `document.write` is an anti-pattern that can lead to XSS vulnerabilities"},"help":{"markdown":"User controlled data in methods like `innerHTML`, `outerHTML` or `document.write` is an anti-pattern that can lead to XSS vulnerabilities\n\nReferences: \n - [Semgrep Rule](https://semgrep.dev/r/javascript.browser.security.insecure-document-method.insecure-document-method)\n - [https://owasp.org/Top10/A03_2021-Injection](https://owasp.org/Top10/A03_2021-Injection)\n","text":"User controlled data in methods like `innerHTML`, `outerHTML` or `document.write` is an anti-pattern that can lead to XSS vulnerabilities"},"helpUri":"https://semgrep.dev/r/javascript.browser.security.insecure-document-method.insecure-document-method","id":"javascript.browser.security.insecure-document-method.insecure-document-method","name":"javascript.browser.security.insecure-document-method.insecure-document-method","properties":{"precision":"very-high","tags":["CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')","LOW CONFIDENCE","OWASP-A03:2021 - Injection","OWASP-A07:2017 - Cross-Site Scripting (XSS)","security"]},"shortDescription":{"text":"Semgrep Finding: javascript.browser.security.insecure-document-method.insecure-document-method"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"No validation of origin is done by the addEventListener API. It may be possible to exploit this flaw to perform Cross Origin attacks such as Cross-Site Scripting(XSS)."},"help":{"markdown":"No validation of origin is done by the addEventListener API. It may be possible to exploit this flaw to perform Cross Origin attacks such as Cross-Site Scripting(XSS).\n\nReferences: \n - [Semgrep Rule](https://semgrep.dev/r/javascript.browser.security.insufficient-postmessage-origin-validation.insufficient-postmessage-origin-validation)\n - [https://owasp.org/Top10/A08_2021-Software_and_Data_Integrity_Failures](https://owasp.org/Top10/A08_2021-Software_and_Data_Integrity_Failures)\n","text":"No validation of origin is done by the addEventListener API. It may be possible to exploit this flaw to perform Cross Origin attacks such as Cross-Site Scripting(XSS)."},"helpUri":"https://semgrep.dev/r/javascript.browser.security.insufficient-postmessage-origin-validation.insufficient-postmessage-origin-validation","id":"javascript.browser.security.insufficient-postmessage-origin-validation.insufficient-postmessage-origin-validation","name":"javascript.browser.security.insufficient-postmessage-origin-validation.insufficient-postmessage-origin-validation","properties":{"precision":"very-high","tags":["CWE-345: Insufficient Verification of Data Authenticity","LOW CONFIDENCE","OWASP-A08:2021 - Software and Data Integrity Failures","security"]},"shortDescription":{"text":"Semgrep Finding: javascript.browser.security.insufficient-postmessage-origin-validation.insufficient-postmessage-origin-validation"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"The application accepts potentially user-controlled input `$PROP` which can control the location of the current window context. This can lead two types of vulnerabilities open-redirection and Cross-Site-Scripting (XSS) with JavaScript URIs. It is recommended to validate user-controllable input before allowing it to control the redirection."},"help":{"markdown":"The application accepts potentially user-controlled input `$PROP` which can control the location of the current window context. This can lead two types of vulnerabilities open-redirection and Cross-Site-Scripting (XSS) with JavaScript URIs. It is recommended to validate user-controllable input before allowing it to control the redirection.\n\nReferences: \n - [Semgrep Rule](https://semgrep.dev/r/javascript.browser.security.open-redirect.js-open-redirect)\n - [https://cheatsheetseries.owasp.org/cheatsheets/Unvalidated_Redirects_and_Forwards_Cheat_Sheet.html](https://cheatsheetseries.owasp.org/cheatsheets/Unvalidated_Redirects_and_Forwards_Cheat_Sheet.html)\n","text":"The application accepts potentially user-controlled input `$PROP` which can control the location of the current window context. This can lead two types of vulnerabilities open-redirection and Cross-Site-Scripting (XSS) with JavaScript URIs. It is recommended to validate user-controllable input before allowing it to control the redirection."},"helpUri":"https://semgrep.dev/r/javascript.browser.security.open-redirect.js-open-redirect","id":"javascript.browser.security.open-redirect.js-open-redirect","name":"javascript.browser.security.open-redirect.js-open-redirect","properties":{"precision":"very-high","tags":["CWE-601: URL Redirection to Untrusted Site ('Open Redirect')","HIGH CONFIDENCE","OWASP-A01:2021 - Broken Access Control","security"]},"shortDescription":{"text":"Semgrep Finding: javascript.browser.security.open-redirect.js-open-redirect"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"User controlled data in a HTML string may result in XSS"},"help":{"markdown":"User controlled data in a HTML string may result in XSS\n\nReferences: \n - [Semgrep Rule](https://semgrep.dev/r/javascript.browser.security.raw-html-concat.raw-html-concat)\n - [https://owasp.org/www-community/attacks/xss/](https://owasp.org/www-community/attacks/xss/)\n","text":"User controlled data in a HTML string may result in XSS"},"helpUri":"https://semgrep.dev/r/javascript.browser.security.raw-html-concat.raw-html-concat","id":"javascript.browser.security.raw-html-concat.raw-html-concat","name":"javascript.browser.security.raw-html-concat.raw-html-concat","properties":{"precision":"very-high","tags":["CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')","MEDIUM CONFIDENCE","OWASP-A03:2021 - Injection","OWASP-A07:2017 - Cross-Site Scripting (XSS)","security"]},"shortDescription":{"text":"Semgrep Finding: javascript.browser.security.raw-html-concat.raw-html-concat"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"The target origin of the window.postMessage() API is set to \"*\". This could allow for information disclosure due to the possibility of any origin allowed to receive the message."},"help":{"markdown":"The target origin of the window.postMessage() API is set to \"*\". This could allow for information disclosure due to the possibility of any origin allowed to receive the message.\n\nReferences: \n - [Semgrep Rule](https://semgrep.dev/r/javascript.browser.security.wildcard-postmessage-configuration.wildcard-postmessage-configuration)\n - [https://owasp.org/Top10/A08_2021-Software_and_Data_Integrity_Failures](https://owasp.org/Top10/A08_2021-Software_and_Data_Integrity_Failures)\n","text":"The target origin of the window.postMessage() API is set to \"*\". This could allow for information disclosure due to the possibility of any origin allowed to receive the message."},"helpUri":"https://semgrep.dev/r/javascript.browser.security.wildcard-postmessage-configuration.wildcard-postmessage-configuration","id":"javascript.browser.security.wildcard-postmessage-configuration.wildcard-postmessage-configuration","name":"javascript.browser.security.wildcard-postmessage-configuration.wildcard-postmessage-configuration","properties":{"precision":"very-high","tags":["CWE-345: Insufficient Verification of Data Authenticity","MEDIUM CONFIDENCE","OWASP-A08:2021 - Software and Data Integrity Failures","security"]},"shortDescription":{"text":"Semgrep Finding: javascript.browser.security.wildcard-postmessage-configuration.wildcard-postmessage-configuration"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"Untrusted input could be used to tamper with a web page rendering, which can lead to a Cross-site scripting (XSS) vulnerability. XSS vulnerabilities occur when untrusted input executes malicious JavaScript code, leading to issues such as account compromise and sensitive information leakage. To prevent this vulnerability, validate the user input, perform contextual output encoding or sanitize the input."},"help":{"markdown":"Untrusted input could be used to tamper with a web page rendering, which can lead to a Cross-site scripting (XSS) vulnerability. XSS vulnerabilities occur when untrusted input executes malicious JavaScript code, leading to issues such as account compromise and sensitive information leakage. To prevent this vulnerability, validate the user input, perform contextual output encoding or sanitize the input.\n\nReferences: \n - [Semgrep Rule](https://semgrep.dev/r/javascript.browser.xss.xss)\n - [https://owasp.org/Top10/A03_2021-Injection](https://owasp.org/Top10/A03_2021-Injection)\n","text":"Untrusted input could be used to tamper with a web page rendering, which can lead to a Cross-site scripting (XSS) vulnerability. XSS vulnerabilities occur when untrusted input executes malicious JavaScript code, leading to issues such as account compromise and sensitive information leakage. To prevent this vulnerability, validate the user input, perform contextual output encoding or sanitize the input."},"helpUri":"https://semgrep.dev/r/javascript.browser.xss.xss","id":"javascript.browser.xss.xss","name":"javascript.browser.xss.xss","properties":{"precision":"very-high","tags":["CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')","HIGH CONFIDENCE","OWASP-A03:2021 - Injection","OWASP-A07:2017 - Cross-Site Scripting (XSS)","security"]},"shortDescription":{"text":"Semgrep Finding: javascript.browser.xss.xss"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"If unverified user data can reach the `compileScript` method it can result in Server-Side Request Forgery vulnerabilities"},"help":{"markdown":"If unverified user data can reach the `compileScript` method it can result in Server-Side Request Forgery vulnerabilities\n\nReferences: \n - [Semgrep Rule](https://semgrep.dev/r/javascript.chrome-remote-interface.security.audit.chrome-remote-interface-compilescript-injection.chrome-remote-interface-compilescript-injection)\n - [https://github.com/cyrus-and/chrome-remote-interface](https://github.com/cyrus-and/chrome-remote-interface)\n","text":"If unverified user data can reach the `compileScript` method it can result in Server-Side Request Forgery vulnerabilities"},"helpUri":"https://semgrep.dev/r/javascript.chrome-remote-interface.security.audit.chrome-remote-interface-compilescript-injection.chrome-remote-interface-compilescript-injection","id":"javascript.chrome-remote-interface.security.audit.chrome-remote-interface-compilescript-injection.chrome-remote-interface-compilescript-injection","name":"javascript.chrome-remote-interface.security.audit.chrome-remote-interface-compilescript-injection.chrome-remote-interface-compilescript-injection","properties":{"precision":"very-high","tags":["CWE-918: Server-Side Request Forgery (SSRF)","MEDIUM CONFIDENCE","OWASP-A10:2021 - Server-Side Request Forgery (SSRF)","security"]},"shortDescription":{"text":"Semgrep Finding: javascript.chrome-remote-interface.security.audit.chrome-remote-interface-compilescript-injection.chrome-remote-interface-compilescript-injection"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"A secret is hard-coded in the application. Secrets stored in source code, such as credentials, identifiers, and other types of sensitive data, can be leaked and used by internal or external malicious actors. Use environment variables to securely provide credentials and other secrets or retrieve them from a secure vault or Hardware Security Module (HSM)."},"help":{"markdown":"A secret is hard-coded in the application. Secrets stored in source code, such as credentials, identifiers, and other types of sensitive data, can be leaked and used by internal or external malicious actors. Use environment variables to securely provide credentials and other secrets or retrieve them from a secure vault or Hardware Security Module (HSM).\n\nReferences: \n - [Semgrep Rule](https://semgrep.dev/r/javascript.crypto.symmetric-hardcoded-key.symmetric-hardcoded-key)\n - [https://cheatsheetseries.owasp.org/cheatsheets/Secrets_Management_Cheat_Sheet.html](https://cheatsheetseries.owasp.org/cheatsheets/Secrets_Management_Cheat_Sheet.html)\n","text":"A secret is hard-coded in the application. Secrets stored in source code, such as credentials, identifiers, and other types of sensitive data, can be leaked and used by internal or external malicious actors. Use environment variables to securely provide credentials and other secrets or retrieve them from a secure vault or Hardware Security Module (HSM)."},"helpUri":"https://semgrep.dev/r/javascript.crypto.symmetric-hardcoded-key.symmetric-hardcoded-key","id":"javascript.crypto.symmetric-hardcoded-key.symmetric-hardcoded-key","name":"javascript.crypto.symmetric-hardcoded-key.symmetric-hardcoded-key","properties":{"precision":"very-high","tags":["CWE-798: Use of Hard-coded Credentials","HIGH CONFIDENCE","OWASP-A07:2021 - Identification and Authentication Failures","security"]},"shortDescription":{"text":"Semgrep Finding: javascript.crypto.symmetric-hardcoded-key.symmetric-hardcoded-key"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"Detected the use of `$METHOD(\"$VALUE\")` which is considered a weak cryptographic algorithm. Where possible, leverage the industry standard recommendation which is to use a block cipher such as `AES` with at least `128-bit` strength, an example of a secure algorithm is `AES-256-GCM`. If your company has its own guidelines, you should follow your company's internal best practices."},"help":{"markdown":"Detected the use of `$METHOD(\"$VALUE\")` which is considered a weak cryptographic algorithm. Where possible, leverage the industry standard recommendation which is to use a block cipher such as `AES` with at least `128-bit` strength, an example of a secure algorithm is `AES-256-GCM`. If your company has its own guidelines, you should follow your company's internal best practices.\n\nReferences: \n - [Semgrep Rule](https://semgrep.dev/r/javascript.crypto.weak-symmetric-algorithm.weak-symmetric-algorithm)\n - [https://owasp.org/Top10/A02_2021-Cryptographic_Failures](https://owasp.org/Top10/A02_2021-Cryptographic_Failures)\n","text":"Detected the use of `$METHOD(\"$VALUE\")` which is considered a weak cryptographic algorithm. Where possible, leverage the industry standard recommendation which is to use a block cipher such as `AES` with at least `128-bit` strength, an example of a secure algorithm is `AES-256-GCM`. If your company has its own guidelines, you should follow your company's internal best practices."},"helpUri":"https://semgrep.dev/r/javascript.crypto.weak-symmetric-algorithm.weak-symmetric-algorithm","id":"javascript.crypto.weak-symmetric-algorithm.weak-symmetric-algorithm","name":"javascript.crypto.weak-symmetric-algorithm.weak-symmetric-algorithm","properties":{"precision":"very-high","tags":["CWE-327: Use of a Broken or Risky Cryptographic Algorithm","HIGH CONFIDENCE","OWASP-A02:2021 - Cryptographic Failures","OWASP-A03:2017 - Sensitive Data Exposure","security"]},"shortDescription":{"text":"Semgrep Finding: javascript.crypto.weak-symmetric-algorithm.weak-symmetric-algorithm"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"Detected the use of `$METHOD(\"$VALUE\")` which is considered a weak cryptographic mode. Where possible, leverage the industry standard recommendation which is to use a block cipher such as `AES` with at least `128-bit` strength, an example of a secure algorithm is `AES-256-GCM`. If your company has its own guidelines, you should follow your company's internal best practices."},"help":{"markdown":"Detected the use of `$METHOD(\"$VALUE\")` which is considered a weak cryptographic mode. Where possible, leverage the industry standard recommendation which is to use a block cipher such as `AES` with at least `128-bit` strength, an example of a secure algorithm is `AES-256-GCM`. If your company has its own guidelines, you should follow your company's internal best practices.\n\nReferences: \n - [Semgrep Rule](https://semgrep.dev/r/javascript.crypto.weak-symmetric-mode.weak-symmetric-mode)\n - [https://owasp.org/Top10/A02_2021-Cryptographic_Failures](https://owasp.org/Top10/A02_2021-Cryptographic_Failures)\n","text":"Detected the use of `$METHOD(\"$VALUE\")` which is considered a weak cryptographic mode. Where possible, leverage the industry standard recommendation which is to use a block cipher such as `AES` with at least `128-bit` strength, an example of a secure algorithm is `AES-256-GCM`. If your company has its own guidelines, you should follow your company's internal best practices."},"helpUri":"https://semgrep.dev/r/javascript.crypto.weak-symmetric-mode.weak-symmetric-mode","id":"javascript.crypto.weak-symmetric-mode.weak-symmetric-mode","name":"javascript.crypto.weak-symmetric-mode.weak-symmetric-mode","properties":{"precision":"very-high","tags":["CWE-327: Use of a Broken or Risky Cryptographic Algorithm","HIGH CONFIDENCE","OWASP-A02:2021 - Cryptographic Failures","OWASP-A03:2017 - Sensitive Data Exposure","security"]},"shortDescription":{"text":"Semgrep Finding: javascript.crypto.weak-symmetric-mode.weak-symmetric-mode"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"Detected non-literal calls to Deno.run(). This could lead to a command injection vulnerability."},"help":{"markdown":"Detected non-literal calls to Deno.run(). This could lead to a command injection vulnerability.\n\nReferences: \n - [Semgrep Rule](https://semgrep.dev/r/javascript.deno.security.audit.deno-dangerous-run.deno-dangerous-run)\n - [https://deno.land/manual/examples/subprocess#simple-example](https://deno.land/manual/examples/subprocess#simple-example)\n","text":"Detected non-literal calls to Deno.run(). This could lead to a command injection vulnerability."},"helpUri":"https://semgrep.dev/r/javascript.deno.security.audit.deno-dangerous-run.deno-dangerous-run","id":"javascript.deno.security.audit.deno-dangerous-run.deno-dangerous-run","name":"javascript.deno.security.audit.deno-dangerous-run.deno-dangerous-run","properties":{"precision":"very-high","tags":["CWE-78: Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')","MEDIUM CONFIDENCE","OWASP-A01:2017 - Injection","OWASP-A03:2021 - Injection","security"]},"shortDescription":{"text":"Semgrep Finding: javascript.deno.security.audit.deno-dangerous-run.deno-dangerous-run"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"The application might dynamically evaluate untrusted input, which can lead to a code injection vulnerability. An attacker can execute arbitrary code, potentially gaining complete control of the system. To prevent this vulnerability, avoid executing code containing user input. If this is unavoidable, validate and sanitize the input, and use safe alternatives for evaluating user input."},"help":{"markdown":"The application might dynamically evaluate untrusted input, which can lead to a code injection vulnerability. An attacker can execute arbitrary code, potentially gaining complete control of the system. To prevent this vulnerability, avoid executing code containing user input. If this is unavoidable, validate and sanitize the input, and use safe alternatives for evaluating user input.\n\nReferences: \n - [Semgrep Rule](https://semgrep.dev/r/javascript.express.code.eval-express.eval-express)\n - [https://owasp.org/Top10/A03_2021-Injection](https://owasp.org/Top10/A03_2021-Injection)\n","text":"The application might dynamically evaluate untrusted input, which can lead to a code injection vulnerability. An attacker can execute arbitrary code, potentially gaining complete control of the system. To prevent this vulnerability, avoid executing code containing user input. If this is unavoidable, validate and sanitize the input, and use safe alternatives for evaluating user input."},"helpUri":"https://semgrep.dev/r/javascript.express.code.eval-express.eval-express","id":"javascript.express.code.eval-express.eval-express","name":"javascript.express.code.eval-express.eval-express","properties":{"precision":"very-high","tags":["CWE-94: Improper Control of Generation of Code ('Code Injection')","HIGH CONFIDENCE","OWASP-A03:2021 - Injection","security"]},"shortDescription":{"text":"Semgrep Finding: javascript.express.code.eval-express.eval-express"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"The application might dynamically evaluate untrusted input, which can lead to a code injection vulnerability. An attacker can execute arbitrary code, potentially gaining complete control of the system. To prevent this vulnerability, avoid executing code containing user input. If this is unavoidable, validate and sanitize the input, and use safe alternatives for evaluating user input."},"help":{"markdown":"The application might dynamically evaluate untrusted input, which can lead to a code injection vulnerability. An attacker can execute arbitrary code, potentially gaining complete control of the system. To prevent this vulnerability, avoid executing code containing user input. If this is unavoidable, validate and sanitize the input, and use safe alternatives for evaluating user input.\n\nReferences: \n - [Semgrep Rule](https://semgrep.dev/r/javascript.express.code.puppeteer-express.puppeteer-express)\n - [https://owasp.org/Top10/A03_2021-Injection](https://owasp.org/Top10/A03_2021-Injection)\n","text":"The application might dynamically evaluate untrusted input, which can lead to a code injection vulnerability. An attacker can execute arbitrary code, potentially gaining complete control of the system. To prevent this vulnerability, avoid executing code containing user input. If this is unavoidable, validate and sanitize the input, and use safe alternatives for evaluating user input."},"helpUri":"https://semgrep.dev/r/javascript.express.code.puppeteer-express.puppeteer-express","id":"javascript.express.code.puppeteer-express.puppeteer-express","name":"javascript.express.code.puppeteer-express.puppeteer-express","properties":{"precision":"very-high","tags":["CWE-94: Improper Control of Generation of Code ('Code Injection')","HIGH CONFIDENCE","OWASP-A03:2021 - Injection","security"]},"shortDescription":{"text":"Semgrep Finding: javascript.express.code.puppeteer-express.puppeteer-express"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"The application might dynamically evaluate untrusted input, which can lead to a code injection vulnerability. An attacker can execute arbitrary code, potentially gaining complete control of the system. To prevent this vulnerability, avoid executing code containing user input. If this is unavoidable, validate and sanitize the input, and use safe alternatives for evaluating user input."},"help":{"markdown":"The application might dynamically evaluate untrusted input, which can lead to a code injection vulnerability. An attacker can execute arbitrary code, potentially gaining complete control of the system. To prevent this vulnerability, avoid executing code containing user input. If this is unavoidable, validate and sanitize the input, and use safe alternatives for evaluating user input.\n\nReferences: \n - [Semgrep Rule](https://semgrep.dev/r/javascript.express.code.vm-express.vm-express)\n - [https://owasp.org/Top10/A03_2021-Injection](https://owasp.org/Top10/A03_2021-Injection)\n","text":"The application might dynamically evaluate untrusted input, which can lead to a code injection vulnerability. An attacker can execute arbitrary code, potentially gaining complete control of the system. To prevent this vulnerability, avoid executing code containing user input. If this is unavoidable, validate and sanitize the input, and use safe alternatives for evaluating user input."},"helpUri":"https://semgrep.dev/r/javascript.express.code.vm-express.vm-express","id":"javascript.express.code.vm-express.vm-express","name":"javascript.express.code.vm-express.vm-express","properties":{"precision":"very-high","tags":["CWE-94: Improper Control of Generation of Code ('Code Injection')","HIGH CONFIDENCE","OWASP-A03:2021 - Injection","security"]},"shortDescription":{"text":"Semgrep Finding: javascript.express.code.vm-express.vm-express"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"The application might dynamically evaluate untrusted input, which can lead to a code injection vulnerability. An attacker can execute arbitrary code, potentially gaining complete control of the system. To prevent this vulnerability, avoid executing code containing user input. If this is unavoidable, validate and sanitize the input, and use safe alternatives for evaluating user input."},"help":{"markdown":"The application might dynamically evaluate untrusted input, which can lead to a code injection vulnerability. An attacker can execute arbitrary code, potentially gaining complete control of the system. To prevent this vulnerability, avoid executing code containing user input. If this is unavoidable, validate and sanitize the input, and use safe alternatives for evaluating user input.\n\nReferences: \n - [Semgrep Rule](https://semgrep.dev/r/javascript.express.code.vm2-express.vm2-express)\n - [https://owasp.org/Top10/A03_2021-Injection](https://owasp.org/Top10/A03_2021-Injection)\n","text":"The application might dynamically evaluate untrusted input, which can lead to a code injection vulnerability. An attacker can execute arbitrary code, potentially gaining complete control of the system. To prevent this vulnerability, avoid executing code containing user input. If this is unavoidable, validate and sanitize the input, and use safe alternatives for evaluating user input."},"helpUri":"https://semgrep.dev/r/javascript.express.code.vm2-express.vm2-express","id":"javascript.express.code.vm2-express.vm2-express","name":"javascript.express.code.vm2-express.vm2-express","properties":{"precision":"very-high","tags":["CWE-94: Improper Control of Generation of Code ('Code Injection')","HIGH CONFIDENCE","OWASP-A03:2021 - Injection","security"]},"shortDescription":{"text":"Semgrep Finding: javascript.express.code.vm2-express.vm2-express"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"Untrusted input might be used to build a database query, which can lead to a SQL injection vulnerability. An attacker can execute malicious SQL statements and gain unauthorized access to sensitive data, modify, delete data, or execute arbitrary system commands. To prevent this vulnerability, use prepared statements that do not concatenate user-controllable strings and use parameterized queries where SQL commands and user data are strictly separated. Also, consider using an object-relational (ORM) framework to operate with safer abstractions."},"help":{"markdown":"Untrusted input might be used to build a database query, which can lead to a SQL injection vulnerability. An attacker can execute malicious SQL statements and gain unauthorized access to sensitive data, modify, delete data, or execute arbitrary system commands. To prevent this vulnerability, use prepared statements that do not concatenate user-controllable strings and use parameterized queries where SQL commands and user data are strictly separated. Also, consider using an object-relational (ORM) framework to operate with safer abstractions.\n\nReferences: \n - [Semgrep Rule](https://semgrep.dev/r/javascript.express.db.knex-express.knex-express)\n - [https://owasp.org/Top10/A03_2021-Injection](https://owasp.org/Top10/A03_2021-Injection)\n","text":"Untrusted input might be used to build a database query, which can lead to a SQL injection vulnerability. An attacker can execute malicious SQL statements and gain unauthorized access to sensitive data, modify, delete data, or execute arbitrary system commands. To prevent this vulnerability, use prepared statements that do not concatenate user-controllable strings and use parameterized queries where SQL commands and user data are strictly separated. Also, consider using an object-relational (ORM) framework to operate with safer abstractions."},"helpUri":"https://semgrep.dev/r/javascript.express.db.knex-express.knex-express","id":"javascript.express.db.knex-express.knex-express","name":"javascript.express.db.knex-express.knex-express","properties":{"precision":"very-high","tags":["CWE-89: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')","HIGH CONFIDENCE","OWASP-A01:2017 - Injection","OWASP-A03:2021 - Injection","security"]},"shortDescription":{"text":"Semgrep Finding: javascript.express.db.knex-express.knex-express"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"Untrusted input might be used to build a database query, which can lead to a NoSQL injection vulnerability. An attacker can execute malicious NoSQL statements and gain unauthorized access to sensitive data, modify, delete data, or execute arbitrary system commands. Make sure all user input is validated and sanitized, and avoid using tainted user input to construct NoSQL statements if possible. Ideally, avoid raw queries and instead use parameterized queries."},"help":{"markdown":"Untrusted input might be used to build a database query, which can lead to a NoSQL injection vulnerability. An attacker can execute malicious NoSQL statements and gain unauthorized access to sensitive data, modify, delete data, or execute arbitrary system commands. Make sure all user input is validated and sanitized, and avoid using tainted user input to construct NoSQL statements if possible. Ideally, avoid raw queries and instead use parameterized queries.\n\nReferences: \n - [Semgrep Rule](https://semgrep.dev/r/javascript.express.db.mongodb-express.mongodb-express)\n - [https://owasp.org/Top10/A03_2021-Injection](https://owasp.org/Top10/A03_2021-Injection)\n - [https://owasp.org/www-project-web-security-testing-guide/latest/4-Web_Application_Security_Testing/07-Input_Validation_Testing/05.6-Testing_for_NoSQL_Injection](https://owasp.org/www-project-web-security-testing-guide/latest/4-Web_Application_Security_Testing/07-Input_Validation_Testing/05.6-Testing_for_NoSQL_Injection)\n - [https://portswigger.net/web-security/nosql-injection](https://portswigger.net/web-security/nosql-injection)\n","text":"Untrusted input might be used to build a database query, which can lead to a NoSQL injection vulnerability. An attacker can execute malicious NoSQL statements and gain unauthorized access to sensitive data, modify, delete data, or execute arbitrary system commands. Make sure all user input is validated and sanitized, and avoid using tainted user input to construct NoSQL statements if possible. Ideally, avoid raw queries and instead use parameterized queries."},"helpUri":"https://semgrep.dev/r/javascript.express.db.mongodb-express.mongodb-express","id":"javascript.express.db.mongodb-express.mongodb-express","name":"javascript.express.db.mongodb-express.mongodb-express","properties":{"precision":"very-high","tags":["CWE-943: Improper Neutralization of Special Elements in Data Query Logic","HIGH CONFIDENCE","OWASP-A01:2017 - Injection","security"]},"shortDescription":{"text":"Semgrep Finding: javascript.express.db.mongodb-express.mongodb-express"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"Untrusted input might be used to build a database query, which can lead to a NoSQL injection vulnerability. An attacker can execute malicious NoSQL statements and gain unauthorized access to sensitive data, modify, delete data, or execute arbitrary system commands. Make sure all user input is validated and sanitized, and avoid using tainted user input to construct NoSQL statements if possible. Ideally, avoid raw queries and instead use parameterized queries."},"help":{"markdown":"Untrusted input might be used to build a database query, which can lead to a NoSQL injection vulnerability. An attacker can execute malicious NoSQL statements and gain unauthorized access to sensitive data, modify, delete data, or execute arbitrary system commands. Make sure all user input is validated and sanitized, and avoid using tainted user input to construct NoSQL statements if possible. Ideally, avoid raw queries and instead use parameterized queries.\n\nReferences: \n - [Semgrep Rule](https://semgrep.dev/r/javascript.express.db.mongodb-where-express.mongodb-where-express)\n - [https://owasp.org/Top10/A03_2021-Injection](https://owasp.org/Top10/A03_2021-Injection)\n - [https://owasp.org/www-project-web-security-testing-guide/latest/4-Web_Application_Security_Testing/07-Input_Validation_Testing/05.6-Testing_for_NoSQL_Injection](https://owasp.org/www-project-web-security-testing-guide/latest/4-Web_Application_Security_Testing/07-Input_Validation_Testing/05.6-Testing_for_NoSQL_Injection)\n - [https://portswigger.net/web-security/nosql-injection](https://portswigger.net/web-security/nosql-injection)\n","text":"Untrusted input might be used to build a database query, which can lead to a NoSQL injection vulnerability. An attacker can execute malicious NoSQL statements and gain unauthorized access to sensitive data, modify, delete data, or execute arbitrary system commands. Make sure all user input is validated and sanitized, and avoid using tainted user input to construct NoSQL statements if possible. Ideally, avoid raw queries and instead use parameterized queries."},"helpUri":"https://semgrep.dev/r/javascript.express.db.mongodb-where-express.mongodb-where-express","id":"javascript.express.db.mongodb-where-express.mongodb-where-express","name":"javascript.express.db.mongodb-where-express.mongodb-where-express","properties":{"precision":"very-high","tags":["CWE-943: Improper Neutralization of Special Elements in Data Query Logic","HIGH CONFIDENCE","OWASP-A01:2017 - Injection","security"]},"shortDescription":{"text":"Semgrep Finding: javascript.express.db.mongodb-where-express.mongodb-where-express"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"Untrusted input might be used to build a database query, which can lead to a SQL injection vulnerability. An attacker can execute malicious SQL statements and gain unauthorized access to sensitive data, modify, delete data, or execute arbitrary system commands. To prevent this vulnerability, use prepared statements that do not concatenate user-controllable strings and use parameterized queries where SQL commands and user data are strictly separated. Also, consider using an object-relational (ORM) framework to operate with safer abstractions."},"help":{"markdown":"Untrusted input might be used to build a database query, which can lead to a SQL injection vulnerability. An attacker can execute malicious SQL statements and gain unauthorized access to sensitive data, modify, delete data, or execute arbitrary system commands. To prevent this vulnerability, use prepared statements that do not concatenate user-controllable strings and use parameterized queries where SQL commands and user data are strictly separated. Also, consider using an object-relational (ORM) framework to operate with safer abstractions.\n\nReferences: \n - [Semgrep Rule](https://semgrep.dev/r/javascript.express.db.mongoose-express.mongoose-express)\n - [https://owasp.org/Top10/A03_2021-Injection](https://owasp.org/Top10/A03_2021-Injection)\n","text":"Untrusted input might be used to build a database query, which can lead to a SQL injection vulnerability. An attacker can execute malicious SQL statements and gain unauthorized access to sensitive data, modify, delete data, or execute arbitrary system commands. To prevent this vulnerability, use prepared statements that do not concatenate user-controllable strings and use parameterized queries where SQL commands and user data are strictly separated. Also, consider using an object-relational (ORM) framework to operate with safer abstractions."},"helpUri":"https://semgrep.dev/r/javascript.express.db.mongoose-express.mongoose-express","id":"javascript.express.db.mongoose-express.mongoose-express","name":"javascript.express.db.mongoose-express.mongoose-express","properties":{"precision":"very-high","tags":["CWE-89: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')","HIGH CONFIDENCE","OWASP-A01:2017 - Injection","OWASP-A03:2021 - Injection","security"]},"shortDescription":{"text":"Semgrep Finding: javascript.express.db.mongoose-express.mongoose-express"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"Untrusted input might be used to build a database query, which can lead to a SQL injection vulnerability. An attacker can execute malicious SQL statements and gain unauthorized access to sensitive data, modify, delete data, or execute arbitrary system commands. To prevent this vulnerability, use prepared statements that do not concatenate user-controllable strings and use parameterized queries where SQL commands and user data are strictly separated. Also, consider using an object-relational (ORM) framework to operate with safer abstractions."},"help":{"markdown":"Untrusted input might be used to build a database query, which can lead to a SQL injection vulnerability. An attacker can execute malicious SQL statements and gain unauthorized access to sensitive data, modify, delete data, or execute arbitrary system commands. To prevent this vulnerability, use prepared statements that do not concatenate user-controllable strings and use parameterized queries where SQL commands and user data are strictly separated. Also, consider using an object-relational (ORM) framework to operate with safer abstractions.\n\nReferences: \n - [Semgrep Rule](https://semgrep.dev/r/javascript.express.db.mongoose-where-express.mongoose-where-express)\n - [https://owasp.org/Top10/A03_2021-Injection](https://owasp.org/Top10/A03_2021-Injection)\n","text":"Untrusted input might be used to build a database query, which can lead to a SQL injection vulnerability. An attacker can execute malicious SQL statements and gain unauthorized access to sensitive data, modify, delete data, or execute arbitrary system commands. To prevent this vulnerability, use prepared statements that do not concatenate user-controllable strings and use parameterized queries where SQL commands and user data are strictly separated. Also, consider using an object-relational (ORM) framework to operate with safer abstractions."},"helpUri":"https://semgrep.dev/r/javascript.express.db.mongoose-where-express.mongoose-where-express","id":"javascript.express.db.mongoose-where-express.mongoose-where-express","name":"javascript.express.db.mongoose-where-express.mongoose-where-express","properties":{"precision":"very-high","tags":["CWE-89: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')","HIGH CONFIDENCE","OWASP-A01:2017 - Injection","OWASP-A03:2021 - Injection","security"]},"shortDescription":{"text":"Semgrep Finding: javascript.express.db.mongoose-where-express.mongoose-where-express"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"Untrusted input might be used to build a database query, which can lead to a SQL injection vulnerability. An attacker can execute malicious SQL statements and gain unauthorized access to sensitive data, modify, delete data, or execute arbitrary system commands. To prevent this vulnerability, use prepared statements that do not concatenate user-controllable strings and use parameterized queries where SQL commands and user data are strictly separated. Also, consider using an object-relational (ORM) framework to operate with safer abstractions."},"help":{"markdown":"Untrusted input might be used to build a database query, which can lead to a SQL injection vulnerability. An attacker can execute malicious SQL statements and gain unauthorized access to sensitive data, modify, delete data, or execute arbitrary system commands. To prevent this vulnerability, use prepared statements that do not concatenate user-controllable strings and use parameterized queries where SQL commands and user data are strictly separated. Also, consider using an object-relational (ORM) framework to operate with safer abstractions.\n\nReferences: \n - [Semgrep Rule](https://semgrep.dev/r/javascript.express.db.mysql-express.mysql-express)\n - [https://github.com/mysqljs/mysql?tab=readme-ov-file#escaping-query-values](https://github.com/mysqljs/mysql?tab=readme-ov-file#escaping-query-values)\n - [https://owasp.org/Top10/A03_2021-Injection](https://owasp.org/Top10/A03_2021-Injection)\n","text":"Untrusted input might be used to build a database query, which can lead to a SQL injection vulnerability. An attacker can execute malicious SQL statements and gain unauthorized access to sensitive data, modify, delete data, or execute arbitrary system commands. To prevent this vulnerability, use prepared statements that do not concatenate user-controllable strings and use parameterized queries where SQL commands and user data are strictly separated. Also, consider using an object-relational (ORM) framework to operate with safer abstractions."},"helpUri":"https://semgrep.dev/r/javascript.express.db.mysql-express.mysql-express","id":"javascript.express.db.mysql-express.mysql-express","name":"javascript.express.db.mysql-express.mysql-express","properties":{"precision":"very-high","tags":["CWE-89: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')","HIGH CONFIDENCE","OWASP-A01:2017 - Injection","OWASP-A03:2021 - Injection","security"]},"shortDescription":{"text":"Semgrep Finding: javascript.express.db.mysql-express.mysql-express"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"Untrusted input might be used to build a database query, which can lead to a SQL injection vulnerability. An attacker can execute malicious SQL statements and gain unauthorized access to sensitive data, modify, delete data, or execute arbitrary system commands. To prevent this vulnerability, use prepared statements that do not concatenate user-controllable strings and use parameterized queries where SQL commands and user data are strictly separated. Also, consider using an object-relational (ORM) framework to operate with safer abstractions."},"help":{"markdown":"Untrusted input might be used to build a database query, which can lead to a SQL injection vulnerability. An attacker can execute malicious SQL statements and gain unauthorized access to sensitive data, modify, delete data, or execute arbitrary system commands. To prevent this vulnerability, use prepared statements that do not concatenate user-controllable strings and use parameterized queries where SQL commands and user data are strictly separated. Also, consider using an object-relational (ORM) framework to operate with safer abstractions.\n\nReferences: \n - [Semgrep Rule](https://semgrep.dev/r/javascript.express.db.pg-express.pg-express)\n - [https://owasp.org/Top10/A03_2021-Injection](https://owasp.org/Top10/A03_2021-Injection)\n","text":"Untrusted input might be used to build a database query, which can lead to a SQL injection vulnerability. An attacker can execute malicious SQL statements and gain unauthorized access to sensitive data, modify, delete data, or execute arbitrary system commands. To prevent this vulnerability, use prepared statements that do not concatenate user-controllable strings and use parameterized queries where SQL commands and user data are strictly separated. Also, consider using an object-relational (ORM) framework to operate with safer abstractions."},"helpUri":"https://semgrep.dev/r/javascript.express.db.pg-express.pg-express","id":"javascript.express.db.pg-express.pg-express","name":"javascript.express.db.pg-express.pg-express","properties":{"precision":"very-high","tags":["CWE-89: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')","HIGH CONFIDENCE","OWASP-A01:2017 - Injection","OWASP-A03:2021 - Injection","security"]},"shortDescription":{"text":"Semgrep Finding: javascript.express.db.pg-express.pg-express"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"Untrusted input might be used to build a database query, which can lead to a SQL injection vulnerability. An attacker can execute malicious SQL statements and gain unauthorized access to sensitive data, modify, delete data, or execute arbitrary system commands. To prevent this vulnerability, use prepared statements that do not concatenate user-controllable strings and use parameterized queries where SQL commands and user data are strictly separated. Also, consider using an object-relational (ORM) framework to operate with safer abstractions."},"help":{"markdown":"Untrusted input might be used to build a database query, which can lead to a SQL injection vulnerability. An attacker can execute malicious SQL statements and gain unauthorized access to sensitive data, modify, delete data, or execute arbitrary system commands. To prevent this vulnerability, use prepared statements that do not concatenate user-controllable strings and use parameterized queries where SQL commands and user data are strictly separated. Also, consider using an object-relational (ORM) framework to operate with safer abstractions.\n\nReferences: \n - [Semgrep Rule](https://semgrep.dev/r/javascript.express.db.sequelize-express.sequelize-express)\n - [https://owasp.org/Top10/A03_2021-Injection](https://owasp.org/Top10/A03_2021-Injection)\n","text":"Untrusted input might be used to build a database query, which can lead to a SQL injection vulnerability. An attacker can execute malicious SQL statements and gain unauthorized access to sensitive data, modify, delete data, or execute arbitrary system commands. To prevent this vulnerability, use prepared statements that do not concatenate user-controllable strings and use parameterized queries where SQL commands and user data are strictly separated. Also, consider using an object-relational (ORM) framework to operate with safer abstractions."},"helpUri":"https://semgrep.dev/r/javascript.express.db.sequelize-express.sequelize-express","id":"javascript.express.db.sequelize-express.sequelize-express","name":"javascript.express.db.sequelize-express.sequelize-express","properties":{"precision":"very-high","tags":["CWE-89: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')","HIGH CONFIDENCE","OWASP-A01:2017 - Injection","OWASP-A03:2021 - Injection","security"]},"shortDescription":{"text":"Semgrep Finding: javascript.express.db.sequelize-express.sequelize-express"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"Untrusted input might be used to build a database query, which can lead to a SQL injection vulnerability. An attacker can execute malicious SQL statements and gain unauthorized access to sensitive data, modify, delete data, or execute arbitrary system commands. To prevent this vulnerability, use prepared statements that do not concatenate user-controllable strings and use parameterized queries where SQL commands and user data are strictly separated. Also, consider using an object-relational (ORM) framework to operate with safer abstractions."},"help":{"markdown":"Untrusted input might be used to build a database query, which can lead to a SQL injection vulnerability. An attacker can execute malicious SQL statements and gain unauthorized access to sensitive data, modify, delete data, or execute arbitrary system commands. To prevent this vulnerability, use prepared statements that do not concatenate user-controllable strings and use parameterized queries where SQL commands and user data are strictly separated. Also, consider using an object-relational (ORM) framework to operate with safer abstractions.\n\nReferences: \n - [Semgrep Rule](https://semgrep.dev/r/javascript.express.db.sqlite-express.sqlite-express)\n - [https://owasp.org/Top10/A03_2021-Injection](https://owasp.org/Top10/A03_2021-Injection)\n","text":"Untrusted input might be used to build a database query, which can lead to a SQL injection vulnerability. An attacker can execute malicious SQL statements and gain unauthorized access to sensitive data, modify, delete data, or execute arbitrary system commands. To prevent this vulnerability, use prepared statements that do not concatenate user-controllable strings and use parameterized queries where SQL commands and user data are strictly separated. Also, consider using an object-relational (ORM) framework to operate with safer abstractions."},"helpUri":"https://semgrep.dev/r/javascript.express.db.sqlite-express.sqlite-express","id":"javascript.express.db.sqlite-express.sqlite-express","name":"javascript.express.db.sqlite-express.sqlite-express","properties":{"precision":"very-high","tags":["CWE-89: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')","HIGH CONFIDENCE","OWASP-A01:2017 - Injection","OWASP-A03:2021 - Injection","security"]},"shortDescription":{"text":"Semgrep Finding: javascript.express.db.sqlite-express.sqlite-express"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"Untrusted input might be used to build a database query, which can lead to a SQL injection vulnerability. An attacker can execute malicious SQL statements and gain unauthorized access to sensitive data, modify, delete data, or execute arbitrary system commands. To prevent this vulnerability, use prepared statements that do not concatenate user-controllable strings and use parameterized queries where SQL commands and user data are strictly separated. Also, consider using an object-relational (ORM) framework to operate with safer abstractions."},"help":{"markdown":"Untrusted input might be used to build a database query, which can lead to a SQL injection vulnerability. An attacker can execute malicious SQL statements and gain unauthorized access to sensitive data, modify, delete data, or execute arbitrary system commands. To prevent this vulnerability, use prepared statements that do not concatenate user-controllable strings and use parameterized queries where SQL commands and user data are strictly separated. Also, consider using an object-relational (ORM) framework to operate with safer abstractions.\n\nReferences: \n - [Semgrep Rule](https://semgrep.dev/r/javascript.express.db.typeorm-express.typeorm-express)\n - [https://owasp.org/Top10/A03_2021-Injection](https://owasp.org/Top10/A03_2021-Injection)\n","text":"Untrusted input might be used to build a database query, which can lead to a SQL injection vulnerability. An attacker can execute malicious SQL statements and gain unauthorized access to sensitive data, modify, delete data, or execute arbitrary system commands. To prevent this vulnerability, use prepared statements that do not concatenate user-controllable strings and use parameterized queries where SQL commands and user data are strictly separated. Also, consider using an object-relational (ORM) framework to operate with safer abstractions."},"helpUri":"https://semgrep.dev/r/javascript.express.db.typeorm-express.typeorm-express","id":"javascript.express.db.typeorm-express.typeorm-express","name":"javascript.express.db.typeorm-express.typeorm-express","properties":{"precision":"very-high","tags":["CWE-89: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')","HIGH CONFIDENCE","OWASP-A01:2017 - Injection","OWASP-A03:2021 - Injection","security"]},"shortDescription":{"text":"Semgrep Finding: javascript.express.db.typeorm-express.typeorm-express"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"Untrusted input could be used to tamper with a web page rendering, which can lead to a Cross-site scripting (XSS) vulnerability. XSS vulnerabilities occur when untrusted input executes malicious JavaScript code, leading to issues such as account compromise and sensitive information leakage. Use 'resp.render()' to render safely escaped HTML. Validate the user input, perform contextual output encoding, or sanitize the input. A popular library used to prevent XSS is DOMPurify. You can also use libraries and frameworks such as Angular, Vue, and React, which offer secure defaults when rendering input."},"help":{"markdown":"Untrusted input could be used to tamper with a web page rendering, which can lead to a Cross-site scripting (XSS) vulnerability. XSS vulnerabilities occur when untrusted input executes malicious JavaScript code, leading to issues such as account compromise and sensitive information leakage. Use 'resp.render()' to render safely escaped HTML. Validate the user input, perform contextual output encoding, or sanitize the input. A popular library used to prevent XSS is DOMPurify. You can also use libraries and frameworks such as Angular, Vue, and React, which offer secure defaults when rendering input.\n\nReferences: \n - [Semgrep Rule](https://semgrep.dev/r/javascript.express.direct-response-write-with-header.direct-response-write-with-header)\n - [https://cheatsheetseries.owasp.org/cheatsheets/Cross_Site_Scripting_Prevention_Cheat_Sheet.html](https://cheatsheetseries.owasp.org/cheatsheets/Cross_Site_Scripting_Prevention_Cheat_Sheet.html)\n","text":"Untrusted input could be used to tamper with a web page rendering, which can lead to a Cross-site scripting (XSS) vulnerability. XSS vulnerabilities occur when untrusted input executes malicious JavaScript code, leading to issues such as account compromise and sensitive information leakage. Use 'resp.render()' to render safely escaped HTML. Validate the user input, perform contextual output encoding, or sanitize the input. A popular library used to prevent XSS is DOMPurify. You can also use libraries and frameworks such as Angular, Vue, and React, which offer secure defaults when rendering input."},"helpUri":"https://semgrep.dev/r/javascript.express.direct-response-write-with-header.direct-response-write-with-header","id":"javascript.express.direct-response-write-with-header.direct-response-write-with-header","name":"javascript.express.direct-response-write-with-header.direct-response-write-with-header","properties":{"precision":"very-high","tags":["CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')","MEDIUM CONFIDENCE","OWASP-A03:2021 - Injection","OWASP-A07:2017 - Cross-Site Scripting (XSS)","security"]},"shortDescription":{"text":"Semgrep Finding: javascript.express.direct-response-write-with-header.direct-response-write-with-header"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"Untrusted input might be injected into a command executed by the application, which can lead to a command injection vulnerability. An attacker can execute arbitrary commands, potentially gaining complete control of the system. To prevent this vulnerability, avoid executing OS commands with user input. If this is unavoidable, validate and sanitize the user input, and use safe methods for executing the commands. For more information, see [Command injection prevention for JavaScript ](https://semgrep.dev/docs/cheat-sheets/javascript-command-injection/)."},"help":{"markdown":"Untrusted input might be injected into a command executed by the application, which can lead to a command injection vulnerability. An attacker can execute arbitrary commands, potentially gaining complete control of the system. To prevent this vulnerability, avoid executing OS commands with user input. If this is unavoidable, validate and sanitize the user input, and use safe methods for executing the commands. For more information, see [Command injection prevention for JavaScript ](https://semgrep.dev/docs/cheat-sheets/javascript-command-injection/).\n\nReferences: \n - [Semgrep Rule](https://semgrep.dev/r/javascript.express.express-child-process.express-child-process)\n - [https://cheatsheetseries.owasp.org/cheatsheets/Nodejs_Security_Cheat_Sheet.html#do-not-use-dangerous-functions](https://cheatsheetseries.owasp.org/cheatsheets/Nodejs_Security_Cheat_Sheet.html#do-not-use-dangerous-functions)\n","text":"Untrusted input might be injected into a command executed by the application, which can lead to a command injection vulnerability. An attacker can execute arbitrary commands, potentially gaining complete control of the system. To prevent this vulnerability, avoid executing OS commands with user input. If this is unavoidable, validate and sanitize the user input, and use safe methods for executing the commands. For more information, see [Command injection prevention for JavaScript ](https://semgrep.dev/docs/cheat-sheets/javascript-command-injection/)."},"helpUri":"https://semgrep.dev/r/javascript.express.express-child-process.express-child-process","id":"javascript.express.express-child-process.express-child-process","name":"javascript.express.express-child-process.express-child-process","properties":{"precision":"very-high","tags":["CWE-78: Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')","MEDIUM CONFIDENCE","OWASP-A01:2017 - Injection","OWASP-A03:2021 - Injection","security"]},"shortDescription":{"text":"Semgrep Finding: javascript.express.express-child-process.express-child-process"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"The application builds a file path from potentially untrusted data, which can lead to a path traversal vulnerability. An attacker can manipulate the file path which the application uses to access files. If the application does not validate user input and sanitize file paths, sensitive files such as configuration or user data can be accessed, potentially creating or overwriting files. To prevent this vulnerability, validate and sanitize any input that is used to create references to file paths. Also, enforce strict file access controls. For example, choose privileges allowing public-facing applications to access only the required files."},"help":{"markdown":"The application builds a file path from potentially untrusted data, which can lead to a path traversal vulnerability. An attacker can manipulate the file path which the application uses to access files. If the application does not validate user input and sanitize file paths, sensitive files such as configuration or user data can be accessed, potentially creating or overwriting files. To prevent this vulnerability, validate and sanitize any input that is used to create references to file paths. Also, enforce strict file access controls. For example, choose privileges allowing public-facing applications to access only the required files.\n\nReferences: \n - [Semgrep Rule](https://semgrep.dev/r/javascript.express.express-fs-filename.express-fs-filename)\n - [https://owasp.org/www-community/attacks/Path_Traversal](https://owasp.org/www-community/attacks/Path_Traversal)\n","text":"The application builds a file path from potentially untrusted data, which can lead to a path traversal vulnerability. An attacker can manipulate the file path which the application uses to access files. If the application does not validate user input and sanitize file paths, sensitive files such as configuration or user data can be accessed, potentially creating or overwriting files. To prevent this vulnerability, validate and sanitize any input that is used to create references to file paths. Also, enforce strict file access controls. For example, choose privileges allowing public-facing applications to access only the required files."},"helpUri":"https://semgrep.dev/r/javascript.express.express-fs-filename.express-fs-filename","id":"javascript.express.express-fs-filename.express-fs-filename","name":"javascript.express.express-fs-filename.express-fs-filename","properties":{"precision":"very-high","tags":["CWE-22: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')","MEDIUM CONFIDENCE","OWASP-A01:2021 - Broken Access Control","OWASP-A05:2017 - Broken Access Control","security"]},"shortDescription":{"text":"Semgrep Finding: javascript.express.express-fs-filename.express-fs-filename"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"Untrusted input might be used to build a database query, which can lead to a SQL injection vulnerability. An attacker can execute malicious SQL statements and gain unauthorized access to sensitive data, modify, delete data, or execute arbitrary system commands. To prevent this vulnerability, use prepared statements that do not concatenate user-controllable strings and use parameterized queries where SQL commands and user data are strictly separated. Also, consider using an object-relational (ORM) framework to operate with safer abstractions."},"help":{"markdown":"Untrusted input might be used to build a database query, which can lead to a SQL injection vulnerability. An attacker can execute malicious SQL statements and gain unauthorized access to sensitive data, modify, delete data, or execute arbitrary system commands. To prevent this vulnerability, use prepared statements that do not concatenate user-controllable strings and use parameterized queries where SQL commands and user data are strictly separated. Also, consider using an object-relational (ORM) framework to operate with safer abstractions.\n\nReferences: \n - [Semgrep Rule](https://semgrep.dev/r/javascript.express.express-sqlite-sqli.express-sqlite-sqli)\n - [https://www.sqlitetutorial.net/sqlite-nodejs/](https://www.sqlitetutorial.net/sqlite-nodejs/)\n","text":"Untrusted input might be used to build a database query, which can lead to a SQL injection vulnerability. An attacker can execute malicious SQL statements and gain unauthorized access to sensitive data, modify, delete data, or execute arbitrary system commands. To prevent this vulnerability, use prepared statements that do not concatenate user-controllable strings and use parameterized queries where SQL commands and user data are strictly separated. Also, consider using an object-relational (ORM) framework to operate with safer abstractions."},"helpUri":"https://semgrep.dev/r/javascript.express.express-sqlite-sqli.express-sqlite-sqli","id":"javascript.express.express-sqlite-sqli.express-sqlite-sqli","name":"javascript.express.express-sqlite-sqli.express-sqlite-sqli","properties":{"precision":"very-high","tags":["CWE-89: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')","HIGH CONFIDENCE","OWASP-A01:2017 - Injection","OWASP-A03:2021 - Injection","security"]},"shortDescription":{"text":"Semgrep Finding: javascript.express.express-sqlite-sqli.express-sqlite-sqli"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"The application builds a file path from potentially untrusted data, which can lead to a path traversal vulnerability. An attacker can manipulate the path which the application uses to access files. If the application does not validate user input and sanitize file paths, sensitive files such as configuration or user data can be accessed, potentially creating or overwriting files. To prevent this vulnerability, validate and sanitize any input that is used to create references to file paths. Also, enforce strict file access controls. For example, choose privileges allowing public-facing applications to access only the required files."},"help":{"markdown":"The application builds a file path from potentially untrusted data, which can lead to a path traversal vulnerability. An attacker can manipulate the path which the application uses to access files. If the application does not validate user input and sanitize file paths, sensitive files such as configuration or user data can be accessed, potentially creating or overwriting files. To prevent this vulnerability, validate and sanitize any input that is used to create references to file paths. Also, enforce strict file access controls. For example, choose privileges allowing public-facing applications to access only the required files.\n\nReferences: \n - [Semgrep Rule](https://semgrep.dev/r/javascript.express.file.fs-express.fs-express)\n - [https://nodejs.org/api/fs.html#promises-api](https://nodejs.org/api/fs.html#promises-api)\n - [https://owasp.org/Top10/A01_2021-Broken_Access_Control](https://owasp.org/Top10/A01_2021-Broken_Access_Control)\n - [https://owasp.org/www-community/attacks/Path_Traversal](https://owasp.org/www-community/attacks/Path_Traversal)\n - [https://portswigger.net/web-security/file-path-traversal](https://portswigger.net/web-security/file-path-traversal)\n","text":"The application builds a file path from potentially untrusted data, which can lead to a path traversal vulnerability. An attacker can manipulate the path which the application uses to access files. If the application does not validate user input and sanitize file paths, sensitive files such as configuration or user data can be accessed, potentially creating or overwriting files. To prevent this vulnerability, validate and sanitize any input that is used to create references to file paths. Also, enforce strict file access controls. For example, choose privileges allowing public-facing applications to access only the required files."},"helpUri":"https://semgrep.dev/r/javascript.express.file.fs-express.fs-express","id":"javascript.express.file.fs-express.fs-express","name":"javascript.express.file.fs-express.fs-express","properties":{"precision":"very-high","tags":["CWE-22: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')","HIGH CONFIDENCE","OWASP-A01:2021 - Broken Access Control","OWASP-A05:2017 - Broken Access Control","security"]},"shortDescription":{"text":"Semgrep Finding: javascript.express.file.fs-express.fs-express"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"The application builds a file path from potentially untrusted data, which can lead to a path traversal vulnerability. An attacker can manipulate the path which the application uses to access files. If the application does not validate user input and sanitize file paths, sensitive files such as configuration or user data can be accessed, potentially creating or overwriting files. To prevent this vulnerability, validate and sanitize any input that is used to create references to file paths. Also, enforce strict file access controls. For example, choose privileges allowing public-facing applications to access only the required files."},"help":{"markdown":"The application builds a file path from potentially untrusted data, which can lead to a path traversal vulnerability. An attacker can manipulate the path which the application uses to access files. If the application does not validate user input and sanitize file paths, sensitive files such as configuration or user data can be accessed, potentially creating or overwriting files. To prevent this vulnerability, validate and sanitize any input that is used to create references to file paths. Also, enforce strict file access controls. For example, choose privileges allowing public-facing applications to access only the required files.\n\nReferences: \n - [Semgrep Rule](https://semgrep.dev/r/javascript.express.file.fs-extra-express.fs-extra-express)\n - [https://github.com/jprichardson/node-fs-extra/tree/master](https://github.com/jprichardson/node-fs-extra/tree/master)\n - [https://owasp.org/Top10/A01_2021-Broken_Access_Control](https://owasp.org/Top10/A01_2021-Broken_Access_Control)\n - [https://owasp.org/www-community/attacks/Path_Traversal](https://owasp.org/www-community/attacks/Path_Traversal)\n - [https://portswigger.net/web-security/file-path-traversal](https://portswigger.net/web-security/file-path-traversal)\n","text":"The application builds a file path from potentially untrusted data, which can lead to a path traversal vulnerability. An attacker can manipulate the path which the application uses to access files. If the application does not validate user input and sanitize file paths, sensitive files such as configuration or user data can be accessed, potentially creating or overwriting files. To prevent this vulnerability, validate and sanitize any input that is used to create references to file paths. Also, enforce strict file access controls. For example, choose privileges allowing public-facing applications to access only the required files."},"helpUri":"https://semgrep.dev/r/javascript.express.file.fs-extra-express.fs-extra-express","id":"javascript.express.file.fs-extra-express.fs-extra-express","name":"javascript.express.file.fs-extra-express.fs-extra-express","properties":{"precision":"very-high","tags":["CWE-22: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')","HIGH CONFIDENCE","OWASP-A01:2021 - Broken Access Control","OWASP-A05:2017 - Broken Access Control","security"]},"shortDescription":{"text":"Semgrep Finding: javascript.express.file.fs-extra-express.fs-extra-express"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"Detected a `$IMPORT` statement that comes from a `$REQ` argument. This could lead to NoSQL injection if the variable is user-controlled and is not properly sanitized. Be sure to properly sanitize the data if you absolutely must pass request data into a mongo query."},"help":{"markdown":"Detected a `$IMPORT` statement that comes from a `$REQ` argument. This could lead to NoSQL injection if the variable is user-controlled and is not properly sanitized. Be sure to properly sanitize the data if you absolutely must pass request data into a mongo query.\n\nReferences: \n - [Semgrep Rule](https://semgrep.dev/r/javascript.express.mongodb.express-mongo-nosqli.express-mongo-nosqli)\n - [https://owasp.org/www-pdf-archive/GOD16-NOSQL.pdf](https://owasp.org/www-pdf-archive/GOD16-NOSQL.pdf)\n","text":"Detected a `$IMPORT` statement that comes from a `$REQ` argument. This could lead to NoSQL injection if the variable is user-controlled and is not properly sanitized. Be sure to properly sanitize the data if you absolutely must pass request data into a mongo query."},"helpUri":"https://semgrep.dev/r/javascript.express.mongodb.express-mongo-nosqli.express-mongo-nosqli","id":"javascript.express.mongodb.express-mongo-nosqli.express-mongo-nosqli","name":"javascript.express.mongodb.express-mongo-nosqli.express-mongo-nosqli","properties":{"precision":"very-high","tags":["CWE-943: Improper Neutralization of Special Elements in Data Query Logic","MEDIUM CONFIDENCE","OWASP-A01:2017 - Injection","security"]},"shortDescription":{"text":"Semgrep Finding: javascript.express.mongodb.express-mongo-nosqli.express-mongo-nosqli"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"Untrusted input might be used to build a database query, which can lead to a SQL injection vulnerability. An attacker can execute malicious SQL statements and gain unauthorized access to sensitive data, modify, delete data, or execute arbitrary system commands. To prevent this vulnerability, use prepared statements that do not concatenate user-controllable strings and use parameterized queries where SQL commands and user data are strictly separated. Also, consider using an object-relational (ORM) framework to operate with safer abstractions."},"help":{"markdown":"Untrusted input might be used to build a database query, which can lead to a SQL injection vulnerability. An attacker can execute malicious SQL statements and gain unauthorized access to sensitive data, modify, delete data, or execute arbitrary system commands. To prevent this vulnerability, use prepared statements that do not concatenate user-controllable strings and use parameterized queries where SQL commands and user data are strictly separated. Also, consider using an object-relational (ORM) framework to operate with safer abstractions.\n\nReferences: \n - [Semgrep Rule](https://semgrep.dev/r/javascript.express.mysql.express-mysql-sqli.express-mysql-sqli)\n - [https://sequelize.org/docs/v6/core-concepts/raw-queries/#replacements](https://sequelize.org/docs/v6/core-concepts/raw-queries/#replacements)\n","text":"Untrusted input might be used to build a database query, which can lead to a SQL injection vulnerability. An attacker can execute malicious SQL statements and gain unauthorized access to sensitive data, modify, delete data, or execute arbitrary system commands. To prevent this vulnerability, use prepared statements that do not concatenate user-controllable strings and use parameterized queries where SQL commands and user data are strictly separated. Also, consider using an object-relational (ORM) framework to operate with safer abstractions."},"helpUri":"https://semgrep.dev/r/javascript.express.mysql.express-mysql-sqli.express-mysql-sqli","id":"javascript.express.mysql.express-mysql-sqli.express-mysql-sqli","name":"javascript.express.mysql.express-mysql-sqli.express-mysql-sqli","properties":{"precision":"very-high","tags":["CWE-89: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')","HIGH CONFIDENCE","OWASP-A01:2017 - Injection","OWASP-A03:2021 - Injection","security"]},"shortDescription":{"text":"Semgrep Finding: javascript.express.mysql.express-mysql-sqli.express-mysql-sqli"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"Untrusted input might be used to build an HTTP request, which can lead to a Server-side request forgery (SSRF) vulnerability. SSRF allows an attacker to send crafted requests from the server side to other internal or external systems. SSRF can lead to unauthorized access to sensitive data and, in some cases, allow the attacker to control applications or systems that trust the vulnerable service. To prevent this vulnerability, avoid allowing user input to craft the base request. Instead, treat it as part of the path or query parameter and encode it appropriately. When user input is necessary to prepare the HTTP request, perform strict input validation. Additionally, whenever possible, use allowlists to only interact with expected, trusted domains."},"help":{"markdown":"Untrusted input might be used to build an HTTP request, which can lead to a Server-side request forgery (SSRF) vulnerability. SSRF allows an attacker to send crafted requests from the server side to other internal or external systems. SSRF can lead to unauthorized access to sensitive data and, in some cases, allow the attacker to control applications or systems that trust the vulnerable service. To prevent this vulnerability, avoid allowing user input to craft the base request. Instead, treat it as part of the path or query parameter and encode it appropriately. When user input is necessary to prepare the HTTP request, perform strict input validation. Additionally, whenever possible, use allowlists to only interact with expected, trusted domains.\n\nReferences: \n - [Semgrep Rule](https://semgrep.dev/r/javascript.express.needle.ssrf.ssrf)\n - [https://owasp.org/Top10/A10_2021-Server-Side_Request_Forgery_%28SSRF%29](https://owasp.org/Top10/A10_2021-Server-Side_Request_Forgery_%28SSRF%29)\n","text":"Untrusted input might be used to build an HTTP request, which can lead to a Server-side request forgery (SSRF) vulnerability. SSRF allows an attacker to send crafted requests from the server side to other internal or external systems. SSRF can lead to unauthorized access to sensitive data and, in some cases, allow the attacker to control applications or systems that trust the vulnerable service. To prevent this vulnerability, avoid allowing user input to craft the base request. Instead, treat it as part of the path or query parameter and encode it appropriately. When user input is necessary to prepare the HTTP request, perform strict input validation. Additionally, whenever possible, use allowlists to only interact with expected, trusted domains."},"helpUri":"https://semgrep.dev/r/javascript.express.needle.ssrf.ssrf","id":"javascript.express.needle.ssrf.ssrf","name":"javascript.express.needle.ssrf.ssrf","properties":{"precision":"very-high","tags":["CWE-918: Server-Side Request Forgery (SSRF)","HIGH CONFIDENCE","OWASP-A10:2021 - Server-Side Request Forgery (SSRF)","security"]},"shortDescription":{"text":"Semgrep Finding: javascript.express.needle.ssrf.ssrf"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"JSON injection occurs when untrusted input is incorporated into a JavaScript object without proper validation or sanitization. When using methods like Object.assign, malicious input can override or add unintended properties to the object. Attackers may inject properties that alter the application's behavior. Validate the structure and content of input data to ensure it adheres to expected schemas. Reject inputs containing unexpected or disallowed properties."},"help":{"markdown":"JSON injection occurs when untrusted input is incorporated into a JavaScript object without proper validation or sanitization. When using methods like Object.assign, malicious input can override or add unintended properties to the object. Attackers may inject properties that alter the application's behavior. Validate the structure and content of input data to ensure it adheres to expected schemas. Reject inputs containing unexpected or disallowed properties.\n\nReferences: \n - [Semgrep Rule](https://semgrep.dev/r/javascript.express.object.object-assign-express.object-assign-express)\n - [https://owasp.org/Top10/A03_2021-Injection](https://owasp.org/Top10/A03_2021-Injection)\n","text":"JSON injection occurs when untrusted input is incorporated into a JavaScript object without proper validation or sanitization. When using methods like Object.assign, malicious input can override or add unintended properties to the object. Attackers may inject properties that alter the application's behavior. Validate the structure and content of input data to ensure it adheres to expected schemas. Reject inputs containing unexpected or disallowed properties."},"helpUri":"https://semgrep.dev/r/javascript.express.object.object-assign-express.object-assign-express","id":"javascript.express.object.object-assign-express.object-assign-express","name":"javascript.express.object.object-assign-express.object-assign-express","properties":{"precision":"very-high","tags":["CWE-74: Improper Neutralization of Special Elements in Output Used by a Downstream Component ('Injection')","HIGH CONFIDENCE","OWASP-A03:2021 - Injection","security"]},"shortDescription":{"text":"Semgrep Finding: javascript.express.object.object-assign-express.object-assign-express"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"The application builds a URL using user-controlled input which can lead to an open redirect vulnerability. An attacker can manipulate the URL and redirect users to an arbitrary domain. Open redirect vulnerabilities can lead to issues such as Cross-site scripting (XSS) or redirecting to a malicious domain for activities such as phishing to capture users' credentials. To prevent this vulnerability perform strict input validation of the domain against an allowlist of approved domains. Notify a user in your application that they are leaving the website. Display a domain where they are redirected to the user. A user can then either accept or deny the redirect to an untrusted site."},"help":{"markdown":"The application builds a URL using user-controlled input which can lead to an open redirect vulnerability. An attacker can manipulate the URL and redirect users to an arbitrary domain. Open redirect vulnerabilities can lead to issues such as Cross-site scripting (XSS) or redirecting to a malicious domain for activities such as phishing to capture users' credentials. To prevent this vulnerability perform strict input validation of the domain against an allowlist of approved domains. Notify a user in your application that they are leaving the website. Display a domain where they are redirected to the user. A user can then either accept or deny the redirect to an untrusted site.\n\nReferences: \n - [Semgrep Rule](https://semgrep.dev/r/javascript.express.open-redirect-deepsemgrep.open-redirect-deepsemgrep)\n - [https://cheatsheetseries.owasp.org/cheatsheets/Unvalidated_Redirects_and_Forwards_Cheat_Sheet.html](https://cheatsheetseries.owasp.org/cheatsheets/Unvalidated_Redirects_and_Forwards_Cheat_Sheet.html)\n","text":"The application builds a URL using user-controlled input which can lead to an open redirect vulnerability. An attacker can manipulate the URL and redirect users to an arbitrary domain. Open redirect vulnerabilities can lead to issues such as Cross-site scripting (XSS) or redirecting to a malicious domain for activities such as phishing to capture users' credentials. To prevent this vulnerability perform strict input validation of the domain against an allowlist of approved domains. Notify a user in your application that they are leaving the website. Display a domain where they are redirected to the user. A user can then either accept or deny the redirect to an untrusted site."},"helpUri":"https://semgrep.dev/r/javascript.express.open-redirect-deepsemgrep.open-redirect-deepsemgrep","id":"javascript.express.open-redirect-deepsemgrep.open-redirect-deepsemgrep","name":"javascript.express.open-redirect-deepsemgrep.open-redirect-deepsemgrep","properties":{"precision":"very-high","tags":["CWE-601: URL Redirection to Untrusted Site ('Open Redirect')","HIGH CONFIDENCE","OWASP-A01:2021 - Broken Access Control","security"]},"shortDescription":{"text":"Semgrep Finding: javascript.express.open-redirect-deepsemgrep.open-redirect-deepsemgrep"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"Untrusted input might be injected into a command executed by the application, which can lead to a command injection vulnerability. An attacker can execute arbitrary commands, potentially gaining complete control of the system. To prevent this vulnerability, avoid executing OS commands with user input. If this is unavoidable, validate and sanitize the input, and use safe methods for executing the commands. For more information, see: [JavaScript command injection prevention](https://semgrep.dev/docs/cheat-sheets/javascript-command-injection/)"},"help":{"markdown":"Untrusted input might be injected into a command executed by the application, which can lead to a command injection vulnerability. An attacker can execute arbitrary commands, potentially gaining complete control of the system. To prevent this vulnerability, avoid executing OS commands with user input. If this is unavoidable, validate and sanitize the input, and use safe methods for executing the commands. For more information, see: [JavaScript command injection prevention](https://semgrep.dev/docs/cheat-sheets/javascript-command-injection/)\n\nReferences: \n - [Semgrep Rule](https://semgrep.dev/r/javascript.express.os.tainted-os-command-child-process-express.tainted-os-command-child-process-express)\n - [https://owasp.org/Top10/A03_2021-Injection](https://owasp.org/Top10/A03_2021-Injection)\n","text":"Untrusted input might be injected into a command executed by the application, which can lead to a command injection vulnerability. An attacker can execute arbitrary commands, potentially gaining complete control of the system. To prevent this vulnerability, avoid executing OS commands with user input. If this is unavoidable, validate and sanitize the input, and use safe methods for executing the commands. For more information, see: [JavaScript command injection prevention](https://semgrep.dev/docs/cheat-sheets/javascript-command-injection/)"},"helpUri":"https://semgrep.dev/r/javascript.express.os.tainted-os-command-child-process-express.tainted-os-command-child-process-express","id":"javascript.express.os.tainted-os-command-child-process-express.tainted-os-command-child-process-express","name":"javascript.express.os.tainted-os-command-child-process-express.tainted-os-command-child-process-express","properties":{"precision":"very-high","tags":["CWE-78: Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')","HIGH CONFIDENCE","OWASP-A01:2017 - Injection","OWASP-A03:2021 - Injection","security"]},"shortDescription":{"text":"Semgrep Finding: javascript.express.os.tainted-os-command-child-process-express.tainted-os-command-child-process-express"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"Untrusted input might be used to build a database query, which can lead to a SQL injection vulnerability. An attacker can execute malicious SQL statements and gain unauthorized access to sensitive data, modify, delete data, or execute arbitrary system commands. To prevent this vulnerability, use prepared statements that do not concatenate user-controllable strings and use parameterized queries where SQL commands and user data are strictly separated. Also, consider using an object-relational (ORM) framework to operate with safer abstractions."},"help":{"markdown":"Untrusted input might be used to build a database query, which can lead to a SQL injection vulnerability. An attacker can execute malicious SQL statements and gain unauthorized access to sensitive data, modify, delete data, or execute arbitrary system commands. To prevent this vulnerability, use prepared statements that do not concatenate user-controllable strings and use parameterized queries where SQL commands and user data are strictly separated. Also, consider using an object-relational (ORM) framework to operate with safer abstractions.\n\nReferences: \n - [Semgrep Rule](https://semgrep.dev/r/javascript.express.pg.express-pg-sqli.express-pg-sqli)\n - [https://www.npmjs.com/package/pg](https://www.npmjs.com/package/pg)\n - [https://cheatsheetseries.owasp.org/cheatsheets/SQL_Injection_Prevention_Cheat_Sheet.html](https://cheatsheetseries.owasp.org/cheatsheets/SQL_Injection_Prevention_Cheat_Sheet.html)\n","text":"Untrusted input might be used to build a database query, which can lead to a SQL injection vulnerability. An attacker can execute malicious SQL statements and gain unauthorized access to sensitive data, modify, delete data, or execute arbitrary system commands. To prevent this vulnerability, use prepared statements that do not concatenate user-controllable strings and use parameterized queries where SQL commands and user data are strictly separated. Also, consider using an object-relational (ORM) framework to operate with safer abstractions."},"helpUri":"https://semgrep.dev/r/javascript.express.pg.express-pg-sqli.express-pg-sqli","id":"javascript.express.pg.express-pg-sqli.express-pg-sqli","name":"javascript.express.pg.express-pg-sqli.express-pg-sqli","properties":{"precision":"very-high","tags":["CWE-89: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')","HIGH CONFIDENCE","OWASP-A01:2017 - Injection","OWASP-A03:2021 - Injection","security"]},"shortDescription":{"text":"Semgrep Finding: javascript.express.pg.express-pg-sqli.express-pg-sqli"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"Detected `$REQ` argument enters calls to `RegExp`. This could lead to a Regular Expression Denial of Service (ReDoS) through catastrophic backtracking. If the input is attacker controllable, this vulnerability can lead to systems being non-responsive or may crash due to ReDoS. Where possible avoid calls to `RegExp` with user input, if required ensure user input is escaped or validated. "},"help":{"markdown":"Detected `$REQ` argument enters calls to `RegExp`. This could lead to a Regular Expression Denial of Service (ReDoS) through catastrophic backtracking. If the input is attacker controllable, this vulnerability can lead to systems being non-responsive or may crash due to ReDoS. Where possible avoid calls to `RegExp` with user input, if required ensure user input is escaped or validated. \n\nReferences: \n - [Semgrep Rule](https://semgrep.dev/r/javascript.express.regexp-redos.regexp-redos)\n - [https://owasp.org/www-community/attacks/Regular_expression_Denial_of_Service_-_ReDoS](https://owasp.org/www-community/attacks/Regular_expression_Denial_of_Service_-_ReDoS)\n - [https://www.regular-expressions.info/catastrophic.html](https://www.regular-expressions.info/catastrophic.html)\n","text":"Detected `$REQ` argument enters calls to `RegExp`. This could lead to a Regular Expression Denial of Service (ReDoS) through catastrophic backtracking. If the input is attacker controllable, this vulnerability can lead to systems being non-responsive or may crash due to ReDoS. Where possible avoid calls to `RegExp` with user input, if required ensure user input is escaped or validated. "},"helpUri":"https://semgrep.dev/r/javascript.express.regexp-redos.regexp-redos","id":"javascript.express.regexp-redos.regexp-redos","name":"javascript.express.regexp-redos.regexp-redos","properties":{"precision":"very-high","tags":["CWE-1333: Inefficient Regular Expression Complexity","HIGH CONFIDENCE","security"]},"shortDescription":{"text":"Semgrep Finding: javascript.express.regexp-redos.regexp-redos"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"Untrusted input might be used to build an HTTP request, which can lead to a Server-side request forgery (SSRF) vulnerability. SSRF allows an attacker to send crafted requests from the server side to other internal or external systems. SSRF can lead to unauthorized access to sensitive data and, in some cases, allow the attacker to control applications or systems that trust the vulnerable service. To prevent this vulnerability, avoid allowing user input to craft the base request. Instead, treat it as part of the path or query parameter and encode it appropriately. When user input is necessary to prepare the HTTP request, perform strict input validation. Additionally, whenever possible, use allowlists to only interact with expected, trusted domains."},"help":{"markdown":"Untrusted input might be used to build an HTTP request, which can lead to a Server-side request forgery (SSRF) vulnerability. SSRF allows an attacker to send crafted requests from the server side to other internal or external systems. SSRF can lead to unauthorized access to sensitive data and, in some cases, allow the attacker to control applications or systems that trust the vulnerable service. To prevent this vulnerability, avoid allowing user input to craft the base request. Instead, treat it as part of the path or query parameter and encode it appropriately. When user input is necessary to prepare the HTTP request, perform strict input validation. Additionally, whenever possible, use allowlists to only interact with expected, trusted domains.\n\nReferences: \n - [Semgrep Rule](https://semgrep.dev/r/javascript.express.request.ssrf-deepsemgrep.ssrf-deepsemgrep)\n - [https://cheatsheetseries.owasp.org/cheatsheets/Server_Side_Request_Forgery_Prevention_Cheat_Sheet.html](https://cheatsheetseries.owasp.org/cheatsheets/Server_Side_Request_Forgery_Prevention_Cheat_Sheet.html)\n","text":"Untrusted input might be used to build an HTTP request, which can lead to a Server-side request forgery (SSRF) vulnerability. SSRF allows an attacker to send crafted requests from the server side to other internal or external systems. SSRF can lead to unauthorized access to sensitive data and, in some cases, allow the attacker to control applications or systems that trust the vulnerable service. To prevent this vulnerability, avoid allowing user input to craft the base request. Instead, treat it as part of the path or query parameter and encode it appropriately. When user input is necessary to prepare the HTTP request, perform strict input validation. Additionally, whenever possible, use allowlists to only interact with expected, trusted domains."},"helpUri":"https://semgrep.dev/r/javascript.express.request.ssrf-deepsemgrep.ssrf-deepsemgrep","id":"javascript.express.request.ssrf-deepsemgrep.ssrf-deepsemgrep","name":"javascript.express.request.ssrf-deepsemgrep.ssrf-deepsemgrep","properties":{"precision":"very-high","tags":["CWE-918: Server-Side Request Forgery (SSRF)","HIGH CONFIDENCE","OWASP-A10:2021 - Server-Side Request Forgery (SSRF)","security"]},"shortDescription":{"text":"Semgrep Finding: javascript.express.request.ssrf-deepsemgrep.ssrf-deepsemgrep"}},{"defaultConfiguration":{"level":"note"},"fullDescription":{"text":"A CSRF middleware was not detected in your express application. Ensure you are either using one such as `csurf` or `csrf` (see rule references) and/or you are properly doing CSRF validation in your routes with a token or cookies."},"help":{"markdown":"A CSRF middleware was not detected in your express application. Ensure you are either using one such as `csurf` or `csrf` (see rule references) and/or you are properly doing CSRF validation in your routes with a token or cookies.\n\nReferences: \n - [Semgrep Rule](https://semgrep.dev/r/javascript.express.security.audit.express-check-csurf-middleware-usage.express-check-csurf-middleware-usage)\n - [https://www.npmjs.com/package/csurf](https://www.npmjs.com/package/csurf)\n - [https://www.npmjs.com/package/csrf](https://www.npmjs.com/package/csrf)\n - [https://cheatsheetseries.owasp.org/cheatsheets/Cross-Site_Request_Forgery_Prevention_Cheat_Sheet.html](https://cheatsheetseries.owasp.org/cheatsheets/Cross-Site_Request_Forgery_Prevention_Cheat_Sheet.html)\n","text":"A CSRF middleware was not detected in your express application. Ensure you are either using one such as `csurf` or `csrf` (see rule references) and/or you are properly doing CSRF validation in your routes with a token or cookies."},"helpUri":"https://semgrep.dev/r/javascript.express.security.audit.express-check-csurf-middleware-usage.express-check-csurf-middleware-usage","id":"javascript.express.security.audit.express-check-csurf-middleware-usage.express-check-csurf-middleware-usage","name":"javascript.express.security.audit.express-check-csurf-middleware-usage.express-check-csurf-middleware-usage","properties":{"precision":"very-high","tags":["CWE-352: Cross-Site Request Forgery (CSRF)","LOW CONFIDENCE","OWASP-A01:2021 - Broken Access Control","security"]},"shortDescription":{"text":"Semgrep Finding: javascript.express.security.audit.express-check-csurf-middleware-usage.express-check-csurf-middleware-usage"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"Directory listing/indexing is enabled, which may lead to disclosure of sensitive directories and files. It is recommended to disable directory listing unless it is a public resource. If you need directory listing, ensure that sensitive files are inaccessible when querying the resource."},"help":{"markdown":"Directory listing/indexing is enabled, which may lead to disclosure of sensitive directories and files. It is recommended to disable directory listing unless it is a public resource. If you need directory listing, ensure that sensitive files are inaccessible when querying the resource.\n\nReferences: \n - [Semgrep Rule](https://semgrep.dev/r/javascript.express.security.audit.express-check-directory-listing.express-check-directory-listing)\n - [https://www.npmjs.com/package/serve-index](https://www.npmjs.com/package/serve-index)\n - [https://www.acunetix.com/blog/articles/directory-listing-information-disclosure/](https://www.acunetix.com/blog/articles/directory-listing-information-disclosure/)\n","text":"Directory listing/indexing is enabled, which may lead to disclosure of sensitive directories and files. It is recommended to disable directory listing unless it is a public resource. If you need directory listing, ensure that sensitive files are inaccessible when querying the resource."},"helpUri":"https://semgrep.dev/r/javascript.express.security.audit.express-check-directory-listing.express-check-directory-listing","id":"javascript.express.security.audit.express-check-directory-listing.express-check-directory-listing","name":"javascript.express.security.audit.express-check-directory-listing.express-check-directory-listing","properties":{"precision":"very-high","tags":["CWE-548: Exposure of Information Through Directory Listing","MEDIUM CONFIDENCE","OWASP-A01:2021 - Broken Access Control","OWASP-A06:2017 - Security Misconfiguration","security"]},"shortDescription":{"text":"Semgrep Finding: javascript.express.security.audit.express-check-directory-listing.express-check-directory-listing"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"Don’t use the default session cookie name Using the default session cookie name can open your app to attacks. The security issue posed is similar to X-Powered-By: a potential attacker can use it to fingerprint the server and target attacks accordingly."},"help":{"markdown":"Don’t use the default session cookie name Using the default session cookie name can open your app to attacks. The security issue posed is similar to X-Powered-By: a potential attacker can use it to fingerprint the server and target attacks accordingly.\n\nReferences: \n - [Semgrep Rule](https://semgrep.dev/r/javascript.express.security.audit.express-cookie-settings.express-cookie-session-default-name)\n - [https://owasp.org/Top10/A04_2021-Insecure_Design](https://owasp.org/Top10/A04_2021-Insecure_Design)\n","text":"Don’t use the default session cookie name Using the default session cookie name can open your app to attacks. The security issue posed is similar to X-Powered-By: a potential attacker can use it to fingerprint the server and target attacks accordingly."},"helpUri":"https://semgrep.dev/r/javascript.express.security.audit.express-cookie-settings.express-cookie-session-default-name","id":"javascript.express.security.audit.express-cookie-settings.express-cookie-session-default-name","name":"javascript.express.security.audit.express-cookie-settings.express-cookie-session-default-name","properties":{"precision":"very-high","tags":["CWE-522: Insufficiently Protected Credentials","MEDIUM CONFIDENCE","OWASP-A02:2017 - Broken Authentication","OWASP-A04:2021 - Insecure Design","security"]},"shortDescription":{"text":"Semgrep Finding: javascript.express.security.audit.express-cookie-settings.express-cookie-session-default-name"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"Default session middleware settings: `domain` not set. It indicates the domain of the cookie; use it to compare against the domain of the server in which the URL is being requested. If they match, then check the path attribute next."},"help":{"markdown":"Default session middleware settings: `domain` not set. It indicates the domain of the cookie; use it to compare against the domain of the server in which the URL is being requested. If they match, then check the path attribute next.\n\nReferences: \n - [Semgrep Rule](https://semgrep.dev/r/javascript.express.security.audit.express-cookie-settings.express-cookie-session-no-domain)\n - [https://owasp.org/Top10/A04_2021-Insecure_Design](https://owasp.org/Top10/A04_2021-Insecure_Design)\n","text":"Default session middleware settings: `domain` not set. It indicates the domain of the cookie; use it to compare against the domain of the server in which the URL is being requested. If they match, then check the path attribute next."},"helpUri":"https://semgrep.dev/r/javascript.express.security.audit.express-cookie-settings.express-cookie-session-no-domain","id":"javascript.express.security.audit.express-cookie-settings.express-cookie-session-no-domain","name":"javascript.express.security.audit.express-cookie-settings.express-cookie-session-no-domain","properties":{"precision":"very-high","tags":["CWE-522: Insufficiently Protected Credentials","MEDIUM CONFIDENCE","OWASP-A02:2017 - Broken Authentication","OWASP-A04:2021 - Insecure Design","security"]},"shortDescription":{"text":"Semgrep Finding: javascript.express.security.audit.express-cookie-settings.express-cookie-session-no-domain"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"Default session middleware settings: `expires` not set. Use it to set expiration date for persistent cookies."},"help":{"markdown":"Default session middleware settings: `expires` not set. Use it to set expiration date for persistent cookies.\n\nReferences: \n - [Semgrep Rule](https://semgrep.dev/r/javascript.express.security.audit.express-cookie-settings.express-cookie-session-no-expires)\n - [https://owasp.org/Top10/A04_2021-Insecure_Design](https://owasp.org/Top10/A04_2021-Insecure_Design)\n","text":"Default session middleware settings: `expires` not set. Use it to set expiration date for persistent cookies."},"helpUri":"https://semgrep.dev/r/javascript.express.security.audit.express-cookie-settings.express-cookie-session-no-expires","id":"javascript.express.security.audit.express-cookie-settings.express-cookie-session-no-expires","name":"javascript.express.security.audit.express-cookie-settings.express-cookie-session-no-expires","properties":{"precision":"very-high","tags":["CWE-522: Insufficiently Protected Credentials","MEDIUM CONFIDENCE","OWASP-A02:2017 - Broken Authentication","OWASP-A04:2021 - Insecure Design","security"]},"shortDescription":{"text":"Semgrep Finding: javascript.express.security.audit.express-cookie-settings.express-cookie-session-no-expires"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"Default session middleware settings: `httpOnly` not set. It ensures the cookie is sent only over HTTP(S), not client JavaScript, helping to protect against cross-site scripting attacks."},"help":{"markdown":"Default session middleware settings: `httpOnly` not set. It ensures the cookie is sent only over HTTP(S), not client JavaScript, helping to protect against cross-site scripting attacks.\n\nReferences: \n - [Semgrep Rule](https://semgrep.dev/r/javascript.express.security.audit.express-cookie-settings.express-cookie-session-no-httponly)\n - [https://owasp.org/Top10/A04_2021-Insecure_Design](https://owasp.org/Top10/A04_2021-Insecure_Design)\n","text":"Default session middleware settings: `httpOnly` not set. It ensures the cookie is sent only over HTTP(S), not client JavaScript, helping to protect against cross-site scripting attacks."},"helpUri":"https://semgrep.dev/r/javascript.express.security.audit.express-cookie-settings.express-cookie-session-no-httponly","id":"javascript.express.security.audit.express-cookie-settings.express-cookie-session-no-httponly","name":"javascript.express.security.audit.express-cookie-settings.express-cookie-session-no-httponly","properties":{"precision":"very-high","tags":["CWE-522: Insufficiently Protected Credentials","MEDIUM CONFIDENCE","OWASP-A02:2017 - Broken Authentication","OWASP-A04:2021 - Insecure Design","security"]},"shortDescription":{"text":"Semgrep Finding: javascript.express.security.audit.express-cookie-settings.express-cookie-session-no-httponly"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"Default session middleware settings: `path` not set. It indicates the path of the cookie; use it to compare against the request path. If this and domain match, then send the cookie in the request."},"help":{"markdown":"Default session middleware settings: `path` not set. It indicates the path of the cookie; use it to compare against the request path. If this and domain match, then send the cookie in the request.\n\nReferences: \n - [Semgrep Rule](https://semgrep.dev/r/javascript.express.security.audit.express-cookie-settings.express-cookie-session-no-path)\n - [https://owasp.org/Top10/A04_2021-Insecure_Design](https://owasp.org/Top10/A04_2021-Insecure_Design)\n","text":"Default session middleware settings: `path` not set. It indicates the path of the cookie; use it to compare against the request path. If this and domain match, then send the cookie in the request."},"helpUri":"https://semgrep.dev/r/javascript.express.security.audit.express-cookie-settings.express-cookie-session-no-path","id":"javascript.express.security.audit.express-cookie-settings.express-cookie-session-no-path","name":"javascript.express.security.audit.express-cookie-settings.express-cookie-session-no-path","properties":{"precision":"very-high","tags":["CWE-522: Insufficiently Protected Credentials","MEDIUM CONFIDENCE","OWASP-A02:2017 - Broken Authentication","OWASP-A04:2021 - Insecure Design","security"]},"shortDescription":{"text":"Semgrep Finding: javascript.express.security.audit.express-cookie-settings.express-cookie-session-no-path"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"Default session middleware settings: `secure` not set. It ensures the browser only sends the cookie over HTTPS."},"help":{"markdown":"Default session middleware settings: `secure` not set. It ensures the browser only sends the cookie over HTTPS.\n\nReferences: \n - [Semgrep Rule](https://semgrep.dev/r/javascript.express.security.audit.express-cookie-settings.express-cookie-session-no-secure)\n - [https://owasp.org/Top10/A04_2021-Insecure_Design](https://owasp.org/Top10/A04_2021-Insecure_Design)\n","text":"Default session middleware settings: `secure` not set. It ensures the browser only sends the cookie over HTTPS."},"helpUri":"https://semgrep.dev/r/javascript.express.security.audit.express-cookie-settings.express-cookie-session-no-secure","id":"javascript.express.security.audit.express-cookie-settings.express-cookie-session-no-secure","name":"javascript.express.security.audit.express-cookie-settings.express-cookie-session-no-secure","properties":{"precision":"very-high","tags":["CWE-522: Insufficiently Protected Credentials","MEDIUM CONFIDENCE","OWASP-A02:2017 - Broken Authentication","OWASP-A04:2021 - Insecure Design","security"]},"shortDescription":{"text":"Semgrep Finding: javascript.express.security.audit.express-cookie-settings.express-cookie-session-no-secure"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"Detected usage of the `notevil` package, which is unmaintained and has vulnerabilities. Using any sort of `eval()` functionality can be very dangerous, but if you must, the `eval` package is an up to date alternative. Be sure that only trusted input reaches an `eval()` function."},"help":{"markdown":"Detected usage of the `notevil` package, which is unmaintained and has vulnerabilities. Using any sort of `eval()` functionality can be very dangerous, but if you must, the `eval` package is an up to date alternative. Be sure that only trusted input reaches an `eval()` function.\n\nReferences: \n - [Semgrep Rule](https://semgrep.dev/r/javascript.express.security.audit.express-detect-notevil-usage.express-detect-notevil-usage)\n - [https://github.com/mmckegg/notevil](https://github.com/mmckegg/notevil)\n","text":"Detected usage of the `notevil` package, which is unmaintained and has vulnerabilities. Using any sort of `eval()` functionality can be very dangerous, but if you must, the `eval` package is an up to date alternative. Be sure that only trusted input reaches an `eval()` function."},"helpUri":"https://semgrep.dev/r/javascript.express.security.audit.express-detect-notevil-usage.express-detect-notevil-usage","id":"javascript.express.security.audit.express-detect-notevil-usage.express-detect-notevil-usage","name":"javascript.express.security.audit.express-detect-notevil-usage.express-detect-notevil-usage","properties":{"precision":"very-high","tags":["CWE-1104: Use of Unmaintained Third Party Components","LOW CONFIDENCE","OWASP-A06:2021 - Vulnerable and Outdated Components","security"]},"shortDescription":{"text":"Semgrep Finding: javascript.express.security.audit.express-detect-notevil-usage.express-detect-notevil-usage"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"No token revoking configured for `express-jwt`. A leaked token could still be used and unable to be revoked. Consider using function as the `isRevoked` option."},"help":{"markdown":"No token revoking configured for `express-jwt`. A leaked token could still be used and unable to be revoked. Consider using function as the `isRevoked` option.\n\nReferences: \n - [Semgrep Rule](https://semgrep.dev/r/javascript.express.security.audit.express-jwt-not-revoked.express-jwt-not-revoked)\n - [https://owasp.org/Top10/A04_2021-Insecure_Design](https://owasp.org/Top10/A04_2021-Insecure_Design)\n","text":"No token revoking configured for `express-jwt`. A leaked token could still be used and unable to be revoked. Consider using function as the `isRevoked` option."},"helpUri":"https://semgrep.dev/r/javascript.express.security.audit.express-jwt-not-revoked.express-jwt-not-revoked","id":"javascript.express.security.audit.express-jwt-not-revoked.express-jwt-not-revoked","name":"javascript.express.security.audit.express-jwt-not-revoked.express-jwt-not-revoked","properties":{"precision":"very-high","tags":["CWE-522: Insufficiently Protected Credentials","MEDIUM CONFIDENCE","OWASP-A02:2017 - Broken Authentication","OWASP-A04:2021 - Insecure Design","security"]},"shortDescription":{"text":"Semgrep Finding: javascript.express.security.audit.express-jwt-not-revoked.express-jwt-not-revoked"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"The libxml library processes user-input with the `noent` attribute is set to `true` which can lead to being vulnerable to XML External Entities (XXE) type attacks. It is recommended to set `noent` to `false` when using this feature to ensure you are protected."},"help":{"markdown":"The libxml library processes user-input with the `noent` attribute is set to `true` which can lead to being vulnerable to XML External Entities (XXE) type attacks. It is recommended to set `noent` to `false` when using this feature to ensure you are protected.\n\nReferences: \n - [Semgrep Rule](https://semgrep.dev/r/javascript.express.security.audit.express-libxml-noent.express-libxml-noent)\n - [https://cheatsheetseries.owasp.org/cheatsheets/XML_External_Entity_Prevention_Cheat_Sheet.html](https://cheatsheetseries.owasp.org/cheatsheets/XML_External_Entity_Prevention_Cheat_Sheet.html)\n","text":"The libxml library processes user-input with the `noent` attribute is set to `true` which can lead to being vulnerable to XML External Entities (XXE) type attacks. It is recommended to set `noent` to `false` when using this feature to ensure you are protected."},"helpUri":"https://semgrep.dev/r/javascript.express.security.audit.express-libxml-noent.express-libxml-noent","id":"javascript.express.security.audit.express-libxml-noent.express-libxml-noent","name":"javascript.express.security.audit.express-libxml-noent.express-libxml-noent","properties":{"precision":"very-high","tags":["CWE-611: Improper Restriction of XML External Entity Reference","HIGH CONFIDENCE","OWASP-A04:2017 - XML External Entities (XXE)","OWASP-A05:2021 - Security Misconfiguration","security"]},"shortDescription":{"text":"Semgrep Finding: javascript.express.security.audit.express-libxml-noent.express-libxml-noent"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"Detected use of parseXml() function with the `noent` field set to `true`. This can lead to an XML External Entities (XXE) attack if untrusted data is passed into it."},"help":{"markdown":"Detected use of parseXml() function with the `noent` field set to `true`. This can lead to an XML External Entities (XXE) attack if untrusted data is passed into it.\n\nReferences: \n - [Semgrep Rule](https://semgrep.dev/r/javascript.express.security.audit.express-libxml-vm-noent.express-libxml-vm-noent)\n - [https://cheatsheetseries.owasp.org/cheatsheets/XML_External_Entity_Prevention_Cheat_Sheet.html](https://cheatsheetseries.owasp.org/cheatsheets/XML_External_Entity_Prevention_Cheat_Sheet.html)\n","text":"Detected use of parseXml() function with the `noent` field set to `true`. This can lead to an XML External Entities (XXE) attack if untrusted data is passed into it."},"helpUri":"https://semgrep.dev/r/javascript.express.security.audit.express-libxml-vm-noent.express-libxml-vm-noent","id":"javascript.express.security.audit.express-libxml-vm-noent.express-libxml-vm-noent","name":"javascript.express.security.audit.express-libxml-vm-noent.express-libxml-vm-noent","properties":{"precision":"very-high","tags":["CWE-611: Improper Restriction of XML External Entity Reference","LOW CONFIDENCE","OWASP-A04:2017 - XML External Entities (XXE)","OWASP-A05:2021 - Security Misconfiguration","security"]},"shortDescription":{"text":"Semgrep Finding: javascript.express.security.audit.express-libxml-vm-noent.express-libxml-vm-noent"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"The application redirects to a URL specified by user-supplied input `$REQ` that is not validated. This could redirect users to malicious locations. Consider using an allow-list approach to validate URLs, or warn users they are being redirected to a third-party website."},"help":{"markdown":"The application redirects to a URL specified by user-supplied input `$REQ` that is not validated. This could redirect users to malicious locations. Consider using an allow-list approach to validate URLs, or warn users they are being redirected to a third-party website.\n\nReferences: \n - [Semgrep Rule](https://semgrep.dev/r/javascript.express.security.audit.express-open-redirect.express-open-redirect)\n - [https://cheatsheetseries.owasp.org/cheatsheets/Unvalidated_Redirects_and_Forwards_Cheat_Sheet.html](https://cheatsheetseries.owasp.org/cheatsheets/Unvalidated_Redirects_and_Forwards_Cheat_Sheet.html)\n","text":"The application redirects to a URL specified by user-supplied input `$REQ` that is not validated. This could redirect users to malicious locations. Consider using an allow-list approach to validate URLs, or warn users they are being redirected to a third-party website."},"helpUri":"https://semgrep.dev/r/javascript.express.security.audit.express-open-redirect.express-open-redirect","id":"javascript.express.security.audit.express-open-redirect.express-open-redirect","name":"javascript.express.security.audit.express-open-redirect.express-open-redirect","properties":{"precision":"very-high","tags":["CWE-601: URL Redirection to Untrusted Site ('Open Redirect')","HIGH CONFIDENCE","OWASP-A01:2021 - Broken Access Control","security"]},"shortDescription":{"text":"Semgrep Finding: javascript.express.security.audit.express-open-redirect.express-open-redirect"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"Possible writing outside of the destination, make sure that the target path is nested in the intended destination"},"help":{"markdown":"Possible writing outside of the destination, make sure that the target path is nested in the intended destination\n\nReferences: \n - [Semgrep Rule](https://semgrep.dev/r/javascript.express.security.audit.express-path-join-resolve-traversal.express-path-join-resolve-traversal)\n - [https://owasp.org/www-community/attacks/Path_Traversal](https://owasp.org/www-community/attacks/Path_Traversal)\n","text":"Possible writing outside of the destination, make sure that the target path is nested in the intended destination"},"helpUri":"https://semgrep.dev/r/javascript.express.security.audit.express-path-join-resolve-traversal.express-path-join-resolve-traversal","id":"javascript.express.security.audit.express-path-join-resolve-traversal.express-path-join-resolve-traversal","name":"javascript.express.security.audit.express-path-join-resolve-traversal.express-path-join-resolve-traversal","properties":{"precision":"very-high","tags":["CWE-22: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')","MEDIUM CONFIDENCE","OWASP-A01:2021 - Broken Access Control","OWASP-A05:2017 - Broken Access Control","security"]},"shortDescription":{"text":"Semgrep Finding: javascript.express.security.audit.express-path-join-resolve-traversal.express-path-join-resolve-traversal"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"The application processes user-input, this is passed to res.sendFile which can allow an attacker to arbitrarily read files on the system through path traversal. It is recommended to perform input validation in addition to canonicalizing the path. This allows you to validate the path against the intended directory it should be accessing."},"help":{"markdown":"The application processes user-input, this is passed to res.sendFile which can allow an attacker to arbitrarily read files on the system through path traversal. It is recommended to perform input validation in addition to canonicalizing the path. This allows you to validate the path against the intended directory it should be accessing.\n\nReferences: \n - [Semgrep Rule](https://semgrep.dev/r/javascript.express.security.audit.express-res-sendfile.express-res-sendfile)\n - [https://cheatsheetseries.owasp.org/cheatsheets/Input_Validation_Cheat_Sheet.html](https://cheatsheetseries.owasp.org/cheatsheets/Input_Validation_Cheat_Sheet.html)\n","text":"The application processes user-input, this is passed to res.sendFile which can allow an attacker to arbitrarily read files on the system through path traversal. It is recommended to perform input validation in addition to canonicalizing the path. This allows you to validate the path against the intended directory it should be accessing."},"helpUri":"https://semgrep.dev/r/javascript.express.security.audit.express-res-sendfile.express-res-sendfile","id":"javascript.express.security.audit.express-res-sendfile.express-res-sendfile","name":"javascript.express.security.audit.express-res-sendfile.express-res-sendfile","properties":{"precision":"very-high","tags":["CWE-73: External Control of File Name or Path","MEDIUM CONFIDENCE","OWASP-A04:2021 - Insecure Design","security"]},"shortDescription":{"text":"Semgrep Finding: javascript.express.security.audit.express-res-sendfile.express-res-sendfile"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"A hard-coded credential was detected. It is not recommended to store credentials in source-code, as this risks secrets being leaked and used by either an internal or external malicious adversary. It is recommended to use environment variables to securely provide credentials or retrieve credentials from a secure vault or HSM (Hardware Security Module)."},"help":{"markdown":"A hard-coded credential was detected. It is not recommended to store credentials in source-code, as this risks secrets being leaked and used by either an internal or external malicious adversary. It is recommended to use environment variables to securely provide credentials or retrieve credentials from a secure vault or HSM (Hardware Security Module).\n\nReferences: \n - [Semgrep Rule](https://semgrep.dev/r/javascript.express.security.audit.express-session-hardcoded-secret.express-session-hardcoded-secret)\n - [https://cheatsheetseries.owasp.org/cheatsheets/Secrets_Management_Cheat_Sheet.html](https://cheatsheetseries.owasp.org/cheatsheets/Secrets_Management_Cheat_Sheet.html)\n","text":"A hard-coded credential was detected. It is not recommended to store credentials in source-code, as this risks secrets being leaked and used by either an internal or external malicious adversary. It is recommended to use environment variables to securely provide credentials or retrieve credentials from a secure vault or HSM (Hardware Security Module)."},"helpUri":"https://semgrep.dev/r/javascript.express.security.audit.express-session-hardcoded-secret.express-session-hardcoded-secret","id":"javascript.express.security.audit.express-session-hardcoded-secret.express-session-hardcoded-secret","name":"javascript.express.security.audit.express-session-hardcoded-secret.express-session-hardcoded-secret","properties":{"precision":"very-high","tags":["CWE-798: Use of Hard-coded Credentials","HIGH CONFIDENCE","OWASP-A07:2021 - Identification and Authentication Failures","security"]},"shortDescription":{"text":"Semgrep Finding: javascript.express.security.audit.express-session-hardcoded-secret.express-session-hardcoded-secret"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"The following request $REQUEST.$METHOD() was found to be crafted from user-input `$REQ` which can lead to Server-Side Request Forgery (SSRF) vulnerabilities. It is recommended where possible to not allow user-input to craft the base request, but to be treated as part of the path or query parameter. When user-input is necessary to craft the request, it is recommeneded to follow OWASP best practices to prevent abuse. "},"help":{"markdown":"The following request $REQUEST.$METHOD() was found to be crafted from user-input `$REQ` which can lead to Server-Side Request Forgery (SSRF) vulnerabilities. It is recommended where possible to not allow user-input to craft the base request, but to be treated as part of the path or query parameter. When user-input is necessary to craft the request, it is recommeneded to follow OWASP best practices to prevent abuse. \n\nReferences: \n - [Semgrep Rule](https://semgrep.dev/r/javascript.express.security.audit.express-ssrf.express-ssrf)\n - [https://cheatsheetseries.owasp.org/cheatsheets/Server_Side_Request_Forgery_Prevention_Cheat_Sheet.html](https://cheatsheetseries.owasp.org/cheatsheets/Server_Side_Request_Forgery_Prevention_Cheat_Sheet.html)\n","text":"The following request $REQUEST.$METHOD() was found to be crafted from user-input `$REQ` which can lead to Server-Side Request Forgery (SSRF) vulnerabilities. It is recommended where possible to not allow user-input to craft the base request, but to be treated as part of the path or query parameter. When user-input is necessary to craft the request, it is recommeneded to follow OWASP best practices to prevent abuse. "},"helpUri":"https://semgrep.dev/r/javascript.express.security.audit.express-ssrf.express-ssrf","id":"javascript.express.security.audit.express-ssrf.express-ssrf","name":"javascript.express.security.audit.express-ssrf.express-ssrf","properties":{"precision":"very-high","tags":["CWE-918: Server-Side Request Forgery (SSRF)","MEDIUM CONFIDENCE","OWASP-A10:2021 - Server-Side Request Forgery (SSRF)","security"]},"shortDescription":{"text":"Semgrep Finding: javascript.express.security.audit.express-ssrf.express-ssrf"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"The following function call $SER.$FUNC accepts user controlled data which can result in Remote Code Execution (RCE) through Object Deserialization. It is recommended to use secure data processing alternatives such as JSON.parse() and Buffer.from()."},"help":{"markdown":"The following function call $SER.$FUNC accepts user controlled data which can result in Remote Code Execution (RCE) through Object Deserialization. It is recommended to use secure data processing alternatives such as JSON.parse() and Buffer.from().\n\nReferences: \n - [Semgrep Rule](https://semgrep.dev/r/javascript.express.security.audit.express-third-party-object-deserialization.express-third-party-object-deserialization)\n - [https://cheatsheetseries.owasp.org/cheatsheets/Deserialization_Cheat_Sheet.html](https://cheatsheetseries.owasp.org/cheatsheets/Deserialization_Cheat_Sheet.html)\n","text":"The following function call $SER.$FUNC accepts user controlled data which can result in Remote Code Execution (RCE) through Object Deserialization. It is recommended to use secure data processing alternatives such as JSON.parse() and Buffer.from()."},"helpUri":"https://semgrep.dev/r/javascript.express.security.audit.express-third-party-object-deserialization.express-third-party-object-deserialization","id":"javascript.express.security.audit.express-third-party-object-deserialization.express-third-party-object-deserialization","name":"javascript.express.security.audit.express-third-party-object-deserialization.express-third-party-object-deserialization","properties":{"precision":"very-high","tags":["CWE-502: Deserialization of Untrusted Data","HIGH CONFIDENCE","OWASP-A08:2017 - Insecure Deserialization","OWASP-A08:2021 - Software and Data Integrity Failures","security"]},"shortDescription":{"text":"Semgrep Finding: javascript.express.security.audit.express-third-party-object-deserialization.express-third-party-object-deserialization"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"Xml Parser is used inside Request Event. Make sure that unverified user data can not reach the XML Parser, as it can result in XML External or Internal Entity (XXE) Processing vulnerabilities"},"help":{"markdown":"Xml Parser is used inside Request Event. Make sure that unverified user data can not reach the XML Parser, as it can result in XML External or Internal Entity (XXE) Processing vulnerabilities\n\nReferences: \n - [Semgrep Rule](https://semgrep.dev/r/javascript.express.security.audit.express-xml2json-xxe-event.express-xml2json-xxe-event)\n - [https://www.npmjs.com/package/xml2json](https://www.npmjs.com/package/xml2json)\n","text":"Xml Parser is used inside Request Event. Make sure that unverified user data can not reach the XML Parser, as it can result in XML External or Internal Entity (XXE) Processing vulnerabilities"},"helpUri":"https://semgrep.dev/r/javascript.express.security.audit.express-xml2json-xxe-event.express-xml2json-xxe-event","id":"javascript.express.security.audit.express-xml2json-xxe-event.express-xml2json-xxe-event","name":"javascript.express.security.audit.express-xml2json-xxe-event.express-xml2json-xxe-event","properties":{"precision":"very-high","tags":["CWE-611: Improper Restriction of XML External Entity Reference","MEDIUM CONFIDENCE","OWASP-A04:2017 - XML External Entities (XXE)","OWASP-A05:2021 - Security Misconfiguration","security"]},"shortDescription":{"text":"Semgrep Finding: javascript.express.security.audit.express-xml2json-xxe-event.express-xml2json-xxe-event"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"Bracket object notation with user input is present, this might allow an attacker to access all properties of the object and even it's prototype. Use literal values for object properties."},"help":{"markdown":"Bracket object notation with user input is present, this might allow an attacker to access all properties of the object and even it's prototype. Use literal values for object properties.\n\nReferences: \n - [Semgrep Rule](https://semgrep.dev/r/javascript.express.security.audit.remote-property-injection.remote-property-injection)\n - [https://github.com/nodesecurity/eslint-plugin-security/blob/3c7522ca1be800353513282867a1034c795d9eb4/docs/the-dangers-of-square-bracket-notation.md](https://github.com/nodesecurity/eslint-plugin-security/blob/3c7522ca1be800353513282867a1034c795d9eb4/docs/the-dangers-of-square-bracket-notation.md)\n","text":"Bracket object notation with user input is present, this might allow an attacker to access all properties of the object and even it's prototype. Use literal values for object properties."},"helpUri":"https://semgrep.dev/r/javascript.express.security.audit.remote-property-injection.remote-property-injection","id":"javascript.express.security.audit.remote-property-injection.remote-property-injection","name":"javascript.express.security.audit.remote-property-injection.remote-property-injection","properties":{"precision":"very-high","tags":["CWE-522: Insufficiently Protected Credentials","LOW CONFIDENCE","OWASP-A02:2017 - Broken Authentication","OWASP-A04:2021 - Insecure Design","security"]},"shortDescription":{"text":"Semgrep Finding: javascript.express.security.audit.remote-property-injection.remote-property-injection"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"User controllable data `$REQ` enters `$RES.render(...)` this can lead to the loading of other HTML/templating pages that they may not be authorized to render. An attacker may attempt to use directory traversal techniques e.g. `../folder/index` to access other HTML pages on the file system. Where possible, do not allow users to define what should be loaded in $RES.render or use an allow list for the existing application."},"help":{"markdown":"User controllable data `$REQ` enters `$RES.render(...)` this can lead to the loading of other HTML/templating pages that they may not be authorized to render. An attacker may attempt to use directory traversal techniques e.g. `../folder/index` to access other HTML pages on the file system. Where possible, do not allow users to define what should be loaded in $RES.render or use an allow list for the existing application.\n\nReferences: \n - [Semgrep Rule](https://semgrep.dev/r/javascript.express.security.audit.res-render-injection.res-render-injection)\n - [http://expressjs.com/en/4x/api.html#res.render](http://expressjs.com/en/4x/api.html#res.render)\n","text":"User controllable data `$REQ` enters `$RES.render(...)` this can lead to the loading of other HTML/templating pages that they may not be authorized to render. An attacker may attempt to use directory traversal techniques e.g. `../folder/index` to access other HTML pages on the file system. Where possible, do not allow users to define what should be loaded in $RES.render or use an allow list for the existing application."},"helpUri":"https://semgrep.dev/r/javascript.express.security.audit.res-render-injection.res-render-injection","id":"javascript.express.security.audit.res-render-injection.res-render-injection","name":"javascript.express.security.audit.res-render-injection.res-render-injection","properties":{"precision":"very-high","tags":["CWE-706: Use of Incorrectly-Resolved Name or Reference","MEDIUM CONFIDENCE","OWASP-A01:2021 - Broken Access Control","security"]},"shortDescription":{"text":"Semgrep Finding: javascript.express.security.audit.res-render-injection.res-render-injection"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"Detected directly writing to a Response object from user-defined input. This bypasses any HTML escaping and may expose your application to a Cross-Site-scripting (XSS) vulnerability. Instead, use 'resp.render()' to render safely escaped HTML."},"help":{"markdown":"Detected directly writing to a Response object from user-defined input. This bypasses any HTML escaping and may expose your application to a Cross-Site-scripting (XSS) vulnerability. Instead, use 'resp.render()' to render safely escaped HTML.\n\nReferences: \n - [Semgrep Rule](https://semgrep.dev/r/javascript.express.security.audit.xss.direct-response-write.direct-response-write)\n - [https://cheatsheetseries.owasp.org/cheatsheets/Cross_Site_Scripting_Prevention_Cheat_Sheet.html](https://cheatsheetseries.owasp.org/cheatsheets/Cross_Site_Scripting_Prevention_Cheat_Sheet.html)\n","text":"Detected directly writing to a Response object from user-defined input. This bypasses any HTML escaping and may expose your application to a Cross-Site-scripting (XSS) vulnerability. Instead, use 'resp.render()' to render safely escaped HTML."},"helpUri":"https://semgrep.dev/r/javascript.express.security.audit.xss.direct-response-write.direct-response-write","id":"javascript.express.security.audit.xss.direct-response-write.direct-response-write","name":"javascript.express.security.audit.xss.direct-response-write.direct-response-write","properties":{"precision":"very-high","tags":["CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')","MEDIUM CONFIDENCE","OWASP-A03:2021 - Injection","OWASP-A07:2017 - Cross-Site Scripting (XSS)","security"]},"shortDescription":{"text":"Semgrep Finding: javascript.express.security.audit.xss.direct-response-write.direct-response-write"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"Detected an explicit unescape in an EJS template, using '<%- ... %>' If external data can reach these locations, your application is exposed to a cross-site scripting (XSS) vulnerability. Use '<%= ... %>' to escape this data. If you need escaping, ensure no external data can reach this location."},"help":{"markdown":"Detected an explicit unescape in an EJS template, using '<%- ... %>' If external data can reach these locations, your application is exposed to a cross-site scripting (XSS) vulnerability. Use '<%= ... %>' to escape this data. If you need escaping, ensure no external data can reach this location.\n\nReferences: \n - [Semgrep Rule](https://semgrep.dev/r/javascript.express.security.audit.xss.ejs.explicit-unescape.template-explicit-unescape)\n - [http://www.managerjs.com/blog/2015/05/will-ejs-escape-save-me-from-xss-sorta/](http://www.managerjs.com/blog/2015/05/will-ejs-escape-save-me-from-xss-sorta/)\n","text":"Detected an explicit unescape in an EJS template, using '<%- ... %>' If external data can reach these locations, your application is exposed to a cross-site scripting (XSS) vulnerability. Use '<%= ... %>' to escape this data. If you need escaping, ensure no external data can reach this location."},"helpUri":"https://semgrep.dev/r/javascript.express.security.audit.xss.ejs.explicit-unescape.template-explicit-unescape","id":"javascript.express.security.audit.xss.ejs.explicit-unescape.template-explicit-unescape","name":"javascript.express.security.audit.xss.ejs.explicit-unescape.template-explicit-unescape","properties":{"precision":"very-high","tags":["CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')","LOW CONFIDENCE","OWASP-A03:2021 - Injection","OWASP-A07:2017 - Cross-Site Scripting (XSS)","security"]},"shortDescription":{"text":"Semgrep Finding: javascript.express.security.audit.xss.ejs.explicit-unescape.template-explicit-unescape"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"Detected a template variable used as the 'src' in a script tag. Although template variables are HTML escaped, HTML escaping does not always prevent malicious URLs from being injected and could results in a cross-site scripting (XSS) vulnerability. Prefer not to dynamically generate the 'src' attribute and use static URLs instead. If you must do this, carefully check URLs against an allowlist and be sure to URL-encode the result."},"help":{"markdown":"Detected a template variable used as the 'src' in a script tag. Although template variables are HTML escaped, HTML escaping does not always prevent malicious URLs from being injected and could results in a cross-site scripting (XSS) vulnerability. Prefer not to dynamically generate the 'src' attribute and use static URLs instead. If you must do this, carefully check URLs against an allowlist and be sure to URL-encode the result.\n\nReferences: \n - [Semgrep Rule](https://semgrep.dev/r/javascript.express.security.audit.xss.ejs.var-in-script-src.var-in-script-src)\n - [https://www.veracode.com/blog/secure-development/nodejs-template-engines-why-default-encoders-are-not-enough](https://www.veracode.com/blog/secure-development/nodejs-template-engines-why-default-encoders-are-not-enough)\n - [https://github.com/ESAPI/owasp-esapi-js](https://github.com/ESAPI/owasp-esapi-js)\n","text":"Detected a template variable used as the 'src' in a script tag. Although template variables are HTML escaped, HTML escaping does not always prevent malicious URLs from being injected and could results in a cross-site scripting (XSS) vulnerability. Prefer not to dynamically generate the 'src' attribute and use static URLs instead. If you must do this, carefully check URLs against an allowlist and be sure to URL-encode the result."},"helpUri":"https://semgrep.dev/r/javascript.express.security.audit.xss.ejs.var-in-script-src.var-in-script-src","id":"javascript.express.security.audit.xss.ejs.var-in-script-src.var-in-script-src","name":"javascript.express.security.audit.xss.ejs.var-in-script-src.var-in-script-src","properties":{"precision":"very-high","tags":["CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')","LOW CONFIDENCE","OWASP-A03:2021 - Injection","OWASP-A07:2017 - Cross-Site Scripting (XSS)","security"]},"shortDescription":{"text":"Semgrep Finding: javascript.express.security.audit.xss.ejs.var-in-script-src.var-in-script-src"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"Detected a template variable used in a script tag. Although template variables are HTML escaped, HTML escaping does not always prevent cross-site scripting (XSS) attacks when used directly in JavaScript. If you need this data on the rendered page, consider placing it in the HTML portion (outside of a script tag). Alternatively, use a JavaScript-specific encoder, such as the one available in OWASP ESAPI."},"help":{"markdown":"Detected a template variable used in a script tag. Although template variables are HTML escaped, HTML escaping does not always prevent cross-site scripting (XSS) attacks when used directly in JavaScript. If you need this data on the rendered page, consider placing it in the HTML portion (outside of a script tag). Alternatively, use a JavaScript-specific encoder, such as the one available in OWASP ESAPI.\n\nReferences: \n - [Semgrep Rule](https://semgrep.dev/r/javascript.express.security.audit.xss.ejs.var-in-script-tag.var-in-script-tag)\n - [https://www.veracode.com/blog/secure-development/nodejs-template-engines-why-default-encoders-are-not-enough](https://www.veracode.com/blog/secure-development/nodejs-template-engines-why-default-encoders-are-not-enough)\n - [https://github.com/ESAPI/owasp-esapi-js](https://github.com/ESAPI/owasp-esapi-js)\n","text":"Detected a template variable used in a script tag. Although template variables are HTML escaped, HTML escaping does not always prevent cross-site scripting (XSS) attacks when used directly in JavaScript. If you need this data on the rendered page, consider placing it in the HTML portion (outside of a script tag). Alternatively, use a JavaScript-specific encoder, such as the one available in OWASP ESAPI."},"helpUri":"https://semgrep.dev/r/javascript.express.security.audit.xss.ejs.var-in-script-tag.var-in-script-tag","id":"javascript.express.security.audit.xss.ejs.var-in-script-tag.var-in-script-tag","name":"javascript.express.security.audit.xss.ejs.var-in-script-tag.var-in-script-tag","properties":{"precision":"very-high","tags":["CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')","LOW CONFIDENCE","OWASP-A03:2021 - Injection","OWASP-A07:2017 - Cross-Site Scripting (XSS)","security"]},"shortDescription":{"text":"Semgrep Finding: javascript.express.security.audit.xss.ejs.var-in-script-tag.var-in-script-tag"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"The Mustache escape function is being overwritten. This could bypass HTML escaping safety measures built into the rendering engine, exposing your application to cross-site scripting (XSS) vulnerabilities. If you need unescaped HTML, use the triple brace operator in your template: '{{{ ... }}}'."},"help":{"markdown":"The Mustache escape function is being overwritten. This could bypass HTML escaping safety measures built into the rendering engine, exposing your application to cross-site scripting (XSS) vulnerabilities. If you need unescaped HTML, use the triple brace operator in your template: '{{{ ... }}}'.\n\nReferences: \n - [Semgrep Rule](https://semgrep.dev/r/javascript.express.security.audit.xss.mustache.escape-function-overwrite.escape-function-overwrite)\n - [https://github.com/janl/mustache.js/#variables](https://github.com/janl/mustache.js/#variables)\n","text":"The Mustache escape function is being overwritten. This could bypass HTML escaping safety measures built into the rendering engine, exposing your application to cross-site scripting (XSS) vulnerabilities. If you need unescaped HTML, use the triple brace operator in your template: '{{{ ... }}}'."},"helpUri":"https://semgrep.dev/r/javascript.express.security.audit.xss.mustache.escape-function-overwrite.escape-function-overwrite","id":"javascript.express.security.audit.xss.mustache.escape-function-overwrite.escape-function-overwrite","name":"javascript.express.security.audit.xss.mustache.escape-function-overwrite.escape-function-overwrite","properties":{"precision":"very-high","tags":["CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')","LOW CONFIDENCE","OWASP-A03:2021 - Injection","OWASP-A07:2017 - Cross-Site Scripting (XSS)","security"]},"shortDescription":{"text":"Semgrep Finding: javascript.express.security.audit.xss.mustache.escape-function-overwrite.escape-function-overwrite"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"Detected an explicit unescape in a Mustache template, using triple braces '{{{...}}}' or ampersand '&'. If external data can reach these locations, your application is exposed to a cross-site scripting (XSS) vulnerability. If you must do this, ensure no external data can reach this location."},"help":{"markdown":"Detected an explicit unescape in a Mustache template, using triple braces '{{{...}}}' or ampersand '&'. If external data can reach these locations, your application is exposed to a cross-site scripting (XSS) vulnerability. If you must do this, ensure no external data can reach this location.\n\nReferences: \n - [Semgrep Rule](https://semgrep.dev/r/javascript.express.security.audit.xss.mustache.explicit-unescape.template-explicit-unescape)\n - [https://github.com/janl/mustache.js/#variables](https://github.com/janl/mustache.js/#variables)\n - [https://ractive.js.org/v0.x/0.7/mustaches#variables](https://ractive.js.org/v0.x/0.7/mustaches#variables)\n","text":"Detected an explicit unescape in a Mustache template, using triple braces '{{{...}}}' or ampersand '&'. If external data can reach these locations, your application is exposed to a cross-site scripting (XSS) vulnerability. If you must do this, ensure no external data can reach this location."},"helpUri":"https://semgrep.dev/r/javascript.express.security.audit.xss.mustache.explicit-unescape.template-explicit-unescape","id":"javascript.express.security.audit.xss.mustache.explicit-unescape.template-explicit-unescape","name":"javascript.express.security.audit.xss.mustache.explicit-unescape.template-explicit-unescape","properties":{"precision":"very-high","tags":["CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')","LOW CONFIDENCE","OWASP-A03:2021 - Injection","OWASP-A07:2017 - Cross-Site Scripting (XSS)","security"]},"shortDescription":{"text":"Semgrep Finding: javascript.express.security.audit.xss.mustache.explicit-unescape.template-explicit-unescape"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"Detected a unescaped variables using '&attributes'. If external data can reach these locations, your application is exposed to a cross-site scripting (XSS) vulnerability. If you must do this, ensure no external data can reach this location."},"help":{"markdown":"Detected a unescaped variables using '&attributes'. If external data can reach these locations, your application is exposed to a cross-site scripting (XSS) vulnerability. If you must do this, ensure no external data can reach this location.\n\nReferences: \n - [Semgrep Rule](https://semgrep.dev/r/javascript.express.security.audit.xss.pug.and-attributes.template-and-attributes)\n - [https://pugjs.org/language/attributes.html#attributes](https://pugjs.org/language/attributes.html#attributes)\n","text":"Detected a unescaped variables using '&attributes'. If external data can reach these locations, your application is exposed to a cross-site scripting (XSS) vulnerability. If you must do this, ensure no external data can reach this location."},"helpUri":"https://semgrep.dev/r/javascript.express.security.audit.xss.pug.and-attributes.template-and-attributes","id":"javascript.express.security.audit.xss.pug.and-attributes.template-and-attributes","name":"javascript.express.security.audit.xss.pug.and-attributes.template-and-attributes","properties":{"precision":"very-high","tags":["CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')","LOW CONFIDENCE","OWASP-A03:2021 - Injection","OWASP-A07:2017 - Cross-Site Scripting (XSS)","security"]},"shortDescription":{"text":"Semgrep Finding: javascript.express.security.audit.xss.pug.and-attributes.template-and-attributes"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"Detected an explicit unescape in a Pug template, using either '!=' or '!{...}'. If external data can reach these locations, your application is exposed to a cross-site scripting (XSS) vulnerability. If you must do this, ensure no external data can reach this location."},"help":{"markdown":"Detected an explicit unescape in a Pug template, using either '!=' or '!{...}'. If external data can reach these locations, your application is exposed to a cross-site scripting (XSS) vulnerability. If you must do this, ensure no external data can reach this location.\n\nReferences: \n - [Semgrep Rule](https://semgrep.dev/r/javascript.express.security.audit.xss.pug.explicit-unescape.template-explicit-unescape)\n - [https://pugjs.org/language/code.html#unescaped-buffered-code](https://pugjs.org/language/code.html#unescaped-buffered-code)\n - [https://pugjs.org/language/attributes.html#unescaped-attributes](https://pugjs.org/language/attributes.html#unescaped-attributes)\n","text":"Detected an explicit unescape in a Pug template, using either '!=' or '!{...}'. If external data can reach these locations, your application is exposed to a cross-site scripting (XSS) vulnerability. If you must do this, ensure no external data can reach this location."},"helpUri":"https://semgrep.dev/r/javascript.express.security.audit.xss.pug.explicit-unescape.template-explicit-unescape","id":"javascript.express.security.audit.xss.pug.explicit-unescape.template-explicit-unescape","name":"javascript.express.security.audit.xss.pug.explicit-unescape.template-explicit-unescape","properties":{"precision":"very-high","tags":["CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')","LOW CONFIDENCE","OWASP-A03:2021 - Injection","OWASP-A07:2017 - Cross-Site Scripting (XSS)","security"]},"shortDescription":{"text":"Semgrep Finding: javascript.express.security.audit.xss.pug.explicit-unescape.template-explicit-unescape"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"Detected a template variable used in an anchor tag with the 'href' attribute. This allows a malicious actor to input the 'javascript:' URI and is subject to cross- site scripting (XSS) attacks. If using a relative URL, start with a literal forward slash and concatenate the URL, like this: a(href='/'+url). You may also consider setting the Content Security Policy (CSP) header."},"help":{"markdown":"Detected a template variable used in an anchor tag with the 'href' attribute. This allows a malicious actor to input the 'javascript:' URI and is subject to cross- site scripting (XSS) attacks. If using a relative URL, start with a literal forward slash and concatenate the URL, like this: a(href='/'+url). You may also consider setting the Content Security Policy (CSP) header.\n\nReferences: \n - [Semgrep Rule](https://semgrep.dev/r/javascript.express.security.audit.xss.pug.var-in-href.var-in-href)\n - [https://github.com/pugjs/pug/issues/2952](https://github.com/pugjs/pug/issues/2952)\n - [https://flask.palletsprojects.com/en/1.1.x/security/#cross-site-scripting-xss#:~:text=javascript:%20URI](https://flask.palletsprojects.com/en/1.1.x/security/#cross-site-scripting-xss#:~:text=javascript:%20URI)\n","text":"Detected a template variable used in an anchor tag with the 'href' attribute. This allows a malicious actor to input the 'javascript:' URI and is subject to cross- site scripting (XSS) attacks. If using a relative URL, start with a literal forward slash and concatenate the URL, like this: a(href='/'+url). You may also consider setting the Content Security Policy (CSP) header."},"helpUri":"https://semgrep.dev/r/javascript.express.security.audit.xss.pug.var-in-href.var-in-href","id":"javascript.express.security.audit.xss.pug.var-in-href.var-in-href","name":"javascript.express.security.audit.xss.pug.var-in-href.var-in-href","properties":{"precision":"very-high","tags":["CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')","LOW CONFIDENCE","OWASP-A03:2021 - Injection","OWASP-A07:2017 - Cross-Site Scripting (XSS)","security"]},"shortDescription":{"text":"Semgrep Finding: javascript.express.security.audit.xss.pug.var-in-href.var-in-href"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"Detected a template variable used in a script tag. Although template variables are HTML escaped, HTML escaping does not always prevent cross-site scripting (XSS) attacks when used directly in JavaScript. If you need this data on the rendered page, consider placing it in the HTML portion (outside of a script tag). Alternatively, use a JavaScript-specific encoder, such as the one available in OWASP ESAPI."},"help":{"markdown":"Detected a template variable used in a script tag. Although template variables are HTML escaped, HTML escaping does not always prevent cross-site scripting (XSS) attacks when used directly in JavaScript. If you need this data on the rendered page, consider placing it in the HTML portion (outside of a script tag). Alternatively, use a JavaScript-specific encoder, such as the one available in OWASP ESAPI.\n\nReferences: \n - [Semgrep Rule](https://semgrep.dev/r/javascript.express.security.audit.xss.pug.var-in-script-tag.var-in-script-tag)\n - [https://www.veracode.com/blog/secure-development/nodejs-template-engines-why-default-encoders-are-not-enough](https://www.veracode.com/blog/secure-development/nodejs-template-engines-why-default-encoders-are-not-enough)\n - [https://github.com/ESAPI/owasp-esapi-js](https://github.com/ESAPI/owasp-esapi-js)\n","text":"Detected a template variable used in a script tag. Although template variables are HTML escaped, HTML escaping does not always prevent cross-site scripting (XSS) attacks when used directly in JavaScript. If you need this data on the rendered page, consider placing it in the HTML portion (outside of a script tag). Alternatively, use a JavaScript-specific encoder, such as the one available in OWASP ESAPI."},"helpUri":"https://semgrep.dev/r/javascript.express.security.audit.xss.pug.var-in-script-tag.var-in-script-tag","id":"javascript.express.security.audit.xss.pug.var-in-script-tag.var-in-script-tag","name":"javascript.express.security.audit.xss.pug.var-in-script-tag.var-in-script-tag","properties":{"precision":"very-high","tags":["CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')","LOW CONFIDENCE","OWASP-A03:2021 - Injection","OWASP-A07:2017 - Cross-Site Scripting (XSS)","security"]},"shortDescription":{"text":"Semgrep Finding: javascript.express.security.audit.xss.pug.var-in-script-tag.var-in-script-tag"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"By letting user input control CORS parameters, there is a risk that software does not properly verify that the source of data or communication is valid. Use literal values for CORS settings."},"help":{"markdown":"By letting user input control CORS parameters, there is a risk that software does not properly verify that the source of data or communication is valid. Use literal values for CORS settings.\n\nReferences: \n - [Semgrep Rule](https://semgrep.dev/r/javascript.express.security.cors-misconfiguration.cors-misconfiguration)\n - [https://developer.mozilla.org/en-US/docs/Web/HTTP/CORS](https://developer.mozilla.org/en-US/docs/Web/HTTP/CORS)\n","text":"By letting user input control CORS parameters, there is a risk that software does not properly verify that the source of data or communication is valid. Use literal values for CORS settings."},"helpUri":"https://semgrep.dev/r/javascript.express.security.cors-misconfiguration.cors-misconfiguration","id":"javascript.express.security.cors-misconfiguration.cors-misconfiguration","name":"javascript.express.security.cors-misconfiguration.cors-misconfiguration","properties":{"precision":"very-high","tags":["CWE-346: Origin Validation Error","MEDIUM CONFIDENCE","OWASP-A07:2021 - Identification and Authentication Failures","security"]},"shortDescription":{"text":"Semgrep Finding: javascript.express.security.cors-misconfiguration.cors-misconfiguration"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"Depending on the context, user control data in `Object.assign` can cause web response to include data that it should not have or can lead to a mass assignment vulnerability."},"help":{"markdown":"Depending on the context, user control data in `Object.assign` can cause web response to include data that it should not have or can lead to a mass assignment vulnerability.\n\nReferences: \n - [Semgrep Rule](https://semgrep.dev/r/javascript.express.security.express-data-exfiltration.express-data-exfiltration)\n - [https://en.wikipedia.org/wiki/Mass_assignment_vulnerability](https://en.wikipedia.org/wiki/Mass_assignment_vulnerability)\n - [https://cheatsheetseries.owasp.org/cheatsheets/Mass_Assignment_Cheat_Sheet.html](https://cheatsheetseries.owasp.org/cheatsheets/Mass_Assignment_Cheat_Sheet.html)\n","text":"Depending on the context, user control data in `Object.assign` can cause web response to include data that it should not have or can lead to a mass assignment vulnerability."},"helpUri":"https://semgrep.dev/r/javascript.express.security.express-data-exfiltration.express-data-exfiltration","id":"javascript.express.security.express-data-exfiltration.express-data-exfiltration","name":"javascript.express.security.express-data-exfiltration.express-data-exfiltration","properties":{"precision":"very-high","tags":["CWE-915: Improperly Controlled Modification of Dynamically-Determined Object Attributes","LOW CONFIDENCE","OWASP-A08:2021 - Software and Data Integrity Failures","security"]},"shortDescription":{"text":"Semgrep Finding: javascript.express.security.express-data-exfiltration.express-data-exfiltration"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"Make sure that unverified user data can not reach the XML Parser, as it can result in XML External or Internal Entity (XXE) Processing vulnerabilities."},"help":{"markdown":"Make sure that unverified user data can not reach the XML Parser, as it can result in XML External or Internal Entity (XXE) Processing vulnerabilities.\n\nReferences: \n - [Semgrep Rule](https://semgrep.dev/r/javascript.express.security.express-expat-xxe.express-expat-xxe)\n - [https://github.com/astro/node-expat](https://github.com/astro/node-expat)\n","text":"Make sure that unverified user data can not reach the XML Parser, as it can result in XML External or Internal Entity (XXE) Processing vulnerabilities."},"helpUri":"https://semgrep.dev/r/javascript.express.security.express-expat-xxe.express-expat-xxe","id":"javascript.express.security.express-expat-xxe.express-expat-xxe","name":"javascript.express.security.express-expat-xxe.express-expat-xxe","properties":{"precision":"very-high","tags":["CWE-611: Improper Restriction of XML External Entity Reference","MEDIUM CONFIDENCE","OWASP-A04:2017 - XML External Entities (XXE)","OWASP-A05:2021 - Security Misconfiguration","security"]},"shortDescription":{"text":"Semgrep Finding: javascript.express.security.express-expat-xxe.express-expat-xxe"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"User data from `$REQ` is being compiled into the template, which can lead to a Server Side Template Injection (SSTI) vulnerability."},"help":{"markdown":"User data from `$REQ` is being compiled into the template, which can lead to a Server Side Template Injection (SSTI) vulnerability.\n\nReferences: \n - [Semgrep Rule](https://semgrep.dev/r/javascript.express.security.express-insecure-template-usage.express-insecure-template-usage)\n - [https://cheatsheetseries.owasp.org/cheatsheets/Injection_Prevention_Cheat_Sheet.html](https://cheatsheetseries.owasp.org/cheatsheets/Injection_Prevention_Cheat_Sheet.html)\n","text":"User data from `$REQ` is being compiled into the template, which can lead to a Server Side Template Injection (SSTI) vulnerability."},"helpUri":"https://semgrep.dev/r/javascript.express.security.express-insecure-template-usage.express-insecure-template-usage","id":"javascript.express.security.express-insecure-template-usage.express-insecure-template-usage","name":"javascript.express.security.express-insecure-template-usage.express-insecure-template-usage","properties":{"precision":"very-high","tags":["CWE-1336: Improper Neutralization of Special Elements Used in a Template Engine","MEDIUM CONFIDENCE","OWASP-A01:2017 - Injection","OWASP-A03:2021 - Injection","security"]},"shortDescription":{"text":"Semgrep Finding: javascript.express.security.express-insecure-template-usage.express-insecure-template-usage"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"A hard-coded credential was detected. It is not recommended to store credentials in source-code, as this risks secrets being leaked and used by either an internal or external malicious adversary. It is recommended to use environment variables to securely provide credentials or retrieve credentials from a secure vault or HSM (Hardware Security Module)."},"help":{"markdown":"A hard-coded credential was detected. It is not recommended to store credentials in source-code, as this risks secrets being leaked and used by either an internal or external malicious adversary. It is recommended to use environment variables to securely provide credentials or retrieve credentials from a secure vault or HSM (Hardware Security Module).\n\nReferences: \n - [Semgrep Rule](https://semgrep.dev/r/javascript.express.security.express-jwt-hardcoded-secret.express-jwt-hardcoded-secret)\n - [https://cheatsheetseries.owasp.org/cheatsheets/Secrets_Management_Cheat_Sheet.html](https://cheatsheetseries.owasp.org/cheatsheets/Secrets_Management_Cheat_Sheet.html)\n","text":"A hard-coded credential was detected. It is not recommended to store credentials in source-code, as this risks secrets being leaked and used by either an internal or external malicious adversary. It is recommended to use environment variables to securely provide credentials or retrieve credentials from a secure vault or HSM (Hardware Security Module)."},"helpUri":"https://semgrep.dev/r/javascript.express.security.express-jwt-hardcoded-secret.express-jwt-hardcoded-secret","id":"javascript.express.security.express-jwt-hardcoded-secret.express-jwt-hardcoded-secret","name":"javascript.express.security.express-jwt-hardcoded-secret.express-jwt-hardcoded-secret","properties":{"precision":"very-high","tags":["CWE-798: Use of Hard-coded Credentials","HIGH CONFIDENCE","OWASP-A07:2021 - Identification and Authentication Failures","security"]},"shortDescription":{"text":"Semgrep Finding: javascript.express.security.express-jwt-hardcoded-secret.express-jwt-hardcoded-secret"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"If unverified user data can reach the `phantom` methods it can result in Server-Side Request Forgery vulnerabilities"},"help":{"markdown":"If unverified user data can reach the `phantom` methods it can result in Server-Side Request Forgery vulnerabilities\n\nReferences: \n - [Semgrep Rule](https://semgrep.dev/r/javascript.express.security.express-phantom-injection.express-phantom-injection)\n - [https://phantomjs.org/page-automation.html](https://phantomjs.org/page-automation.html)\n","text":"If unverified user data can reach the `phantom` methods it can result in Server-Side Request Forgery vulnerabilities"},"helpUri":"https://semgrep.dev/r/javascript.express.security.express-phantom-injection.express-phantom-injection","id":"javascript.express.security.express-phantom-injection.express-phantom-injection","name":"javascript.express.security.express-phantom-injection.express-phantom-injection","properties":{"precision":"very-high","tags":["CWE-918: Server-Side Request Forgery (SSRF)","MEDIUM CONFIDENCE","OWASP-A10:2021 - Server-Side Request Forgery (SSRF)","security"]},"shortDescription":{"text":"Semgrep Finding: javascript.express.security.express-phantom-injection.express-phantom-injection"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"If unverified user data can reach the `puppeteer` methods it can result in Server-Side Request Forgery vulnerabilities"},"help":{"markdown":"If unverified user data can reach the `puppeteer` methods it can result in Server-Side Request Forgery vulnerabilities\n\nReferences: \n - [Semgrep Rule](https://semgrep.dev/r/javascript.express.security.express-puppeteer-injection.express-puppeteer-injection)\n - [https://pptr.dev/api/puppeteer.page](https://pptr.dev/api/puppeteer.page)\n","text":"If unverified user data can reach the `puppeteer` methods it can result in Server-Side Request Forgery vulnerabilities"},"helpUri":"https://semgrep.dev/r/javascript.express.security.express-puppeteer-injection.express-puppeteer-injection","id":"javascript.express.security.express-puppeteer-injection.express-puppeteer-injection","name":"javascript.express.security.express-puppeteer-injection.express-puppeteer-injection","properties":{"precision":"very-high","tags":["CWE-918: Server-Side Request Forgery (SSRF)","MEDIUM CONFIDENCE","OWASP-A10:2021 - Server-Side Request Forgery (SSRF)","security"]},"shortDescription":{"text":"Semgrep Finding: javascript.express.security.express-puppeteer-injection.express-puppeteer-injection"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"Make sure that unverified user data can not reach `sandbox`."},"help":{"markdown":"Make sure that unverified user data can not reach `sandbox`.\n\nReferences: \n - [Semgrep Rule](https://semgrep.dev/r/javascript.express.security.express-sandbox-injection.express-sandbox-code-injection)\n - [https://cheatsheetseries.owasp.org/cheatsheets/Injection_Prevention_Cheat_Sheet.html](https://cheatsheetseries.owasp.org/cheatsheets/Injection_Prevention_Cheat_Sheet.html)\n","text":"Make sure that unverified user data can not reach `sandbox`."},"helpUri":"https://semgrep.dev/r/javascript.express.security.express-sandbox-injection.express-sandbox-code-injection","id":"javascript.express.security.express-sandbox-injection.express-sandbox-code-injection","name":"javascript.express.security.express-sandbox-injection.express-sandbox-code-injection","properties":{"precision":"very-high","tags":["CWE-94: Improper Control of Generation of Code ('Code Injection')","MEDIUM CONFIDENCE","OWASP-A03:2021 - Injection","security"]},"shortDescription":{"text":"Semgrep Finding: javascript.express.security.express-sandbox-injection.express-sandbox-code-injection"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"Make sure that unverified user data can not reach `$VM`."},"help":{"markdown":"Make sure that unverified user data can not reach `$VM`.\n\nReferences: \n - [Semgrep Rule](https://semgrep.dev/r/javascript.express.security.express-vm-injection.express-vm-injection)\n - [https://cheatsheetseries.owasp.org/cheatsheets/Injection_Prevention_Cheat_Sheet.html](https://cheatsheetseries.owasp.org/cheatsheets/Injection_Prevention_Cheat_Sheet.html)\n","text":"Make sure that unverified user data can not reach `$VM`."},"helpUri":"https://semgrep.dev/r/javascript.express.security.express-vm-injection.express-vm-injection","id":"javascript.express.security.express-vm-injection.express-vm-injection","name":"javascript.express.security.express-vm-injection.express-vm-injection","properties":{"precision":"very-high","tags":["CWE-94: Improper Control of Generation of Code ('Code Injection')","MEDIUM CONFIDENCE","OWASP-A03:2021 - Injection","security"]},"shortDescription":{"text":"Semgrep Finding: javascript.express.security.express-vm-injection.express-vm-injection"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"Make sure that unverified user data can not reach `vm2`."},"help":{"markdown":"Make sure that unverified user data can not reach `vm2`.\n\nReferences: \n - [Semgrep Rule](https://semgrep.dev/r/javascript.express.security.express-vm2-injection.express-vm2-injection)\n - [https://cheatsheetseries.owasp.org/cheatsheets/Injection_Prevention_Cheat_Sheet.html](https://cheatsheetseries.owasp.org/cheatsheets/Injection_Prevention_Cheat_Sheet.html)\n","text":"Make sure that unverified user data can not reach `vm2`."},"helpUri":"https://semgrep.dev/r/javascript.express.security.express-vm2-injection.express-vm2-injection","id":"javascript.express.security.express-vm2-injection.express-vm2-injection","name":"javascript.express.security.express-vm2-injection.express-vm2-injection","properties":{"precision":"very-high","tags":["CWE-94: Improper Control of Generation of Code ('Code Injection')","MEDIUM CONFIDENCE","OWASP-A03:2021 - Injection","security"]},"shortDescription":{"text":"Semgrep Finding: javascript.express.security.express-vm2-injection.express-vm2-injection"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"If unverified user data can reach the `phantom` methods it can result in Server-Side Request Forgery vulnerabilities"},"help":{"markdown":"If unverified user data can reach the `phantom` methods it can result in Server-Side Request Forgery vulnerabilities\n\nReferences: \n - [Semgrep Rule](https://semgrep.dev/r/javascript.express.security.express-wkhtml-injection.express-wkhtmltoimage-injection)\n - [https://www.npmjs.com/package/wkhtmltopdf](https://www.npmjs.com/package/wkhtmltopdf)\n","text":"If unverified user data can reach the `phantom` methods it can result in Server-Side Request Forgery vulnerabilities"},"helpUri":"https://semgrep.dev/r/javascript.express.security.express-wkhtml-injection.express-wkhtmltoimage-injection","id":"javascript.express.security.express-wkhtml-injection.express-wkhtmltoimage-injection","name":"javascript.express.security.express-wkhtml-injection.express-wkhtmltoimage-injection","properties":{"precision":"very-high","tags":["CWE-918: Server-Side Request Forgery (SSRF)","LOW CONFIDENCE","OWASP-A10:2021 - Server-Side Request Forgery (SSRF)","security"]},"shortDescription":{"text":"Semgrep Finding: javascript.express.security.express-wkhtml-injection.express-wkhtmltoimage-injection"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"If unverified user data can reach the `wkhtmltopdf` methods it can result in Server-Side Request Forgery vulnerabilities"},"help":{"markdown":"If unverified user data can reach the `wkhtmltopdf` methods it can result in Server-Side Request Forgery vulnerabilities\n\nReferences: \n - [Semgrep Rule](https://semgrep.dev/r/javascript.express.security.express-wkhtml-injection.express-wkhtmltopdf-injection)\n - [https://www.npmjs.com/package/wkhtmltopdf](https://www.npmjs.com/package/wkhtmltopdf)\n","text":"If unverified user data can reach the `wkhtmltopdf` methods it can result in Server-Side Request Forgery vulnerabilities"},"helpUri":"https://semgrep.dev/r/javascript.express.security.express-wkhtml-injection.express-wkhtmltopdf-injection","id":"javascript.express.security.express-wkhtml-injection.express-wkhtmltopdf-injection","name":"javascript.express.security.express-wkhtml-injection.express-wkhtmltopdf-injection","properties":{"precision":"very-high","tags":["CWE-918: Server-Side Request Forgery (SSRF)","LOW CONFIDENCE","OWASP-A10:2021 - Server-Side Request Forgery (SSRF)","security"]},"shortDescription":{"text":"Semgrep Finding: javascript.express.security.express-wkhtml-injection.express-wkhtmltopdf-injection"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"Make sure that unverified user data can not reach the XML Parser, as it can result in XML External or Internal Entity (XXE) Processing vulnerabilities"},"help":{"markdown":"Make sure that unverified user data can not reach the XML Parser, as it can result in XML External or Internal Entity (XXE) Processing vulnerabilities\n\nReferences: \n - [Semgrep Rule](https://semgrep.dev/r/javascript.express.security.express-xml2json-xxe.express-xml2json-xxe)\n - [https://www.npmjs.com/package/xml2json](https://www.npmjs.com/package/xml2json)\n","text":"Make sure that unverified user data can not reach the XML Parser, as it can result in XML External or Internal Entity (XXE) Processing vulnerabilities"},"helpUri":"https://semgrep.dev/r/javascript.express.security.express-xml2json-xxe.express-xml2json-xxe","id":"javascript.express.security.express-xml2json-xxe.express-xml2json-xxe","name":"javascript.express.security.express-xml2json-xxe.express-xml2json-xxe","properties":{"precision":"very-high","tags":["CWE-611: Improper Restriction of XML External Entity Reference","MEDIUM CONFIDENCE","OWASP-A04:2017 - XML External Entities (XXE)","OWASP-A05:2021 - Security Misconfiguration","security"]},"shortDescription":{"text":"Semgrep Finding: javascript.express.security.express-xml2json-xxe.express-xml2json-xxe"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"User data flows into the host portion of this manually-constructed HTML. This can introduce a Cross-Site-Scripting (XSS) vulnerability if this comes from user-provided input. Consider using a sanitization library such as DOMPurify to sanitize the HTML within."},"help":{"markdown":"User data flows into the host portion of this manually-constructed HTML. This can introduce a Cross-Site-Scripting (XSS) vulnerability if this comes from user-provided input. Consider using a sanitization library such as DOMPurify to sanitize the HTML within.\n\nReferences: \n - [Semgrep Rule](https://semgrep.dev/r/javascript.express.security.injection.raw-html-format.raw-html-format)\n - [https://cheatsheetseries.owasp.org/cheatsheets/Cross_Site_Scripting_Prevention_Cheat_Sheet.html](https://cheatsheetseries.owasp.org/cheatsheets/Cross_Site_Scripting_Prevention_Cheat_Sheet.html)\n","text":"User data flows into the host portion of this manually-constructed HTML. This can introduce a Cross-Site-Scripting (XSS) vulnerability if this comes from user-provided input. Consider using a sanitization library such as DOMPurify to sanitize the HTML within."},"helpUri":"https://semgrep.dev/r/javascript.express.security.injection.raw-html-format.raw-html-format","id":"javascript.express.security.injection.raw-html-format.raw-html-format","name":"javascript.express.security.injection.raw-html-format.raw-html-format","properties":{"precision":"very-high","tags":["CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')","MEDIUM CONFIDENCE","OWASP-A03:2021 - Injection","OWASP-A07:2017 - Cross-Site Scripting (XSS)","security"]},"shortDescription":{"text":"Semgrep Finding: javascript.express.security.injection.raw-html-format.raw-html-format"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"Detected user input used to manually construct a SQL string. This is usually bad practice because manual construction could accidentally result in a SQL injection. An attacker could use a SQL injection to steal or modify contents of the database. Instead, use a parameterized query which is available by default in most database engines. Alternatively, consider using an object-relational mapper (ORM) such as Sequelize which will protect your queries."},"help":{"markdown":"Detected user input used to manually construct a SQL string. This is usually bad practice because manual construction could accidentally result in a SQL injection. An attacker could use a SQL injection to steal or modify contents of the database. Instead, use a parameterized query which is available by default in most database engines. Alternatively, consider using an object-relational mapper (ORM) such as Sequelize which will protect your queries.\n\nReferences: \n - [Semgrep Rule](https://semgrep.dev/r/javascript.express.security.injection.tainted-sql-string.tainted-sql-string)\n - [https://owasp.org/www-community/attacks/SQL_Injection](https://owasp.org/www-community/attacks/SQL_Injection)\n","text":"Detected user input used to manually construct a SQL string. This is usually bad practice because manual construction could accidentally result in a SQL injection. An attacker could use a SQL injection to steal or modify contents of the database. Instead, use a parameterized query which is available by default in most database engines. Alternatively, consider using an object-relational mapper (ORM) such as Sequelize which will protect your queries."},"helpUri":"https://semgrep.dev/r/javascript.express.security.injection.tainted-sql-string.tainted-sql-string","id":"javascript.express.security.injection.tainted-sql-string.tainted-sql-string","name":"javascript.express.security.injection.tainted-sql-string.tainted-sql-string","properties":{"precision":"very-high","tags":["CWE-89: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')","MEDIUM CONFIDENCE","OWASP-A01:2017 - Injection","OWASP-A03:2021 - Injection","security"]},"shortDescription":{"text":"Semgrep Finding: javascript.express.security.injection.tainted-sql-string.tainted-sql-string"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"If an attacker controls the x in require(x) then they can cause code to load that was not intended to run on the server."},"help":{"markdown":"If an attacker controls the x in require(x) then they can cause code to load that was not intended to run on the server.\n\nReferences: \n - [Semgrep Rule](https://semgrep.dev/r/javascript.express.security.require-request.require-request)\n - [https://github.com/google/node-sec-roadmap/blob/master/chapter-2/dynamism.md#dynamism-when-you-need-it](https://github.com/google/node-sec-roadmap/blob/master/chapter-2/dynamism.md#dynamism-when-you-need-it)\n","text":"If an attacker controls the x in require(x) then they can cause code to load that was not intended to run on the server."},"helpUri":"https://semgrep.dev/r/javascript.express.security.require-request.require-request","id":"javascript.express.security.require-request.require-request","name":"javascript.express.security.require-request.require-request","properties":{"precision":"very-high","tags":["CWE-706: Use of Incorrectly-Resolved Name or Reference","MEDIUM CONFIDENCE","OWASP-A01:2021 - Broken Access Control","security"]},"shortDescription":{"text":"Semgrep Finding: javascript.express.security.require-request.require-request"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"By letting user input control `X-Frame-Options` header, there is a risk that software does not properly verify whether or not a browser should be allowed to render a page in an `iframe`."},"help":{"markdown":"By letting user input control `X-Frame-Options` header, there is a risk that software does not properly verify whether or not a browser should be allowed to render a page in an `iframe`.\n\nReferences: \n - [Semgrep Rule](https://semgrep.dev/r/javascript.express.security.x-frame-options-misconfiguration.x-frame-options-misconfiguration)\n - [https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/X-Frame-Options](https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/X-Frame-Options)\n","text":"By letting user input control `X-Frame-Options` header, there is a risk that software does not properly verify whether or not a browser should be allowed to render a page in an `iframe`."},"helpUri":"https://semgrep.dev/r/javascript.express.security.x-frame-options-misconfiguration.x-frame-options-misconfiguration","id":"javascript.express.security.x-frame-options-misconfiguration.x-frame-options-misconfiguration","name":"javascript.express.security.x-frame-options-misconfiguration.x-frame-options-misconfiguration","properties":{"precision":"very-high","tags":["CWE-451: User Interface (UI) Misrepresentation of Critical Information","MEDIUM CONFIDENCE","OWASP-A04:2021 - Insecure Design","security"]},"shortDescription":{"text":"Semgrep Finding: javascript.express.security.x-frame-options-misconfiguration.x-frame-options-misconfiguration"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"Detected `$REQ` argument which enters `$RES.$HEADER`, this can lead to session fixation vulnerabilities if an attacker can control the cookie value. This vulnerability can lead to unauthorized access to accounts, and in some esoteric cases, Cross-Site-Scripting (XSS). Users should not be able to influence cookies directly, for session cookies, they should be generated securely using an approved session management library. If the cookie does need to be set by a user, consider using an allow-list based approach to restrict the cookies which can be set."},"help":{"markdown":"Detected `$REQ` argument which enters `$RES.$HEADER`, this can lead to session fixation vulnerabilities if an attacker can control the cookie value. This vulnerability can lead to unauthorized access to accounts, and in some esoteric cases, Cross-Site-Scripting (XSS). Users should not be able to influence cookies directly, for session cookies, they should be generated securely using an approved session management library. If the cookie does need to be set by a user, consider using an allow-list based approach to restrict the cookies which can be set.\n\nReferences: \n - [Semgrep Rule](https://semgrep.dev/r/javascript.express.session-fixation.session-fixation)\n - [https://owasp.org/Top10/A07_2021-Identification_and_Authentication_Failures](https://owasp.org/Top10/A07_2021-Identification_and_Authentication_Failures)\n - [https://owasp.org/www-community/attacks/Session_fixation](https://owasp.org/www-community/attacks/Session_fixation)\n","text":"Detected `$REQ` argument which enters `$RES.$HEADER`, this can lead to session fixation vulnerabilities if an attacker can control the cookie value. This vulnerability can lead to unauthorized access to accounts, and in some esoteric cases, Cross-Site-Scripting (XSS). Users should not be able to influence cookies directly, for session cookies, they should be generated securely using an approved session management library. If the cookie does need to be set by a user, consider using an allow-list based approach to restrict the cookies which can be set."},"helpUri":"https://semgrep.dev/r/javascript.express.session-fixation.session-fixation","id":"javascript.express.session-fixation.session-fixation","name":"javascript.express.session-fixation.session-fixation","properties":{"precision":"very-high","tags":["CWE-384: Session Fixation","MEDIUM CONFIDENCE","OWASP-A02:2017 - Broken Authentication","OWASP-A07:2021 - Identification and Authentication Failures","security"]},"shortDescription":{"text":"Semgrep Finding: javascript.express.session-fixation.session-fixation"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"Having default cookie settings is insecure because they often lack critical security attributes, leaving cookies vulnerable to various attacks like CSRF or XSS. Always configure cookies with security attributes: `HttpOnly`, `Secure`, `SameSite`."},"help":{"markdown":"Having default cookie settings is insecure because they often lack critical security attributes, leaving cookies vulnerable to various attacks like CSRF or XSS. Always configure cookies with security attributes: `HttpOnly`, `Secure`, `SameSite`.\n\nReferences: \n - [Semgrep Rule](https://semgrep.dev/r/javascript.express.web.cookies-default-express.cookies-default-express)\n - [https://cwe.mitre.org/data/definitions/732.html](https://cwe.mitre.org/data/definitions/732.html)\n - [https://owasp.org/www-project-web-security-testing-guide/latest/4-Web_Application_Security_Testing/06-Session_Management_Testing/02-Testing_for_Cookies_Attributes](https://owasp.org/www-project-web-security-testing-guide/latest/4-Web_Application_Security_Testing/06-Session_Management_Testing/02-Testing_for_Cookies_Attributes)\n","text":"Having default cookie settings is insecure because they often lack critical security attributes, leaving cookies vulnerable to various attacks like CSRF or XSS. Always configure cookies with security attributes: `HttpOnly`, `Secure`, `SameSite`."},"helpUri":"https://semgrep.dev/r/javascript.express.web.cookies-default-express.cookies-default-express","id":"javascript.express.web.cookies-default-express.cookies-default-express","name":"javascript.express.web.cookies-default-express.cookies-default-express","properties":{"precision":"very-high","tags":["CWE-732: Incorrect Permission Assignment for Critical Resource","HIGH CONFIDENCE","security"]},"shortDescription":{"text":"Semgrep Finding: javascript.express.web.cookies-default-express.cookies-default-express"}},{"defaultConfiguration":{"level":"note"},"fullDescription":{"text":"Detected a cookie where the `HttpOnly` flag is either missing or disabled. The `HttpOnly` cookie flag instructs the browser to forbid client-side JavaScript to read the cookie. If JavaScript interaction is required, you can ignore this finding. However, set the `HttpOnly` flag to `true` in all other cases. If this wasn't intentional, it's recommended to set the HttpOnly flag to true by adding `httpOnly: true` to the cookie options, so the cookie will not be accessible through client-side scripts."},"help":{"markdown":"Detected a cookie where the `HttpOnly` flag is either missing or disabled. The `HttpOnly` cookie flag instructs the browser to forbid client-side JavaScript to read the cookie. If JavaScript interaction is required, you can ignore this finding. However, set the `HttpOnly` flag to `true` in all other cases. If this wasn't intentional, it's recommended to set the HttpOnly flag to true by adding `httpOnly: true` to the cookie options, so the cookie will not be accessible through client-side scripts.\n\nReferences: \n - [Semgrep Rule](https://semgrep.dev/r/javascript.express.web.cookies-httponly-false-express.cookies-httponly-false-express)\n - [https://owasp.org/Top10/A05_2021-Security_Misconfiguration](https://owasp.org/Top10/A05_2021-Security_Misconfiguration)\n - [https://owasp.org/www-project-web-security-testing-guide/latest/4-Web_Application_Security_Testing/06-Session_Management_Testing/02-Testing_for_Cookies_Attributes](https://owasp.org/www-project-web-security-testing-guide/latest/4-Web_Application_Security_Testing/06-Session_Management_Testing/02-Testing_for_Cookies_Attributes)\n","text":"Detected a cookie where the `HttpOnly` flag is either missing or disabled. The `HttpOnly` cookie flag instructs the browser to forbid client-side JavaScript to read the cookie. If JavaScript interaction is required, you can ignore this finding. However, set the `HttpOnly` flag to `true` in all other cases. If this wasn't intentional, it's recommended to set the HttpOnly flag to true by adding `httpOnly: true` to the cookie options, so the cookie will not be accessible through client-side scripts."},"helpUri":"https://semgrep.dev/r/javascript.express.web.cookies-httponly-false-express.cookies-httponly-false-express","id":"javascript.express.web.cookies-httponly-false-express.cookies-httponly-false-express","name":"javascript.express.web.cookies-httponly-false-express.cookies-httponly-false-express","properties":{"precision":"very-high","tags":["CWE-1004: Sensitive Cookie Without 'HttpOnly' Flag","HIGH CONFIDENCE","OWASP-A05:2021 - Security Misconfiguration","security"]},"shortDescription":{"text":"Semgrep Finding: javascript.express.web.cookies-httponly-false-express.cookies-httponly-false-express"}},{"defaultConfiguration":{"level":"note"},"fullDescription":{"text":"Detected a cookie where the `HttpOnly` flag is either missing or disabled. The `HttpOnly` cookie flag instructs the browser to forbid client-side JavaScript to read the cookie. If JavaScript interaction is required, you can ignore this finding. However, set the `HttpOnly` flag to `true` in all other cases. If this wasn't intentional, it's recommended to set the HttpOnly flag to true by adding `httpOnly: true` to the cookie options, so the cookie will not be accessible through client-side scripts."},"help":{"markdown":"Detected a cookie where the `HttpOnly` flag is either missing or disabled. The `HttpOnly` cookie flag instructs the browser to forbid client-side JavaScript to read the cookie. If JavaScript interaction is required, you can ignore this finding. However, set the `HttpOnly` flag to `true` in all other cases. If this wasn't intentional, it's recommended to set the HttpOnly flag to true by adding `httpOnly: true` to the cookie options, so the cookie will not be accessible through client-side scripts.\n\nReferences: \n - [Semgrep Rule](https://semgrep.dev/r/javascript.express.web.cookies-httponly-missing-express.cookies-httponly-missing-express)\n - [https://owasp.org/Top10/A05_2021-Security_Misconfiguration](https://owasp.org/Top10/A05_2021-Security_Misconfiguration)\n - [https://owasp.org/www-project-web-security-testing-guide/latest/4-Web_Application_Security_Testing/06-Session_Management_Testing/02-Testing_for_Cookies_Attributes](https://owasp.org/www-project-web-security-testing-guide/latest/4-Web_Application_Security_Testing/06-Session_Management_Testing/02-Testing_for_Cookies_Attributes)\n","text":"Detected a cookie where the `HttpOnly` flag is either missing or disabled. The `HttpOnly` cookie flag instructs the browser to forbid client-side JavaScript to read the cookie. If JavaScript interaction is required, you can ignore this finding. However, set the `HttpOnly` flag to `true` in all other cases. If this wasn't intentional, it's recommended to set the HttpOnly flag to true by adding `httpOnly: true` to the cookie options, so the cookie will not be accessible through client-side scripts."},"helpUri":"https://semgrep.dev/r/javascript.express.web.cookies-httponly-missing-express.cookies-httponly-missing-express","id":"javascript.express.web.cookies-httponly-missing-express.cookies-httponly-missing-express","name":"javascript.express.web.cookies-httponly-missing-express.cookies-httponly-missing-express","properties":{"precision":"very-high","tags":["CWE-1004: Sensitive Cookie Without 'HttpOnly' Flag","HIGH CONFIDENCE","OWASP-A05:2021 - Security Misconfiguration","security"]},"shortDescription":{"text":"Semgrep Finding: javascript.express.web.cookies-httponly-missing-express.cookies-httponly-missing-express"}},{"defaultConfiguration":{"level":"note"},"fullDescription":{"text":"Detected a cookie options with the `SameSite` flag set to \"None\". This is a potential security risk that arises from the way web browsers manage cookies. In a typical web application, cookies are used to store and transmit session-related data between a client and a server. To enhance security, cookies can be marked with the \"SameSite\" attribute, which restricts their usage based on the origin of the page that set them. This attribute can have three values: \"Strict,\" \"Lax,\" or \"None\". Make sure the `SameSite` attribute of the important cookies (e.g., session cookie) is set to a reasonable value. When `SameSite` is set to \"Strict\", no 3rd party cookie will be sent with outgoing requests, this is the most secure and private setting but harder to deploy with good usability. Setting it to \"Lax\" is the minimum requirement. If this wasn't intentional, it's recommended to set the SameSite flag to the `Strict` or `Lax` value, depending on your needs."},"help":{"markdown":"Detected a cookie options with the `SameSite` flag set to \"None\". This is a potential security risk that arises from the way web browsers manage cookies. In a typical web application, cookies are used to store and transmit session-related data between a client and a server. To enhance security, cookies can be marked with the \"SameSite\" attribute, which restricts their usage based on the origin of the page that set them. This attribute can have three values: \"Strict,\" \"Lax,\" or \"None\". Make sure the `SameSite` attribute of the important cookies (e.g., session cookie) is set to a reasonable value. When `SameSite` is set to \"Strict\", no 3rd party cookie will be sent with outgoing requests, this is the most secure and private setting but harder to deploy with good usability. Setting it to \"Lax\" is the minimum requirement. If this wasn't intentional, it's recommended to set the SameSite flag to the `Strict` or `Lax` value, depending on your needs.\n\nReferences: \n - [Semgrep Rule](https://semgrep.dev/r/javascript.express.web.cookies-samesite-missing-express.cookies-samesite-missing-express)\n - [https://owasp.org/Top10/A01_2021-Broken_Access_Control](https://owasp.org/Top10/A01_2021-Broken_Access_Control)\n - [https://owasp.org/www-project-web-security-testing-guide/latest/4-Web_Application_Security_Testing/06-Session_Management_Testing/02-Testing_for_Cookies_Attributes](https://owasp.org/www-project-web-security-testing-guide/latest/4-Web_Application_Security_Testing/06-Session_Management_Testing/02-Testing_for_Cookies_Attributes)\n - [https://web.dev/articles/samesite-cookies-explained](https://web.dev/articles/samesite-cookies-explained)\n","text":"Detected a cookie options with the `SameSite` flag set to \"None\". This is a potential security risk that arises from the way web browsers manage cookies. In a typical web application, cookies are used to store and transmit session-related data between a client and a server. To enhance security, cookies can be marked with the \"SameSite\" attribute, which restricts their usage based on the origin of the page that set them. This attribute can have three values: \"Strict,\" \"Lax,\" or \"None\". Make sure the `SameSite` attribute of the important cookies (e.g., session cookie) is set to a reasonable value. When `SameSite` is set to \"Strict\", no 3rd party cookie will be sent with outgoing requests, this is the most secure and private setting but harder to deploy with good usability. Setting it to \"Lax\" is the minimum requirement. If this wasn't intentional, it's recommended to set the SameSite flag to the `Strict` or `Lax` value, depending on your needs."},"helpUri":"https://semgrep.dev/r/javascript.express.web.cookies-samesite-missing-express.cookies-samesite-missing-express","id":"javascript.express.web.cookies-samesite-missing-express.cookies-samesite-missing-express","name":"javascript.express.web.cookies-samesite-missing-express.cookies-samesite-missing-express","properties":{"precision":"very-high","tags":["CWE-1275: Sensitive Cookie with Improper SameSite Attribute","HIGH CONFIDENCE","OWASP-A01:2021 - Broken Access Control","security"]},"shortDescription":{"text":"Semgrep Finding: javascript.express.web.cookies-samesite-missing-express.cookies-samesite-missing-express"}},{"defaultConfiguration":{"level":"note"},"fullDescription":{"text":"Detected a cookie options with the `SameSite` flag set to \"None\". This is a potential security risk that arises from the way web browsers manage cookies. In a typical web application, cookies are used to store and transmit session-related data between a client and a server. To enhance security, cookies can be marked with the \"SameSite\" attribute, which restricts their usage based on the origin of the page that set them. This attribute can have three values: \"Strict,\" \"Lax,\" or \"None\". Make sure the `SameSite` attribute of the important cookies (e.g., session cookie) is set to a reasonable value. When `SameSite` is set to \"Strict\", no 3rd party cookie will be sent with outgoing requests, this is the most secure and private setting but harder to deploy with good usability. Setting it to \"Lax\" is the minimum requirement. If this wasn't intentional, it's recommended to set the SameSite flag to the `Strict` or `Lax` value, depending on your needs."},"help":{"markdown":"Detected a cookie options with the `SameSite` flag set to \"None\". This is a potential security risk that arises from the way web browsers manage cookies. In a typical web application, cookies are used to store and transmit session-related data between a client and a server. To enhance security, cookies can be marked with the \"SameSite\" attribute, which restricts their usage based on the origin of the page that set them. This attribute can have three values: \"Strict,\" \"Lax,\" or \"None\". Make sure the `SameSite` attribute of the important cookies (e.g., session cookie) is set to a reasonable value. When `SameSite` is set to \"Strict\", no 3rd party cookie will be sent with outgoing requests, this is the most secure and private setting but harder to deploy with good usability. Setting it to \"Lax\" is the minimum requirement. If this wasn't intentional, it's recommended to set the SameSite flag to the `Strict` or `Lax` value, depending on your needs.\n\nReferences: \n - [Semgrep Rule](https://semgrep.dev/r/javascript.express.web.cookies-samesite-none-express.cookies-samesite-none-express)\n - [https://owasp.org/Top10/A01_2021-Broken_Access_Control](https://owasp.org/Top10/A01_2021-Broken_Access_Control)\n - [https://owasp.org/www-project-web-security-testing-guide/latest/4-Web_Application_Security_Testing/06-Session_Management_Testing/02-Testing_for_Cookies_Attributes](https://owasp.org/www-project-web-security-testing-guide/latest/4-Web_Application_Security_Testing/06-Session_Management_Testing/02-Testing_for_Cookies_Attributes)\n - [https://web.dev/articles/samesite-cookies-explained](https://web.dev/articles/samesite-cookies-explained)\n","text":"Detected a cookie options with the `SameSite` flag set to \"None\". This is a potential security risk that arises from the way web browsers manage cookies. In a typical web application, cookies are used to store and transmit session-related data between a client and a server. To enhance security, cookies can be marked with the \"SameSite\" attribute, which restricts their usage based on the origin of the page that set them. This attribute can have three values: \"Strict,\" \"Lax,\" or \"None\". Make sure the `SameSite` attribute of the important cookies (e.g., session cookie) is set to a reasonable value. When `SameSite` is set to \"Strict\", no 3rd party cookie will be sent with outgoing requests, this is the most secure and private setting but harder to deploy with good usability. Setting it to \"Lax\" is the minimum requirement. If this wasn't intentional, it's recommended to set the SameSite flag to the `Strict` or `Lax` value, depending on your needs."},"helpUri":"https://semgrep.dev/r/javascript.express.web.cookies-samesite-none-express.cookies-samesite-none-express","id":"javascript.express.web.cookies-samesite-none-express.cookies-samesite-none-express","name":"javascript.express.web.cookies-samesite-none-express.cookies-samesite-none-express","properties":{"precision":"very-high","tags":["CWE-1275: Sensitive Cookie with Improper SameSite Attribute","HIGH CONFIDENCE","OWASP-A01:2021 - Broken Access Control","security"]},"shortDescription":{"text":"Semgrep Finding: javascript.express.web.cookies-samesite-none-express.cookies-samesite-none-express"}},{"defaultConfiguration":{"level":"note"},"fullDescription":{"text":"Detected a cookie where the `Secure` flag is either missing or disabled. The `Secure` cookie flag instructs the browser to forbid sending the cookie over an insecure HTTP request. Set the `Secure` flag to `true` so the cookie will only be sent over HTTPS. If this wasn't intentional, it's recommended to set the Secure flag to true by adding `secure: true` to the cookie options, so the cookie will always be sent over HTTPS."},"help":{"markdown":"Detected a cookie where the `Secure` flag is either missing or disabled. The `Secure` cookie flag instructs the browser to forbid sending the cookie over an insecure HTTP request. Set the `Secure` flag to `true` so the cookie will only be sent over HTTPS. If this wasn't intentional, it's recommended to set the Secure flag to true by adding `secure: true` to the cookie options, so the cookie will always be sent over HTTPS.\n\nReferences: \n - [Semgrep Rule](https://semgrep.dev/r/javascript.express.web.cookies-secure-false-express.cookies-secure-false-express)\n - [https://owasp.org/Top10/A05_2021-Security_Misconfiguration](https://owasp.org/Top10/A05_2021-Security_Misconfiguration)\n - [https://owasp.org/www-project-web-security-testing-guide/latest/4-Web_Application_Security_Testing/06-Session_Management_Testing/02-Testing_for_Cookies_Attributes](https://owasp.org/www-project-web-security-testing-guide/latest/4-Web_Application_Security_Testing/06-Session_Management_Testing/02-Testing_for_Cookies_Attributes)\n","text":"Detected a cookie where the `Secure` flag is either missing or disabled. The `Secure` cookie flag instructs the browser to forbid sending the cookie over an insecure HTTP request. Set the `Secure` flag to `true` so the cookie will only be sent over HTTPS. If this wasn't intentional, it's recommended to set the Secure flag to true by adding `secure: true` to the cookie options, so the cookie will always be sent over HTTPS."},"helpUri":"https://semgrep.dev/r/javascript.express.web.cookies-secure-false-express.cookies-secure-false-express","id":"javascript.express.web.cookies-secure-false-express.cookies-secure-false-express","name":"javascript.express.web.cookies-secure-false-express.cookies-secure-false-express","properties":{"precision":"very-high","tags":["CWE-614: Sensitive Cookie in HTTPS Session Without 'Secure' Attribute","HIGH CONFIDENCE","OWASP-A05:2021 - Security Misconfiguration","security"]},"shortDescription":{"text":"Semgrep Finding: javascript.express.web.cookies-secure-false-express.cookies-secure-false-express"}},{"defaultConfiguration":{"level":"note"},"fullDescription":{"text":"Detected a cookie where the `Secure` flag is either missing or disabled. The `Secure` cookie flag instructs the browser to forbid sending the cookie over an insecure HTTP request. Set the `Secure` flag to `true` so the cookie will only be sent over HTTPS. If this wasn't intentional, it's recommended to set the Secure flag to true by adding `secure: true` to the cookie options, so the cookie will always be sent over HTTPS."},"help":{"markdown":"Detected a cookie where the `Secure` flag is either missing or disabled. The `Secure` cookie flag instructs the browser to forbid sending the cookie over an insecure HTTP request. Set the `Secure` flag to `true` so the cookie will only be sent over HTTPS. If this wasn't intentional, it's recommended to set the Secure flag to true by adding `secure: true` to the cookie options, so the cookie will always be sent over HTTPS.\n\nReferences: \n - [Semgrep Rule](https://semgrep.dev/r/javascript.express.web.cookies-secure-missing-express.cookies-secure-missing-express)\n - [https://owasp.org/Top10/A05_2021-Security_Misconfiguration](https://owasp.org/Top10/A05_2021-Security_Misconfiguration)\n - [https://owasp.org/www-project-web-security-testing-guide/latest/4-Web_Application_Security_Testing/06-Session_Management_Testing/02-Testing_for_Cookies_Attributes](https://owasp.org/www-project-web-security-testing-guide/latest/4-Web_Application_Security_Testing/06-Session_Management_Testing/02-Testing_for_Cookies_Attributes)\n","text":"Detected a cookie where the `Secure` flag is either missing or disabled. The `Secure` cookie flag instructs the browser to forbid sending the cookie over an insecure HTTP request. Set the `Secure` flag to `true` so the cookie will only be sent over HTTPS. If this wasn't intentional, it's recommended to set the Secure flag to true by adding `secure: true` to the cookie options, so the cookie will always be sent over HTTPS."},"helpUri":"https://semgrep.dev/r/javascript.express.web.cookies-secure-missing-express.cookies-secure-missing-express","id":"javascript.express.web.cookies-secure-missing-express.cookies-secure-missing-express","name":"javascript.express.web.cookies-secure-missing-express.cookies-secure-missing-express","properties":{"precision":"very-high","tags":["CWE-614: Sensitive Cookie in HTTPS Session Without 'Secure' Attribute","HIGH CONFIDENCE","OWASP-A05:2021 - Security Misconfiguration","security"]},"shortDescription":{"text":"Semgrep Finding: javascript.express.web.cookies-secure-missing-express.cookies-secure-missing-express"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"Having default CORS settings is insecure because they often allow overly permissive cross-origin access, exposing your application to unauthorized data sharing, potentially exposing sensitive data to malicious websites. Avoid using wildcard (*) origins, especially for endpoints that handle sensitive data. Use a restrictive CORS policy by explicitly specifying trusted origins in the Access-Control-Allow-Origin header."},"help":{"markdown":"Having default CORS settings is insecure because they often allow overly permissive cross-origin access, exposing your application to unauthorized data sharing, potentially exposing sensitive data to malicious websites. Avoid using wildcard (*) origins, especially for endpoints that handle sensitive data. Use a restrictive CORS policy by explicitly specifying trusted origins in the Access-Control-Allow-Origin header.\n\nReferences: \n - [Semgrep Rule](https://semgrep.dev/r/javascript.express.web.cors-default-config-express.cors-default-config-express)\n - [https://owasp.org/Top10/A07_2021-Identification_and_Authentication_Failures](https://owasp.org/Top10/A07_2021-Identification_and_Authentication_Failures)\n - [https://owasp.org/www-project-web-security-testing-guide/latest/4-Web_Application_Security_Testing/06-Session_Management_Testing/02-Testing_for_Cookies_Attributes](https://owasp.org/www-project-web-security-testing-guide/latest/4-Web_Application_Security_Testing/06-Session_Management_Testing/02-Testing_for_Cookies_Attributes)\n","text":"Having default CORS settings is insecure because they often allow overly permissive cross-origin access, exposing your application to unauthorized data sharing, potentially exposing sensitive data to malicious websites. Avoid using wildcard (*) origins, especially for endpoints that handle sensitive data. Use a restrictive CORS policy by explicitly specifying trusted origins in the Access-Control-Allow-Origin header."},"helpUri":"https://semgrep.dev/r/javascript.express.web.cors-default-config-express.cors-default-config-express","id":"javascript.express.web.cors-default-config-express.cors-default-config-express","name":"javascript.express.web.cors-default-config-express.cors-default-config-express","properties":{"precision":"very-high","tags":["CWE-346: Origin Validation Error","HIGH CONFIDENCE","OWASP-A07:2021 - Identification and Authentication Failures","security"]},"shortDescription":{"text":"Semgrep Finding: javascript.express.web.cors-default-config-express.cors-default-config-express"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"A permissive Cross-Origin Resource Sharing (CORS) vulnerability occurs when a server's CORS policy allows any origin to access its resources or improperly validates allowed origins. This can enable attackers to make unauthorized cross-origin requests, potentially exposing sensitive data to malicious websites. Avoid using wildcard (*) origins, especially for endpoints that handle sensitive data. Use a restrictive CORS policy by explicitly specifying trusted origins in the Access-Control-Allow-Origin header."},"help":{"markdown":"A permissive Cross-Origin Resource Sharing (CORS) vulnerability occurs when a server's CORS policy allows any origin to access its resources or improperly validates allowed origins. This can enable attackers to make unauthorized cross-origin requests, potentially exposing sensitive data to malicious websites. Avoid using wildcard (*) origins, especially for endpoints that handle sensitive data. Use a restrictive CORS policy by explicitly specifying trusted origins in the Access-Control-Allow-Origin header.\n\nReferences: \n - [Semgrep Rule](https://semgrep.dev/r/javascript.express.web.cors-permissive-express.cors-permissive-express)\n - [https://owasp.org/Top10/A07_2021-Identification_and_Authentication_Failures](https://owasp.org/Top10/A07_2021-Identification_and_Authentication_Failures)\n","text":"A permissive Cross-Origin Resource Sharing (CORS) vulnerability occurs when a server's CORS policy allows any origin to access its resources or improperly validates allowed origins. This can enable attackers to make unauthorized cross-origin requests, potentially exposing sensitive data to malicious websites. Avoid using wildcard (*) origins, especially for endpoints that handle sensitive data. Use a restrictive CORS policy by explicitly specifying trusted origins in the Access-Control-Allow-Origin header."},"helpUri":"https://semgrep.dev/r/javascript.express.web.cors-permissive-express.cors-permissive-express","id":"javascript.express.web.cors-permissive-express.cors-permissive-express","name":"javascript.express.web.cors-permissive-express.cors-permissive-express","properties":{"precision":"very-high","tags":["CWE-346: Origin Validation Error","HIGH CONFIDENCE","OWASP-A07:2021 - Identification and Authentication Failures","security"]},"shortDescription":{"text":"Semgrep Finding: javascript.express.web.cors-permissive-express.cors-permissive-express"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"User controlled data in a `createNodesFromMarkup` is an anti-pattern that can lead to XSS vulnerabilities"},"help":{"markdown":"User controlled data in a `createNodesFromMarkup` is an anti-pattern that can lead to XSS vulnerabilities\n\nReferences: \n - [Semgrep Rule](https://semgrep.dev/r/javascript.fbjs.security.audit.insecure-createnodesfrommarkup.insecure-createnodesfrommarkup)\n - [https://owasp.org/Top10/A03_2021-Injection](https://owasp.org/Top10/A03_2021-Injection)\n","text":"User controlled data in a `createNodesFromMarkup` is an anti-pattern that can lead to XSS vulnerabilities"},"helpUri":"https://semgrep.dev/r/javascript.fbjs.security.audit.insecure-createnodesfrommarkup.insecure-createnodesfrommarkup","id":"javascript.fbjs.security.audit.insecure-createnodesfrommarkup.insecure-createnodesfrommarkup","name":"javascript.fbjs.security.audit.insecure-createnodesfrommarkup.insecure-createnodesfrommarkup","properties":{"precision":"very-high","tags":["CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')","LOW CONFIDENCE","OWASP-A03:2021 - Injection","OWASP-A07:2017 - Cross-Site Scripting (XSS)","security"]},"shortDescription":{"text":"Semgrep Finding: javascript.fbjs.security.audit.insecure-createnodesfrommarkup.insecure-createnodesfrommarkup"}},{"defaultConfiguration":{"level":"note"},"fullDescription":{"text":"A secret is hard-coded in the application. Secrets stored in source code, such as credentials, identifiers, and other types of sensitive data, can be leaked and used by internal or external malicious actors. Use environment variables to securely provide credentials and other secrets or retrieve them from a secure vault or Hardware Security Module (HSM)."},"help":{"markdown":"A secret is hard-coded in the application. Secrets stored in source code, such as credentials, identifiers, and other types of sensitive data, can be leaked and used by internal or external malicious actors. Use environment variables to securely provide credentials and other secrets or retrieve them from a secure vault or Hardware Security Module (HSM).\n\nReferences: \n - [Semgrep Rule](https://semgrep.dev/r/javascript.firebase.firebase-hardcoded-secret.firebase-hardcoded-secret)\n - [https://cheatsheetseries.owasp.org/cheatsheets/Secrets_Management_Cheat_Sheet.html](https://cheatsheetseries.owasp.org/cheatsheets/Secrets_Management_Cheat_Sheet.html)\n","text":"A secret is hard-coded in the application. Secrets stored in source code, such as credentials, identifiers, and other types of sensitive data, can be leaked and used by internal or external malicious actors. Use environment variables to securely provide credentials and other secrets or retrieve them from a secure vault or Hardware Security Module (HSM)."},"helpUri":"https://semgrep.dev/r/javascript.firebase.firebase-hardcoded-secret.firebase-hardcoded-secret","id":"javascript.firebase.firebase-hardcoded-secret.firebase-hardcoded-secret","name":"javascript.firebase.firebase-hardcoded-secret.firebase-hardcoded-secret","properties":{"precision":"very-high","tags":["CWE-798: Use of Hard-coded Credentials","MEDIUM CONFIDENCE","OWASP-A07:2021 - Identification and Authentication Failures","security"]},"shortDescription":{"text":"Semgrep Finding: javascript.firebase.firebase-hardcoded-secret.firebase-hardcoded-secret"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"Found an insecure gRPC connection. This creates a connection without encryption to a gRPC client/server. A malicious attacker could tamper with the gRPC message, which could compromise the machine."},"help":{"markdown":"Found an insecure gRPC connection. This creates a connection without encryption to a gRPC client/server. A malicious attacker could tamper with the gRPC message, which could compromise the machine.\n\nReferences: \n - [Semgrep Rule](https://semgrep.dev/r/javascript.grpc.security.grpc-nodejs-insecure-connection.grpc-nodejs-insecure-connection)\n - [https://blog.gopheracademy.com/advent-2017/go-grpc-beyond-basics/#:~:text=disables%20transport%20security](https://blog.gopheracademy.com/advent-2017/go-grpc-beyond-basics/#:~:text=disables%20transport%20security)\n","text":"Found an insecure gRPC connection. This creates a connection without encryption to a gRPC client/server. A malicious attacker could tamper with the gRPC message, which could compromise the machine."},"helpUri":"https://semgrep.dev/r/javascript.grpc.security.grpc-nodejs-insecure-connection.grpc-nodejs-insecure-connection","id":"javascript.grpc.security.grpc-nodejs-insecure-connection.grpc-nodejs-insecure-connection","name":"javascript.grpc.security.grpc-nodejs-insecure-connection.grpc-nodejs-insecure-connection","properties":{"precision":"very-high","tags":["CWE-502: Deserialization of Untrusted Data","LOW CONFIDENCE","OWASP-A08:2017 - Insecure Deserialization","OWASP-A08:2021 - Software and Data Integrity Failures","security"]},"shortDescription":{"text":"Semgrep Finding: javascript.grpc.security.grpc-nodejs-insecure-connection.grpc-nodejs-insecure-connection"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"Untrusted input could be used to tamper with a web page rendering, which can lead to a Cross-site scripting (XSS) vulnerability. XSS vulnerabilities occur when untrusted input executes malicious JavaScript code, leading to issues such as account compromise and sensitive information leakage. To prevent this vulnerability, validate the user input, perform contextual output encoding or sanitize the input."},"help":{"markdown":"Untrusted input could be used to tamper with a web page rendering, which can lead to a Cross-site scripting (XSS) vulnerability. XSS vulnerabilities occur when untrusted input executes malicious JavaScript code, leading to issues such as account compromise and sensitive information leakage. To prevent this vulnerability, validate the user input, perform contextual output encoding or sanitize the input.\n\nReferences: \n - [Semgrep Rule](https://semgrep.dev/r/javascript.helmet.csp-misconfiguration.csp-misconfiguration)\n - [https://owasp.org/Top10/A03_2021-Injection](https://owasp.org/Top10/A03_2021-Injection)\n","text":"Untrusted input could be used to tamper with a web page rendering, which can lead to a Cross-site scripting (XSS) vulnerability. XSS vulnerabilities occur when untrusted input executes malicious JavaScript code, leading to issues such as account compromise and sensitive information leakage. To prevent this vulnerability, validate the user input, perform contextual output encoding or sanitize the input."},"helpUri":"https://semgrep.dev/r/javascript.helmet.csp-misconfiguration.csp-misconfiguration","id":"javascript.helmet.csp-misconfiguration.csp-misconfiguration","name":"javascript.helmet.csp-misconfiguration.csp-misconfiguration","properties":{"precision":"very-high","tags":["CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')","HIGH CONFIDENCE","OWASP-A03:2021 - Injection","OWASP-A07:2017 - Cross-Site Scripting (XSS)","security"]},"shortDescription":{"text":"Semgrep Finding: javascript.helmet.csp-misconfiguration.csp-misconfiguration"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"Found an initialization of the Intercom Messenger that identifies a User, but does not specify a `user_hash`. This configuration allows users to impersonate one another. See the Intercom Identity Verification docs for more context https://www.intercom.com/help/en/articles/183-set-up-identity-verification-for-web-and-mobile"},"help":{"markdown":"Found an initialization of the Intercom Messenger that identifies a User, but does not specify a `user_hash`. This configuration allows users to impersonate one another. See the Intercom Identity Verification docs for more context https://www.intercom.com/help/en/articles/183-set-up-identity-verification-for-web-and-mobile\n\nReferences: \n - [Semgrep Rule](https://semgrep.dev/r/javascript.intercom.security.audit.intercom-settings-user-identifier-without-user-hash.intercom-settings-user-identifier-without-user-hash)\n - [https://www.intercom.com/help/en/articles/183-set-up-identity-verification-for-web-and-mobile](https://www.intercom.com/help/en/articles/183-set-up-identity-verification-for-web-and-mobile)\n","text":"Found an initialization of the Intercom Messenger that identifies a User, but does not specify a `user_hash`. This configuration allows users to impersonate one another. See the Intercom Identity Verification docs for more context https://www.intercom.com/help/en/articles/183-set-up-identity-verification-for-web-and-mobile"},"helpUri":"https://semgrep.dev/r/javascript.intercom.security.audit.intercom-settings-user-identifier-without-user-hash.intercom-settings-user-identifier-without-user-hash","id":"javascript.intercom.security.audit.intercom-settings-user-identifier-without-user-hash.intercom-settings-user-identifier-without-user-hash","name":"javascript.intercom.security.audit.intercom-settings-user-identifier-without-user-hash.intercom-settings-user-identifier-without-user-hash","properties":{"precision":"very-high","tags":["CWE-287: Improper Authentication","MEDIUM CONFIDENCE","security"]},"shortDescription":{"text":"Semgrep Finding: javascript.intercom.security.audit.intercom-settings-user-identifier-without-user-hash.intercom-settings-user-identifier-without-user-hash"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"The object is passed strictly to jose.JWT.sign(...) Make sure that sensitive information is not exposed through JWT token payload."},"help":{"markdown":"The object is passed strictly to jose.JWT.sign(...) Make sure that sensitive information is not exposed through JWT token payload.\n\nReferences: \n - [Semgrep Rule](https://semgrep.dev/r/javascript.jose.security.audit.jose-exposed-data.jose-exposed-data)\n - [https://owasp.org/Top10/A04_2021-Insecure_Design](https://owasp.org/Top10/A04_2021-Insecure_Design)\n","text":"The object is passed strictly to jose.JWT.sign(...) Make sure that sensitive information is not exposed through JWT token payload."},"helpUri":"https://semgrep.dev/r/javascript.jose.security.audit.jose-exposed-data.jose-exposed-data","id":"javascript.jose.security.audit.jose-exposed-data.jose-exposed-data","name":"javascript.jose.security.audit.jose-exposed-data.jose-exposed-data","properties":{"precision":"very-high","tags":["CWE-522: Insufficiently Protected Credentials","LOW CONFIDENCE","OWASP-A02:2017 - Broken Authentication","OWASP-A04:2021 - Insecure Design","security"]},"shortDescription":{"text":"Semgrep Finding: javascript.jose.security.audit.jose-exposed-data.jose-exposed-data"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"A hard-coded credential was detected. It is not recommended to store credentials in source-code, as this risks secrets being leaked and used by either an internal or external malicious adversary. It is recommended to use environment variables to securely provide credentials or retrieve credentials from a secure vault or HSM (Hardware Security Module)."},"help":{"markdown":"A hard-coded credential was detected. It is not recommended to store credentials in source-code, as this risks secrets being leaked and used by either an internal or external malicious adversary. It is recommended to use environment variables to securely provide credentials or retrieve credentials from a secure vault or HSM (Hardware Security Module).\n\nReferences: \n - [Semgrep Rule](https://semgrep.dev/r/javascript.jose.security.jwt-hardcode.hardcoded-jwt-secret)\n - [https://cheatsheetseries.owasp.org/cheatsheets/Secrets_Management_Cheat_Sheet.html](https://cheatsheetseries.owasp.org/cheatsheets/Secrets_Management_Cheat_Sheet.html)\n","text":"A hard-coded credential was detected. It is not recommended to store credentials in source-code, as this risks secrets being leaked and used by either an internal or external malicious adversary. It is recommended to use environment variables to securely provide credentials or retrieve credentials from a secure vault or HSM (Hardware Security Module)."},"helpUri":"https://semgrep.dev/r/javascript.jose.security.jwt-hardcode.hardcoded-jwt-secret","id":"javascript.jose.security.jwt-hardcode.hardcoded-jwt-secret","name":"javascript.jose.security.jwt-hardcode.hardcoded-jwt-secret","properties":{"precision":"very-high","tags":["CWE-798: Use of Hard-coded Credentials","HIGH CONFIDENCE","OWASP-A07:2021 - Identification and Authentication Failures","security"]},"shortDescription":{"text":"Semgrep Finding: javascript.jose.security.jwt-hardcode.hardcoded-jwt-secret"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"Detected use of the 'none' algorithm in a JWT token. The 'none' algorithm assumes the integrity of the token has already been verified. This would allow a malicious actor to forge a JWT token that will automatically be verified. Do not explicitly use the 'none' algorithm. Instead, use an algorithm such as 'HS256'."},"help":{"markdown":"Detected use of the 'none' algorithm in a JWT token. The 'none' algorithm assumes the integrity of the token has already been verified. This would allow a malicious actor to forge a JWT token that will automatically be verified. Do not explicitly use the 'none' algorithm. Instead, use an algorithm such as 'HS256'.\n\nReferences: \n - [Semgrep Rule](https://semgrep.dev/r/javascript.jose.security.jwt-none-alg.jwt-none-alg)\n - [https://owasp.org/Top10/A02_2021-Cryptographic_Failures](https://owasp.org/Top10/A02_2021-Cryptographic_Failures)\n","text":"Detected use of the 'none' algorithm in a JWT token. The 'none' algorithm assumes the integrity of the token has already been verified. This would allow a malicious actor to forge a JWT token that will automatically be verified. Do not explicitly use the 'none' algorithm. Instead, use an algorithm such as 'HS256'."},"helpUri":"https://semgrep.dev/r/javascript.jose.security.jwt-none-alg.jwt-none-alg","id":"javascript.jose.security.jwt-none-alg.jwt-none-alg","name":"javascript.jose.security.jwt-none-alg.jwt-none-alg","properties":{"precision":"very-high","tags":["CWE-327: Use of a Broken or Risky Cryptographic Algorithm","HIGH CONFIDENCE","OWASP-A02:2021 - Cryptographic Failures","OWASP-A03:2017 - Sensitive Data Exposure","security"]},"shortDescription":{"text":"Semgrep Finding: javascript.jose.security.jwt-none-alg.jwt-none-alg"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"Detected the decoding of a JWT token without a verify step. JWT tokens must be verified before use, otherwise the token's integrity is unknown. This means a malicious actor could forge a JWT token with any claims. Call '.verify()' before using the token."},"help":{"markdown":"Detected the decoding of a JWT token without a verify step. JWT tokens must be verified before use, otherwise the token's integrity is unknown. This means a malicious actor could forge a JWT token with any claims. Call '.verify()' before using the token.\n\nReferences: \n - [Semgrep Rule](https://semgrep.dev/r/javascript.jsonwebtoken.security.audit.jwt-decode-without-verify.jwt-decode-without-verify)\n - [https://owasp.org/Top10/A08_2021-Software_and_Data_Integrity_Failures](https://owasp.org/Top10/A08_2021-Software_and_Data_Integrity_Failures)\n","text":"Detected the decoding of a JWT token without a verify step. JWT tokens must be verified before use, otherwise the token's integrity is unknown. This means a malicious actor could forge a JWT token with any claims. Call '.verify()' before using the token."},"helpUri":"https://semgrep.dev/r/javascript.jsonwebtoken.security.audit.jwt-decode-without-verify.jwt-decode-without-verify","id":"javascript.jsonwebtoken.security.audit.jwt-decode-without-verify.jwt-decode-without-verify","name":"javascript.jsonwebtoken.security.audit.jwt-decode-without-verify.jwt-decode-without-verify","properties":{"precision":"very-high","tags":["CWE-345: Insufficient Verification of Data Authenticity","LOW CONFIDENCE","OWASP-A08:2021 - Software and Data Integrity Failures","security"]},"shortDescription":{"text":"Semgrep Finding: javascript.jsonwebtoken.security.audit.jwt-decode-without-verify.jwt-decode-without-verify"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"The object is passed strictly to jsonwebtoken.sign(...) Make sure that sensitive information is not exposed through JWT token payload."},"help":{"markdown":"The object is passed strictly to jsonwebtoken.sign(...) Make sure that sensitive information is not exposed through JWT token payload.\n\nReferences: \n - [Semgrep Rule](https://semgrep.dev/r/javascript.jsonwebtoken.security.audit.jwt-exposed-data.jwt-exposed-data)\n - [https://owasp.org/Top10/A04_2021-Insecure_Design](https://owasp.org/Top10/A04_2021-Insecure_Design)\n","text":"The object is passed strictly to jsonwebtoken.sign(...) Make sure that sensitive information is not exposed through JWT token payload."},"helpUri":"https://semgrep.dev/r/javascript.jsonwebtoken.security.audit.jwt-exposed-data.jwt-exposed-data","id":"javascript.jsonwebtoken.security.audit.jwt-exposed-data.jwt-exposed-data","name":"javascript.jsonwebtoken.security.audit.jwt-exposed-data.jwt-exposed-data","properties":{"precision":"very-high","tags":["CWE-522: Insufficiently Protected Credentials","LOW CONFIDENCE","OWASP-A02:2017 - Broken Authentication","OWASP-A04:2021 - Insecure Design","security"]},"shortDescription":{"text":"Semgrep Finding: javascript.jsonwebtoken.security.audit.jwt-exposed-data.jwt-exposed-data"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"A hard-coded credential was detected. It is not recommended to store credentials in source-code, as this risks secrets being leaked and used by either an internal or external malicious adversary. It is recommended to use environment variables to securely provide credentials or retrieve credentials from a secure vault or HSM (Hardware Security Module)."},"help":{"markdown":"A hard-coded credential was detected. It is not recommended to store credentials in source-code, as this risks secrets being leaked and used by either an internal or external malicious adversary. It is recommended to use environment variables to securely provide credentials or retrieve credentials from a secure vault or HSM (Hardware Security Module).\n\nReferences: \n - [Semgrep Rule](https://semgrep.dev/r/javascript.jsonwebtoken.security.jwt-hardcode.hardcoded-jwt-secret)\n - [https://cheatsheetseries.owasp.org/cheatsheets/Secrets_Management_Cheat_Sheet.html](https://cheatsheetseries.owasp.org/cheatsheets/Secrets_Management_Cheat_Sheet.html)\n","text":"A hard-coded credential was detected. It is not recommended to store credentials in source-code, as this risks secrets being leaked and used by either an internal or external malicious adversary. It is recommended to use environment variables to securely provide credentials or retrieve credentials from a secure vault or HSM (Hardware Security Module)."},"helpUri":"https://semgrep.dev/r/javascript.jsonwebtoken.security.jwt-hardcode.hardcoded-jwt-secret","id":"javascript.jsonwebtoken.security.jwt-hardcode.hardcoded-jwt-secret","name":"javascript.jsonwebtoken.security.jwt-hardcode.hardcoded-jwt-secret","properties":{"precision":"very-high","tags":["CWE-798: Use of Hard-coded Credentials","HIGH CONFIDENCE","OWASP-A07:2021 - Identification and Authentication Failures","security"]},"shortDescription":{"text":"Semgrep Finding: javascript.jsonwebtoken.security.jwt-hardcode.hardcoded-jwt-secret"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"Detected use of the 'none' algorithm in a JWT token. The 'none' algorithm assumes the integrity of the token has already been verified. This would allow a malicious actor to forge a JWT token that will automatically be verified. Do not explicitly use the 'none' algorithm. Instead, use an algorithm such as 'HS256'."},"help":{"markdown":"Detected use of the 'none' algorithm in a JWT token. The 'none' algorithm assumes the integrity of the token has already been verified. This would allow a malicious actor to forge a JWT token that will automatically be verified. Do not explicitly use the 'none' algorithm. Instead, use an algorithm such as 'HS256'.\n\nReferences: \n - [Semgrep Rule](https://semgrep.dev/r/javascript.jsonwebtoken.security.jwt-none-alg.jwt-none-alg)\n - [https://owasp.org/Top10/A02_2021-Cryptographic_Failures](https://owasp.org/Top10/A02_2021-Cryptographic_Failures)\n","text":"Detected use of the 'none' algorithm in a JWT token. The 'none' algorithm assumes the integrity of the token has already been verified. This would allow a malicious actor to forge a JWT token that will automatically be verified. Do not explicitly use the 'none' algorithm. Instead, use an algorithm such as 'HS256'."},"helpUri":"https://semgrep.dev/r/javascript.jsonwebtoken.security.jwt-none-alg.jwt-none-alg","id":"javascript.jsonwebtoken.security.jwt-none-alg.jwt-none-alg","name":"javascript.jsonwebtoken.security.jwt-none-alg.jwt-none-alg","properties":{"precision":"very-high","tags":["CWE-327: Use of a Broken or Risky Cryptographic Algorithm","MEDIUM CONFIDENCE","OWASP-A02:2021 - Cryptographic Failures","OWASP-A03:2017 - Sensitive Data Exposure","security"]},"shortDescription":{"text":"Semgrep Finding: javascript.jsonwebtoken.security.jwt-none-alg.jwt-none-alg"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"The SHA1 hashing algorithm is considered to be weak. If this is used in any sensitive operation such as password hashing, or is used to ensure data integrity (collision sensitive) then you should use a stronger hashing algorithm. For passwords, consider using `Argon2id`, `scrypt`, or `bcrypt`. For data integrity, consider using `SHA-256`."},"help":{"markdown":"The SHA1 hashing algorithm is considered to be weak. If this is used in any sensitive operation such as password hashing, or is used to ensure data integrity (collision sensitive) then you should use a stronger hashing algorithm. For passwords, consider using `Argon2id`, `scrypt`, or `bcrypt`. For data integrity, consider using `SHA-256`.\n\nReferences: \n - [Semgrep Rule](https://semgrep.dev/r/javascript.jssha.jssha-sha1.jssha-sha1)\n - [https://owasp.org/Top10/A02_2021-Cryptographic_Failures](https://owasp.org/Top10/A02_2021-Cryptographic_Failures)\n","text":"The SHA1 hashing algorithm is considered to be weak. If this is used in any sensitive operation such as password hashing, or is used to ensure data integrity (collision sensitive) then you should use a stronger hashing algorithm. For passwords, consider using `Argon2id`, `scrypt`, or `bcrypt`. For data integrity, consider using `SHA-256`."},"helpUri":"https://semgrep.dev/r/javascript.jssha.jssha-sha1.jssha-sha1","id":"javascript.jssha.jssha-sha1.jssha-sha1","name":"javascript.jssha.jssha-sha1.jssha-sha1","properties":{"precision":"very-high","tags":["CWE-327: Use of a Broken or Risky Cryptographic Algorithm","LOW CONFIDENCE","OWASP-A02:2021 - Cryptographic Failures","OWASP-A03:2017 - Sensitive Data Exposure","security"]},"shortDescription":{"text":"Semgrep Finding: javascript.jssha.jssha-sha1.jssha-sha1"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"Detected the decoding of a JWT token without a verify step. JWT tokens must be verified before use, otherwise the token's integrity is unknown. This means a malicious actor could forge a JWT token with any claims. Set 'verify' to `true` before using the token."},"help":{"markdown":"Detected the decoding of a JWT token without a verify step. JWT tokens must be verified before use, otherwise the token's integrity is unknown. This means a malicious actor could forge a JWT token with any claims. Set 'verify' to `true` before using the token.\n\nReferences: \n - [Semgrep Rule](https://semgrep.dev/r/javascript.jwt-simple.security.jwt-simple-noverify.jwt-simple-noverify)\n - [https://www.npmjs.com/package/jwt-simple](https://www.npmjs.com/package/jwt-simple)\n - [https://cwe.mitre.org/data/definitions/287](https://cwe.mitre.org/data/definitions/287)\n - [https://cwe.mitre.org/data/definitions/345](https://cwe.mitre.org/data/definitions/345)\n - [https://cwe.mitre.org/data/definitions/347](https://cwe.mitre.org/data/definitions/347)\n","text":"Detected the decoding of a JWT token without a verify step. JWT tokens must be verified before use, otherwise the token's integrity is unknown. This means a malicious actor could forge a JWT token with any claims. Set 'verify' to `true` before using the token."},"helpUri":"https://semgrep.dev/r/javascript.jwt-simple.security.jwt-simple-noverify.jwt-simple-noverify","id":"javascript.jwt-simple.security.jwt-simple-noverify.jwt-simple-noverify","name":"javascript.jwt-simple.security.jwt-simple-noverify.jwt-simple-noverify","properties":{"precision":"very-high","tags":["CWE-287: Improper Authentication","CWE-345: Insufficient Verification of Data Authenticity","CWE-347: Improper Verification of Cryptographic Signature","HIGH CONFIDENCE","OWASP-A05:2021 - Security Misconfiguration","OWASP-A07:2021 - Identification and Authentication Failures","security"]},"shortDescription":{"text":"Semgrep Finding: javascript.jwt-simple.security.jwt-simple-noverify.jwt-simple-noverify"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"The application creates a database connection with an empty password. This can lead to unauthorized access by either an internal or external malicious actor. To prevent this vulnerability, enforce authentication when connecting to a database by using environment variables to securely provide credentials or retrieving them from a secure vault or HSM (Hardware Security Module)."},"help":{"markdown":"The application creates a database connection with an empty password. This can lead to unauthorized access by either an internal or external malicious actor. To prevent this vulnerability, enforce authentication when connecting to a database by using environment variables to securely provide credentials or retrieving them from a secure vault or HSM (Hardware Security Module).\n\nReferences: \n - [Semgrep Rule](https://semgrep.dev/r/javascript.knex.node-knex-empty-password-connection-string.node-knex-empty-password-connection-string)\n - [https://cheatsheetseries.owasp.org/cheatsheets/Secrets_Management_Cheat_Sheet.html](https://cheatsheetseries.owasp.org/cheatsheets/Secrets_Management_Cheat_Sheet.html)\n","text":"The application creates a database connection with an empty password. This can lead to unauthorized access by either an internal or external malicious actor. To prevent this vulnerability, enforce authentication when connecting to a database by using environment variables to securely provide credentials or retrieving them from a secure vault or HSM (Hardware Security Module)."},"helpUri":"https://semgrep.dev/r/javascript.knex.node-knex-empty-password-connection-string.node-knex-empty-password-connection-string","id":"javascript.knex.node-knex-empty-password-connection-string.node-knex-empty-password-connection-string","name":"javascript.knex.node-knex-empty-password-connection-string.node-knex-empty-password-connection-string","properties":{"precision":"very-high","tags":["CWE-287: Improper Authentication","HIGH CONFIDENCE","OWASP-A07:2021 - Identification and Authentication Failures","security"]},"shortDescription":{"text":"Semgrep Finding: javascript.knex.node-knex-empty-password-connection-string.node-knex-empty-password-connection-string"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"The application creates a database connection with an empty password. This can lead to unauthorized access by either an internal or external malicious actor. To prevent this vulnerability, enforce authentication when connecting to a database by using environment variables to securely provide credentials or retrieving them from a secure vault or HSM (Hardware Security Module)."},"help":{"markdown":"The application creates a database connection with an empty password. This can lead to unauthorized access by either an internal or external malicious actor. To prevent this vulnerability, enforce authentication when connecting to a database by using environment variables to securely provide credentials or retrieving them from a secure vault or HSM (Hardware Security Module).\n\nReferences: \n - [Semgrep Rule](https://semgrep.dev/r/javascript.knex.node-knex-empty-password.node-knex-empty-password)\n - [https://cheatsheetseries.owasp.org/cheatsheets/Secrets_Management_Cheat_Sheet.html](https://cheatsheetseries.owasp.org/cheatsheets/Secrets_Management_Cheat_Sheet.html)\n","text":"The application creates a database connection with an empty password. This can lead to unauthorized access by either an internal or external malicious actor. To prevent this vulnerability, enforce authentication when connecting to a database by using environment variables to securely provide credentials or retrieving them from a secure vault or HSM (Hardware Security Module)."},"helpUri":"https://semgrep.dev/r/javascript.knex.node-knex-empty-password.node-knex-empty-password","id":"javascript.knex.node-knex-empty-password.node-knex-empty-password","name":"javascript.knex.node-knex-empty-password.node-knex-empty-password","properties":{"precision":"very-high","tags":["CWE-287: Improper Authentication","MEDIUM CONFIDENCE","OWASP-A07:2021 - Identification and Authentication Failures","security"]},"shortDescription":{"text":"Semgrep Finding: javascript.knex.node-knex-empty-password.node-knex-empty-password"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"A secret is hard-coded in the application. Secrets stored in source code, such as credentials, identifiers, and other types of sensitive data, can be leaked and used by internal or external malicious actors. Use environment variables to securely provide credentials and other secrets or retrieve them from a secure vault or Hardware Security Module (HSM)."},"help":{"markdown":"A secret is hard-coded in the application. Secrets stored in source code, such as credentials, identifiers, and other types of sensitive data, can be leaked and used by internal or external malicious actors. Use environment variables to securely provide credentials and other secrets or retrieve them from a secure vault or Hardware Security Module (HSM).\n\nReferences: \n - [Semgrep Rule](https://semgrep.dev/r/javascript.knex.node-knex-hardcoded-secret-connection-string.node-knex-hardcoded-secret-connection-string)\n - [https://cheatsheetseries.owasp.org/cheatsheets/Secrets_Management_Cheat_Sheet.html](https://cheatsheetseries.owasp.org/cheatsheets/Secrets_Management_Cheat_Sheet.html)\n","text":"A secret is hard-coded in the application. Secrets stored in source code, such as credentials, identifiers, and other types of sensitive data, can be leaked and used by internal or external malicious actors. Use environment variables to securely provide credentials and other secrets or retrieve them from a secure vault or Hardware Security Module (HSM)."},"helpUri":"https://semgrep.dev/r/javascript.knex.node-knex-hardcoded-secret-connection-string.node-knex-hardcoded-secret-connection-string","id":"javascript.knex.node-knex-hardcoded-secret-connection-string.node-knex-hardcoded-secret-connection-string","name":"javascript.knex.node-knex-hardcoded-secret-connection-string.node-knex-hardcoded-secret-connection-string","properties":{"precision":"very-high","tags":["CWE-798: Use of Hard-coded Credentials","HIGH CONFIDENCE","OWASP-A07:2021 - Identification and Authentication Failures","security"]},"shortDescription":{"text":"Semgrep Finding: javascript.knex.node-knex-hardcoded-secret-connection-string.node-knex-hardcoded-secret-connection-string"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"A secret is hard-coded in the application. Secrets stored in source code, such as credentials, identifiers, and other types of sensitive data, can be leaked and used by internal or external malicious actors. Use environment variables to securely provide credentials and other secrets or retrieve them from a secure vault or Hardware Security Module (HSM)."},"help":{"markdown":"A secret is hard-coded in the application. Secrets stored in source code, such as credentials, identifiers, and other types of sensitive data, can be leaked and used by internal or external malicious actors. Use environment variables to securely provide credentials and other secrets or retrieve them from a secure vault or Hardware Security Module (HSM).\n\nReferences: \n - [Semgrep Rule](https://semgrep.dev/r/javascript.knex.node-knex-hardcoded-secret.node-knex-hardcoded-secret)\n - [https://cheatsheetseries.owasp.org/cheatsheets/Secrets_Management_Cheat_Sheet.html](https://cheatsheetseries.owasp.org/cheatsheets/Secrets_Management_Cheat_Sheet.html)\n","text":"A secret is hard-coded in the application. Secrets stored in source code, such as credentials, identifiers, and other types of sensitive data, can be leaked and used by internal or external malicious actors. Use environment variables to securely provide credentials and other secrets or retrieve them from a secure vault or Hardware Security Module (HSM)."},"helpUri":"https://semgrep.dev/r/javascript.knex.node-knex-hardcoded-secret.node-knex-hardcoded-secret","id":"javascript.knex.node-knex-hardcoded-secret.node-knex-hardcoded-secret","name":"javascript.knex.node-knex-hardcoded-secret.node-knex-hardcoded-secret","properties":{"precision":"very-high","tags":["CWE-798: Use of Hard-coded Credentials","HIGH CONFIDENCE","OWASP-A07:2021 - Identification and Authentication Failures","security"]},"shortDescription":{"text":"Semgrep Finding: javascript.knex.node-knex-hardcoded-secret.node-knex-hardcoded-secret"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"A secret is hard-coded in the application. Secrets stored in source code, such as credentials, identifiers, and other types of sensitive data, can be leaked and used by internal or external malicious actors. Use environment variables to securely provide credentials and other secrets or retrieve them from a secure vault or Hardware Security Module (HSM)."},"help":{"markdown":"A secret is hard-coded in the application. Secrets stored in source code, such as credentials, identifiers, and other types of sensitive data, can be leaked and used by internal or external malicious actors. Use environment variables to securely provide credentials and other secrets or retrieve them from a secure vault or Hardware Security Module (HSM).\n\nReferences: \n - [Semgrep Rule](https://semgrep.dev/r/javascript.lang.hardcoded.headers.hardcoded-basic-token.hardcoded-basic-token)\n - [https://cheatsheetseries.owasp.org/cheatsheets/Secrets_Management_Cheat_Sheet.html](https://cheatsheetseries.owasp.org/cheatsheets/Secrets_Management_Cheat_Sheet.html)\n","text":"A secret is hard-coded in the application. Secrets stored in source code, such as credentials, identifiers, and other types of sensitive data, can be leaked and used by internal or external malicious actors. Use environment variables to securely provide credentials and other secrets or retrieve them from a secure vault or Hardware Security Module (HSM)."},"helpUri":"https://semgrep.dev/r/javascript.lang.hardcoded.headers.hardcoded-basic-token.hardcoded-basic-token","id":"javascript.lang.hardcoded.headers.hardcoded-basic-token.hardcoded-basic-token","name":"javascript.lang.hardcoded.headers.hardcoded-basic-token.hardcoded-basic-token","properties":{"precision":"very-high","tags":["CWE-798: Use of Hard-coded Credentials","HIGH CONFIDENCE","OWASP-A07:2021 - Identification and Authentication Failures","security"]},"shortDescription":{"text":"Semgrep Finding: javascript.lang.hardcoded.headers.hardcoded-basic-token.hardcoded-basic-token"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"A secret is hard-coded in the application. Secrets stored in source code, such as credentials, identifiers, and other types of sensitive data, can be leaked and used by internal or external malicious actors. Use environment variables to securely provide credentials and other secrets or retrieve them from a secure vault or Hardware Security Module (HSM)."},"help":{"markdown":"A secret is hard-coded in the application. Secrets stored in source code, such as credentials, identifiers, and other types of sensitive data, can be leaked and used by internal or external malicious actors. Use environment variables to securely provide credentials and other secrets or retrieve them from a secure vault or Hardware Security Module (HSM).\n\nReferences: \n - [Semgrep Rule](https://semgrep.dev/r/javascript.lang.hardcoded.headers.hardcoded-bearer-token.hardcoded-bearer-token)\n - [https://cheatsheetseries.owasp.org/cheatsheets/Secrets_Management_Cheat_Sheet.html](https://cheatsheetseries.owasp.org/cheatsheets/Secrets_Management_Cheat_Sheet.html)\n","text":"A secret is hard-coded in the application. Secrets stored in source code, such as credentials, identifiers, and other types of sensitive data, can be leaked and used by internal or external malicious actors. Use environment variables to securely provide credentials and other secrets or retrieve them from a secure vault or Hardware Security Module (HSM)."},"helpUri":"https://semgrep.dev/r/javascript.lang.hardcoded.headers.hardcoded-bearer-token.hardcoded-bearer-token","id":"javascript.lang.hardcoded.headers.hardcoded-bearer-token.hardcoded-bearer-token","name":"javascript.lang.hardcoded.headers.hardcoded-bearer-token.hardcoded-bearer-token","properties":{"precision":"very-high","tags":["CWE-798: Use of Hard-coded Credentials","HIGH CONFIDENCE","OWASP-A07:2021 - Identification and Authentication Failures","security"]},"shortDescription":{"text":"Semgrep Finding: javascript.lang.hardcoded.headers.hardcoded-bearer-token.hardcoded-bearer-token"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"A secret is hard-coded in the application. Secrets stored in source code, such as credentials, identifiers, and other types of sensitive data, can be leaked and used by internal or external malicious actors. Use environment variables to securely provide credentials and other secrets or retrieve them from a secure vault or Hardware Security Module (HSM)."},"help":{"markdown":"A secret is hard-coded in the application. Secrets stored in source code, such as credentials, identifiers, and other types of sensitive data, can be leaked and used by internal or external malicious actors. Use environment variables to securely provide credentials and other secrets or retrieve them from a secure vault or Hardware Security Module (HSM).\n\nReferences: \n - [Semgrep Rule](https://semgrep.dev/r/javascript.lang.hardcoded.headers.hardcoded-github-token.hardcoded-github-token)\n - [https://cheatsheetseries.owasp.org/cheatsheets/Secrets_Management_Cheat_Sheet.html](https://cheatsheetseries.owasp.org/cheatsheets/Secrets_Management_Cheat_Sheet.html)\n","text":"A secret is hard-coded in the application. Secrets stored in source code, such as credentials, identifiers, and other types of sensitive data, can be leaked and used by internal or external malicious actors. Use environment variables to securely provide credentials and other secrets or retrieve them from a secure vault or Hardware Security Module (HSM)."},"helpUri":"https://semgrep.dev/r/javascript.lang.hardcoded.headers.hardcoded-github-token.hardcoded-github-token","id":"javascript.lang.hardcoded.headers.hardcoded-github-token.hardcoded-github-token","name":"javascript.lang.hardcoded.headers.hardcoded-github-token.hardcoded-github-token","properties":{"precision":"very-high","tags":["CWE-798: Use of Hard-coded Credentials","HIGH CONFIDENCE","OWASP-A07:2021 - Identification and Authentication Failures","security"]},"shortDescription":{"text":"Semgrep Finding: javascript.lang.hardcoded.headers.hardcoded-github-token.hardcoded-github-token"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"A secret is hard-coded in the application. Secrets stored in source code, such as credentials, identifiers, and other types of sensitive data, can be leaked and used by internal or external malicious actors. Use environment variables to securely provide credentials and other secrets or retrieve them from a secure vault or Hardware Security Module (HSM)."},"help":{"markdown":"A secret is hard-coded in the application. Secrets stored in source code, such as credentials, identifiers, and other types of sensitive data, can be leaked and used by internal or external malicious actors. Use environment variables to securely provide credentials and other secrets or retrieve them from a secure vault or Hardware Security Module (HSM).\n\nReferences: \n - [Semgrep Rule](https://semgrep.dev/r/javascript.lang.hardcoded.strings.detected-private-key.detected-private-key)\n - [https://cheatsheetseries.owasp.org/cheatsheets/Secrets_Management_Cheat_Sheet.html](https://cheatsheetseries.owasp.org/cheatsheets/Secrets_Management_Cheat_Sheet.html)\n","text":"A secret is hard-coded in the application. Secrets stored in source code, such as credentials, identifiers, and other types of sensitive data, can be leaked and used by internal or external malicious actors. Use environment variables to securely provide credentials and other secrets or retrieve them from a secure vault or Hardware Security Module (HSM)."},"helpUri":"https://semgrep.dev/r/javascript.lang.hardcoded.strings.detected-private-key.detected-private-key","id":"javascript.lang.hardcoded.strings.detected-private-key.detected-private-key","name":"javascript.lang.hardcoded.strings.detected-private-key.detected-private-key","properties":{"precision":"very-high","tags":["CWE-798: Use of Hard-coded Credentials","MEDIUM CONFIDENCE","OWASP-A07:2021 - Identification and Authentication Failures","security"]},"shortDescription":{"text":"Semgrep Finding: javascript.lang.hardcoded.strings.detected-private-key.detected-private-key"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"A secret is hard-coded in the application. Secrets stored in source code, such as credentials, identifiers, and other types of sensitive data, can be leaked and used by internal or external malicious actors. Use environment variables to securely provide credentials and other secrets or retrieve them from a secure vault or Hardware Security Module (HSM)."},"help":{"markdown":"A secret is hard-coded in the application. Secrets stored in source code, such as credentials, identifiers, and other types of sensitive data, can be leaked and used by internal or external malicious actors. Use environment variables to securely provide credentials and other secrets or retrieve them from a secure vault or Hardware Security Module (HSM).\n\nReferences: \n - [Semgrep Rule](https://semgrep.dev/r/javascript.lang.hardcoded.tokens.hardcoded-aws-secretaccesskey.hardcoded-aws-secretaccesskey)\n - [https://cheatsheetseries.owasp.org/cheatsheets/Secrets_Management_Cheat_Sheet.html](https://cheatsheetseries.owasp.org/cheatsheets/Secrets_Management_Cheat_Sheet.html)\n","text":"A secret is hard-coded in the application. Secrets stored in source code, such as credentials, identifiers, and other types of sensitive data, can be leaked and used by internal or external malicious actors. Use environment variables to securely provide credentials and other secrets or retrieve them from a secure vault or Hardware Security Module (HSM)."},"helpUri":"https://semgrep.dev/r/javascript.lang.hardcoded.tokens.hardcoded-aws-secretaccesskey.hardcoded-aws-secretaccesskey","id":"javascript.lang.hardcoded.tokens.hardcoded-aws-secretaccesskey.hardcoded-aws-secretaccesskey","name":"javascript.lang.hardcoded.tokens.hardcoded-aws-secretaccesskey.hardcoded-aws-secretaccesskey","properties":{"precision":"very-high","tags":["CWE-798: Use of Hard-coded Credentials","HIGH CONFIDENCE","OWASP-A07:2021 - Identification and Authentication Failures","security"]},"shortDescription":{"text":"Semgrep Finding: javascript.lang.hardcoded.tokens.hardcoded-aws-secretaccesskey.hardcoded-aws-secretaccesskey"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"A secret is hard-coded in the application. Secrets stored in source code, such as credentials, identifiers, and other types of sensitive data, can be leaked and used by internal or external malicious actors. Use environment variables to securely provide credentials and other secrets or retrieve them from a secure vault or Hardware Security Module (HSM)."},"help":{"markdown":"A secret is hard-coded in the application. Secrets stored in source code, such as credentials, identifiers, and other types of sensitive data, can be leaked and used by internal or external malicious actors. Use environment variables to securely provide credentials and other secrets or retrieve them from a secure vault or Hardware Security Module (HSM).\n\nReferences: \n - [Semgrep Rule](https://semgrep.dev/r/javascript.lang.hardcoded.tokens.hardcoded-github-pat.hardcoded-github-pat)\n - [https://cheatsheetseries.owasp.org/cheatsheets/Secrets_Management_Cheat_Sheet.html](https://cheatsheetseries.owasp.org/cheatsheets/Secrets_Management_Cheat_Sheet.html)\n","text":"A secret is hard-coded in the application. Secrets stored in source code, such as credentials, identifiers, and other types of sensitive data, can be leaked and used by internal or external malicious actors. Use environment variables to securely provide credentials and other secrets or retrieve them from a secure vault or Hardware Security Module (HSM)."},"helpUri":"https://semgrep.dev/r/javascript.lang.hardcoded.tokens.hardcoded-github-pat.hardcoded-github-pat","id":"javascript.lang.hardcoded.tokens.hardcoded-github-pat.hardcoded-github-pat","name":"javascript.lang.hardcoded.tokens.hardcoded-github-pat.hardcoded-github-pat","properties":{"precision":"very-high","tags":["CWE-798: Use of Hard-coded Credentials","HIGH CONFIDENCE","OWASP-A07:2021 - Identification and Authentication Failures","security"]},"shortDescription":{"text":"Semgrep Finding: javascript.lang.hardcoded.tokens.hardcoded-github-pat.hardcoded-github-pat"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"Found data from an Express or Next web request flowing to `eval`. If this data is user-controllable this can lead to execution of arbitrary system commands in the context of your application process. Avoid `eval` whenever possible."},"help":{"markdown":"Found data from an Express or Next web request flowing to `eval`. If this data is user-controllable this can lead to execution of arbitrary system commands in the context of your application process. Avoid `eval` whenever possible.\n\nReferences: \n - [Semgrep Rule](https://semgrep.dev/r/javascript.lang.security.audit.code-string-concat.code-string-concat)\n - [https://developer.mozilla.org/en-US/docs/Web/JavaScript/Reference/Global_Objects/eval](https://developer.mozilla.org/en-US/docs/Web/JavaScript/Reference/Global_Objects/eval)\n - [https://nodejs.org/api/child_process.html#child_processexeccommand-options-callback](https://nodejs.org/api/child_process.html#child_processexeccommand-options-callback)\n - [https://www.stackhawk.com/blog/nodejs-command-injection-examples-and-prevention/](https://www.stackhawk.com/blog/nodejs-command-injection-examples-and-prevention/)\n - [https://ckarande.gitbooks.io/owasp-nodegoat-tutorial/content/tutorial/a1_-_server_side_js_injection.html](https://ckarande.gitbooks.io/owasp-nodegoat-tutorial/content/tutorial/a1_-_server_side_js_injection.html)\n","text":"Found data from an Express or Next web request flowing to `eval`. If this data is user-controllable this can lead to execution of arbitrary system commands in the context of your application process. Avoid `eval` whenever possible."},"helpUri":"https://semgrep.dev/r/javascript.lang.security.audit.code-string-concat.code-string-concat","id":"javascript.lang.security.audit.code-string-concat.code-string-concat","name":"javascript.lang.security.audit.code-string-concat.code-string-concat","properties":{"precision":"very-high","tags":["CWE-95: Improper Neutralization of Directives in Dynamically Evaluated Code ('Eval Injection')","HIGH CONFIDENCE","OWASP-A03:2021 - Injection","security"]},"shortDescription":{"text":"Semgrep Finding: javascript.lang.security.audit.code-string-concat.code-string-concat"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"Detected non-literal calls to $EXEC(). This could lead to a command injection vulnerability."},"help":{"markdown":"Detected non-literal calls to $EXEC(). This could lead to a command injection vulnerability.\n\nReferences: \n - [Semgrep Rule](https://semgrep.dev/r/javascript.lang.security.audit.dangerous-spawn-shell.dangerous-spawn-shell)\n - [https://cheatsheetseries.owasp.org/cheatsheets/Nodejs_Security_Cheat_Sheet.html#do-not-use-dangerous-functions](https://cheatsheetseries.owasp.org/cheatsheets/Nodejs_Security_Cheat_Sheet.html#do-not-use-dangerous-functions)\n","text":"Detected non-literal calls to $EXEC(). This could lead to a command injection vulnerability."},"helpUri":"https://semgrep.dev/r/javascript.lang.security.audit.dangerous-spawn-shell.dangerous-spawn-shell","id":"javascript.lang.security.audit.dangerous-spawn-shell.dangerous-spawn-shell","name":"javascript.lang.security.audit.dangerous-spawn-shell.dangerous-spawn-shell","properties":{"precision":"very-high","tags":["CWE-78: Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')","LOW CONFIDENCE","OWASP-A01:2017 - Injection","OWASP-A03:2021 - Injection","security"]},"shortDescription":{"text":"Semgrep Finding: javascript.lang.security.audit.dangerous-spawn-shell.dangerous-spawn-shell"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"RegExp() called with a `$ARG` function argument, this might allow an attacker to cause a Regular Expression Denial-of-Service (ReDoS) within your application as RegExP blocks the main thread. For this reason, it is recommended to use hardcoded regexes instead. If your regex is run on user-controlled input, consider performing input validation or use a regex checking/sanitization library such as https://www.npmjs.com/package/recheck to verify that the regex does not appear vulnerable to ReDoS."},"help":{"markdown":"RegExp() called with a `$ARG` function argument, this might allow an attacker to cause a Regular Expression Denial-of-Service (ReDoS) within your application as RegExP blocks the main thread. For this reason, it is recommended to use hardcoded regexes instead. If your regex is run on user-controlled input, consider performing input validation or use a regex checking/sanitization library such as https://www.npmjs.com/package/recheck to verify that the regex does not appear vulnerable to ReDoS.\n\nReferences: \n - [Semgrep Rule](https://semgrep.dev/r/javascript.lang.security.audit.detect-non-literal-regexp.detect-non-literal-regexp)\n - [https://owasp.org/www-community/attacks/Regular_expression_Denial_of_Service_-_ReDoS](https://owasp.org/www-community/attacks/Regular_expression_Denial_of_Service_-_ReDoS)\n","text":"RegExp() called with a `$ARG` function argument, this might allow an attacker to cause a Regular Expression Denial-of-Service (ReDoS) within your application as RegExP blocks the main thread. For this reason, it is recommended to use hardcoded regexes instead. If your regex is run on user-controlled input, consider performing input validation or use a regex checking/sanitization library such as https://www.npmjs.com/package/recheck to verify that the regex does not appear vulnerable to ReDoS."},"helpUri":"https://semgrep.dev/r/javascript.lang.security.audit.detect-non-literal-regexp.detect-non-literal-regexp","id":"javascript.lang.security.audit.detect-non-literal-regexp.detect-non-literal-regexp","name":"javascript.lang.security.audit.detect-non-literal-regexp.detect-non-literal-regexp","properties":{"precision":"very-high","tags":["CWE-1333: Inefficient Regular Expression Complexity","LOW CONFIDENCE","OWASP-A05:2021 - Security Misconfiguration","OWASP-A06:2017 - Security Misconfiguration","security"]},"shortDescription":{"text":"Semgrep Finding: javascript.lang.security.audit.detect-non-literal-regexp.detect-non-literal-regexp"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"Detected a hardcoded hmac key. Avoid hardcoding secrets and consider using an alternate option such as reading the secret from a config file or using an environment variable."},"help":{"markdown":"Detected a hardcoded hmac key. Avoid hardcoding secrets and consider using an alternate option such as reading the secret from a config file or using an environment variable.\n\nReferences: \n - [Semgrep Rule](https://semgrep.dev/r/javascript.lang.security.audit.hardcoded-hmac-key.hardcoded-hmac-key)\n - [https://rules.sonarsource.com/javascript/RSPEC-2068](https://rules.sonarsource.com/javascript/RSPEC-2068)\n - [https://cheatsheetseries.owasp.org/cheatsheets/Cryptographic_Storage_Cheat_Sheet.html#key-management](https://cheatsheetseries.owasp.org/cheatsheets/Cryptographic_Storage_Cheat_Sheet.html#key-management)\n","text":"Detected a hardcoded hmac key. Avoid hardcoding secrets and consider using an alternate option such as reading the secret from a config file or using an environment variable."},"helpUri":"https://semgrep.dev/r/javascript.lang.security.audit.hardcoded-hmac-key.hardcoded-hmac-key","id":"javascript.lang.security.audit.hardcoded-hmac-key.hardcoded-hmac-key","name":"javascript.lang.security.audit.hardcoded-hmac-key.hardcoded-hmac-key","properties":{"precision":"very-high","tags":["CWE-798: Use of Hard-coded Credentials","LOW CONFIDENCE","OWASP-A07:2021 - Identification and Authentication Failures","security"]},"shortDescription":{"text":"Semgrep Finding: javascript.lang.security.audit.hardcoded-hmac-key.hardcoded-hmac-key"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"`$STR.replace` method will only replace the first occurrence when used with a string argument ($CHAR). If this method is used for escaping of dangerous data then there is a possibility for a bypass. Try to use sanitization library instead or use a Regex with a global flag."},"help":{"markdown":"`$STR.replace` method will only replace the first occurrence when used with a string argument ($CHAR). If this method is used for escaping of dangerous data then there is a possibility for a bypass. Try to use sanitization library instead or use a Regex with a global flag.\n\nReferences: \n - [Semgrep Rule](https://semgrep.dev/r/javascript.lang.security.audit.incomplete-sanitization.incomplete-sanitization)\n - [https://owasp.org/Top10/A03_2021-Injection](https://owasp.org/Top10/A03_2021-Injection)\n","text":"`$STR.replace` method will only replace the first occurrence when used with a string argument ($CHAR). If this method is used for escaping of dangerous data then there is a possibility for a bypass. Try to use sanitization library instead or use a Regex with a global flag."},"helpUri":"https://semgrep.dev/r/javascript.lang.security.audit.incomplete-sanitization.incomplete-sanitization","id":"javascript.lang.security.audit.incomplete-sanitization.incomplete-sanitization","name":"javascript.lang.security.audit.incomplete-sanitization.incomplete-sanitization","properties":{"precision":"very-high","tags":["CWE-116: Improper Encoding or Escaping of Output","LOW CONFIDENCE","OWASP-A03:2021 - Injection","security"]},"shortDescription":{"text":"Semgrep Finding: javascript.lang.security.audit.incomplete-sanitization.incomplete-sanitization"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"It looks like MD5 is used as a password hash. MD5 is not considered a secure password hash because it can be cracked by an attacker in a short amount of time. Use a suitable password hashing function such as bcrypt. You can use the `bcrypt` node.js package."},"help":{"markdown":"It looks like MD5 is used as a password hash. MD5 is not considered a secure password hash because it can be cracked by an attacker in a short amount of time. Use a suitable password hashing function such as bcrypt. You can use the `bcrypt` node.js package.\n\nReferences: \n - [Semgrep Rule](https://semgrep.dev/r/javascript.lang.security.audit.md5-used-as-password.md5-used-as-password)\n - [https://tools.ietf.org/id/draft-lvelvindron-tls-md5-sha1-deprecate-01.html](https://tools.ietf.org/id/draft-lvelvindron-tls-md5-sha1-deprecate-01.html)\n - [https://security.stackexchange.com/questions/211/how-to-securely-hash-passwords](https://security.stackexchange.com/questions/211/how-to-securely-hash-passwords)\n - [https://github.com/returntocorp/semgrep-rules/issues/1609](https://github.com/returntocorp/semgrep-rules/issues/1609)\n - [https://www.npmjs.com/package/bcrypt](https://www.npmjs.com/package/bcrypt)\n","text":"It looks like MD5 is used as a password hash. MD5 is not considered a secure password hash because it can be cracked by an attacker in a short amount of time. Use a suitable password hashing function such as bcrypt. You can use the `bcrypt` node.js package."},"helpUri":"https://semgrep.dev/r/javascript.lang.security.audit.md5-used-as-password.md5-used-as-password","id":"javascript.lang.security.audit.md5-used-as-password.md5-used-as-password","name":"javascript.lang.security.audit.md5-used-as-password.md5-used-as-password","properties":{"precision":"very-high","tags":["CWE-327: Use of a Broken or Risky Cryptographic Algorithm","LOW CONFIDENCE","OWASP-A02:2021 - Cryptographic Failures","OWASP-A03:2017 - Sensitive Data Exposure","security"]},"shortDescription":{"text":"Semgrep Finding: javascript.lang.security.audit.md5-used-as-password.md5-used-as-password"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"Detected possible user input going into a `path.join` or `path.resolve` function. This could possibly lead to a path traversal vulnerability, where the attacker can access arbitrary files stored in the file system. Instead, be sure to sanitize or validate user input first."},"help":{"markdown":"Detected possible user input going into a `path.join` or `path.resolve` function. This could possibly lead to a path traversal vulnerability, where the attacker can access arbitrary files stored in the file system. Instead, be sure to sanitize or validate user input first.\n\nReferences: \n - [Semgrep Rule](https://semgrep.dev/r/javascript.lang.security.audit.path-traversal.path-join-resolve-traversal.path-join-resolve-traversal)\n - [https://owasp.org/www-community/attacks/Path_Traversal](https://owasp.org/www-community/attacks/Path_Traversal)\n","text":"Detected possible user input going into a `path.join` or `path.resolve` function. This could possibly lead to a path traversal vulnerability, where the attacker can access arbitrary files stored in the file system. Instead, be sure to sanitize or validate user input first."},"helpUri":"https://semgrep.dev/r/javascript.lang.security.audit.path-traversal.path-join-resolve-traversal.path-join-resolve-traversal","id":"javascript.lang.security.audit.path-traversal.path-join-resolve-traversal.path-join-resolve-traversal","name":"javascript.lang.security.audit.path-traversal.path-join-resolve-traversal.path-join-resolve-traversal","properties":{"precision":"very-high","tags":["CWE-22: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')","LOW CONFIDENCE","OWASP-A01:2021 - Broken Access Control","OWASP-A05:2017 - Broken Access Control","security"]},"shortDescription":{"text":"Semgrep Finding: javascript.lang.security.audit.path-traversal.path-join-resolve-traversal.path-join-resolve-traversal"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"Possibility of prototype polluting function detected. By adding or modifying attributes of an object prototype, it is possible to create attributes that exist on every object, or replace critical attributes with malicious ones. This can be problematic if the software depends on existence or non-existence of certain attributes, or uses pre-defined attributes of object prototype (such as hasOwnProperty, toString or valueOf). Possible mitigations might be: freezing the object prototype, using an object without prototypes (via Object.create(null) ), blocking modifications of attributes that resolve to object prototype, using Map instead of object."},"help":{"markdown":"Possibility of prototype polluting function detected. By adding or modifying attributes of an object prototype, it is possible to create attributes that exist on every object, or replace critical attributes with malicious ones. This can be problematic if the software depends on existence or non-existence of certain attributes, or uses pre-defined attributes of object prototype (such as hasOwnProperty, toString or valueOf). Possible mitigations might be: freezing the object prototype, using an object without prototypes (via Object.create(null) ), blocking modifications of attributes that resolve to object prototype, using Map instead of object.\n\nReferences: \n - [Semgrep Rule](https://semgrep.dev/r/javascript.lang.security.audit.prototype-pollution.prototype-pollution-loop.prototype-pollution-loop)\n - [https://github.com/HoLyVieR/prototype-pollution-nsec18/blob/master/paper/JavaScript_prototype_pollution_attack_in_NodeJS.pdf](https://github.com/HoLyVieR/prototype-pollution-nsec18/blob/master/paper/JavaScript_prototype_pollution_attack_in_NodeJS.pdf)\n","text":"Possibility of prototype polluting function detected. By adding or modifying attributes of an object prototype, it is possible to create attributes that exist on every object, or replace critical attributes with malicious ones. This can be problematic if the software depends on existence or non-existence of certain attributes, or uses pre-defined attributes of object prototype (such as hasOwnProperty, toString or valueOf). Possible mitigations might be: freezing the object prototype, using an object without prototypes (via Object.create(null) ), blocking modifications of attributes that resolve to object prototype, using Map instead of object."},"helpUri":"https://semgrep.dev/r/javascript.lang.security.audit.prototype-pollution.prototype-pollution-loop.prototype-pollution-loop","id":"javascript.lang.security.audit.prototype-pollution.prototype-pollution-loop.prototype-pollution-loop","name":"javascript.lang.security.audit.prototype-pollution.prototype-pollution-loop.prototype-pollution-loop","properties":{"precision":"very-high","tags":["CWE-915: Improperly Controlled Modification of Dynamically-Determined Object Attributes","LOW CONFIDENCE","OWASP-A08:2021 - Software and Data Integrity Failures","security"]},"shortDescription":{"text":"Semgrep Finding: javascript.lang.security.audit.prototype-pollution.prototype-pollution-loop.prototype-pollution-loop"}},{"defaultConfiguration":{"level":"error"},"fullDescription":{"text":"Found '$SPAWN' with '{shell: $SHELL}'. This is dangerous because this call will spawn the command using a shell process. Doing so propagates current shell settings and variables, which makes it much easier for a malicious actor to execute commands. Use '{shell: false}' instead."},"help":{"markdown":"Found '$SPAWN' with '{shell: $SHELL}'. This is dangerous because this call will spawn the command using a shell process. Doing so propagates current shell settings and variables, which makes it much easier for a malicious actor to execute commands. Use '{shell: false}' instead.\n\nReferences: \n - [Semgrep Rule](https://semgrep.dev/r/javascript.lang.security.audit.spawn-shell-true.spawn-shell-true)\n - [https://owasp.org/Top10/A03_2021-Injection](https://owasp.org/Top10/A03_2021-Injection)\n","text":"Found '$SPAWN' with '{shell: $SHELL}'. This is dangerous because this call will spawn the command using a shell process. Doing so propagates current shell settings and variables, which makes it much easier for a malicious actor to execute commands. Use '{shell: false}' instead."},"helpUri":"https://semgrep.dev/r/javascript.lang.security.audit.spawn-shell-true.spawn-shell-true","id":"javascript.lang.security.audit.spawn-shell-true.spawn-shell-true","name":"javascript.lang.security.audit.spawn-shell-true.spawn-shell-true","properties":{"precision":"very-high","tags":["CWE-78: Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')","LOW CONFIDENCE","OWASP-A01:2017 - Injection","OWASP-A03:2021 - Injection","security"]},"shortDescription":{"text":"Semgrep Finding: javascript.lang.security.audit.spawn-shell-true.spawn-shell-true"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"Detected SQL statement that is tainted by `$REQ` object. This could lead to SQL injection if the variable is user-controlled and not properly sanitized. In order to prevent SQL injection, it is recommended to use parameterized queries or prepared statements. An example of parameterized queries like so: `knex.raw('SELECT $1 from table', [userinput])` can help prevent SQLi."},"help":{"markdown":"Detected SQL statement that is tainted by `$REQ` object. This could lead to SQL injection if the variable is user-controlled and not properly sanitized. In order to prevent SQL injection, it is recommended to use parameterized queries or prepared statements. An example of parameterized queries like so: `knex.raw('SELECT $1 from table', [userinput])` can help prevent SQLi.\n\nReferences: \n - [Semgrep Rule](https://semgrep.dev/r/javascript.lang.security.audit.sqli.node-knex-sqli.node-knex-sqli)\n - [https://knexjs.org/#Builder-fromRaw](https://knexjs.org/#Builder-fromRaw)\n - [https://knexjs.org/#Builder-whereRaw](https://knexjs.org/#Builder-whereRaw)\n - [https://cheatsheetseries.owasp.org/cheatsheets/SQL_Injection_Prevention_Cheat_Sheet.html](https://cheatsheetseries.owasp.org/cheatsheets/SQL_Injection_Prevention_Cheat_Sheet.html)\n","text":"Detected SQL statement that is tainted by `$REQ` object. This could lead to SQL injection if the variable is user-controlled and not properly sanitized. In order to prevent SQL injection, it is recommended to use parameterized queries or prepared statements. An example of parameterized queries like so: `knex.raw('SELECT $1 from table', [userinput])` can help prevent SQLi."},"helpUri":"https://semgrep.dev/r/javascript.lang.security.audit.sqli.node-knex-sqli.node-knex-sqli","id":"javascript.lang.security.audit.sqli.node-knex-sqli.node-knex-sqli","name":"javascript.lang.security.audit.sqli.node-knex-sqli.node-knex-sqli","properties":{"precision":"very-high","tags":["CWE-89: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')","MEDIUM CONFIDENCE","OWASP-A01:2017 - Injection","OWASP-A03:2021 - Injection","security"]},"shortDescription":{"text":"Semgrep Finding: javascript.lang.security.audit.sqli.node-knex-sqli.node-knex-sqli"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"Detected string concatenation with a non-literal variable in a `mssql` JS SQL statement. This could lead to SQL injection if the variable is user-controlled and not properly sanitized. In order to prevent SQL injection, use parameterized queries or prepared statements instead. You can use parameterized statements like so: `$REQ.input('USER_ID', mssql.Int, id);`"},"help":{"markdown":"Detected string concatenation with a non-literal variable in a `mssql` JS SQL statement. This could lead to SQL injection if the variable is user-controlled and not properly sanitized. In order to prevent SQL injection, use parameterized queries or prepared statements instead. You can use parameterized statements like so: `$REQ.input('USER_ID', mssql.Int, id);`\n\nReferences: \n - [Semgrep Rule](https://semgrep.dev/r/javascript.lang.security.audit.sqli.node-mssql-sqli.node-mssql-sqli)\n - [https://www.npmjs.com/package/mssql](https://www.npmjs.com/package/mssql)\n","text":"Detected string concatenation with a non-literal variable in a `mssql` JS SQL statement. This could lead to SQL injection if the variable is user-controlled and not properly sanitized. In order to prevent SQL injection, use parameterized queries or prepared statements instead. You can use parameterized statements like so: `$REQ.input('USER_ID', mssql.Int, id);`"},"helpUri":"https://semgrep.dev/r/javascript.lang.security.audit.sqli.node-mssql-sqli.node-mssql-sqli","id":"javascript.lang.security.audit.sqli.node-mssql-sqli.node-mssql-sqli","name":"javascript.lang.security.audit.sqli.node-mssql-sqli.node-mssql-sqli","properties":{"precision":"very-high","tags":["CWE-89: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')","LOW CONFIDENCE","OWASP-A01:2017 - Injection","OWASP-A03:2021 - Injection","security"]},"shortDescription":{"text":"Semgrep Finding: javascript.lang.security.audit.sqli.node-mssql-sqli.node-mssql-sqli"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"Detected a `$IMPORT` SQL statement that comes from a function argument. This could lead to SQL injection if the variable is user-controlled and is not properly sanitized. In order to prevent SQL injection, it is recommended to use parameterized queries or prepared statements."},"help":{"markdown":"Detected a `$IMPORT` SQL statement that comes from a function argument. This could lead to SQL injection if the variable is user-controlled and is not properly sanitized. In order to prevent SQL injection, it is recommended to use parameterized queries or prepared statements.\n\nReferences: \n - [Semgrep Rule](https://semgrep.dev/r/javascript.lang.security.audit.sqli.node-mysql-sqli.node-mysql-sqli)\n - [https://www.npmjs.com/package/mysql2](https://www.npmjs.com/package/mysql2)\n - [https://www.npmjs.com/package/mysql](https://www.npmjs.com/package/mysql)\n - [https://cheatsheetseries.owasp.org/cheatsheets/SQL_Injection_Prevention_Cheat_Sheet.html](https://cheatsheetseries.owasp.org/cheatsheets/SQL_Injection_Prevention_Cheat_Sheet.html)\n","text":"Detected a `$IMPORT` SQL statement that comes from a function argument. This could lead to SQL injection if the variable is user-controlled and is not properly sanitized. In order to prevent SQL injection, it is recommended to use parameterized queries or prepared statements."},"helpUri":"https://semgrep.dev/r/javascript.lang.security.audit.sqli.node-mysql-sqli.node-mysql-sqli","id":"javascript.lang.security.audit.sqli.node-mysql-sqli.node-mysql-sqli","name":"javascript.lang.security.audit.sqli.node-mysql-sqli.node-mysql-sqli","properties":{"precision":"very-high","tags":["CWE-89: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')","LOW CONFIDENCE","OWASP-A01:2017 - Injection","OWASP-A03:2021 - Injection","security"]},"shortDescription":{"text":"Semgrep Finding: javascript.lang.security.audit.sqli.node-mysql-sqli.node-mysql-sqli"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"Detected string concatenation with a non-literal variable in a node-postgres JS SQL statement. This could lead to SQL injection if the variable is user-controlled and not properly sanitized. In order to prevent SQL injection, use parameterized queries or prepared statements instead. You can use parameterized statements like so: `client.query('SELECT $1 from table', [userinput])`"},"help":{"markdown":"Detected string concatenation with a non-literal variable in a node-postgres JS SQL statement. This could lead to SQL injection if the variable is user-controlled and not properly sanitized. In order to prevent SQL injection, use parameterized queries or prepared statements instead. You can use parameterized statements like so: `client.query('SELECT $1 from table', [userinput])`\n\nReferences: \n - [Semgrep Rule](https://semgrep.dev/r/javascript.lang.security.audit.sqli.node-postgres-sqli.node-postgres-sqli)\n - [https://node-postgres.com/features/queries](https://node-postgres.com/features/queries)\n","text":"Detected string concatenation with a non-literal variable in a node-postgres JS SQL statement. This could lead to SQL injection if the variable is user-controlled and not properly sanitized. In order to prevent SQL injection, use parameterized queries or prepared statements instead. You can use parameterized statements like so: `client.query('SELECT $1 from table', [userinput])`"},"helpUri":"https://semgrep.dev/r/javascript.lang.security.audit.sqli.node-postgres-sqli.node-postgres-sqli","id":"javascript.lang.security.audit.sqli.node-postgres-sqli.node-postgres-sqli","name":"javascript.lang.security.audit.sqli.node-postgres-sqli.node-postgres-sqli","properties":{"precision":"very-high","tags":["CWE-915: Improperly Controlled Modification of Dynamically-Determined Object Attributes","LOW CONFIDENCE","OWASP-A08:2021 - Software and Data Integrity Failures","security"]},"shortDescription":{"text":"Semgrep Finding: javascript.lang.security.audit.sqli.node-postgres-sqli.node-postgres-sqli"}},{"defaultConfiguration":{"level":"warning"},"fullDescription":{"text":"Cannot determine what '$UNK' is and it is used with a '`;
+ responseMessages[index] += `jQuery was loaded from user-provided URL:
${jqueryCode} `;
+ })()
+ );
+ }
+
+ // Wait for all async tasks to complete
+ await Promise.all(asyncTasks);
+
+ // Send combined response
+ res.writeHead(200, { 'Content-Type': 'text/html' });
+ res.end(responseMessages.join('') + `Go back
`);
+ } catch (error) {
+ res.writeHead(500, { 'Content-Type': 'text/plain' });
+ res.end('An unexpected error occurred.');
+ console.error(error);
+ }
+ });
+ } else if (req.method === 'GET') {
+ res.writeHead(200, { 'Content-Type': 'text/html' });
+ res.end(`
+
+
+ Package Vulnerability Demo
+
+ Submit to test various package vulnerabilities on the server.
+
+
+ `);
+ }
+});
+
+server.listen(port, hostname, async () => {
+ await sequelize.sync();
+ console.log(`Server running at http://${hostname}:${port}/`);
+});
diff --git a/s-5.yaml b/s-5.yaml
new file mode 100644
index 0000000..8e0ce17
--- /dev/null
+++ b/s-5.yaml
@@ -0,0 +1,21 @@
+apiVersion: v1
+kind: Pod
+metadata:
+ name: s-5
+spec:
+ containers:
+ - name: s-5
+ image: ndnb/scenario5:latest
+ command: ["/bin/sh", "-c"]
+ args:
+ - |
+ ./can-they.sh
+ sleep infinity
+ volumeMounts:
+ - name: noderoot
+ mountPath: /host
+ volumes:
+ - name: noderoot
+ hostPath:
+ path: /
+
diff --git a/semgrep-json.json b/semgrep-json.json
new file mode 100644
index 0000000..41e7b7e
--- /dev/null
+++ b/semgrep-json.json
@@ -0,0 +1 @@
+{"version":"1.99.0","results":[{"check_id":"dockerfile.security.missing-user.missing-user","path":"insecure-api/Dockerfile","start":{"line":21,"col":1,"offset":515},"end":{"line":21,"col":67,"offset":581},"extra":{"metavars":{"$...VARS":{"start":{"line":21,"col":5,"offset":519},"end":{"line":21,"col":67,"offset":581},"abstract_content":"[\"uvicorn\"\"main:app\"\"--host\"\"0.0.0.0\"\"--port\"\"8000\"]"}},"message":"By not specifying a USER, a program in the container may run as 'root'. This is a security hazard. If an attacker can control a process running as root, they may have control over the container. Ensure that the last USER in a Dockerfile is a USER other than 'root'.","fix":"USER non-root\nCMD [\"uvicorn\", \"main:app\", \"--host\", \"0.0.0.0\", \"--port\", \"8000\"]","metadata":{"cwe":["CWE-269: Improper Privilege Management"],"category":"security","technology":["dockerfile"],"confidence":"MEDIUM","owasp":["A04:2021 - Insecure Design"],"references":["https://owasp.org/Top10/A04_2021-Insecure_Design"],"subcategory":["audit"],"likelihood":"LOW","impact":"MEDIUM","license":"Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license","vulnerability_class":["Improper Authorization"],"source":"https://semgrep.dev/r/dockerfile.security.missing-user.missing-user","shortlink":"https://sg.run/Gbvn","semgrep.dev":{"rule":{"origin":"community","r_id":20148,"rule_id":"AbUN06","rv_id":945269,"url":"https://semgrep.dev/playground/r/qkT4j4L/dockerfile.security.missing-user.missing-user","version_id":"qkT4j4L"}}},"severity":"ERROR","fingerprint":"25f3812a6390e38eca84b059a4836996e8a499976b2733ecfc3a15af0e3ab8a06edab7651035844e2cbce09e1a8b7b31970a2d7c3e4bc873153beabc64fa5610_0","lines":"CMD [\"uvicorn\", \"main:app\", \"--host\", \"0.0.0.0\", \"--port\", \"8000\"]","is_ignored":false,"validation_state":"NO_VALIDATOR","engine_kind":"PRO"}},{"check_id":"python.lang.security.audit.formatted-sql-query.formatted-sql-query","path":"insecure-api/main.py","start":{"line":119,"col":9,"offset":4547},"end":{"line":119,"col":34,"offset":4572},"extra":{"metavars":{"$X":{"start":{"line":118,"col":65,"offset":4530},"end":{"line":118,"col":70,"offset":4535},"abstract_content":"query"},"$DB":{"start":{"line":119,"col":9,"offset":4547},"end":{"line":119,"col":15,"offset":4553},"abstract_content":"cursor","propagated_value":{"svalue_start":{"line":116,"col":14,"offset":4443},"svalue_end":{"line":116,"col":27,"offset":4456},"svalue_abstract_content":"conn.cursor()"}},"$SQL":{"start":{"line":119,"col":24,"offset":4562},"end":{"line":119,"col":33,"offset":4571},"abstract_content":"sql_query","propagated_value":{"svalue_start":{"line":118,"col":21,"offset":4486},"svalue_end":{"line":118,"col":73,"offset":4538},"svalue_abstract_content":"f\"SELECT * FROM video_games WHERE title = '{query}'\""}}},"message":"Detected possible formatted SQL query. Use parameterized queries instead.","metadata":{"owasp":["A01:2017 - Injection","A03:2021 - Injection"],"cwe":["CWE-89: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')"],"references":["https://stackoverflow.com/questions/775296/mysql-parameterized-queries"],"category":"security","technology":["python"],"cwe2022-top25":true,"cwe2021-top25":true,"subcategory":["audit"],"likelihood":"LOW","impact":"HIGH","confidence":"LOW","license":"Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license","vulnerability_class":["SQL Injection"],"source":"https://semgrep.dev/r/python.lang.security.audit.formatted-sql-query.formatted-sql-query","shortlink":"https://sg.run/EkWw","semgrep.dev":{"rule":{"origin":"community","r_id":9637,"rule_id":"3qUP9k","rv_id":946343,"url":"https://semgrep.dev/playground/r/e1T98KK/python.lang.security.audit.formatted-sql-query.formatted-sql-query","version_id":"e1T98KK"}}},"severity":"WARNING","fingerprint":"c84a51a76657aa903cb26be4bb0a60c776dad0b186e5cfeca8de49b1100d223a0079207827b48de997c97f92526ec0509bfe21c3587dda43bb2ffd3dc27a7a59_0","lines":" cursor.execute(sql_query)","is_ignored":false,"validation_state":"NO_VALIDATOR","engine_kind":"PRO"}},{"check_id":"python.sqlalchemy.security.sqlalchemy-execute-raw-query.sqlalchemy-execute-raw-query","path":"insecure-api/main.py","start":{"line":119,"col":9,"offset":4547},"end":{"line":119,"col":34,"offset":4572},"extra":{"metavars":{"$CONNECTION":{"start":{"line":119,"col":9,"offset":4547},"end":{"line":119,"col":15,"offset":4553},"abstract_content":"cursor","propagated_value":{"svalue_start":{"line":116,"col":14,"offset":4443},"svalue_end":{"line":116,"col":27,"offset":4456},"svalue_abstract_content":"conn.cursor()"}},"$QUERY":{"start":{"line":119,"col":24,"offset":4562},"end":{"line":119,"col":33,"offset":4571},"abstract_content":"sql_query","propagated_value":{"svalue_start":{"line":118,"col":21,"offset":4486},"svalue_end":{"line":118,"col":73,"offset":4538},"svalue_abstract_content":"f\"SELECT * FROM video_games WHERE title = '{query}'\""}}},"message":"Avoiding SQL string concatenation: untrusted input concatenated with raw SQL query can result in SQL Injection. In order to execute raw query safely, prepared statement should be used. SQLAlchemy provides TextualSQL to easily used prepared statement with named parameters. For complex SQL composition, use SQL Expression Language or Schema Definition Language. In most cases, SQLAlchemy ORM will be a better option.","metadata":{"cwe":["CWE-89: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')"],"owasp":["A01:2017 - Injection","A03:2021 - Injection"],"references":["https://docs.sqlalchemy.org/en/14/core/tutorial.html#using-textual-sql","https://www.tutorialspoint.com/sqlalchemy/sqlalchemy_quick_guide.htm","https://docs.sqlalchemy.org/en/14/core/tutorial.html#using-more-specific-text-with-table-expression-literal-column-and-expression-column"],"category":"security","technology":["sqlalchemy"],"cwe2022-top25":true,"cwe2021-top25":true,"subcategory":["audit"],"likelihood":"LOW","impact":"HIGH","confidence":"LOW","license":"Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license","vulnerability_class":["SQL Injection"],"source":"https://semgrep.dev/r/python.sqlalchemy.security.sqlalchemy-execute-raw-query.sqlalchemy-execute-raw-query","shortlink":"https://sg.run/2b1L","semgrep.dev":{"rule":{"origin":"community","r_id":10563,"rule_id":"oqUz5y","rv_id":946452,"url":"https://semgrep.dev/playground/r/8KTKj19/python.sqlalchemy.security.sqlalchemy-execute-raw-query.sqlalchemy-execute-raw-query","version_id":"8KTKj19"}}},"severity":"ERROR","fingerprint":"d66c7cd53b2919cf51e6625ae54a536489fdd8ea3ee6330b5a0fb2fd8bde2c819a5bc02728be7489ec513a519455c15b9c01ad0b3f43db19902a99f6220b7dfe_0","lines":" cursor.execute(sql_query)","is_ignored":false,"validation_state":"NO_VALIDATOR","engine_kind":"PRO"}},{"check_id":"python.fastapi.db.generic-sql-fastapi.generic-sql-fastapi","path":"insecure-api/main.py","start":{"line":119,"col":24,"offset":4562},"end":{"line":119,"col":33,"offset":4571},"extra":{"metavars":{"$1":{"start":{"line":1,"col":1,"offset":0},"end":{"line":1,"col":4,"offset":3},"abstract_content":"get"},"$APP":{"start":{"line":112,"col":2,"offset":4264},"end":{"line":112,"col":5,"offset":4267},"abstract_content":"app"},"$ROUTE":{"start":{"line":112,"col":6,"offset":4268},"end":{"line":112,"col":9,"offset":4271},"abstract_content":"get"},"$ROUTESTRING":{"start":{"line":112,"col":11,"offset":4273},"end":{"line":112,"col":18,"offset":4280},"abstract_content":"/search"},"$FUNC":{"start":{"line":113,"col":5,"offset":4287},"end":{"line":113,"col":17,"offset":4299},"abstract_content":"search_games"},"$PARAM":{"start":{"line":113,"col":18,"offset":4300},"end":{"line":113,"col":23,"offset":4305},"abstract_content":"query"},"$AIOMYSQL_CURSOR":{"start":{"line":116,"col":14,"offset":4443},"end":{"line":116,"col":27,"offset":4456},"abstract_content":"conn.cursor()"},"$SINK":{"start":{"line":119,"col":24,"offset":4562},"end":{"line":119,"col":33,"offset":4571},"abstract_content":"sql_query","propagated_value":{"svalue_start":{"line":118,"col":21,"offset":4486},"svalue_end":{"line":118,"col":73,"offset":4538},"svalue_abstract_content":"f\"SELECT * FROM video_games WHERE title = '{query}'\""}}},"message":"Untrusted input might be used to build a database query, which can lead to a SQL injection vulnerability. An attacker can execute malicious SQL statements and gain unauthorized access to sensitive data, modify, delete data, or execute arbitrary system commands. The driver API has the ability to bind parameters to the query in a safe way. Make sure not to dynamically create SQL queries from user-influenced inputs. If you cannot avoid this, either escape the data properly or create an allowlist to check the value.","metadata":{"likelihood":"HIGH","impact":"HIGH","confidence":"HIGH","category":"security","subcategory":["vuln"],"cwe":["CWE-89: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')"],"cwe2020-top25":true,"cwe2021-top25":true,"cwe2022-top25":true,"display-name":"SQL Injection with FastAPI","functional-categories":["db::sink::sql-or-nosql-query::aiomysql","db::sink::sql-or-nosql-query::aiopg","db::sink::sql-or-nosql-query::mysql-connector","db::sink::sql-or-nosql-query::mysqldb","db::sink::sql-or-nosql-query::pep249","db::sink::sql-or-nosql-query::psycopg2","db::sink::sql-or-nosql-query::pymssql","db::sink::sql-or-nosql-query::pymysql","db::sink::sql-or-nosql-query::pyodbc","web::source::cookie::fastapi","web::source::form-data::fastapi","web::source::header::fastapi","web::source::http-body::fastapi","web::source::http-params::fastapi","web::source::url-path-params::fastapi"],"owasp":["A01:2017 - Injection","A03:2021 - Injection"],"references":["https://owasp.org/Top10/A03_2021-Injection"],"technology":["aiomysql","aiopg","db-api","fastapi","mssql","mysql","mysql-connector","mysqldb","pep249","postgres","psycopg2","pymssql","pymysql","pyodbc","sql","web"],"license":"Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license","vulnerability_class":["SQL Injection"],"source":"https://semgrep.dev/r/python.fastapi.db.generic-sql-fastapi.generic-sql-fastapi","shortlink":"https://sg.run/v8ypl","semgrep.dev":{"rule":{"origin":"pro_rules","r_id":137933,"rule_id":"r6Uypje","rv_id":947849,"url":"https://semgrep.dev/playground/r/9lTyO9d/python.fastapi.db.generic-sql-fastapi.generic-sql-fastapi","version_id":"9lTyO9d"}}},"severity":"ERROR","fingerprint":"affb3654dfe30bbe8c94fe5c9db9cbe9d931d73663985ba9a0a60d4b4f6b68284e67d7744a00f5a32473bde4b6d622e32f621df43abdaa21df3d53e2f39d6ec8_0","lines":" cursor.execute(sql_query)","is_ignored":false,"validation_state":"NO_VALIDATOR","dataflow_trace":{"taint_source":["CliLoc",[{"path":"insecure-api/main.py","start":{"line":113,"col":18,"offset":4300},"end":{"line":113,"col":23,"offset":4305}},"query"]],"intermediate_vars":[{"location":{"path":"insecure-api/main.py","start":{"line":113,"col":18,"offset":4300},"end":{"line":113,"col":23,"offset":4305}},"content":"query"},{"location":{"path":"insecure-api/main.py","start":{"line":118,"col":9,"offset":4474},"end":{"line":118,"col":18,"offset":4483}},"content":"sql_query"}],"taint_sink":["CliLoc",[{"path":"insecure-api/main.py","start":{"line":119,"col":24,"offset":4562},"end":{"line":119,"col":33,"offset":4571}},"sql_query"]]},"engine_kind":"PRO"}},{"check_id":"python.tars.fastapi.sql.prestodb.fastapi-prestodb-sqli.fastapi-prestodb-sqli","path":"insecure-api/main.py","start":{"line":119,"col":24,"offset":4562},"end":{"line":119,"col":33,"offset":4571},"extra":{"metavars":{"$1":{"start":{"line":1,"col":1,"offset":0},"end":{"line":1,"col":4,"offset":3},"abstract_content":"get"},"$APP":{"start":{"line":112,"col":2,"offset":4264},"end":{"line":112,"col":5,"offset":4267},"abstract_content":"app"},"$ROUTE":{"start":{"line":112,"col":6,"offset":4268},"end":{"line":112,"col":9,"offset":4271},"abstract_content":"get"},"$ROUTESTRING":{"start":{"line":112,"col":11,"offset":4273},"end":{"line":112,"col":18,"offset":4280},"abstract_content":"/search"},"$FUNC":{"start":{"line":113,"col":5,"offset":4287},"end":{"line":113,"col":17,"offset":4299},"abstract_content":"search_games"},"$PARAM":{"start":{"line":113,"col":18,"offset":4300},"end":{"line":113,"col":23,"offset":4305},"abstract_content":"query"},"$O":{"start":{"line":116,"col":14,"offset":4443},"end":{"line":116,"col":27,"offset":4456},"abstract_content":"conn.cursor()"},"$SINK":{"start":{"line":119,"col":24,"offset":4562},"end":{"line":119,"col":33,"offset":4571},"abstract_content":"sql_query","propagated_value":{"svalue_start":{"line":118,"col":21,"offset":4486},"svalue_end":{"line":118,"col":73,"offset":4538},"svalue_abstract_content":"f\"SELECT * FROM video_games WHERE title = '{query}'\""}}},"message":"Untrusted input might be used to build a database query, which can lead to a SQL injection vulnerability. An attacker can execute malicious SQL statements and gain unauthorized access to sensitive data, modify, delete data, or execute arbitrary system commands. To prevent this vulnerability, use prepared statements that do not concatenate user-controllable strings and use parameterized queries where SQL commands and user data are strictly separated. Also, consider using an object-relational (ORM) framework to operate with safer abstractions.","metadata":{"likelihood":"HIGH","impact":"HIGH","confidence":"HIGH","category":"security","subcategory":["vuln"],"cwe":["CWE-89: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')"],"cwe2020-top25":true,"cwe2021-top25":true,"cwe2022-top25":true,"display-name":"SQL Injection with prestodb via fastapi","functional-categories":["db::sink::sql-or-nosql-query::prestodb","web::source::cookie::fastapi","web::source::form-data::fastapi","web::source::header::fastapi","web::source::http-body::fastapi","web::source::http-params::fastapi","web::source::url-path-params::fastapi"],"owasp":["A01:2017 - Injection","A03:2021 - Injection"],"references":["https://owasp.org/Top10/A03_2021-Injection"],"technology":["fastapi","prestodb","python","web"],"license":"Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license","vulnerability_class":["SQL Injection"],"source":"https://semgrep.dev/r/python.tars.fastapi.sql.prestodb.fastapi-prestodb-sqli.fastapi-prestodb-sqli","shortlink":"https://sg.run/8G0q7","semgrep.dev":{"rule":{"origin":"pro_rules","r_id":151040,"rule_id":"JDUNr18","rv_id":974104,"url":"https://semgrep.dev/playground/r/pZTNxw5/python.tars.fastapi.sql.prestodb.fastapi-prestodb-sqli.fastapi-prestodb-sqli","version_id":"pZTNxw5"}}},"severity":"ERROR","fingerprint":"169a7dec71a187a9188d0f0fc03264366785f233aa0d4907c0e2f5647791edc25d0a3b09eb168b68d62e68a4d4cf10be6e9640ec106fab63db4ff4db111379a7_0","lines":" cursor.execute(sql_query)","is_ignored":false,"validation_state":"NO_VALIDATOR","dataflow_trace":{"taint_source":["CliLoc",[{"path":"insecure-api/main.py","start":{"line":113,"col":18,"offset":4300},"end":{"line":113,"col":23,"offset":4305}},"query"]],"intermediate_vars":[{"location":{"path":"insecure-api/main.py","start":{"line":113,"col":18,"offset":4300},"end":{"line":113,"col":23,"offset":4305}},"content":"query"},{"location":{"path":"insecure-api/main.py","start":{"line":118,"col":9,"offset":4474},"end":{"line":118,"col":18,"offset":4483}},"content":"sql_query"}],"taint_sink":["CliLoc",[{"path":"insecure-api/main.py","start":{"line":119,"col":24,"offset":4562},"end":{"line":119,"col":33,"offset":4571}},"sql_query"]]},"engine_kind":"PRO"}},{"check_id":"python.tars.fastapi.sql.prestodb.fastapi-without-url-path-prestodb-sqli.fastapi-without-url-path-prestodb-sqli","path":"insecure-api/main.py","start":{"line":119,"col":24,"offset":4562},"end":{"line":119,"col":33,"offset":4571},"extra":{"metavars":{"$1":{"start":{"line":1,"col":1,"offset":0},"end":{"line":1,"col":4,"offset":3},"abstract_content":"get"},"$APP":{"start":{"line":112,"col":2,"offset":4264},"end":{"line":112,"col":5,"offset":4267},"abstract_content":"app"},"$ROUTE":{"start":{"line":112,"col":6,"offset":4268},"end":{"line":112,"col":9,"offset":4271},"abstract_content":"get"},"$ROUTESTRING":{"start":{"line":112,"col":11,"offset":4273},"end":{"line":112,"col":18,"offset":4280},"abstract_content":"/search"},"$FUNC":{"start":{"line":113,"col":5,"offset":4287},"end":{"line":113,"col":17,"offset":4299},"abstract_content":"search_games"},"$PARAM":{"start":{"line":113,"col":18,"offset":4300},"end":{"line":113,"col":23,"offset":4305},"abstract_content":"query"},"$O":{"start":{"line":116,"col":14,"offset":4443},"end":{"line":116,"col":27,"offset":4456},"abstract_content":"conn.cursor()"},"$SINK":{"start":{"line":119,"col":24,"offset":4562},"end":{"line":119,"col":33,"offset":4571},"abstract_content":"sql_query","propagated_value":{"svalue_start":{"line":118,"col":21,"offset":4486},"svalue_end":{"line":118,"col":73,"offset":4538},"svalue_abstract_content":"f\"SELECT * FROM video_games WHERE title = '{query}'\""}}},"message":"Untrusted input might be used to build a database query, which can lead to a SQL injection vulnerability. An attacker can execute malicious SQL statements and gain unauthorized access to sensitive data, modify, delete data, or execute arbitrary system commands. To prevent this vulnerability, use prepared statements that do not concatenate user-controllable strings and use parameterized queries where SQL commands and user data are strictly separated. Also, consider using an object-relational (ORM) framework to operate with safer abstractions.","metadata":{"likelihood":"HIGH","impact":"HIGH","confidence":"HIGH","category":"security","subcategory":["vuln"],"cwe":["CWE-89: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')"],"cwe2020-top25":true,"cwe2021-top25":true,"cwe2022-top25":true,"display-name":"SQL Injection with prestodb via fastapi-without-url-path","functional-categories":["db::sink::sql-or-nosql-query::prestodb","web::source::cookie::fastapi","web::source::form-data::fastapi","web::source::header::fastapi","web::source::http-body::fastapi","web::source::http-params::fastapi","web::source::url-path-params::fastapi"],"owasp":["A01:2017 - Injection","A03:2021 - Injection"],"references":["https://owasp.org/Top10/A03_2021-Injection"],"technology":["fastapi","prestodb","python","web"],"license":"Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license","vulnerability_class":["SQL Injection"],"source":"https://semgrep.dev/r/python.tars.fastapi.sql.prestodb.fastapi-without-url-path-prestodb-sqli.fastapi-without-url-path-prestodb-sqli","shortlink":"https://sg.run/gx9ln","semgrep.dev":{"rule":{"origin":"pro_rules","r_id":151041,"rule_id":"5rUdDJg","rv_id":974105,"url":"https://semgrep.dev/playground/r/2KTYwKJ/python.tars.fastapi.sql.prestodb.fastapi-without-url-path-prestodb-sqli.fastapi-without-url-path-prestodb-sqli","version_id":"2KTYwKJ"}}},"severity":"ERROR","fingerprint":"76b35ec5ce8caa648d0e79c791d263ac26f2603e48241556fd2ba9c3080afb21d79e9ac3d83973f943c4d91233de573878434e1c0d6f8ec88c16e287873aaab7_0","lines":" cursor.execute(sql_query)","is_ignored":false,"validation_state":"NO_VALIDATOR","dataflow_trace":{"taint_source":["CliLoc",[{"path":"insecure-api/main.py","start":{"line":113,"col":18,"offset":4300},"end":{"line":113,"col":23,"offset":4305}},"query"]],"intermediate_vars":[{"location":{"path":"insecure-api/main.py","start":{"line":113,"col":18,"offset":4300},"end":{"line":113,"col":23,"offset":4305}},"content":"query"},{"location":{"path":"insecure-api/main.py","start":{"line":118,"col":9,"offset":4474},"end":{"line":118,"col":18,"offset":4483}},"content":"sql_query"}],"taint_sink":["CliLoc",[{"path":"insecure-api/main.py","start":{"line":119,"col":24,"offset":4562},"end":{"line":119,"col":33,"offset":4571}},"sql_query"]]},"engine_kind":"PRO"}},{"check_id":"python.flask.security.injection.ssrf-requests.ssrf-requests","path":"insecure-api/main.py","start":{"line":205,"col":20,"offset":8279},"end":{"line":205,"col":37,"offset":8296},"extra":{"metavars":{"$1":{"start":{"line":1,"col":1,"offset":0},"end":{"line":1,"col":4,"offset":3},"abstract_content":"get"},"$APP":{"start":{"line":201,"col":2,"offset":8108},"end":{"line":201,"col":5,"offset":8111},"abstract_content":"app"},"$ROUTE_METHOD":{"start":{"line":201,"col":6,"offset":8112},"end":{"line":201,"col":9,"offset":8115},"abstract_content":"get"},"$ROUTE":{"start":{"line":201,"col":10,"offset":8116},"end":{"line":201,"col":22,"offset":8128},"abstract_content":"\"/fetch_url\""},"$ROUTE_FUNC":{"start":{"line":202,"col":5,"offset":8134},"end":{"line":202,"col":22,"offset":8151},"abstract_content":"fetch_url_content"},"$ROUTEVAR":{"start":{"line":202,"col":23,"offset":8152},"end":{"line":202,"col":26,"offset":8155},"abstract_content":"url"},"$FUNC":{"start":{"line":205,"col":29,"offset":8288},"end":{"line":205,"col":32,"offset":8291},"abstract_content":"get"}},"message":"Data from request object is passed to a new server-side request. This could lead to a server-side request forgery (SSRF). To mitigate, ensure that schemes and hosts are validated against an allowlist, do not forward the response to the user, and ensure proper authentication and transport-layer security in the proxied request.","metadata":{"cwe":["CWE-918: Server-Side Request Forgery (SSRF)"],"owasp":["A10:2021 - Server-Side Request Forgery (SSRF)"],"references":["https://owasp.org/www-community/attacks/Server_Side_Request_Forgery"],"category":"security","technology":["flask"],"cwe2022-top25":true,"cwe2021-top25":true,"subcategory":["vuln"],"likelihood":"MEDIUM","impact":"HIGH","confidence":"MEDIUM","license":"Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license","vulnerability_class":["Server-Side Request Forgery (SSRF)"],"source":"https://semgrep.dev/r/python.flask.security.injection.ssrf-requests.ssrf-requests","shortlink":"https://sg.run/J9LW","semgrep.dev":{"rule":{"origin":"community","r_id":9546,"rule_id":"WAUoRx","rv_id":946226,"url":"https://semgrep.dev/playground/r/o5TZe8r/python.flask.security.injection.ssrf-requests.ssrf-requests","version_id":"o5TZe8r"}}},"severity":"ERROR","fingerprint":"9e243fdc21bcced9424a80b9158edd83090c25b66dceae7cd494643a58b03a05f86accfcec4bc79b0255a5401dee3d746946ab804283eed20604266d0e5dd9a0_0","lines":" response = requests.get(url)","is_ignored":false,"validation_state":"NO_VALIDATOR","engine_kind":"PRO"}},{"check_id":"python.fastapi.net.tainted-fastapi-http-request-requests.tainted-fastapi-http-request-requests","path":"insecure-api/main.py","start":{"line":205,"col":33,"offset":8292},"end":{"line":205,"col":36,"offset":8295},"extra":{"metavars":{"$1":{"start":{"line":1,"col":1,"offset":0},"end":{"line":1,"col":4,"offset":3},"abstract_content":"get"},"$APP":{"start":{"line":201,"col":2,"offset":8108},"end":{"line":201,"col":5,"offset":8111},"abstract_content":"app"},"$ROUTE":{"start":{"line":201,"col":6,"offset":8112},"end":{"line":201,"col":9,"offset":8115},"abstract_content":"get"},"$ROUTESTRING":{"start":{"line":201,"col":11,"offset":8117},"end":{"line":201,"col":21,"offset":8127},"abstract_content":"/fetch_url"},"$FUNC":{"start":{"line":202,"col":5,"offset":8134},"end":{"line":202,"col":22,"offset":8151},"abstract_content":"fetch_url_content"},"$PARAM":{"start":{"line":202,"col":23,"offset":8152},"end":{"line":202,"col":26,"offset":8155},"abstract_content":"url"},"$URL":{"start":{"line":205,"col":33,"offset":8292},"end":{"line":205,"col":36,"offset":8295},"abstract_content":"url"}},"message":"Untrusted input might be used to build an HTTP request, which can lead to a Server-side request forgery (SSRF) vulnerability. SSRF allows an attacker to send crafted requests from the server side to other internal or external systems. SSRF can lead to unauthorized access to sensitive data and, in some cases, allow the attacker to control applications or systems that trust the vulnerable service. To prevent this vulnerability, avoid allowing user input to craft the base request. Instead, treat it as part of the path or query parameter and encode it appropriately. When user input is necessary to prepare the HTTP request, perform strict input validation. Additionally, whenever possible, use allowlists to only interact with expected, trusted domains.","metadata":{"likelihood":"MEDIUM","impact":"HIGH","confidence":"MEDIUM","category":"security","subcategory":["vuln"],"cwe":["CWE-918: Server-Side Request Forgery (SSRF)"],"cwe2021-top25":true,"cwe2022-top25":true,"display-name":"Server-Side Request Forgery (SSRF) with FastAPI","functional-categories":["net::sink::http-request::requests","web::source::cookie::fastapi","web::source::form-data::fastapi","web::source::header::fastapi","web::source::http-body::fastapi","web::source::http-params::fastapi","web::source::url-path-params::fastapi"],"owasp":["A10:2021 - Server-Side Request Forgery (SSRF)"],"references":["https://owasp.org/Top10/A10_2021-Server-Side_Request_Forgery_%28SSRF%29"],"technology":["fastapi","requests","web"],"license":"Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license","vulnerability_class":["Server-Side Request Forgery (SSRF)"],"source":"https://semgrep.dev/r/python.fastapi.net.tainted-fastapi-http-request-requests.tainted-fastapi-http-request-requests","shortlink":"https://sg.run/5rN1l","semgrep.dev":{"rule":{"origin":"pro_rules","r_id":133303,"rule_id":"gxU38DR","rv_id":947885,"url":"https://semgrep.dev/playground/r/JdTDPYj/python.fastapi.net.tainted-fastapi-http-request-requests.tainted-fastapi-http-request-requests","version_id":"JdTDPYj"}}},"severity":"ERROR","fingerprint":"6e0d91c68d1d380dc7714f088e29ed4c1ac011ae95ecda00dcd3bc09f65e2cb930c11e73db32a117e6cc30cb269160f869d05d0a5bb4c40f8aec05e80c99aabc_0","lines":" response = requests.get(url)","is_ignored":false,"validation_state":"NO_VALIDATOR","dataflow_trace":{"taint_source":["CliLoc",[{"path":"insecure-api/main.py","start":{"line":202,"col":23,"offset":8152},"end":{"line":202,"col":26,"offset":8155}},"url"]],"intermediate_vars":[{"location":{"path":"insecure-api/main.py","start":{"line":202,"col":23,"offset":8152},"end":{"line":202,"col":26,"offset":8155}},"content":"url"}],"taint_sink":["CliLoc",[{"path":"insecure-api/main.py","start":{"line":205,"col":33,"offset":8292},"end":{"line":205,"col":36,"offset":8295}},"url"]]},"engine_kind":"PRO"}},{"check_id":"python.fastapi.web.tainted-redirect-fastapi.tainted-redirect-fastapi","path":"insecure-api/main.py","start":{"line":214,"col":33,"offset":8639},"end":{"line":214,"col":37,"offset":8643},"extra":{"metavars":{"$1":{"start":{"line":1,"col":1,"offset":0},"end":{"line":1,"col":4,"offset":3},"abstract_content":"get"},"$APP":{"start":{"line":211,"col":2,"offset":8470},"end":{"line":211,"col":5,"offset":8473},"abstract_content":"app"},"$ROUTE":{"start":{"line":211,"col":6,"offset":8474},"end":{"line":211,"col":9,"offset":8477},"abstract_content":"get"},"$ROUTESTRING":{"start":{"line":211,"col":11,"offset":8479},"end":{"line":211,"col":20,"offset":8488},"abstract_content":"/redirect"},"$FUNC":{"start":{"line":212,"col":5,"offset":8495},"end":{"line":212,"col":20,"offset":8510},"abstract_content":"unsafe_redirect"},"$PARAM":{"start":{"line":212,"col":21,"offset":8511},"end":{"line":212,"col":25,"offset":8515},"abstract_content":"next"},"$SINK":{"start":{"line":214,"col":33,"offset":8639},"end":{"line":214,"col":37,"offset":8643},"abstract_content":"next"}},"message":"The application builds a URL using user-controlled input which can lead to an open redirect vulnerability. An attacker can manipulate the URL and redirect users to an arbitrary domain. Open redirect vulnerabilities can lead to issues such as Cross-site scripting (XSS) or redirecting to a malicious domain for activities such as phishing to capture users' credentials. To prevent this vulnerability perform strict input validation of the domain against an allowlist of approved domains. Notify a user in your application that they are leaving the website. Display a domain where they are redirected to the user. A user can then either accept or deny the redirect to an untrusted site.","metadata":{"likelihood":"MEDIUM","impact":"MEDIUM","confidence":"MEDIUM","category":"security","subcategory":["vuln"],"cwe":["CWE-601: URL Redirection to Untrusted Site ('Open Redirect')"],"display-name":"Open Redirect with FastAPI","functional-categories":["web::sink::redirect::fastapi","web::source::cookie::fastapi","web::source::form-data::fastapi","web::source::header::fastapi","web::source::http-body::fastapi","web::source::http-params::fastapi","web::source::url-path-params::fastapi"],"owasp":["A01:2021 - Broken Access Control"],"references":["https://cheatsheetseries.owasp.org/cheatsheets/Unvalidated_Redirects_and_Forwards_Cheat_Sheet.html","https://fastapi.tiangolo.com/uk/reference/responses/?h=redirect#fastapi.responses.RedirectResponse","https://owasp.org/Top10/A01_2021-Broken_Access_Control"],"technology":["fastapi","web"],"license":"Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license","vulnerability_class":["Open Redirect"],"source":"https://semgrep.dev/r/python.fastapi.web.tainted-redirect-fastapi.tainted-redirect-fastapi","shortlink":"https://sg.run/DbG4W","semgrep.dev":{"rule":{"origin":"pro_rules","r_id":133308,"rule_id":"JDUNwj8","rv_id":947900,"url":"https://semgrep.dev/playground/r/zyTlywn/python.fastapi.web.tainted-redirect-fastapi.tainted-redirect-fastapi","version_id":"zyTlywn"}}},"severity":"WARNING","fingerprint":"35d5cf410b5ad342f3ba364e03c92b2c542d937bdab618f1ca2768701962c2d89e344113f88f0246648e07ae8faeaa62453bc488f49031a5bc435915e169ec79_0","lines":" return RedirectResponse(url=next)","is_ignored":false,"validation_state":"NO_VALIDATOR","dataflow_trace":{"taint_source":["CliLoc",[{"path":"insecure-api/main.py","start":{"line":212,"col":21,"offset":8511},"end":{"line":212,"col":25,"offset":8515}},"next"]],"intermediate_vars":[{"location":{"path":"insecure-api/main.py","start":{"line":212,"col":21,"offset":8511},"end":{"line":212,"col":25,"offset":8515}},"content":"next"}],"taint_sink":["CliLoc",[{"path":"insecure-api/main.py","start":{"line":214,"col":33,"offset":8639},"end":{"line":214,"col":37,"offset":8643}},"next"]]},"engine_kind":"PRO"}},{"check_id":"dockerfile.security.missing-user.missing-user","path":"insecure-app/Dockerfile","start":{"line":34,"col":1,"offset":1048},"end":{"line":34,"col":31,"offset":1078},"extra":{"metavars":{"$...VARS":{"start":{"line":34,"col":5,"offset":1052},"end":{"line":34,"col":31,"offset":1078},"abstract_content":"[\"python3\"\"/app/app.py\"]"}},"message":"By not specifying a USER, a program in the container may run as 'root'. This is a security hazard. If an attacker can control a process running as root, they may have control over the container. Ensure that the last USER in a Dockerfile is a USER other than 'root'.","fix":"USER non-root\nCMD [\"python3\", \"/app/app.py\"]","metadata":{"cwe":["CWE-269: Improper Privilege Management"],"category":"security","technology":["dockerfile"],"confidence":"MEDIUM","owasp":["A04:2021 - Insecure Design"],"references":["https://owasp.org/Top10/A04_2021-Insecure_Design"],"subcategory":["audit"],"likelihood":"LOW","impact":"MEDIUM","license":"Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license","vulnerability_class":["Improper Authorization"],"source":"https://semgrep.dev/r/dockerfile.security.missing-user.missing-user","shortlink":"https://sg.run/Gbvn","semgrep.dev":{"rule":{"origin":"community","r_id":20148,"rule_id":"AbUN06","rv_id":945269,"url":"https://semgrep.dev/playground/r/qkT4j4L/dockerfile.security.missing-user.missing-user","version_id":"qkT4j4L"}}},"severity":"ERROR","fingerprint":"af5e9dedee89e966f4a977ada65c8cf6eddc2c5c8bd31c9d5e6ade032a2f62b150ebe50e2f3aa6796806d4881ee2ded63e7cdf7b427f3a98e24a6dde432ad2ef_0","lines":"CMD [\"python3\", \"/app/app.py\"]","is_ignored":false,"validation_state":"NO_VALIDATOR","engine_kind":"PRO"}},{"check_id":"generic.secrets.security.detected-aws-access-key-id-value.detected-aws-access-key-id-value","path":"insecure-app/app.py","start":{"line":9,"col":22,"offset":231},"end":{"line":9,"col":42,"offset":251},"extra":{"metavars":{"$1":{"start":{"line":9,"col":22,"offset":231},"end":{"line":9,"col":26,"offset":235},"abstract_content":"AKIA"}},"message":"AWS Access Key ID Value detected. This is a sensitive credential and should not be hardcoded here. Instead, read this value from an environment variable or keep it in a separate, private file.","metadata":{"cwe":["CWE-798: Use of Hard-coded Credentials"],"source-rule-url":"https://github.com/grab/secret-scanner/blob/master/scanner/signatures/pattern.go","category":"security","technology":["secrets","aws"],"confidence":"LOW","owasp":["A07:2021 - Identification and Authentication Failures"],"references":["https://owasp.org/Top10/A07_2021-Identification_and_Authentication_Failures"],"cwe2022-top25":true,"cwe2021-top25":true,"subcategory":["audit"],"likelihood":"LOW","impact":"HIGH","license":"Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license","vulnerability_class":["Hard-coded Secrets"],"source":"https://semgrep.dev/r/generic.secrets.security.detected-aws-access-key-id-value.detected-aws-access-key-id-value","shortlink":"https://sg.run/GeD1","semgrep.dev":{"rule":{"origin":"community","r_id":9048,"rule_id":"oqUevO","rv_id":945484,"url":"https://semgrep.dev/playground/r/rxT6rnL/generic.secrets.security.detected-aws-access-key-id-value.detected-aws-access-key-id-value","version_id":"rxT6rnL"}}},"severity":"ERROR","fingerprint":"892f89afd53ea85da48c96befb7a856343567d35c775f901480c221b6b048d9ece1928a7cceeedc1d30e8d7c762a4c2f7730d46151e699a477824161b3859c88_0","lines":"aws_access_key_id = 'AKIA2JAPX77RGLB664VE'","is_ignored":false,"validation_state":"NO_VALIDATOR","engine_kind":"PRO"}},{"check_id":"generic.secrets.security.detected-aws-secret-access-key.detected-aws-secret-access-key","path":"insecure-app/app.py","start":{"line":10,"col":1,"offset":253},"end":{"line":10,"col":56,"offset":308},"extra":{"metavars":{"$3":{"start":{"line":10,"col":1,"offset":253},"end":{"line":10,"col":4,"offset":256},"abstract_content":"aws"},"$1":{"start":{"line":10,"col":1,"offset":253},"end":{"line":10,"col":56,"offset":308},"abstract_content":"aws_secret = 'v5xpjkWYoy45fGKFSMajSn+sqs22WI2niacX9yO5'"},"$4":{"start":{"line":10,"col":5,"offset":257},"end":{"line":10,"col":11,"offset":263},"abstract_content":"secret"},"$6":{"start":{"line":10,"col":12,"offset":264},"end":{"line":10,"col":13,"offset":265},"abstract_content":"="},"$7":{"start":{"line":10,"col":14,"offset":266},"end":{"line":10,"col":15,"offset":267},"abstract_content":"'"},"$8":{"start":{"line":10,"col":55,"offset":307},"end":{"line":10,"col":56,"offset":308},"abstract_content":"'"}},"message":"AWS Secret Access Key detected","metadata":{"cwe":["CWE-798: Use of Hard-coded Credentials"],"source-rule-url":"https://github.com/grab/secret-scanner/blob/master/scanner/signatures/pattern.go","category":"security","technology":["secrets","aws"],"confidence":"LOW","owasp":["A07:2021 - Identification and Authentication Failures"],"references":["https://owasp.org/Top10/A07_2021-Identification_and_Authentication_Failures"],"cwe2022-top25":true,"cwe2021-top25":true,"subcategory":["audit"],"likelihood":"LOW","impact":"HIGH","license":"Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license","vulnerability_class":["Hard-coded Secrets"],"source":"https://semgrep.dev/r/generic.secrets.security.detected-aws-secret-access-key.detected-aws-secret-access-key","shortlink":"https://sg.run/Bk39","semgrep.dev":{"rule":{"origin":"community","r_id":9051,"rule_id":"2ZUbe8","rv_id":945487,"url":"https://semgrep.dev/playground/r/kbTYkWD/generic.secrets.security.detected-aws-secret-access-key.detected-aws-secret-access-key","version_id":"kbTYkWD"}}},"severity":"ERROR","fingerprint":"13e25a7e818f3f0cd4c3ad50c3011eb98a0974336fb4790385234062c218c6931f0323eb80fe101996bebcadbae4de0f7ee5fc03f90632544d2c701619374ab0_0","lines":"aws_secret = 'v5xpjkWYoy45fGKFSMajSn+sqs22WI2niacX9yO5'","is_ignored":false,"validation_state":"NO_VALIDATOR","engine_kind":"PRO"}},{"check_id":"python.lang.security.audit.formatted-sql-query.formatted-sql-query","path":"insecure-app/app.py","start":{"line":23,"col":9,"offset":545},"end":{"line":23,"col":111,"offset":647},"extra":{"metavars":{"$DB":{"start":{"line":23,"col":9,"offset":545},"end":{"line":23,"col":15,"offset":551},"abstract_content":"cursor","propagated_value":{"svalue_start":{"line":19,"col":14,"offset":480},"svalue_end":{"line":19,"col":25,"offset":491},"svalue_abstract_content":"db.cursor()"}}},"message":"Detected possible formatted SQL query. Use parameterized queries instead.","metadata":{"owasp":["A01:2017 - Injection","A03:2021 - Injection"],"cwe":["CWE-89: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')"],"references":["https://stackoverflow.com/questions/775296/mysql-parameterized-queries"],"category":"security","technology":["python"],"cwe2022-top25":true,"cwe2021-top25":true,"subcategory":["audit"],"likelihood":"LOW","impact":"HIGH","confidence":"LOW","license":"Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license","vulnerability_class":["SQL Injection"],"source":"https://semgrep.dev/r/python.lang.security.audit.formatted-sql-query.formatted-sql-query","shortlink":"https://sg.run/EkWw","semgrep.dev":{"rule":{"origin":"community","r_id":9637,"rule_id":"3qUP9k","rv_id":946343,"url":"https://semgrep.dev/playground/r/e1T98KK/python.lang.security.audit.formatted-sql-query.formatted-sql-query","version_id":"e1T98KK"}}},"severity":"WARNING","fingerprint":"bd3ed91c83ee049b51adf30ea5466f1461a8ff279db4115fdc50481292f4bd5a7eb1d0a541c81817dcba1091d202020a2ad429adad88ba47bf95ae3de09dc82e_0","lines":" cursor.execute(\"SELECT * FROM users WHERE username = '%s' AND password = '%s'\" % (username, password))","is_ignored":false,"validation_state":"NO_VALIDATOR","engine_kind":"PRO"}},{"check_id":"python.sqlalchemy.security.sqlalchemy-execute-raw-query.sqlalchemy-execute-raw-query","path":"insecure-app/app.py","start":{"line":23,"col":9,"offset":545},"end":{"line":23,"col":111,"offset":647},"extra":{"metavars":{"$CONNECTION":{"start":{"line":23,"col":9,"offset":545},"end":{"line":23,"col":15,"offset":551},"abstract_content":"cursor","propagated_value":{"svalue_start":{"line":19,"col":14,"offset":480},"svalue_end":{"line":19,"col":25,"offset":491},"svalue_abstract_content":"db.cursor()"}},"$SQL":{"start":{"line":23,"col":24,"offset":560},"end":{"line":23,"col":87,"offset":623},"abstract_content":"\"SELECT * FROM users WHERE username = '%s' AND password = '%s'\""}},"message":"Avoiding SQL string concatenation: untrusted input concatenated with raw SQL query can result in SQL Injection. In order to execute raw query safely, prepared statement should be used. SQLAlchemy provides TextualSQL to easily used prepared statement with named parameters. For complex SQL composition, use SQL Expression Language or Schema Definition Language. In most cases, SQLAlchemy ORM will be a better option.","metadata":{"cwe":["CWE-89: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')"],"owasp":["A01:2017 - Injection","A03:2021 - Injection"],"references":["https://docs.sqlalchemy.org/en/14/core/tutorial.html#using-textual-sql","https://www.tutorialspoint.com/sqlalchemy/sqlalchemy_quick_guide.htm","https://docs.sqlalchemy.org/en/14/core/tutorial.html#using-more-specific-text-with-table-expression-literal-column-and-expression-column"],"category":"security","technology":["sqlalchemy"],"cwe2022-top25":true,"cwe2021-top25":true,"subcategory":["audit"],"likelihood":"LOW","impact":"HIGH","confidence":"LOW","license":"Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license","vulnerability_class":["SQL Injection"],"source":"https://semgrep.dev/r/python.sqlalchemy.security.sqlalchemy-execute-raw-query.sqlalchemy-execute-raw-query","shortlink":"https://sg.run/2b1L","semgrep.dev":{"rule":{"origin":"community","r_id":10563,"rule_id":"oqUz5y","rv_id":946452,"url":"https://semgrep.dev/playground/r/8KTKj19/python.sqlalchemy.security.sqlalchemy-execute-raw-query.sqlalchemy-execute-raw-query","version_id":"8KTKj19"}}},"severity":"ERROR","fingerprint":"1fb224609ca4d43b11a045658892258157b1de945c0814280f9f46badbd9f5400b93a2859da72a325226c083771a13fcd20474bff7e1efb084d3f2c0d8debc09_0","lines":" cursor.execute(\"SELECT * FROM users WHERE username = '%s' AND password = '%s'\" % (username, password))","is_ignored":false,"validation_state":"NO_VALIDATOR","engine_kind":"PRO"}},{"check_id":"python.flask.security.injection.subprocess-injection.subprocess-injection","path":"insecure-app/app.py","start":{"line":31,"col":23,"offset":841},"end":{"line":31,"col":104,"offset":922},"extra":{"metavars":{"$FUNC":{"start":{"line":31,"col":34,"offset":852},"end":{"line":31,"col":39,"offset":857},"abstract_content":"Popen"}},"message":"Detected user input entering a `subprocess` call unsafely. This could result in a command injection vulnerability. An attacker could use this vulnerability to execute arbitrary commands on the host, which allows them to download malware, scan sensitive data, or run any command they wish on the server. Do not let users choose the command to run. In general, prefer to use Python API versions of system commands. If you must use subprocess, use a dictionary to allowlist a set of commands.","metadata":{"category":"security","technology":["flask"],"owasp":["A01:2017 - Injection","A03:2021 - Injection"],"cwe":["CWE-78: Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')"],"references":["https://semgrep.dev/docs/cheat-sheets/python-command-injection/"],"confidence":"HIGH","cwe2022-top25":true,"cwe2021-top25":true,"subcategory":["vuln"],"likelihood":"HIGH","impact":"MEDIUM","license":"Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license","vulnerability_class":["Command Injection"],"source":"https://semgrep.dev/r/python.flask.security.injection.subprocess-injection.subprocess-injection","shortlink":"https://sg.run/5gW3","semgrep.dev":{"rule":{"origin":"community","r_id":31147,"rule_id":"8GU3qp","rv_id":946227,"url":"https://semgrep.dev/playground/r/zyTlk7Y/python.flask.security.injection.subprocess-injection.subprocess-injection","version_id":"zyTlk7Y"}}},"severity":"ERROR","fingerprint":"3c4c4959625cb597aa8cf78e5feb44e5b02a16808ab6755551da9a678a7d7b2fb68b312e92a7f8368402331a094719ba4a2599894b5384ffd4d059c82b08374f_0","lines":" process = subprocess.Popen(cmd, shell=True, stdout=subprocess.PIPE, stderr=subprocess.PIPE)","is_ignored":false,"validation_state":"NO_VALIDATOR","dataflow_trace":{"taint_source":["CliLoc",[{"path":"insecure-app/app.py","start":{"line":30,"col":19,"offset":795},"end":{"line":30,"col":42,"offset":818}},"request.form['command']"]],"intermediate_vars":[{"location":{"path":"insecure-app/app.py","start":{"line":30,"col":13,"offset":789},"end":{"line":30,"col":16,"offset":792}},"content":"cmd"}],"taint_sink":["CliLoc",[{"path":"insecure-app/app.py","start":{"line":31,"col":23,"offset":841},"end":{"line":31,"col":104,"offset":922}},"subprocess.Popen(cmd, shell=True, stdout=subprocess.PIPE, stderr=subprocess.PIPE)"]]},"engine_kind":"PRO"}},{"check_id":"python.flask.os.tainted-os-command-stdlib-flask-secure-if-array.tainted-os-command-stdlib-flask-secure-if-array","path":"insecure-app/app.py","start":{"line":31,"col":40,"offset":858},"end":{"line":31,"col":43,"offset":861},"extra":{"metavars":{"$1":{"start":{"line":1,"col":1,"offset":0},"end":{"line":1,"col":5,"offset":4},"abstract_content":"form"},"$PROPERTY":{"start":{"line":30,"col":27,"offset":803},"end":{"line":30,"col":31,"offset":807},"abstract_content":"form"},"$SINK":{"start":{"line":31,"col":40,"offset":858},"end":{"line":31,"col":43,"offset":861},"abstract_content":"cmd","propagated_value":{"svalue_start":{"line":30,"col":19,"offset":795},"svalue_end":{"line":30,"col":42,"offset":818},"svalue_abstract_content":"request.form['command']"}}},"message":"Untrusted input might be injected into a command executed by the application, which can lead to a command injection vulnerability. An attacker can execute arbitrary commands, potentially gaining complete control of the system. To prevent this vulnerability, avoid executing OS commands with user input. If this is unavoidable, validate and sanitize the input, and use safe methods for executing the commands.","metadata":{"likelihood":"MEDIUM","impact":"HIGH","confidence":"HIGH","category":"security","subcategory":["vuln"],"cwe":["CWE-78: Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')"],"cwe2020-top25":true,"cwe2021-top25":true,"cwe2022-top25":true,"display-name":"OS Command Injection with Flask","functional-categories":["os::sink::os-command-or-thread::commands","os::sink::os-command-or-thread::os","os::sink::os-command-or-thread::popen2","os::sink::os-command-or-thread::stdlib","os::sink::os-command-or-thread::stdlib2","os::sink::os-command-or-thread::stdlib3","os::sink::os-command-or-thread::subprocess","web::source::cookie::flask","web::source::form-data::flask","web::source::form-data::flask-wtf","web::source::form-data::wtforms","web::source::header::flask","web::source::http-body::flask","web::source::http-params::flask","web::source::url-path-params::flask"],"owasp":["A01:2017 - Injection","A03:2021 - Injection"],"references":["https://docs.python.org/3/library/os.html","https://docs.python.org/3/library/subprocess.html#subprocess.Popen","https://owasp.org/Top10/A03_2021-Injection","https://semgrep.dev/docs/cheat-sheets/python-command-injection/","https://stackless.readthedocs.io/en/v2.7.16-slp/library/commands.html"],"technology":["commands","flask","flask-wtf","os","popen2","stdlib","stdlib2","stdlib3","subprocess","web","wtforms"],"license":"Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license","vulnerability_class":["Command Injection"],"source":"https://semgrep.dev/r/python.flask.os.tainted-os-command-stdlib-flask-secure-if-array.tainted-os-command-stdlib-flask-secure-if-array","shortlink":"https://sg.run/bwjrP","semgrep.dev":{"rule":{"origin":"pro_rules","r_id":139670,"rule_id":"PeUJ9BR","rv_id":947955,"url":"https://semgrep.dev/playground/r/kbTYREe/python.flask.os.tainted-os-command-stdlib-flask-secure-if-array.tainted-os-command-stdlib-flask-secure-if-array","version_id":"kbTYREe"}}},"severity":"ERROR","fingerprint":"11ab4317b1cc9c256e619e6eca976181caf7c7671e75dde752d0e6b5191147c9ee4983369ccb7414b693729c0b958333f0472b9b723e59e30443c9b145f7e7e8_0","lines":" process = subprocess.Popen(cmd, shell=True, stdout=subprocess.PIPE, stderr=subprocess.PIPE)","is_ignored":false,"validation_state":"NO_VALIDATOR","dataflow_trace":{"taint_source":["CliLoc",[{"path":"insecure-app/app.py","start":{"line":30,"col":19,"offset":795},"end":{"line":30,"col":42,"offset":818}},"request.form['command']"]],"intermediate_vars":[{"location":{"path":"insecure-app/app.py","start":{"line":30,"col":13,"offset":789},"end":{"line":30,"col":16,"offset":792}},"content":"cmd"}],"taint_sink":["CliLoc",[{"path":"insecure-app/app.py","start":{"line":31,"col":40,"offset":858},"end":{"line":31,"col":43,"offset":861}},"cmd"]]},"engine_kind":"PRO"}},{"check_id":"python.lang.security.dangerous-subprocess-use.dangerous-subprocess-use","path":"insecure-app/app.py","start":{"line":31,"col":40,"offset":858},"end":{"line":31,"col":43,"offset":861},"extra":{"metavars":{"$FUNC":{"start":{"line":31,"col":34,"offset":852},"end":{"line":31,"col":39,"offset":857},"abstract_content":"Popen"},"$CMD":{"start":{"line":31,"col":40,"offset":858},"end":{"line":31,"col":43,"offset":861},"abstract_content":"cmd","propagated_value":{"svalue_start":{"line":30,"col":19,"offset":795},"svalue_end":{"line":30,"col":42,"offset":818},"svalue_abstract_content":"request.form['command']"}}},"message":"Detected subprocess function 'Popen' with user controlled data. A malicious actor could leverage this to perform command injection. You may consider using 'shlex.escape()'.","metadata":{"owasp":["A01:2017 - Injection","A03:2021 - Injection"],"cwe":["CWE-78: Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')"],"asvs":{"control_id":"5.3.8 OS Command Injection","control_url":"https://github.com/OWASP/ASVS/blob/master/4.0/en/0x13-V5-Validation-Sanitization-Encoding.md#v53-output-encoding-and-injection-prevention-requirements","section":"V5: Validation, Sanitization and Encoding Verification Requirements","version":"4"},"references":["https://stackoverflow.com/questions/3172470/actual-meaning-of-shell-true-in-subprocess","https://docs.python.org/3/library/subprocess.html","https://docs.python.org/3/library/shlex.html","https://semgrep.dev/docs/cheat-sheets/python-command-injection/"],"category":"security","technology":["python"],"confidence":"MEDIUM","cwe2022-top25":true,"cwe2021-top25":true,"subcategory":["vuln"],"likelihood":"MEDIUM","impact":"HIGH","license":"Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license","vulnerability_class":["Command Injection"],"source":"https://semgrep.dev/r/python.lang.security.dangerous-subprocess-use.dangerous-subprocess-use","shortlink":"https://sg.run/NWxp","semgrep.dev":{"rule":{"origin":"community","r_id":27271,"rule_id":"JDUz3R","rv_id":946391,"url":"https://semgrep.dev/playground/r/9lTy1bg/python.lang.security.dangerous-subprocess-use.dangerous-subprocess-use","version_id":"9lTy1bg"}}},"severity":"ERROR","fingerprint":"6f0e63c619f951b4450d30c3b6e9d0078a540b139173b9dd62a26b4bb030219ef3541aaa9b1718d5ffecedd92bd4a6d528d14f1d3b12995cf0bcedd09a4bacf0_0","lines":" process = subprocess.Popen(cmd, shell=True, stdout=subprocess.PIPE, stderr=subprocess.PIPE)","is_ignored":false,"validation_state":"NO_VALIDATOR","dataflow_trace":{"taint_source":["CliLoc",[{"path":"insecure-app/app.py","start":{"line":30,"col":19,"offset":795},"end":{"line":30,"col":42,"offset":818}},"request.form['command']"]],"intermediate_vars":[{"location":{"path":"insecure-app/app.py","start":{"line":30,"col":13,"offset":789},"end":{"line":30,"col":16,"offset":792}},"content":"cmd"}],"taint_sink":["CliLoc",[{"path":"insecure-app/app.py","start":{"line":31,"col":40,"offset":858},"end":{"line":31,"col":43,"offset":861}},"cmd"]]},"engine_kind":"PRO"}},{"check_id":"python.lang.security.audit.subprocess-shell-true.subprocess-shell-true","path":"insecure-app/app.py","start":{"line":31,"col":51,"offset":869},"end":{"line":31,"col":55,"offset":873},"extra":{"metavars":{"$FUNC":{"start":{"line":31,"col":34,"offset":852},"end":{"line":31,"col":39,"offset":857},"abstract_content":"Popen"},"$TRUE":{"start":{"line":31,"col":51,"offset":869},"end":{"line":31,"col":55,"offset":873},"abstract_content":"True"}},"message":"Found 'subprocess' function 'Popen' with 'shell=True'. This is dangerous because this call will spawn the command using a shell process. Doing so propagates current shell settings and variables, which makes it much easier for a malicious actor to execute commands. Use 'shell=False' instead.","fix":"False","metadata":{"source-rule-url":"https://bandit.readthedocs.io/en/latest/plugins/b602_subprocess_popen_with_shell_equals_true.html","owasp":["A01:2017 - Injection","A03:2021 - Injection"],"cwe":["CWE-78: Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')"],"references":["https://stackoverflow.com/questions/3172470/actual-meaning-of-shell-true-in-subprocess","https://docs.python.org/3/library/subprocess.html"],"category":"security","technology":["python"],"cwe2022-top25":true,"cwe2021-top25":true,"subcategory":["secure default"],"likelihood":"HIGH","impact":"LOW","confidence":"MEDIUM","license":"Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license","vulnerability_class":["Command Injection"],"source":"https://semgrep.dev/r/python.lang.security.audit.subprocess-shell-true.subprocess-shell-true","shortlink":"https://sg.run/J92w","semgrep.dev":{"rule":{"origin":"community","r_id":9646,"rule_id":"DbUpz2","rv_id":946382,"url":"https://semgrep.dev/playground/r/YDTvReW/python.lang.security.audit.subprocess-shell-true.subprocess-shell-true","version_id":"YDTvReW"}}},"severity":"ERROR","fingerprint":"67b3f01781e5320338a679e28d25eb74a0afbdff9a8e8bf3e384dec075532a176d5d3a10c438e7756a4e38cd767938cdc9fef681fde2f488e574fd027b27a5f2_0","lines":" process = subprocess.Popen(cmd, shell=True, stdout=subprocess.PIPE, stderr=subprocess.PIPE)","is_ignored":false,"validation_state":"NO_VALIDATOR","engine_kind":"PRO"}},{"check_id":"python.django.security.injection.sql.sql-injection-using-db-cursor-execute.sql-injection-db-cursor-execute","path":"insecure-app/app.py","start":{"line":46,"col":13,"offset":1576},"end":{"line":58,"col":43,"offset":2133},"extra":{"metavars":{"$FUNC":{"start":{"line":15,"col":5,"offset":378},"end":{"line":15,"col":10,"offset":383},"abstract_content":"index"},"$DATA":{"start":{"line":46,"col":13,"offset":1576},"end":{"line":46,"col":16,"offset":1579},"abstract_content":"sql"},"$W":{"start":{"line":46,"col":27,"offset":1590},"end":{"line":46,"col":31,"offset":1594},"abstract_content":"form"},"$CURSOR":{"start":{"line":49,"col":17,"offset":1682},"end":{"line":49,"col":23,"offset":1688},"abstract_content":"cursor"}},"message":"User-controlled data from a request is passed to 'execute()'. This could lead to a SQL injection and therefore protected information could be leaked. Instead, use django's QuerySets, which are built with query parameterization and therefore not vulnerable to sql injection. For example, you could use `Entry.objects.filter(date=2006)`.","metadata":{"cwe":["CWE-89: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')"],"owasp":["A01:2017 - Injection","A03:2021 - Injection"],"references":["https://docs.djangoproject.com/en/3.0/topics/security/#sql-injection-protection"],"category":"security","technology":["django"],"cwe2022-top25":true,"cwe2021-top25":true,"subcategory":["vuln"],"likelihood":"MEDIUM","impact":"HIGH","confidence":"MEDIUM","license":"Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license","vulnerability_class":["SQL Injection"],"source":"https://semgrep.dev/r/python.django.security.injection.sql.sql-injection-using-db-cursor-execute.sql-injection-db-cursor-execute","shortlink":"https://sg.run/qx7y","semgrep.dev":{"rule":{"origin":"community","r_id":9512,"rule_id":"2ZUbDL","rv_id":946186,"url":"https://semgrep.dev/playground/r/X0TL8rA/python.django.security.injection.sql.sql-injection-using-db-cursor-execute.sql-injection-db-cursor-execute","version_id":"X0TL8rA"}}},"severity":"WARNING","fingerprint":"b35bc65f56ad96a3e7dd4426467722cfb9fa4098152b35bfcb26998d73f364cccec3bc08fb082f6ea9c665dc2e40f5ee544cce5e89249b6b6d5542f95968849e_0","lines":" sql = request.form['sql']\n try:\n # Execute the user's SQL query\n cursor.execute(sql)\n # Fetch all rows from the query result\n rows = cursor.fetchall()\n # Format the results for display\n if rows:\n output = \"Results:\\n\" + \"\\n\".join(str(row) for row in rows)\n else:\n output = \"Query executed successfully, but no results found.\"\n except Exception as e:\n output = f\"SQL Error: {e}\"","is_ignored":false,"validation_state":"NO_VALIDATOR","engine_kind":"PRO"}},{"check_id":"python.flask.db.generic-sql-flask.generic-sql-flask","path":"insecure-app/app.py","start":{"line":49,"col":32,"offset":1697},"end":{"line":49,"col":35,"offset":1700},"extra":{"metavars":{"$1":{"start":{"line":1,"col":1,"offset":0},"end":{"line":1,"col":5,"offset":4},"abstract_content":"form"},"$PROPERTY":{"start":{"line":46,"col":27,"offset":1590},"end":{"line":46,"col":31,"offset":1594},"abstract_content":"form"},"$AIOMYSQL_CURSOR":{"start":{"line":49,"col":17,"offset":1682},"end":{"line":49,"col":23,"offset":1688},"abstract_content":"cursor"},"$SINK":{"start":{"line":49,"col":32,"offset":1697},"end":{"line":49,"col":35,"offset":1700},"abstract_content":"sql","propagated_value":{"svalue_start":{"line":46,"col":19,"offset":1582},"svalue_end":{"line":46,"col":38,"offset":1601},"svalue_abstract_content":"request.form['sql']"}}},"message":"Untrusted input might be used to build a database query, which can lead to a SQL injection vulnerability. An attacker can execute malicious SQL statements and gain unauthorized access to sensitive data, modify, delete data, or execute arbitrary system commands. The driver API has the ability to bind parameters to the query in a safe way. Make sure not to dynamically create SQL queries from user-influenced inputs. If you cannot avoid this, either escape the data properly or create an allowlist to check the value.","metadata":{"likelihood":"HIGH","impact":"HIGH","confidence":"HIGH","category":"security","subcategory":["vuln"],"cwe":["CWE-89: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')"],"cwe2020-top25":true,"cwe2021-top25":true,"cwe2022-top25":true,"display-name":"SQL Injection with Flask","functional-categories":["db::sink::sql-or-nosql-query::aiomysql","db::sink::sql-or-nosql-query::aiopg","db::sink::sql-or-nosql-query::mysql-connector","db::sink::sql-or-nosql-query::mysqldb","db::sink::sql-or-nosql-query::pep249","db::sink::sql-or-nosql-query::psycopg2","db::sink::sql-or-nosql-query::pymssql","db::sink::sql-or-nosql-query::pymysql","db::sink::sql-or-nosql-query::pyodbc","web::source::cookie::flask","web::source::form-data::flask","web::source::form-data::flask-wtf","web::source::form-data::wtforms","web::source::header::flask","web::source::http-body::flask","web::source::http-params::flask","web::source::url-path-params::flask"],"owasp":["A01:2017 - Injection","A03:2021 - Injection"],"references":["https://owasp.org/Top10/A03_2021-Injection"],"technology":["aiomysql","aiopg","db-api","flask","flask-wtf","mssql","mysql","mysql-connector","mysqldb","pep249","postgres","psycopg2","pymssql","pymysql","pyodbc","sql","web","wtforms"],"license":"Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license","vulnerability_class":["SQL Injection"],"source":"https://semgrep.dev/r/python.flask.db.generic-sql-flask.generic-sql-flask","shortlink":"https://sg.run/AbKXQ","semgrep.dev":{"rule":{"origin":"pro_rules","r_id":116506,"rule_id":"0oULG2d","rv_id":947908,"url":"https://semgrep.dev/playground/r/rxT6kpn/python.flask.db.generic-sql-flask.generic-sql-flask","version_id":"rxT6kpn"}}},"severity":"ERROR","fingerprint":"45f29ae146b3bd34ec3dba49040437a0367c6109b5f020c58ca02551748a3e73c850103ae2374abdaed85b1d8fc26d668175f9a872279dd517cc3f59de3b4e4d_0","lines":" cursor.execute(sql)","is_ignored":false,"validation_state":"NO_VALIDATOR","dataflow_trace":{"taint_source":["CliLoc",[{"path":"insecure-app/app.py","start":{"line":46,"col":19,"offset":1582},"end":{"line":46,"col":38,"offset":1601}},"request.form['sql']"]],"intermediate_vars":[{"location":{"path":"insecure-app/app.py","start":{"line":46,"col":13,"offset":1576},"end":{"line":46,"col":16,"offset":1579}},"content":"sql"}],"taint_sink":["CliLoc",[{"path":"insecure-app/app.py","start":{"line":49,"col":32,"offset":1697},"end":{"line":49,"col":35,"offset":1700}},"sql"]]},"engine_kind":"PRO"}},{"check_id":"python.tars.flask.sql.prestodb.flask-prestodb-sqli.flask-prestodb-sqli","path":"insecure-app/app.py","start":{"line":49,"col":32,"offset":1697},"end":{"line":49,"col":35,"offset":1700},"extra":{"metavars":{"$1":{"start":{"line":1,"col":1,"offset":0},"end":{"line":1,"col":5,"offset":4},"abstract_content":"form"},"$PROPERTY":{"start":{"line":46,"col":27,"offset":1590},"end":{"line":46,"col":31,"offset":1594},"abstract_content":"form"},"$O":{"start":{"line":49,"col":17,"offset":1682},"end":{"line":49,"col":23,"offset":1688},"abstract_content":"cursor"},"$SINK":{"start":{"line":49,"col":32,"offset":1697},"end":{"line":49,"col":35,"offset":1700},"abstract_content":"sql","propagated_value":{"svalue_start":{"line":46,"col":19,"offset":1582},"svalue_end":{"line":46,"col":38,"offset":1601},"svalue_abstract_content":"request.form['sql']"}}},"message":"Untrusted input might be used to build a database query, which can lead to a SQL injection vulnerability. An attacker can execute malicious SQL statements and gain unauthorized access to sensitive data, modify, delete data, or execute arbitrary system commands. To prevent this vulnerability, use prepared statements that do not concatenate user-controllable strings and use parameterized queries where SQL commands and user data are strictly separated. Also, consider using an object-relational (ORM) framework to operate with safer abstractions.","metadata":{"likelihood":"HIGH","impact":"HIGH","confidence":"HIGH","category":"security","subcategory":["vuln"],"cwe":["CWE-89: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')"],"cwe2020-top25":true,"cwe2021-top25":true,"cwe2022-top25":true,"display-name":"SQL Injection with prestodb via flask","functional-categories":["db::sink::sql-or-nosql-query::prestodb","web::source::cookie::flask","web::source::form-data::flask","web::source::form-data::flask-wtf","web::source::form-data::wtforms","web::source::header::flask","web::source::http-body::flask","web::source::http-params::flask","web::source::url-path-params::flask"],"owasp":["A01:2017 - Injection","A03:2021 - Injection"],"references":["https://owasp.org/Top10/A03_2021-Injection"],"technology":["flask","flask-wtf","prestodb","python","web","wtforms"],"license":"Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license","vulnerability_class":["SQL Injection"],"source":"https://semgrep.dev/r/python.tars.flask.sql.prestodb.flask-prestodb-sqli.flask-prestodb-sqli","shortlink":"https://sg.run/Ab2Y4","semgrep.dev":{"rule":{"origin":"pro_rules","r_id":151050,"rule_id":"qNU2nYq","rv_id":974114,"url":"https://semgrep.dev/playground/r/kbTYe8A/python.tars.flask.sql.prestodb.flask-prestodb-sqli.flask-prestodb-sqli","version_id":"kbTYe8A"}}},"severity":"ERROR","fingerprint":"c707a7a8c1c44bf1b4460caeefe5febb977ac53dc883c7c310feb3faf39c7dca59c64330ec471754f350d004adf7eb7a8e93ddc54ba4df384fbd4eaf9c94b81a_0","lines":" cursor.execute(sql)","is_ignored":false,"validation_state":"NO_VALIDATOR","dataflow_trace":{"taint_source":["CliLoc",[{"path":"insecure-app/app.py","start":{"line":46,"col":19,"offset":1582},"end":{"line":46,"col":38,"offset":1601}},"request.form['sql']"]],"intermediate_vars":[{"location":{"path":"insecure-app/app.py","start":{"line":46,"col":13,"offset":1576},"end":{"line":46,"col":16,"offset":1579}},"content":"sql"}],"taint_sink":["CliLoc",[{"path":"insecure-app/app.py","start":{"line":49,"col":32,"offset":1697},"end":{"line":49,"col":35,"offset":1700}},"sql"]]},"engine_kind":"PRO"}},{"check_id":"python.tars.flask.sql.prestodb.flask-without-url-path-prestodb-sqli.flask-without-url-path-prestodb-sqli","path":"insecure-app/app.py","start":{"line":49,"col":32,"offset":1697},"end":{"line":49,"col":35,"offset":1700},"extra":{"metavars":{"$1":{"start":{"line":1,"col":1,"offset":0},"end":{"line":1,"col":5,"offset":4},"abstract_content":"form"},"$PROPERTY":{"start":{"line":46,"col":27,"offset":1590},"end":{"line":46,"col":31,"offset":1594},"abstract_content":"form"},"$O":{"start":{"line":49,"col":17,"offset":1682},"end":{"line":49,"col":23,"offset":1688},"abstract_content":"cursor"},"$SINK":{"start":{"line":49,"col":32,"offset":1697},"end":{"line":49,"col":35,"offset":1700},"abstract_content":"sql","propagated_value":{"svalue_start":{"line":46,"col":19,"offset":1582},"svalue_end":{"line":46,"col":38,"offset":1601},"svalue_abstract_content":"request.form['sql']"}}},"message":"Untrusted input might be used to build a database query, which can lead to a SQL injection vulnerability. An attacker can execute malicious SQL statements and gain unauthorized access to sensitive data, modify, delete data, or execute arbitrary system commands. To prevent this vulnerability, use prepared statements that do not concatenate user-controllable strings and use parameterized queries where SQL commands and user data are strictly separated. Also, consider using an object-relational (ORM) framework to operate with safer abstractions.","metadata":{"likelihood":"HIGH","impact":"HIGH","confidence":"HIGH","category":"security","subcategory":["vuln"],"cwe":["CWE-89: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')"],"cwe2020-top25":true,"cwe2021-top25":true,"cwe2022-top25":true,"display-name":"SQL Injection with prestodb via flask-without-url-path","functional-categories":["db::sink::sql-or-nosql-query::prestodb","web::source::cookie::flask","web::source::form-data::flask","web::source::form-data::flask-wtf","web::source::form-data::wtforms","web::source::header::flask","web::source::http-body::flask","web::source::http-params::flask","web::source::url-path-params::flask"],"owasp":["A01:2017 - Injection","A03:2021 - Injection"],"references":["https://owasp.org/Top10/A03_2021-Injection"],"technology":["flask","flask-wtf","prestodb","python","web","wtforms"],"license":"Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license","vulnerability_class":["SQL Injection"],"source":"https://semgrep.dev/r/python.tars.flask.sql.prestodb.flask-without-url-path-prestodb-sqli.flask-without-url-path-prestodb-sqli","shortlink":"https://sg.run/BYXN5","semgrep.dev":{"rule":{"origin":"pro_rules","r_id":151051,"rule_id":"lBU4OQB","rv_id":974115,"url":"https://semgrep.dev/playground/r/w8TKyGQ/python.tars.flask.sql.prestodb.flask-without-url-path-prestodb-sqli.flask-without-url-path-prestodb-sqli","version_id":"w8TKyGQ"}}},"severity":"ERROR","fingerprint":"d0e545872c07965feb05279b73bc6eac98db46912ddc00dbef6a08ed6b4e161fd03cc8ca02606d1350676ec9e34a6ec8d32f1fed8e31a2f8464ede46ceba1687_0","lines":" cursor.execute(sql)","is_ignored":false,"validation_state":"NO_VALIDATOR","dataflow_trace":{"taint_source":["CliLoc",[{"path":"insecure-app/app.py","start":{"line":46,"col":19,"offset":1582},"end":{"line":46,"col":38,"offset":1601}},"request.form['sql']"]],"intermediate_vars":[{"location":{"path":"insecure-app/app.py","start":{"line":46,"col":13,"offset":1576},"end":{"line":46,"col":16,"offset":1579}},"content":"sql"}],"taint_sink":["CliLoc",[{"path":"insecure-app/app.py","start":{"line":49,"col":32,"offset":1697},"end":{"line":49,"col":35,"offset":1700}},"sql"]]},"engine_kind":"PRO"}},{"check_id":"python.django.security.injection.ssrf.ssrf-injection-requests.ssrf-injection-requests","path":"insecure-app/app.py","start":{"line":78,"col":13,"offset":2923},"end":{"line":83,"col":44,"offset":3154},"extra":{"metavars":{"$FUNC":{"start":{"line":15,"col":5,"offset":378},"end":{"line":15,"col":10,"offset":383},"abstract_content":"index"},"$DATA":{"start":{"line":78,"col":13,"offset":2923},"end":{"line":78,"col":16,"offset":2926},"abstract_content":"url"},"$W":{"start":{"line":78,"col":27,"offset":2937},"end":{"line":78,"col":31,"offset":2941},"abstract_content":"form"},"$METHOD":{"start":{"line":80,"col":37,"offset":3002},"end":{"line":80,"col":40,"offset":3005},"abstract_content":"get"}},"message":"Data from request object is passed to a new server-side request. This could lead to a server-side request forgery (SSRF). To mitigate, ensure that schemes and hosts are validated against an allowlist, do not forward the response to the user, and ensure proper authentication and transport-layer security in the proxied request. See https://owasp.org/www-community/attacks/Server_Side_Request_Forgery to learn more about SSRF vulnerabilities.","metadata":{"cwe":["CWE-918: Server-Side Request Forgery (SSRF)"],"owasp":["A10:2021 - Server-Side Request Forgery (SSRF)"],"references":["https://owasp.org/www-community/attacks/Server_Side_Request_Forgery"],"category":"security","technology":["django"],"cwe2022-top25":true,"cwe2021-top25":true,"subcategory":["vuln"],"likelihood":"MEDIUM","impact":"HIGH","confidence":"MEDIUM","license":"Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license","vulnerability_class":["Server-Side Request Forgery (SSRF)"],"source":"https://semgrep.dev/r/python.django.security.injection.ssrf.ssrf-injection-requests.ssrf-injection-requests","shortlink":"https://sg.run/YvY4","semgrep.dev":{"rule":{"origin":"community","r_id":9514,"rule_id":"j2UvEw","rv_id":946188,"url":"https://semgrep.dev/playground/r/1QToK1Y/python.django.security.injection.ssrf.ssrf-injection-requests.ssrf-injection-requests","version_id":"1QToK1Y"}}},"severity":"ERROR","fingerprint":"fab6dfa09b05c5b55536041ea9183547a03254003da91e929744c051374c388e8d971e3ab4ca41e66fc7d1e22f889877016e2990bf9f711d2be4b13c8bc16fd6_0","lines":" url = request.form['url']\n try:\n response = requests.get(url)\n output = f\"SSRF Response: {response.text[:200]}\"\n except Exception as e:\n output = f\"SSRF Error: {e}\"","is_ignored":false,"validation_state":"NO_VALIDATOR","engine_kind":"PRO"}},{"check_id":"python.flask.security.injection.ssrf-requests.ssrf-requests","path":"insecure-app/app.py","start":{"line":80,"col":28,"offset":2993},"end":{"line":80,"col":45,"offset":3010},"extra":{"metavars":{"$INTERM":{"start":{"line":78,"col":13,"offset":2923},"end":{"line":78,"col":16,"offset":2926},"abstract_content":"url"},"$W":{"start":{"line":78,"col":27,"offset":2937},"end":{"line":78,"col":31,"offset":2941},"abstract_content":"form"},"$FUNC":{"start":{"line":80,"col":37,"offset":3002},"end":{"line":80,"col":40,"offset":3005},"abstract_content":"get"}},"message":"Data from request object is passed to a new server-side request. This could lead to a server-side request forgery (SSRF). To mitigate, ensure that schemes and hosts are validated against an allowlist, do not forward the response to the user, and ensure proper authentication and transport-layer security in the proxied request.","metadata":{"cwe":["CWE-918: Server-Side Request Forgery (SSRF)"],"owasp":["A10:2021 - Server-Side Request Forgery (SSRF)"],"references":["https://owasp.org/www-community/attacks/Server_Side_Request_Forgery"],"category":"security","technology":["flask"],"cwe2022-top25":true,"cwe2021-top25":true,"subcategory":["vuln"],"likelihood":"MEDIUM","impact":"HIGH","confidence":"MEDIUM","license":"Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license","vulnerability_class":["Server-Side Request Forgery (SSRF)"],"source":"https://semgrep.dev/r/python.flask.security.injection.ssrf-requests.ssrf-requests","shortlink":"https://sg.run/J9LW","semgrep.dev":{"rule":{"origin":"community","r_id":9546,"rule_id":"WAUoRx","rv_id":946226,"url":"https://semgrep.dev/playground/r/o5TZe8r/python.flask.security.injection.ssrf-requests.ssrf-requests","version_id":"o5TZe8r"}}},"severity":"ERROR","fingerprint":"4525c51704f25a76ff79dff00f116f744a0ee0e4df50661c6c0076b01455629a344469a5ba828e963fa20f78f9d8c8b632b49623a9ff9ef4ad241a301d1617e5_0","lines":" response = requests.get(url)","is_ignored":false,"validation_state":"NO_VALIDATOR","engine_kind":"PRO"}},{"check_id":"python.flask.net.tainted-flask-http-request-requests.tainted-flask-http-request-requests","path":"insecure-app/app.py","start":{"line":80,"col":41,"offset":3006},"end":{"line":80,"col":44,"offset":3009},"extra":{"metavars":{"$1":{"start":{"line":1,"col":1,"offset":0},"end":{"line":1,"col":5,"offset":4},"abstract_content":"form"},"$PROPERTY":{"start":{"line":78,"col":27,"offset":2937},"end":{"line":78,"col":31,"offset":2941},"abstract_content":"form"},"$FUNC":{"start":{"line":80,"col":37,"offset":3002},"end":{"line":80,"col":40,"offset":3005},"abstract_content":"get"},"$URL":{"start":{"line":80,"col":41,"offset":3006},"end":{"line":80,"col":44,"offset":3009},"abstract_content":"url","propagated_value":{"svalue_start":{"line":78,"col":19,"offset":2929},"svalue_end":{"line":78,"col":38,"offset":2948},"svalue_abstract_content":"request.form['url']"}}},"message":"Untrusted input might be used to build an HTTP request, which can lead to a Server-side request forgery (SSRF) vulnerability. SSRF allows an attacker to send crafted requests from the server side to other internal or external systems. SSRF can lead to unauthorized access to sensitive data and, in some cases, allow the attacker to control applications or systems that trust the vulnerable service. To prevent this vulnerability, avoid allowing user input to craft the base request. Instead, treat it as part of the path or query parameter and encode it appropriately. When user input is necessary to prepare the HTTP request, perform strict input validation. Additionally, whenever possible, use allowlists to only interact with expected, trusted domains.","metadata":{"likelihood":"MEDIUM","impact":"HIGH","confidence":"MEDIUM","category":"security","subcategory":["vuln"],"cwe":["CWE-918: Server-Side Request Forgery (SSRF)"],"cwe2021-top25":true,"cwe2022-top25":true,"display-name":"Server-Side Request Forgery (SSRF) with Flask","functional-categories":["net::sink::http-request::requests","web::source::cookie::flask","web::source::form-data::flask","web::source::form-data::flask-wtf","web::source::form-data::wtforms","web::source::header::flask","web::source::http-body::flask","web::source::http-params::flask","web::source::url-path-params::flask"],"owasp":["A10:2021 - Server-Side Request Forgery (SSRF)"],"references":["https://owasp.org/Top10/A10_2021-Server-Side_Request_Forgery_%28SSRF%29"],"technology":["flask","flask-wtf","requests","web","wtforms"],"license":"Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license","vulnerability_class":["Server-Side Request Forgery (SSRF)"],"source":"https://semgrep.dev/r/python.flask.net.tainted-flask-http-request-requests.tainted-flask-http-request-requests","shortlink":"https://sg.run/109zk","semgrep.dev":{"rule":{"origin":"pro_rules","r_id":116522,"rule_id":"bwUbEzL","rv_id":947949,"url":"https://semgrep.dev/playground/r/1QToZr7/python.flask.net.tainted-flask-http-request-requests.tainted-flask-http-request-requests","version_id":"1QToZr7"}}},"severity":"ERROR","fingerprint":"b9ea27fee0799df8f4a4afd40cbd61dccca7c131e69366e582ff71ce00d5e7e990fcb5adf0c4e4656360f9d85e36588e47e177df2cb2e179cb7417e68cdfb5f2_0","lines":" response = requests.get(url)","is_ignored":false,"validation_state":"NO_VALIDATOR","dataflow_trace":{"taint_source":["CliLoc",[{"path":"insecure-app/app.py","start":{"line":78,"col":19,"offset":2929},"end":{"line":78,"col":38,"offset":2948}},"request.form['url']"]],"intermediate_vars":[{"location":{"path":"insecure-app/app.py","start":{"line":78,"col":13,"offset":2923},"end":{"line":78,"col":16,"offset":2926}},"content":"url"}],"taint_sink":["CliLoc",[{"path":"insecure-app/app.py","start":{"line":80,"col":41,"offset":3006},"end":{"line":80,"col":44,"offset":3009}},"url"]]},"engine_kind":"PRO"}},{"check_id":"python.django.security.injection.sql.sql-injection-using-db-cursor-execute.sql-injection-db-cursor-execute","path":"insecure-app/app.py","start":{"line":87,"col":13,"offset":3277},"end":{"line":98,"col":43,"offset":3811},"extra":{"metavars":{"$FUNC":{"start":{"line":15,"col":5,"offset":378},"end":{"line":15,"col":10,"offset":383},"abstract_content":"index"},"$DATA":{"start":{"line":87,"col":13,"offset":3277},"end":{"line":87,"col":21,"offset":3285},"abstract_content":"username"},"$W":{"start":{"line":87,"col":32,"offset":3296},"end":{"line":87,"col":36,"offset":3300},"abstract_content":"form"},"$INTERM":{"start":{"line":90,"col":17,"offset":3412},"end":{"line":90,"col":22,"offset":3417},"abstract_content":"query"},"$STR":{"start":{"line":90,"col":25,"offset":3420},"end":{"line":90,"col":75,"offset":3470},"abstract_content":"\"SELECT password FROM users WHERE username = '{}'\""},"$CURSOR":{"start":{"line":91,"col":17,"offset":3504},"end":{"line":91,"col":23,"offset":3510},"abstract_content":"cursor"}},"message":"User-controlled data from a request is passed to 'execute()'. This could lead to a SQL injection and therefore protected information could be leaked. Instead, use django's QuerySets, which are built with query parameterization and therefore not vulnerable to sql injection. For example, you could use `Entry.objects.filter(date=2006)`.","metadata":{"cwe":["CWE-89: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')"],"owasp":["A01:2017 - Injection","A03:2021 - Injection"],"references":["https://docs.djangoproject.com/en/3.0/topics/security/#sql-injection-protection"],"category":"security","technology":["django"],"cwe2022-top25":true,"cwe2021-top25":true,"subcategory":["vuln"],"likelihood":"MEDIUM","impact":"HIGH","confidence":"MEDIUM","license":"Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license","vulnerability_class":["SQL Injection"],"source":"https://semgrep.dev/r/python.django.security.injection.sql.sql-injection-using-db-cursor-execute.sql-injection-db-cursor-execute","shortlink":"https://sg.run/qx7y","semgrep.dev":{"rule":{"origin":"community","r_id":9512,"rule_id":"2ZUbDL","rv_id":946186,"url":"https://semgrep.dev/playground/r/X0TL8rA/python.django.security.injection.sql.sql-injection-using-db-cursor-execute.sql-injection-db-cursor-execute","version_id":"X0TL8rA"}}},"severity":"WARNING","fingerprint":"7de13c47abcf430754420a48d341c9be3f7c9616b721a91fad2547e88f3a1ec7f778a8689a2d00e9752f224332372edb09cec074030cc5031feadeaf9c42e487_0","lines":" username = request.form['username']\n try:\n # Vulnerable SQL query using string interpolation\n query = \"SELECT password FROM users WHERE username = '{}'\".format(username)\n cursor.execute(query)\n result = cursor.fetchone()\n if result:\n output = f\"Password for {username}: {result[0]}\"\n else:\n output = \"User not found.\"\n except Exception as e:\n output = f\"SQL Error: {e}\"","is_ignored":false,"validation_state":"NO_VALIDATOR","engine_kind":"PRO"}},{"check_id":"python.django.security.injection.tainted-sql-string.tainted-sql-string","path":"insecure-app/app.py","start":{"line":90,"col":25,"offset":3420},"end":{"line":90,"col":92,"offset":3487},"extra":{"metavars":{"$1":{"start":{"line":1,"col":1,"offset":0},"end":{"line":1,"col":7,"offset":6},"abstract_content":"SELECT"},"$ANYTHING":{"start":{"line":87,"col":32,"offset":3296},"end":{"line":87,"col":36,"offset":3300},"abstract_content":"form"},"$SQLSTR":{"start":{"line":90,"col":26,"offset":3421},"end":{"line":90,"col":74,"offset":3469},"abstract_content":"SELECT password FROM users WHERE username = '{}'"}},"message":"Detected user input used to manually construct a SQL string. This is usually bad practice because manual construction could accidentally result in a SQL injection. An attacker could use a SQL injection to steal or modify contents of the database. Instead, use a parameterized query which is available by default in most database engines. Alternatively, consider using the Django object-relational mappers (ORM) instead of raw SQL queries.","metadata":{"cwe":["CWE-915: Improperly Controlled Modification of Dynamically-Determined Object Attributes"],"owasp":["A08:2021 - Software and Data Integrity Failures"],"references":["https://docs.djangoproject.com/en/3.0/topics/security/#sql-injection-protection"],"category":"security","technology":["django"],"subcategory":["audit"],"impact":"LOW","likelihood":"MEDIUM","confidence":"LOW","license":"Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license","vulnerability_class":["Mass Assignment"],"source":"https://semgrep.dev/r/python.django.security.injection.tainted-sql-string.tainted-sql-string","shortlink":"https://sg.run/PbZp","semgrep.dev":{"rule":{"origin":"community","r_id":14701,"rule_id":"lBU8Ad","rv_id":946190,"url":"https://semgrep.dev/playground/r/yeT0nKx/python.django.security.injection.tainted-sql-string.tainted-sql-string","version_id":"yeT0nKx"}}},"severity":"ERROR","fingerprint":"131b5e7e7d2ac6fc49fe8d7468f54e651a09d4a4706cdea3961e2fa888007b16999046aff46b29fadd3e0fa30f6ae43e0b461b4ae3bf39a7323b33e3c32d2ff8_0","lines":" query = \"SELECT password FROM users WHERE username = '{}'\".format(username)","is_ignored":false,"validation_state":"NO_VALIDATOR","dataflow_trace":{"taint_source":["CliLoc",[{"path":"insecure-app/app.py","start":{"line":87,"col":24,"offset":3288},"end":{"line":87,"col":36,"offset":3300}},"request.form"]],"intermediate_vars":[{"location":{"path":"insecure-app/app.py","start":{"line":87,"col":13,"offset":3277},"end":{"line":87,"col":21,"offset":3285}},"content":"username"}],"taint_sink":["CliLoc",[{"path":"insecure-app/app.py","start":{"line":90,"col":25,"offset":3420},"end":{"line":90,"col":92,"offset":3487}},"\"SELECT password FROM users WHERE username = '{}'\".format(username)"]]},"engine_kind":"PRO"}},{"check_id":"python.flask.security.injection.tainted-sql-string.tainted-sql-string","path":"insecure-app/app.py","start":{"line":90,"col":25,"offset":3420},"end":{"line":90,"col":92,"offset":3487},"extra":{"metavars":{"$1":{"start":{"line":1,"col":1,"offset":0},"end":{"line":1,"col":7,"offset":6},"abstract_content":"SELECT"},"$ANYTHING":{"start":{"line":87,"col":32,"offset":3296},"end":{"line":87,"col":36,"offset":3300},"abstract_content":"form"},"$SQLSTR":{"start":{"line":90,"col":26,"offset":3421},"end":{"line":90,"col":74,"offset":3469},"abstract_content":"SELECT password FROM users WHERE username = '{}'"}},"message":"Detected user input used to manually construct a SQL string. This is usually bad practice because manual construction could accidentally result in a SQL injection. An attacker could use a SQL injection to steal or modify contents of the database. Instead, use a parameterized query which is available by default in most database engines. Alternatively, consider using an object-relational mapper (ORM) such as SQLAlchemy which will protect your queries.","metadata":{"cwe":["CWE-704: Incorrect Type Conversion or Cast"],"owasp":["A01:2017 - Injection","A03:2021 - Injection"],"references":["https://docs.sqlalchemy.org/en/14/core/tutorial.html#using-textual-sql","https://www.tutorialspoint.com/sqlalchemy/sqlalchemy_quick_guide.htm","https://docs.sqlalchemy.org/en/14/core/tutorial.html#using-more-specific-text-with-table-expression-literal-column-and-expression-column"],"category":"security","technology":["sqlalchemy","flask"],"subcategory":["vuln"],"impact":"MEDIUM","likelihood":"MEDIUM","confidence":"MEDIUM","license":"Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license","vulnerability_class":["Improper Validation"],"source":"https://semgrep.dev/r/python.flask.security.injection.tainted-sql-string.tainted-sql-string","shortlink":"https://sg.run/JxZj","semgrep.dev":{"rule":{"origin":"community","r_id":14702,"rule_id":"YGUDKQ","rv_id":946228,"url":"https://semgrep.dev/playground/r/pZTNO7z/python.flask.security.injection.tainted-sql-string.tainted-sql-string","version_id":"pZTNO7z"}}},"severity":"ERROR","fingerprint":"d78139633035de6bf1b9a560172a84f789b9ddd923facc66df7a193b8e313841e015366f2216bfa6d2a311380594d28e7b5da825a9eaeabb73bf9613adbdb29d_0","lines":" query = \"SELECT password FROM users WHERE username = '{}'\".format(username)","is_ignored":false,"validation_state":"NO_VALIDATOR","dataflow_trace":{"taint_source":["CliLoc",[{"path":"insecure-app/app.py","start":{"line":87,"col":24,"offset":3288},"end":{"line":87,"col":36,"offset":3300}},"request.form"]],"intermediate_vars":[{"location":{"path":"insecure-app/app.py","start":{"line":87,"col":13,"offset":3277},"end":{"line":87,"col":21,"offset":3285}},"content":"username"}],"taint_sink":["CliLoc",[{"path":"insecure-app/app.py","start":{"line":90,"col":25,"offset":3420},"end":{"line":90,"col":92,"offset":3487}},"\"SELECT password FROM users WHERE username = '{}'\".format(username)"]]},"engine_kind":"PRO"}},{"check_id":"python.lang.security.audit.formatted-sql-query.formatted-sql-query","path":"insecure-app/app.py","start":{"line":91,"col":17,"offset":3504},"end":{"line":91,"col":38,"offset":3525},"extra":{"metavars":{"$DB":{"start":{"line":91,"col":17,"offset":3504},"end":{"line":91,"col":23,"offset":3510},"abstract_content":"cursor"},"$SQL":{"start":{"line":91,"col":32,"offset":3519},"end":{"line":91,"col":37,"offset":3524},"abstract_content":"query","propagated_value":{"svalue_start":{"line":90,"col":25,"offset":3420},"svalue_end":{"line":90,"col":92,"offset":3487},"svalue_abstract_content":"\"SELECT password FROM users WHERE username = '{}'\".format(username)"}}},"message":"Detected possible formatted SQL query. Use parameterized queries instead.","metadata":{"owasp":["A01:2017 - Injection","A03:2021 - Injection"],"cwe":["CWE-89: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')"],"references":["https://stackoverflow.com/questions/775296/mysql-parameterized-queries"],"category":"security","technology":["python"],"cwe2022-top25":true,"cwe2021-top25":true,"subcategory":["audit"],"likelihood":"LOW","impact":"HIGH","confidence":"LOW","license":"Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license","vulnerability_class":["SQL Injection"],"source":"https://semgrep.dev/r/python.lang.security.audit.formatted-sql-query.formatted-sql-query","shortlink":"https://sg.run/EkWw","semgrep.dev":{"rule":{"origin":"community","r_id":9637,"rule_id":"3qUP9k","rv_id":946343,"url":"https://semgrep.dev/playground/r/e1T98KK/python.lang.security.audit.formatted-sql-query.formatted-sql-query","version_id":"e1T98KK"}}},"severity":"WARNING","fingerprint":"a74600ac310bdab04cc5ea8c2e7c25221703979f0286dde9018a90d2dbd6c16ea381c5d4f9cb97fbcac0b0aeef454a63c3f82f078d6fa9512358b6566e5263a3_0","lines":" cursor.execute(query)","is_ignored":false,"validation_state":"NO_VALIDATOR","engine_kind":"PRO"}},{"check_id":"python.sqlalchemy.security.sqlalchemy-execute-raw-query.sqlalchemy-execute-raw-query","path":"insecure-app/app.py","start":{"line":91,"col":17,"offset":3504},"end":{"line":91,"col":38,"offset":3525},"extra":{"metavars":{"$SQL":{"start":{"line":90,"col":25,"offset":3420},"end":{"line":90,"col":75,"offset":3470},"abstract_content":"\"SELECT password FROM users WHERE username = '{}'\""},"$CONNECTION":{"start":{"line":91,"col":17,"offset":3504},"end":{"line":91,"col":23,"offset":3510},"abstract_content":"cursor"},"$QUERY":{"start":{"line":91,"col":32,"offset":3519},"end":{"line":91,"col":37,"offset":3524},"abstract_content":"query","propagated_value":{"svalue_start":{"line":90,"col":25,"offset":3420},"svalue_end":{"line":90,"col":92,"offset":3487},"svalue_abstract_content":"\"SELECT password FROM users WHERE username = '{}'\".format(username)"}}},"message":"Avoiding SQL string concatenation: untrusted input concatenated with raw SQL query can result in SQL Injection. In order to execute raw query safely, prepared statement should be used. SQLAlchemy provides TextualSQL to easily used prepared statement with named parameters. For complex SQL composition, use SQL Expression Language or Schema Definition Language. In most cases, SQLAlchemy ORM will be a better option.","metadata":{"cwe":["CWE-89: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')"],"owasp":["A01:2017 - Injection","A03:2021 - Injection"],"references":["https://docs.sqlalchemy.org/en/14/core/tutorial.html#using-textual-sql","https://www.tutorialspoint.com/sqlalchemy/sqlalchemy_quick_guide.htm","https://docs.sqlalchemy.org/en/14/core/tutorial.html#using-more-specific-text-with-table-expression-literal-column-and-expression-column"],"category":"security","technology":["sqlalchemy"],"cwe2022-top25":true,"cwe2021-top25":true,"subcategory":["audit"],"likelihood":"LOW","impact":"HIGH","confidence":"LOW","license":"Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license","vulnerability_class":["SQL Injection"],"source":"https://semgrep.dev/r/python.sqlalchemy.security.sqlalchemy-execute-raw-query.sqlalchemy-execute-raw-query","shortlink":"https://sg.run/2b1L","semgrep.dev":{"rule":{"origin":"community","r_id":10563,"rule_id":"oqUz5y","rv_id":946452,"url":"https://semgrep.dev/playground/r/8KTKj19/python.sqlalchemy.security.sqlalchemy-execute-raw-query.sqlalchemy-execute-raw-query","version_id":"8KTKj19"}}},"severity":"ERROR","fingerprint":"97cb38d9b784f2ccc9d408311b424efd2db86f21a63023679b620bdd2800fa8befdbbd093b704ba25840091646bc7b85382022dc1d4d980c88b5252c8720390a_0","lines":" cursor.execute(query)","is_ignored":false,"validation_state":"NO_VALIDATOR","engine_kind":"PRO"}},{"check_id":"python.flask.db.generic-sql-flask.generic-sql-flask","path":"insecure-app/app.py","start":{"line":91,"col":32,"offset":3519},"end":{"line":91,"col":37,"offset":3524},"extra":{"metavars":{"$1":{"start":{"line":1,"col":1,"offset":0},"end":{"line":1,"col":5,"offset":4},"abstract_content":"form"},"$PROPERTY":{"start":{"line":87,"col":32,"offset":3296},"end":{"line":87,"col":36,"offset":3300},"abstract_content":"form"},"$AIOMYSQL_CURSOR":{"start":{"line":91,"col":17,"offset":3504},"end":{"line":91,"col":23,"offset":3510},"abstract_content":"cursor"},"$SINK":{"start":{"line":91,"col":32,"offset":3519},"end":{"line":91,"col":37,"offset":3524},"abstract_content":"query","propagated_value":{"svalue_start":{"line":90,"col":25,"offset":3420},"svalue_end":{"line":90,"col":92,"offset":3487},"svalue_abstract_content":"\"SELECT password FROM users WHERE username = '{}'\".format(username)"}}},"message":"Untrusted input might be used to build a database query, which can lead to a SQL injection vulnerability. An attacker can execute malicious SQL statements and gain unauthorized access to sensitive data, modify, delete data, or execute arbitrary system commands. The driver API has the ability to bind parameters to the query in a safe way. Make sure not to dynamically create SQL queries from user-influenced inputs. If you cannot avoid this, either escape the data properly or create an allowlist to check the value.","metadata":{"likelihood":"HIGH","impact":"HIGH","confidence":"HIGH","category":"security","subcategory":["vuln"],"cwe":["CWE-89: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')"],"cwe2020-top25":true,"cwe2021-top25":true,"cwe2022-top25":true,"display-name":"SQL Injection with Flask","functional-categories":["db::sink::sql-or-nosql-query::aiomysql","db::sink::sql-or-nosql-query::aiopg","db::sink::sql-or-nosql-query::mysql-connector","db::sink::sql-or-nosql-query::mysqldb","db::sink::sql-or-nosql-query::pep249","db::sink::sql-or-nosql-query::psycopg2","db::sink::sql-or-nosql-query::pymssql","db::sink::sql-or-nosql-query::pymysql","db::sink::sql-or-nosql-query::pyodbc","web::source::cookie::flask","web::source::form-data::flask","web::source::form-data::flask-wtf","web::source::form-data::wtforms","web::source::header::flask","web::source::http-body::flask","web::source::http-params::flask","web::source::url-path-params::flask"],"owasp":["A01:2017 - Injection","A03:2021 - Injection"],"references":["https://owasp.org/Top10/A03_2021-Injection"],"technology":["aiomysql","aiopg","db-api","flask","flask-wtf","mssql","mysql","mysql-connector","mysqldb","pep249","postgres","psycopg2","pymssql","pymysql","pyodbc","sql","web","wtforms"],"license":"Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license","vulnerability_class":["SQL Injection"],"source":"https://semgrep.dev/r/python.flask.db.generic-sql-flask.generic-sql-flask","shortlink":"https://sg.run/AbKXQ","semgrep.dev":{"rule":{"origin":"pro_rules","r_id":116506,"rule_id":"0oULG2d","rv_id":947908,"url":"https://semgrep.dev/playground/r/rxT6kpn/python.flask.db.generic-sql-flask.generic-sql-flask","version_id":"rxT6kpn"}}},"severity":"ERROR","fingerprint":"a80f7e2b4c23589f94ab602f17de0c81936ee0e90bae9e1716a1ceca152f7466301e0b6af164ffe2e311facac9f4f61b278c6c1c47ef1e2e07fce41c0042a588_0","lines":" cursor.execute(query)","is_ignored":false,"validation_state":"NO_VALIDATOR","dataflow_trace":{"taint_source":["CliLoc",[{"path":"insecure-app/app.py","start":{"line":87,"col":24,"offset":3288},"end":{"line":87,"col":48,"offset":3312}},"request.form['username']"]],"intermediate_vars":[{"location":{"path":"insecure-app/app.py","start":{"line":87,"col":13,"offset":3277},"end":{"line":87,"col":21,"offset":3285}},"content":"username"},{"location":{"path":"insecure-app/app.py","start":{"line":90,"col":17,"offset":3412},"end":{"line":90,"col":22,"offset":3417}},"content":"query"}],"taint_sink":["CliLoc",[{"path":"insecure-app/app.py","start":{"line":91,"col":32,"offset":3519},"end":{"line":91,"col":37,"offset":3524}},"query"]]},"engine_kind":"PRO"}},{"check_id":"python.tars.flask.sql.prestodb.flask-prestodb-sqli.flask-prestodb-sqli","path":"insecure-app/app.py","start":{"line":91,"col":32,"offset":3519},"end":{"line":91,"col":37,"offset":3524},"extra":{"metavars":{"$1":{"start":{"line":1,"col":1,"offset":0},"end":{"line":1,"col":5,"offset":4},"abstract_content":"form"},"$PROPERTY":{"start":{"line":87,"col":32,"offset":3296},"end":{"line":87,"col":36,"offset":3300},"abstract_content":"form"},"$O":{"start":{"line":91,"col":17,"offset":3504},"end":{"line":91,"col":23,"offset":3510},"abstract_content":"cursor"},"$SINK":{"start":{"line":91,"col":32,"offset":3519},"end":{"line":91,"col":37,"offset":3524},"abstract_content":"query","propagated_value":{"svalue_start":{"line":90,"col":25,"offset":3420},"svalue_end":{"line":90,"col":92,"offset":3487},"svalue_abstract_content":"\"SELECT password FROM users WHERE username = '{}'\".format(username)"}}},"message":"Untrusted input might be used to build a database query, which can lead to a SQL injection vulnerability. An attacker can execute malicious SQL statements and gain unauthorized access to sensitive data, modify, delete data, or execute arbitrary system commands. To prevent this vulnerability, use prepared statements that do not concatenate user-controllable strings and use parameterized queries where SQL commands and user data are strictly separated. Also, consider using an object-relational (ORM) framework to operate with safer abstractions.","metadata":{"likelihood":"HIGH","impact":"HIGH","confidence":"HIGH","category":"security","subcategory":["vuln"],"cwe":["CWE-89: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')"],"cwe2020-top25":true,"cwe2021-top25":true,"cwe2022-top25":true,"display-name":"SQL Injection with prestodb via flask","functional-categories":["db::sink::sql-or-nosql-query::prestodb","web::source::cookie::flask","web::source::form-data::flask","web::source::form-data::flask-wtf","web::source::form-data::wtforms","web::source::header::flask","web::source::http-body::flask","web::source::http-params::flask","web::source::url-path-params::flask"],"owasp":["A01:2017 - Injection","A03:2021 - Injection"],"references":["https://owasp.org/Top10/A03_2021-Injection"],"technology":["flask","flask-wtf","prestodb","python","web","wtforms"],"license":"Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license","vulnerability_class":["SQL Injection"],"source":"https://semgrep.dev/r/python.tars.flask.sql.prestodb.flask-prestodb-sqli.flask-prestodb-sqli","shortlink":"https://sg.run/Ab2Y4","semgrep.dev":{"rule":{"origin":"pro_rules","r_id":151050,"rule_id":"qNU2nYq","rv_id":974114,"url":"https://semgrep.dev/playground/r/kbTYe8A/python.tars.flask.sql.prestodb.flask-prestodb-sqli.flask-prestodb-sqli","version_id":"kbTYe8A"}}},"severity":"ERROR","fingerprint":"d775a8b630cffbbe8eca881c9cfcdb41f1712b6b4725bd2eff0e62d0a2a62a2d7dd68d3d0f894ebc17c9eac9ae138a5d02473baf772d07f06ff34bb0f87a7b60_0","lines":" cursor.execute(query)","is_ignored":false,"validation_state":"NO_VALIDATOR","dataflow_trace":{"taint_source":["CliLoc",[{"path":"insecure-app/app.py","start":{"line":87,"col":24,"offset":3288},"end":{"line":87,"col":48,"offset":3312}},"request.form['username']"]],"intermediate_vars":[{"location":{"path":"insecure-app/app.py","start":{"line":87,"col":13,"offset":3277},"end":{"line":87,"col":21,"offset":3285}},"content":"username"},{"location":{"path":"insecure-app/app.py","start":{"line":90,"col":17,"offset":3412},"end":{"line":90,"col":22,"offset":3417}},"content":"query"}],"taint_sink":["CliLoc",[{"path":"insecure-app/app.py","start":{"line":91,"col":32,"offset":3519},"end":{"line":91,"col":37,"offset":3524}},"query"]]},"engine_kind":"PRO"}},{"check_id":"python.tars.flask.sql.prestodb.flask-without-url-path-prestodb-sqli.flask-without-url-path-prestodb-sqli","path":"insecure-app/app.py","start":{"line":91,"col":32,"offset":3519},"end":{"line":91,"col":37,"offset":3524},"extra":{"metavars":{"$1":{"start":{"line":1,"col":1,"offset":0},"end":{"line":1,"col":5,"offset":4},"abstract_content":"form"},"$PROPERTY":{"start":{"line":87,"col":32,"offset":3296},"end":{"line":87,"col":36,"offset":3300},"abstract_content":"form"},"$O":{"start":{"line":91,"col":17,"offset":3504},"end":{"line":91,"col":23,"offset":3510},"abstract_content":"cursor"},"$SINK":{"start":{"line":91,"col":32,"offset":3519},"end":{"line":91,"col":37,"offset":3524},"abstract_content":"query","propagated_value":{"svalue_start":{"line":90,"col":25,"offset":3420},"svalue_end":{"line":90,"col":92,"offset":3487},"svalue_abstract_content":"\"SELECT password FROM users WHERE username = '{}'\".format(username)"}}},"message":"Untrusted input might be used to build a database query, which can lead to a SQL injection vulnerability. An attacker can execute malicious SQL statements and gain unauthorized access to sensitive data, modify, delete data, or execute arbitrary system commands. To prevent this vulnerability, use prepared statements that do not concatenate user-controllable strings and use parameterized queries where SQL commands and user data are strictly separated. Also, consider using an object-relational (ORM) framework to operate with safer abstractions.","metadata":{"likelihood":"HIGH","impact":"HIGH","confidence":"HIGH","category":"security","subcategory":["vuln"],"cwe":["CWE-89: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')"],"cwe2020-top25":true,"cwe2021-top25":true,"cwe2022-top25":true,"display-name":"SQL Injection with prestodb via flask-without-url-path","functional-categories":["db::sink::sql-or-nosql-query::prestodb","web::source::cookie::flask","web::source::form-data::flask","web::source::form-data::flask-wtf","web::source::form-data::wtforms","web::source::header::flask","web::source::http-body::flask","web::source::http-params::flask","web::source::url-path-params::flask"],"owasp":["A01:2017 - Injection","A03:2021 - Injection"],"references":["https://owasp.org/Top10/A03_2021-Injection"],"technology":["flask","flask-wtf","prestodb","python","web","wtforms"],"license":"Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license","vulnerability_class":["SQL Injection"],"source":"https://semgrep.dev/r/python.tars.flask.sql.prestodb.flask-without-url-path-prestodb-sqli.flask-without-url-path-prestodb-sqli","shortlink":"https://sg.run/BYXN5","semgrep.dev":{"rule":{"origin":"pro_rules","r_id":151051,"rule_id":"lBU4OQB","rv_id":974115,"url":"https://semgrep.dev/playground/r/w8TKyGQ/python.tars.flask.sql.prestodb.flask-without-url-path-prestodb-sqli.flask-without-url-path-prestodb-sqli","version_id":"w8TKyGQ"}}},"severity":"ERROR","fingerprint":"3b031ef816c35b352f70682b3f4b652864376d5a11968a80b3f91b46993f639a7a3fb6cae975a6fe9eea99a57629691ca54b76eb0a7433160e96197f9a646858_0","lines":" cursor.execute(query)","is_ignored":false,"validation_state":"NO_VALIDATOR","dataflow_trace":{"taint_source":["CliLoc",[{"path":"insecure-app/app.py","start":{"line":87,"col":24,"offset":3288},"end":{"line":87,"col":48,"offset":3312}},"request.form['username']"]],"intermediate_vars":[{"location":{"path":"insecure-app/app.py","start":{"line":87,"col":13,"offset":3277},"end":{"line":87,"col":21,"offset":3285}},"content":"username"},{"location":{"path":"insecure-app/app.py","start":{"line":90,"col":17,"offset":3412},"end":{"line":90,"col":22,"offset":3417}},"content":"query"}],"taint_sink":["CliLoc",[{"path":"insecure-app/app.py","start":{"line":91,"col":32,"offset":3519},"end":{"line":91,"col":37,"offset":3524}},"query"]]},"engine_kind":"PRO"}},{"check_id":"python.flask.security.audit.render-template-string.render-template-string","path":"insecure-app/app.py","start":{"line":100,"col":12,"offset":3824},"end":{"line":165,"col":24,"offset":6152},"extra":{"metavars":{},"message":"Found a template created with string formatting. This is susceptible to server-side template injection and cross-site scripting attacks.","metadata":{"cwe":["CWE-96: Improper Neutralization of Directives in Statically Saved Code ('Static Code Injection')"],"owasp":["A03:2021 - Injection"],"references":["https://nvisium.com/blog/2016/03/09/exploring-ssti-in-flask-jinja2.html"],"category":"security","technology":["flask"],"subcategory":["audit"],"likelihood":"LOW","impact":"MEDIUM","confidence":"LOW","license":"Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license","vulnerability_class":["Code Injection"],"source":"https://semgrep.dev/r/python.flask.security.audit.render-template-string.render-template-string","shortlink":"https://sg.run/8yjE","semgrep.dev":{"rule":{"origin":"community","r_id":9540,"rule_id":"5rUOv1","rv_id":946214,"url":"https://semgrep.dev/playground/r/GxTP7pA/python.flask.security.audit.render-template-string.render-template-string","version_id":"GxTP7pA"}}},"severity":"WARNING","fingerprint":"1fef9f2ee425958911da7faac417e1f471bdc7ae487cbabd9a91be4ea84a6f83752210264ba5524b467e6c75922346531ffa23e80c7cbb432772b1e9135c7eed_0","lines":" return render_template_string(\"\"\"\n Intentionally Insecure App \n Try uploading a file named: ../../../../etc/passwd
\n SQL Injection 2 \n \n {{ output|safe }} \n \"\"\", output=output)","is_ignored":false,"validation_state":"NO_VALIDATOR","engine_kind":"PRO"}},{"check_id":"python.flask.debug.debug-flask.active-debug-code-flask","path":"insecure-app/app.py","start":{"line":168,"col":5,"offset":6185},"end":{"line":168,"col":51,"offset":6231},"extra":{"metavars":{},"message":"The application is running debug code or has debug mode enabled. This may expose sensitive information, like stack traces and environment variables, to attackers. It may also modify application behavior, potentially enabling attackers to bypass restrictions. To remediate this finding, ensure that the application's debug code and debug mode are disabled or removed from the production environment.","metadata":{"likelihood":"LOW","impact":"MEDIUM","confidence":"HIGH","category":"security","subcategory":["vuln"],"cwe":["CWE-489: Active Debug Code"],"display-name":"Active Debug Code in Flask","functional-categories":["debug::search::active-debug-code"],"references":["https://flask.palletsprojects.com/en/3.0.x/debugging/"],"technology":["flask","python"],"license":"Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license","vulnerability_class":["Active Debug Code"],"source":"https://semgrep.dev/r/python.flask.debug.debug-flask.active-debug-code-flask","shortlink":"https://sg.run/lBbpB","semgrep.dev":{"rule":{"origin":"pro_rules","r_id":116513,"rule_id":"zdUKBnK","rv_id":947918,"url":"https://semgrep.dev/playground/r/ZRT3q9v/python.flask.debug.debug-flask.active-debug-code-flask","version_id":"ZRT3q9v"}}},"severity":"INFO","fingerprint":"c23e60005fcb1bcebdf227cb9726b160a35d2a257d070ed02e48086267e9fc89bc16c372bb201f498a69977f671255ee8a9f79ff39693f60f42f6b326b1cbef7_0","lines":" app.run(host='0.0.0.0', port=8080, debug=True)","is_ignored":false,"validation_state":"NO_VALIDATOR","engine_kind":"PRO"}},{"check_id":"python.flask.security.audit.app-run-param-config.avoid_app_run_with_bad_host","path":"insecure-app/app.py","start":{"line":168,"col":5,"offset":6185},"end":{"line":168,"col":51,"offset":6231},"extra":{"metavars":{},"message":"Running flask app with host 0.0.0.0 could expose the server publicly.","metadata":{"cwe":["CWE-668: Exposure of Resource to Wrong Sphere"],"owasp":["A01:2021 - Broken Access Control"],"category":"security","technology":["flask"],"references":["https://owasp.org/Top10/A01_2021-Broken_Access_Control"],"subcategory":["vuln"],"likelihood":"HIGH","impact":"MEDIUM","confidence":"HIGH","license":"Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license","vulnerability_class":["Other"],"source":"https://semgrep.dev/r/python.flask.security.audit.app-run-param-config.avoid_app_run_with_bad_host","shortlink":"https://sg.run/eLby","semgrep.dev":{"rule":{"origin":"community","r_id":9532,"rule_id":"L1Uy1n","rv_id":946204,"url":"https://semgrep.dev/playground/r/7ZTrQkG/python.flask.security.audit.app-run-param-config.avoid_app_run_with_bad_host","version_id":"7ZTrQkG"}}},"severity":"WARNING","fingerprint":"031046540eb43011ccbcd463edf2c3003737673f6218b7a22e609d94ff6b0ad99d098ec0307291bb508e6c1ec8d7e08ebdbe7f7670245df69c0a42db45854bd3_0","lines":" app.run(host='0.0.0.0', port=8080, debug=True)","is_ignored":false,"validation_state":"NO_VALIDATOR","engine_kind":"PRO"}},{"check_id":"python.flask.security.audit.debug-enabled.debug-enabled","path":"insecure-app/app.py","start":{"line":168,"col":5,"offset":6185},"end":{"line":168,"col":51,"offset":6231},"extra":{"metavars":{"$APP":{"start":{"line":168,"col":5,"offset":6185},"end":{"line":168,"col":8,"offset":6188},"abstract_content":"app","propagated_value":{"svalue_start":{"line":12,"col":7,"offset":316},"svalue_end":{"line":12,"col":22,"offset":331},"svalue_abstract_content":"Flask(__name__)"}}},"message":"Detected Flask app with debug=True. Do not deploy to production with this flag enabled as it will leak sensitive information. Instead, consider using Flask configuration variables or setting 'debug' using system environment variables.","metadata":{"cwe":["CWE-489: Active Debug Code"],"owasp":"A06:2017 - Security Misconfiguration","references":["https://labs.detectify.com/2015/10/02/how-patreon-got-hacked-publicly-exposed-werkzeug-debugger/"],"category":"security","technology":["flask"],"subcategory":["vuln"],"likelihood":"HIGH","impact":"MEDIUM","confidence":"HIGH","license":"Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license","vulnerability_class":["Active Debug Code"],"source":"https://semgrep.dev/r/python.flask.security.audit.debug-enabled.debug-enabled","shortlink":"https://sg.run/dKrd","semgrep.dev":{"rule":{"origin":"community","r_id":9534,"rule_id":"gxU1bd","rv_id":946206,"url":"https://semgrep.dev/playground/r/8KTKjwR/python.flask.security.audit.debug-enabled.debug-enabled","version_id":"8KTKjwR"}}},"severity":"WARNING","fingerprint":"688f60f63bb45fb9ddf9a179de37f66efa8644f5976e2115d44c0ee91789446d3bf7d1d4351ea22ab6e616ecb66a2ed26ca94d64746ea41e289bbf71176a4022_0","lines":" app.run(host='0.0.0.0', port=8080, debug=True)","is_ignored":false,"validation_state":"NO_VALIDATOR","engine_kind":"PRO"}},{"check_id":"generic.secrets.security.detected-aws-access-key-id-value.detected-aws-access-key-id-value","path":"insecure-app/ransomware.py","start":{"line":34,"col":16,"offset":1304},"end":{"line":34,"col":36,"offset":1324},"extra":{"metavars":{"$1":{"start":{"line":34,"col":16,"offset":1304},"end":{"line":34,"col":20,"offset":1308},"abstract_content":"AKIA"}},"message":"AWS Access Key ID Value detected. This is a sensitive credential and should not be hardcoded here. Instead, read this value from an environment variable or keep it in a separate, private file.","metadata":{"cwe":["CWE-798: Use of Hard-coded Credentials"],"source-rule-url":"https://github.com/grab/secret-scanner/blob/master/scanner/signatures/pattern.go","category":"security","technology":["secrets","aws"],"confidence":"LOW","owasp":["A07:2021 - Identification and Authentication Failures"],"references":["https://owasp.org/Top10/A07_2021-Identification_and_Authentication_Failures"],"cwe2022-top25":true,"cwe2021-top25":true,"subcategory":["audit"],"likelihood":"LOW","impact":"HIGH","license":"Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license","vulnerability_class":["Hard-coded Secrets"],"source":"https://semgrep.dev/r/generic.secrets.security.detected-aws-access-key-id-value.detected-aws-access-key-id-value","shortlink":"https://sg.run/GeD1","semgrep.dev":{"rule":{"origin":"community","r_id":9048,"rule_id":"oqUevO","rv_id":945484,"url":"https://semgrep.dev/playground/r/rxT6rnL/generic.secrets.security.detected-aws-access-key-id-value.detected-aws-access-key-id-value","version_id":"rxT6rnL"}}},"severity":"ERROR","fingerprint":"fdd4bbda379047f46243b39d05251ca1f58d4adf6e262e3e54050a8031935e79a9bed50cdf71107e644efbf18b43f6edcde2cd2905d9bfb43caf67d59f7bcc98_0","lines":" aws = \"AKIA2JAPX77RGLB664VE\"","is_ignored":false,"validation_state":"NO_VALIDATOR","engine_kind":"PRO"}},{"check_id":"python.lang.security.audit.dynamic-urllib-use-detected.dynamic-urllib-use-detected","path":"insecure-app/ransomware.py","start":{"line":143,"col":9,"offset":6480},"end":{"line":143,"col":51,"offset":6522},"extra":{"metavars":{},"message":"Detected a dynamic value being used with urllib. urllib supports 'file://' schemes, so a dynamic value controlled by a malicious actor may allow them to read arbitrary files. Audit uses of urllib calls to ensure user data cannot control the URLs, or consider using the 'requests' library instead.","metadata":{"cwe":["CWE-939: Improper Authorization in Handler for Custom URL Scheme"],"owasp":"A01:2017 - Injection","source-rule-url":"https://github.com/PyCQA/bandit/blob/b1411bfb43795d3ffd268bef17a839dee954c2b1/bandit/blacklists/calls.py#L163","bandit-code":"B310","asvs":{"control_id":"5.2.4 Dynamic Code Execution Features","control_url":"https://github.com/OWASP/ASVS/blob/master/4.0/en/0x13-V5-Validation-Sanitization-Encoding.md#v52-sanitization-and-sandboxing-requirements","section":"V5: Validation, Sanitization and Encoding Verification Requirements","version":"4"},"category":"security","technology":["python"],"references":["https://cwe.mitre.org/data/definitions/939.html"],"subcategory":["audit"],"likelihood":"LOW","impact":"LOW","confidence":"LOW","license":"Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license","vulnerability_class":["Improper Authorization"],"source":"https://semgrep.dev/r/python.lang.security.audit.dynamic-urllib-use-detected.dynamic-urllib-use-detected","shortlink":"https://sg.run/dKZZ","semgrep.dev":{"rule":{"origin":"community","r_id":9634,"rule_id":"8GUj22","rv_id":946340,"url":"https://semgrep.dev/playground/r/w8TKJbO/python.lang.security.audit.dynamic-urllib-use-detected.dynamic-urllib-use-detected","version_id":"w8TKJbO"}}},"severity":"WARNING","fingerprint":"f74fd93d56d0f782bdccefe534a08a0e542f77db7f2e2bd32b3107a3049506b89945891a6570373cd6b214f08cc50198a61a8b4e680dcaadc5cd4dec38437ec0_0","lines":" urllib.request.urlretrieve(imageUrl, path)","is_ignored":false,"validation_state":"NO_VALIDATOR","engine_kind":"PRO"}},{"check_id":"yaml.kubernetes.security.run-as-non-root.run-as-non-root","path":"insecure-chart/templates/busybox.yaml","start":{"line":17,"col":5,"offset":308},"end":{"line":17,"col":9,"offset":312},"extra":{"metavars":{"$1":{"start":{"line":1,"col":1,"offset":0},"end":{"line":1,"col":5,"offset":4},"abstract_content":"spec"},"$SPEC":{"start":{"line":17,"col":5,"offset":308},"end":{"line":17,"col":9,"offset":312},"abstract_content":"spec"}},"message":"When running containers in Kubernetes, it's important to ensure that they are properly secured to prevent privilege escalation attacks. One potential vulnerability is when a container is allowed to run applications as the root user, which could allow an attacker to gain access to sensitive resources. To mitigate this risk, it's recommended to add a `securityContext` to the container, with the parameter `runAsNonRoot` set to `true`. This will ensure that the container runs as a non-root user, limiting the damage that could be caused by any potential attacks. By adding a `securityContext` to the container in your Kubernetes pod, you can help to ensure that your containerized applications are more secure and less vulnerable to privilege escalation attacks.","fix":"spec:\n securityContext:\n runAsNonRoot: true #","metadata":{"references":["https://kubernetes.io/blog/2016/08/security-best-practices-kubernetes-deployment/","https://kubernetes.io/docs/concepts/policy/pod-security-policy/","https://cheatsheetseries.owasp.org/cheatsheets/Docker_Security_Cheat_Sheet.html#rule-2-set-a-user"],"category":"security","cwe":["CWE-250: Execution with Unnecessary Privileges"],"owasp":["A05:2021 - Security Misconfiguration","A06:2017 - Security Misconfiguration"],"technology":["kubernetes"],"subcategory":["audit"],"likelihood":"LOW","impact":"LOW","confidence":"LOW","license":"Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license","vulnerability_class":["Improper Authorization"],"source":"https://semgrep.dev/r/yaml.kubernetes.security.run-as-non-root.run-as-non-root","shortlink":"https://sg.run/dgP5","semgrep.dev":{"rule":{"origin":"community","r_id":10134,"rule_id":"ZqUqeK","rv_id":947064,"url":"https://semgrep.dev/playground/r/JdTDP66/yaml.kubernetes.security.run-as-non-root.run-as-non-root","version_id":"JdTDP66"}}},"severity":"INFO","fingerprint":"3302f4679b677441ee2e4f843fe636546de78ccbdf7ffa5b66486a65526a675e1ad0c1989e87283307f8e9b2170714659820d02ad476142b371afd41824422ab_0","lines":" spec:","is_ignored":false,"validation_state":"NO_VALIDATOR","engine_kind":"PRO"}},{"check_id":"yaml.kubernetes.security.allow-privilege-escalation-no-securitycontext.allow-privilege-escalation-no-securitycontext","path":"insecure-chart/templates/busybox.yaml","start":{"line":19,"col":9,"offset":340},"end":{"line":19,"col":13,"offset":344},"extra":{"metavars":{"$NAME":{"start":{"line":19,"col":9,"offset":340},"end":{"line":19,"col":13,"offset":344},"abstract_content":"name"},"$CONTAINER":{"start":{"line":19,"col":15,"offset":346},"end":{"line":19,"col":22,"offset":353},"abstract_content":"busybox"}},"message":"In Kubernetes, each pod runs in its own isolated environment with its own set of security policies. However, certain container images may contain `setuid` or `setgid` binaries that could allow an attacker to perform privilege escalation and gain access to sensitive resources. To mitigate this risk, it's recommended to add a `securityContext` to the container in the pod, with the parameter `allowPrivilegeEscalation` set to `false`. This will prevent the container from running any privileged processes and limit the impact of any potential attacks. By adding a `securityContext` to your Kubernetes pod, you can help to ensure that your containerized applications are more secure and less vulnerable to privilege escalation attacks.","fix":"securityContext:\n allowPrivilegeEscalation: false\n name","metadata":{"cwe":["CWE-732: Incorrect Permission Assignment for Critical Resource"],"owasp":["A05:2021 - Security Misconfiguration","A06:2017 - Security Misconfiguration"],"references":["https://kubernetes.io/docs/concepts/policy/pod-security-policy/#privilege-escalation","https://kubernetes.io/docs/tasks/configure-pod-container/security-context/","https://www.kernel.org/doc/Documentation/prctl/no_new_privs.txt","https://cheatsheetseries.owasp.org/cheatsheets/Docker_Security_Cheat_Sheet.html#rule-4-add-no-new-privileges-flag"],"category":"security","technology":["kubernetes"],"cwe2021-top25":true,"subcategory":["vuln"],"likelihood":"MEDIUM","impact":"MEDIUM","confidence":"MEDIUM","license":"Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license","vulnerability_class":["Improper Authorization"],"source":"https://semgrep.dev/r/yaml.kubernetes.security.allow-privilege-escalation-no-securitycontext.allow-privilege-escalation-no-securitycontext","shortlink":"https://sg.run/eleR","semgrep.dev":{"rule":{"origin":"community","r_id":47276,"rule_id":"WAU5J6","rv_id":947050,"url":"https://semgrep.dev/playground/r/e1T9vzn/yaml.kubernetes.security.allow-privilege-escalation-no-securitycontext.allow-privilege-escalation-no-securitycontext","version_id":"e1T9vzn"}}},"severity":"WARNING","fingerprint":"a48a700ff4af7c51c6c89eeda133bc962da19537ab07ae0c31a3e52fa481f4483b37ae55047243392d0f979a5e17ee48f6a31f9e980c15636bb31f6068cc41ac_0","lines":" - name: busybox","is_ignored":false,"validation_state":"NO_VALIDATOR","engine_kind":"PRO"}},{"check_id":"yaml.kubernetes.security.run-as-non-root.run-as-non-root","path":"insecure-chart/templates/insecure-app.yaml","start":{"line":16,"col":5,"offset":360},"end":{"line":16,"col":9,"offset":364},"extra":{"metavars":{"$1":{"start":{"line":1,"col":1,"offset":0},"end":{"line":1,"col":5,"offset":4},"abstract_content":"spec"},"$SPEC":{"start":{"line":16,"col":5,"offset":360},"end":{"line":16,"col":9,"offset":364},"abstract_content":"spec"}},"message":"When running containers in Kubernetes, it's important to ensure that they are properly secured to prevent privilege escalation attacks. One potential vulnerability is when a container is allowed to run applications as the root user, which could allow an attacker to gain access to sensitive resources. To mitigate this risk, it's recommended to add a `securityContext` to the container, with the parameter `runAsNonRoot` set to `true`. This will ensure that the container runs as a non-root user, limiting the damage that could be caused by any potential attacks. By adding a `securityContext` to the container in your Kubernetes pod, you can help to ensure that your containerized applications are more secure and less vulnerable to privilege escalation attacks.","fix":"spec:\n securityContext:\n runAsNonRoot: true #","metadata":{"references":["https://kubernetes.io/blog/2016/08/security-best-practices-kubernetes-deployment/","https://kubernetes.io/docs/concepts/policy/pod-security-policy/","https://cheatsheetseries.owasp.org/cheatsheets/Docker_Security_Cheat_Sheet.html#rule-2-set-a-user"],"category":"security","cwe":["CWE-250: Execution with Unnecessary Privileges"],"owasp":["A05:2021 - Security Misconfiguration","A06:2017 - Security Misconfiguration"],"technology":["kubernetes"],"subcategory":["audit"],"likelihood":"LOW","impact":"LOW","confidence":"LOW","license":"Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license","vulnerability_class":["Improper Authorization"],"source":"https://semgrep.dev/r/yaml.kubernetes.security.run-as-non-root.run-as-non-root","shortlink":"https://sg.run/dgP5","semgrep.dev":{"rule":{"origin":"community","r_id":10134,"rule_id":"ZqUqeK","rv_id":947064,"url":"https://semgrep.dev/playground/r/JdTDP66/yaml.kubernetes.security.run-as-non-root.run-as-non-root","version_id":"JdTDP66"}}},"severity":"INFO","fingerprint":"aecd9bc14da55ad92c0e9f7a736c60d78bfe9d474551beb8606b92da97641b6af609317b6d0a64e78230567359a2a9889b5bd3ae0b3615997a0dd2adcf7ce4b0_0","lines":" spec:","is_ignored":false,"validation_state":"NO_VALIDATOR","engine_kind":"PRO"}},{"check_id":"yaml.kubernetes.security.privileged-container.privileged-container","path":"insecure-chart/templates/insecure-app.yaml","start":{"line":18,"col":9,"offset":392},"end":{"line":29,"col":42,"offset":873},"extra":{"metavars":{},"message":"Container or pod is running in privileged mode. This grants the container the equivalent of root capabilities on the host machine. This can lead to container escapes, privilege escalation, and other security concerns. Remove the 'privileged' key to disable this capability.","metadata":{"cwe":["CWE-250: Execution with Unnecessary Privileges"],"references":["https://kubernetes.io/docs/concepts/policy/pod-security-policy/#privileged","https://kubernetes.io/docs/tasks/configure-pod-container/security-context/","https://cheatsheetseries.owasp.org/cheatsheets/Docker_Security_Cheat_Sheet.html"],"category":"security","technology":["kubernetes"],"subcategory":["vuln"],"likelihood":"MEDIUM","impact":"MEDIUM","confidence":"MEDIUM","license":"Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license","vulnerability_class":["Improper Authorization"],"source":"https://semgrep.dev/r/yaml.kubernetes.security.privileged-container.privileged-container","shortlink":"https://sg.run/Ygr5","semgrep.dev":{"rule":{"origin":"community","r_id":10058,"rule_id":"oqUz2p","rv_id":947059,"url":"https://semgrep.dev/playground/r/gETeWJA/yaml.kubernetes.security.privileged-container.privileged-container","version_id":"gETeWJA"}}},"severity":"WARNING","fingerprint":"8d8d14c31ce0b4adf0e8554f956c7a41ec94f13ad055f4ece2cb0b87d686c8b738020157487eef0b9e5a722092576c68524c0d9200bff9f851caba9f6fd196c4_0","lines":" - name: {{ .Values.insecureApp.appName }}\n image: \"{{ .Values.insecureApp.image.repository }}:{{ .Values.insecureApp.image.tag }}\"\n env:\n - name: AWS_ACCESS_KEY_ID\n value: AKIA2JAPX77RGLB664VE\n - name: AWS_SECRET_ACCESS_KEY\n value: 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\n securityContext:\n privileged: true\n volumeMounts: \n - name: docker-socket\n mountPath: /var/run/docker.sock","is_ignored":false,"validation_state":"NO_VALIDATOR","engine_kind":"PRO"}},{"check_id":"generic.secrets.security.detected-aws-access-key-id-value.detected-aws-access-key-id-value","path":"insecure-chart/templates/insecure-app.yaml","start":{"line":22,"col":18,"offset":592},"end":{"line":22,"col":38,"offset":612},"extra":{"metavars":{"$1":{"start":{"line":22,"col":18,"offset":592},"end":{"line":22,"col":22,"offset":596},"abstract_content":"AKIA"}},"message":"AWS Access Key ID Value detected. This is a sensitive credential and should not be hardcoded here. Instead, read this value from an environment variable or keep it in a separate, private file.","metadata":{"cwe":["CWE-798: Use of Hard-coded Credentials"],"source-rule-url":"https://github.com/grab/secret-scanner/blob/master/scanner/signatures/pattern.go","category":"security","technology":["secrets","aws"],"confidence":"LOW","owasp":["A07:2021 - Identification and Authentication Failures"],"references":["https://owasp.org/Top10/A07_2021-Identification_and_Authentication_Failures"],"cwe2022-top25":true,"cwe2021-top25":true,"subcategory":["audit"],"likelihood":"LOW","impact":"HIGH","license":"Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license","vulnerability_class":["Hard-coded Secrets"],"source":"https://semgrep.dev/r/generic.secrets.security.detected-aws-access-key-id-value.detected-aws-access-key-id-value","shortlink":"https://sg.run/GeD1","semgrep.dev":{"rule":{"origin":"community","r_id":9048,"rule_id":"oqUevO","rv_id":945484,"url":"https://semgrep.dev/playground/r/rxT6rnL/generic.secrets.security.detected-aws-access-key-id-value.detected-aws-access-key-id-value","version_id":"rxT6rnL"}}},"severity":"ERROR","fingerprint":"ba1eb8f472ad179589a1a9121d0766ca94d347074ca129508802d4537dae2c423d53533f10e88538157501b54215abf7a7d0b8b024b182219f664bbd8111d6a4_0","lines":" value: AKIA2JAPX77RGLB664VE","is_ignored":false,"validation_state":"NO_VALIDATOR","engine_kind":"PRO"}},{"check_id":"yaml.kubernetes.security.allow-privilege-escalation.allow-privilege-escalation","path":"insecure-chart/templates/insecure-app.yaml","start":{"line":25,"col":9,"offset":717},"end":{"line":25,"col":24,"offset":732},"extra":{"metavars":{"$1":{"start":{"line":1,"col":1,"offset":0},"end":{"line":1,"col":16,"offset":15},"abstract_content":"securityContext"},"$CONTAINER":{"start":{"line":18,"col":15,"offset":398},"end":{"line":18,"col":47,"offset":430},"abstract_content":"(())"},"$SC":{"start":{"line":25,"col":9,"offset":717},"end":{"line":25,"col":24,"offset":732},"abstract_content":"securityContext"}},"message":"In Kubernetes, each pod runs in its own isolated environment with its own set of security policies. However, certain container images may contain `setuid` or `setgid` binaries that could allow an attacker to perform privilege escalation and gain access to sensitive resources. To mitigate this risk, it's recommended to add a `securityContext` to the container in the pod, with the parameter `allowPrivilegeEscalation` set to `false`. This will prevent the container from running any privileged processes and limit the impact of any potential attacks. By adding the `allowPrivilegeEscalation` parameter to your the `securityContext`, you can help to ensure that your containerized applications are more secure and less vulnerable to privilege escalation attacks.","fix":"securityContext:\n allowPrivilegeEscalation: false #","metadata":{"cwe":["CWE-732: Incorrect Permission Assignment for Critical Resource"],"owasp":["A05:2021 - Security Misconfiguration","A06:2017 - Security Misconfiguration"],"references":["https://kubernetes.io/docs/concepts/policy/pod-security-policy/#privilege-escalation","https://kubernetes.io/docs/tasks/configure-pod-container/security-context/","https://www.kernel.org/doc/Documentation/prctl/no_new_privs.txt","https://cheatsheetseries.owasp.org/cheatsheets/Docker_Security_Cheat_Sheet.html#rule-4-add-no-new-privileges-flag"],"category":"security","technology":["kubernetes"],"cwe2021-top25":true,"subcategory":["vuln"],"likelihood":"MEDIUM","impact":"MEDIUM","confidence":"MEDIUM","license":"Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license","vulnerability_class":["Improper Authorization"],"source":"https://semgrep.dev/r/yaml.kubernetes.security.allow-privilege-escalation.allow-privilege-escalation","shortlink":"https://sg.run/ljp6","semgrep.dev":{"rule":{"origin":"community","r_id":10057,"rule_id":"6JUqEO","rv_id":947052,"url":"https://semgrep.dev/playground/r/d6TPzeB/yaml.kubernetes.security.allow-privilege-escalation.allow-privilege-escalation","version_id":"d6TPzeB"}}},"severity":"WARNING","fingerprint":"776c179c073a251128c9a229b958fb3881849cef53c32d7c8b5634da2885d6373e79e7a39068a1679423ccd0b409c0620683f9a0c95d65177fb897fb48ffd794_0","lines":" securityContext:","is_ignored":false,"validation_state":"NO_VALIDATOR","engine_kind":"PRO"}},{"check_id":"yaml.kubernetes.security.exposing-docker-socket-hostpath.exposing-docker-socket-hostpath","path":"insecure-chart/templates/insecure-app.yaml","start":{"line":32,"col":9,"offset":950},"end":{"line":33,"col":37,"offset":996},"extra":{"metavars":{},"message":"Exposing host's Docker socket to containers via a volume. The owner of this socket is root. Giving someone access to it is equivalent to giving unrestricted root access to your host. Remove 'docker.sock' from hostpath to prevent this.","metadata":{"cwe":["CWE-250: Execution with Unnecessary Privileges"],"references":["https://kubernetes.io/docs/concepts/storage/volumes/#hostpath","https://kubernetes.io/docs/concepts/policy/pod-security-policy/#volumes-and-file-systems","https://kubernetes.io/docs/tasks/configure-pod-container/security-context/","https://cheatsheetseries.owasp.org/cheatsheets/Docker_Security_Cheat_Sheet.html#rule-1-do-not-expose-the-docker-daemon-socket-even-to-the-containers"],"category":"security","technology":["kubernetes"],"subcategory":["vuln"],"likelihood":"LOW","impact":"HIGH","confidence":"MEDIUM","license":"Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license","vulnerability_class":["Improper Authorization"],"source":"https://semgrep.dev/r/yaml.kubernetes.security.exposing-docker-socket-hostpath.exposing-docker-socket-hostpath","shortlink":"https://sg.run/v0pR","semgrep.dev":{"rule":{"origin":"community","r_id":10133,"rule_id":"d8Uz6v","rv_id":947054,"url":"https://semgrep.dev/playground/r/nWTpYZe/yaml.kubernetes.security.exposing-docker-socket-hostpath.exposing-docker-socket-hostpath","version_id":"nWTpYZe"}}},"severity":"WARNING","fingerprint":"7a6331004e7b6359a35200b986c57fc54a82ffc3d1eb71848fd4606545dfb3d195d9a1edd879c8d74c12364291a00adef95be1779caead61655b0590e63d01a9_0","lines":" hostPath:\n path: /var/run/docker.sock","is_ignored":false,"validation_state":"NO_VALIDATOR","engine_kind":"PRO"}},{"check_id":"yaml.kubernetes.security.run-as-non-root.run-as-non-root","path":"insecure-chart/templates/workload-security-evaluator.yaml","start":{"line":16,"col":5,"offset":430},"end":{"line":16,"col":9,"offset":434},"extra":{"metavars":{"$1":{"start":{"line":1,"col":1,"offset":0},"end":{"line":1,"col":5,"offset":4},"abstract_content":"spec"},"$SPEC":{"start":{"line":16,"col":5,"offset":430},"end":{"line":16,"col":9,"offset":434},"abstract_content":"spec"}},"message":"When running containers in Kubernetes, it's important to ensure that they are properly secured to prevent privilege escalation attacks. One potential vulnerability is when a container is allowed to run applications as the root user, which could allow an attacker to gain access to sensitive resources. To mitigate this risk, it's recommended to add a `securityContext` to the container, with the parameter `runAsNonRoot` set to `true`. This will ensure that the container runs as a non-root user, limiting the damage that could be caused by any potential attacks. By adding a `securityContext` to the container in your Kubernetes pod, you can help to ensure that your containerized applications are more secure and less vulnerable to privilege escalation attacks.","fix":"spec:\n securityContext:\n runAsNonRoot: true #","metadata":{"references":["https://kubernetes.io/blog/2016/08/security-best-practices-kubernetes-deployment/","https://kubernetes.io/docs/concepts/policy/pod-security-policy/","https://cheatsheetseries.owasp.org/cheatsheets/Docker_Security_Cheat_Sheet.html#rule-2-set-a-user"],"category":"security","cwe":["CWE-250: Execution with Unnecessary Privileges"],"owasp":["A05:2021 - Security Misconfiguration","A06:2017 - Security Misconfiguration"],"technology":["kubernetes"],"subcategory":["audit"],"likelihood":"LOW","impact":"LOW","confidence":"LOW","license":"Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license","vulnerability_class":["Improper Authorization"],"source":"https://semgrep.dev/r/yaml.kubernetes.security.run-as-non-root.run-as-non-root","shortlink":"https://sg.run/dgP5","semgrep.dev":{"rule":{"origin":"community","r_id":10134,"rule_id":"ZqUqeK","rv_id":947064,"url":"https://semgrep.dev/playground/r/JdTDP66/yaml.kubernetes.security.run-as-non-root.run-as-non-root","version_id":"JdTDP66"}}},"severity":"INFO","fingerprint":"3a55f533ac5a5a36509690fa17d989dd74b859c9205068f60ce9ebc206764744c02e0240842db0f7d7fc4dc7b2cab157033ce576fdc1904bd58eb04f84b184ec_0","lines":" spec:","is_ignored":false,"validation_state":"NO_VALIDATOR","engine_kind":"PRO"}},{"check_id":"yaml.kubernetes.security.privileged-container.privileged-container","path":"insecure-chart/templates/workload-security-evaluator.yaml","start":{"line":18,"col":9,"offset":462},"end":{"line":29,"col":30,"offset":966},"extra":{"metavars":{},"message":"Container or pod is running in privileged mode. This grants the container the equivalent of root capabilities on the host machine. This can lead to container escapes, privilege escalation, and other security concerns. Remove the 'privileged' key to disable this capability.","metadata":{"cwe":["CWE-250: Execution with Unnecessary Privileges"],"references":["https://kubernetes.io/docs/concepts/policy/pod-security-policy/#privileged","https://kubernetes.io/docs/tasks/configure-pod-container/security-context/","https://cheatsheetseries.owasp.org/cheatsheets/Docker_Security_Cheat_Sheet.html"],"category":"security","technology":["kubernetes"],"subcategory":["vuln"],"likelihood":"MEDIUM","impact":"MEDIUM","confidence":"MEDIUM","license":"Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license","vulnerability_class":["Improper Authorization"],"source":"https://semgrep.dev/r/yaml.kubernetes.security.privileged-container.privileged-container","shortlink":"https://sg.run/Ygr5","semgrep.dev":{"rule":{"origin":"community","r_id":10058,"rule_id":"oqUz2p","rv_id":947059,"url":"https://semgrep.dev/playground/r/gETeWJA/yaml.kubernetes.security.privileged-container.privileged-container","version_id":"gETeWJA"}}},"severity":"WARNING","fingerprint":"ffd554b207fb80ce294cc034390d4474858d4264f036ada1a1c11e8b6925b9d1d3231425104899b500b80be005ad1001395576ee17aff2683b9cf73520697663_0","lines":" - name: {{ .Values.workloadSecurityEvaluator.appName }}\n image: \"{{ .Values.workloadSecurityEvaluator.image.repository }}:{{ .Values.workloadSecurityEvaluator.image.tag }}\"\n env:\n - name: AWS_ACCESS_KEY_ID\n value: AKIA2JAPX77RGLB664VE\n - name: AWS_SECRET_ACCESS_KEY\n value: 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\n securityContext:\n privileged: true\n volumeMounts:\n - mountPath: /var/run/docker.sock\n name: docker-socket","is_ignored":false,"validation_state":"NO_VALIDATOR","engine_kind":"PRO"}},{"check_id":"generic.secrets.security.detected-aws-access-key-id-value.detected-aws-access-key-id-value","path":"insecure-chart/templates/workload-security-evaluator.yaml","start":{"line":22,"col":18,"offset":704},"end":{"line":22,"col":38,"offset":724},"extra":{"metavars":{"$1":{"start":{"line":22,"col":18,"offset":704},"end":{"line":22,"col":22,"offset":708},"abstract_content":"AKIA"}},"message":"AWS Access Key ID Value detected. This is a sensitive credential and should not be hardcoded here. Instead, read this value from an environment variable or keep it in a separate, private file.","metadata":{"cwe":["CWE-798: Use of Hard-coded Credentials"],"source-rule-url":"https://github.com/grab/secret-scanner/blob/master/scanner/signatures/pattern.go","category":"security","technology":["secrets","aws"],"confidence":"LOW","owasp":["A07:2021 - Identification and Authentication Failures"],"references":["https://owasp.org/Top10/A07_2021-Identification_and_Authentication_Failures"],"cwe2022-top25":true,"cwe2021-top25":true,"subcategory":["audit"],"likelihood":"LOW","impact":"HIGH","license":"Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license","vulnerability_class":["Hard-coded Secrets"],"source":"https://semgrep.dev/r/generic.secrets.security.detected-aws-access-key-id-value.detected-aws-access-key-id-value","shortlink":"https://sg.run/GeD1","semgrep.dev":{"rule":{"origin":"community","r_id":9048,"rule_id":"oqUevO","rv_id":945484,"url":"https://semgrep.dev/playground/r/rxT6rnL/generic.secrets.security.detected-aws-access-key-id-value.detected-aws-access-key-id-value","version_id":"rxT6rnL"}}},"severity":"ERROR","fingerprint":"d5ec8967dc8f57fcd421997dda6a0abac3a0cc762e6534246a83ffc2a37741ad06e18ee176aa6dbbc85c400080f78f59914c17b2bb32704ae8b360092860feca_0","lines":" value: AKIA2JAPX77RGLB664VE","is_ignored":false,"validation_state":"NO_VALIDATOR","engine_kind":"PRO"}},{"check_id":"yaml.kubernetes.security.allow-privilege-escalation.allow-privilege-escalation","path":"insecure-chart/templates/workload-security-evaluator.yaml","start":{"line":25,"col":9,"offset":829},"end":{"line":25,"col":24,"offset":844},"extra":{"metavars":{"$1":{"start":{"line":1,"col":1,"offset":0},"end":{"line":1,"col":16,"offset":15},"abstract_content":"securityContext"},"$CONTAINER":{"start":{"line":18,"col":15,"offset":468},"end":{"line":18,"col":61,"offset":514},"abstract_content":"(())"},"$SC":{"start":{"line":25,"col":9,"offset":829},"end":{"line":25,"col":24,"offset":844},"abstract_content":"securityContext"}},"message":"In Kubernetes, each pod runs in its own isolated environment with its own set of security policies. However, certain container images may contain `setuid` or `setgid` binaries that could allow an attacker to perform privilege escalation and gain access to sensitive resources. To mitigate this risk, it's recommended to add a `securityContext` to the container in the pod, with the parameter `allowPrivilegeEscalation` set to `false`. This will prevent the container from running any privileged processes and limit the impact of any potential attacks. By adding the `allowPrivilegeEscalation` parameter to your the `securityContext`, you can help to ensure that your containerized applications are more secure and less vulnerable to privilege escalation attacks.","fix":"securityContext:\n allowPrivilegeEscalation: false #","metadata":{"cwe":["CWE-732: Incorrect Permission Assignment for Critical Resource"],"owasp":["A05:2021 - Security Misconfiguration","A06:2017 - Security Misconfiguration"],"references":["https://kubernetes.io/docs/concepts/policy/pod-security-policy/#privilege-escalation","https://kubernetes.io/docs/tasks/configure-pod-container/security-context/","https://www.kernel.org/doc/Documentation/prctl/no_new_privs.txt","https://cheatsheetseries.owasp.org/cheatsheets/Docker_Security_Cheat_Sheet.html#rule-4-add-no-new-privileges-flag"],"category":"security","technology":["kubernetes"],"cwe2021-top25":true,"subcategory":["vuln"],"likelihood":"MEDIUM","impact":"MEDIUM","confidence":"MEDIUM","license":"Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license","vulnerability_class":["Improper Authorization"],"source":"https://semgrep.dev/r/yaml.kubernetes.security.allow-privilege-escalation.allow-privilege-escalation","shortlink":"https://sg.run/ljp6","semgrep.dev":{"rule":{"origin":"community","r_id":10057,"rule_id":"6JUqEO","rv_id":947052,"url":"https://semgrep.dev/playground/r/d6TPzeB/yaml.kubernetes.security.allow-privilege-escalation.allow-privilege-escalation","version_id":"d6TPzeB"}}},"severity":"WARNING","fingerprint":"7021c010b8d0b11136f68b6c85d57b318861ada3d7a906b6942146314eb665dcc6e36826b1deb04c3c890bc829879387ca5ebfcd9d6960554f48900e55355b8f_0","lines":" securityContext:","is_ignored":false,"validation_state":"NO_VALIDATOR","engine_kind":"PRO"}},{"check_id":"yaml.kubernetes.security.exposing-docker-socket-hostpath.exposing-docker-socket-hostpath","path":"insecure-chart/templates/workload-security-evaluator.yaml","start":{"line":31,"col":9,"offset":990},"end":{"line":32,"col":37,"offset":1036},"extra":{"metavars":{},"message":"Exposing host's Docker socket to containers via a volume. The owner of this socket is root. Giving someone access to it is equivalent to giving unrestricted root access to your host. Remove 'docker.sock' from hostpath to prevent this.","metadata":{"cwe":["CWE-250: Execution with Unnecessary Privileges"],"references":["https://kubernetes.io/docs/concepts/storage/volumes/#hostpath","https://kubernetes.io/docs/concepts/policy/pod-security-policy/#volumes-and-file-systems","https://kubernetes.io/docs/tasks/configure-pod-container/security-context/","https://cheatsheetseries.owasp.org/cheatsheets/Docker_Security_Cheat_Sheet.html#rule-1-do-not-expose-the-docker-daemon-socket-even-to-the-containers"],"category":"security","technology":["kubernetes"],"subcategory":["vuln"],"likelihood":"LOW","impact":"HIGH","confidence":"MEDIUM","license":"Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license","vulnerability_class":["Improper Authorization"],"source":"https://semgrep.dev/r/yaml.kubernetes.security.exposing-docker-socket-hostpath.exposing-docker-socket-hostpath","shortlink":"https://sg.run/v0pR","semgrep.dev":{"rule":{"origin":"community","r_id":10133,"rule_id":"d8Uz6v","rv_id":947054,"url":"https://semgrep.dev/playground/r/nWTpYZe/yaml.kubernetes.security.exposing-docker-socket-hostpath.exposing-docker-socket-hostpath","version_id":"nWTpYZe"}}},"severity":"WARNING","fingerprint":"b0fa2105cf388aaf61f7d9b9f73a03a2342c2992b3a938f4e64785c6ec896ee80151e782d77db28ca4efc171718fee4f95c80bb416c5f8c965787ea2faff9d45_0","lines":" - hostPath:\n path: /var/run/docker.sock","is_ignored":false,"validation_state":"NO_VALIDATOR","engine_kind":"PRO"}},{"check_id":"dockerfile.security.missing-user-entrypoint.missing-user-entrypoint","path":"insecure-java/Dockerfile","start":{"line":7,"col":1,"offset":130},"end":{"line":7,"col":38,"offset":167},"extra":{"metavars":{"$...VARS":{"start":{"line":7,"col":12,"offset":141},"end":{"line":7,"col":38,"offset":167},"abstract_content":"[\"java\"\"-jar\"\"/app.jar\"]"}},"message":"By not specifying a USER, a program in the container may run as 'root'. This is a security hazard. If an attacker can control a process running as root, they may have control over the container. Ensure that the last USER in a Dockerfile is a USER other than 'root'.","fix":"USER non-root\nENTRYPOINT [\"java\",\"-jar\",\"/app.jar\"]","metadata":{"cwe":["CWE-269: Improper Privilege Management"],"category":"security","technology":["dockerfile"],"confidence":"MEDIUM","owasp":["A04:2021 - Insecure Design"],"references":["https://owasp.org/Top10/A04_2021-Insecure_Design"],"subcategory":["audit"],"likelihood":"LOW","impact":"MEDIUM","license":"Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license","vulnerability_class":["Improper Authorization"],"source":"https://semgrep.dev/r/dockerfile.security.missing-user-entrypoint.missing-user-entrypoint","shortlink":"https://sg.run/k281","semgrep.dev":{"rule":{"origin":"community","r_id":47272,"rule_id":"ReUW9E","rv_id":945268,"url":"https://semgrep.dev/playground/r/K3TJbJg/dockerfile.security.missing-user-entrypoint.missing-user-entrypoint","version_id":"K3TJbJg"}}},"severity":"ERROR","fingerprint":"8a9ae537c70377699ac7b95add8f39d7bc1192dbb0a0a2e524f7a4e126adfa3e0bcc6c074eeb891021d031d42e016675c69dd491f4bc4116bef9ab0dba840233_0","lines":"ENTRYPOINT [\"java\",\"-jar\",\"/app.jar\"]","is_ignored":false,"validation_state":"NO_VALIDATOR","engine_kind":"PRO"}},{"check_id":"java.spring.security.injection.tainted-sql-string.tainted-sql-string","path":"insecure-java/src/main/java/com/example/catapp/controllers/CatPictureController.java","start":{"line":25,"col":24,"offset":763},"end":{"line":25,"col":80,"offset":819},"extra":{"metavars":{"$1":{"start":{"line":1,"col":1,"offset":0},"end":{"line":1,"col":7,"offset":6},"abstract_content":"SELECT"},"$METHODNAME":{"start":{"line":23,"col":19,"offset":652},"end":{"line":23,"col":25,"offset":658},"abstract_content":"search"},"$REQ":{"start":{"line":23,"col":27,"offset":660},"end":{"line":23,"col":39,"offset":672},"abstract_content":"RequestParam"},"$TYPE":{"start":{"line":23,"col":40,"offset":673},"end":{"line":23,"col":46,"offset":679},"abstract_content":"String"},"$SOURCE":{"start":{"line":23,"col":47,"offset":680},"end":{"line":23,"col":51,"offset":684},"abstract_content":"name"},"$SQLSTR":{"start":{"line":25,"col":25,"offset":764},"end":{"line":25,"col":66,"offset":805},"abstract_content":"SELECT * FROM cat_pictures WHERE name = '"}},"message":"User data flows into this manually-constructed SQL string. User data can be safely inserted into SQL strings using prepared statements or an object-relational mapper (ORM). Manually-constructed SQL strings is a possible indicator of SQL injection, which could let an attacker steal or manipulate data from the database. Instead, use prepared statements (`connection.PreparedStatement`) or a safe library.","metadata":{"cwe":["CWE-89: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')"],"owasp":["A01:2017 - Injection","A03:2021 - Injection"],"references":["https://docs.oracle.com/javase/7/docs/api/java/sql/PreparedStatement.html"],"category":"security","technology":["spring"],"cwe2022-top25":true,"cwe2021-top25":true,"subcategory":["vuln"],"likelihood":"HIGH","impact":"MEDIUM","confidence":"MEDIUM","interfile":true,"license":"Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license","vulnerability_class":["SQL Injection"],"source":"https://semgrep.dev/r/java.spring.security.injection.tainted-sql-string.tainted-sql-string","shortlink":"https://sg.run/9rzz","semgrep.dev":{"rule":{"origin":"community","r_id":14767,"rule_id":"10UdRR","rv_id":945745,"url":"https://semgrep.dev/playground/r/8KTKj0G/java.spring.security.injection.tainted-sql-string.tainted-sql-string","version_id":"8KTKj0G"}}},"severity":"ERROR","fingerprint":"972b22c89a9412da436c82ad486252920fb59fae559c701cb90b25028e1799517d5c6797f5fd5a85ab13c3f05366cc2a858bdb566d53fc311eb720b717fae81f_0","lines":" String query = \"SELECT * FROM cat_pictures WHERE name = '\" + name + \"'\";","is_ignored":false,"validation_state":"NO_VALIDATOR","dataflow_trace":{"taint_source":["CliLoc",[{"path":"insecure-java/src/main/java/com/example/catapp/controllers/CatPictureController.java","start":{"line":23,"col":47,"offset":680},"end":{"line":23,"col":51,"offset":684}},"name"]],"intermediate_vars":[{"location":{"path":"insecure-java/src/main/java/com/example/catapp/controllers/CatPictureController.java","start":{"line":23,"col":47,"offset":680},"end":{"line":23,"col":51,"offset":684}},"content":"name"}],"taint_sink":["CliLoc",[{"path":"insecure-java/src/main/java/com/example/catapp/controllers/CatPictureController.java","start":{"line":25,"col":24,"offset":763},"end":{"line":25,"col":80,"offset":819}},"\"SELECT * FROM cat_pictures WHERE name = '\" + name + \"'\""]]},"engine_kind":"PRO"}},{"check_id":"java.lang.security.audit.object-deserialization.object-deserialization","path":"insecure-java/src/main/java/com/example/insecurejava/UnsafeDeserializationController.java","start":{"line":16,"col":13,"offset":594},"end":{"line":16,"col":91,"offset":672},"extra":{"metavars":{},"message":"Found object deserialization using ObjectInputStream. Deserializing entire Java objects is dangerous because malicious actors can create Java object streams with unintended consequences. Ensure that the objects being deserialized are not user-controlled. If this must be done, consider using HMACs to sign the data stream to make sure it is not tampered with, or consider only transmitting object fields and populating a new object.","metadata":{"cwe":["CWE-502: Deserialization of Untrusted Data"],"owasp":["A08:2017 - Insecure Deserialization","A08:2021 - Software and Data Integrity Failures"],"source-rule-url":"https://find-sec-bugs.github.io/bugs.htm#OBJECT_DESERIALIZATION","references":["https://www.owasp.org/index.php/Deserialization_of_untrusted_data","https://www.oracle.com/java/technologies/javase/seccodeguide.html#8"],"category":"security","technology":["java"],"cwe2022-top25":true,"cwe2021-top25":true,"subcategory":["audit"],"likelihood":"LOW","impact":"HIGH","confidence":"LOW","license":"Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license","vulnerability_class":["Insecure Deserialization "],"source":"https://semgrep.dev/r/java.lang.security.audit.object-deserialization.object-deserialization","shortlink":"https://sg.run/Ek0A","semgrep.dev":{"rule":{"origin":"community","r_id":9181,"rule_id":"GdU7py","rv_id":945687,"url":"https://semgrep.dev/playground/r/bZTXw4q/java.lang.security.audit.object-deserialization.object-deserialization","version_id":"bZTXw4q"}}},"severity":"WARNING","fingerprint":"774378c1d79256d5bab570074c4a6bf6703250887fca212f1a813ada0f8d5de5e786961d4f0b746e5f6292cc9b46c41ca4308c9367ddf6932267ba763012620e_0","lines":" ObjectInputStream ois = new ObjectInputStream(new ByteArrayInputStream(data));","is_ignored":false,"validation_state":"NO_VALIDATOR","engine_kind":"PRO"}},{"check_id":"java.spring.security.objectinputstream-deserialization-spring.objectinputstream-deserialization-spring","path":"insecure-java/src/main/java/com/example/insecurejava/UnsafeDeserializationController.java","start":{"line":16,"col":59,"offset":640},"end":{"line":16,"col":89,"offset":670},"extra":{"metavars":{"$1":{"start":{"line":1,"col":1,"offset":0},"end":{"line":1,"col":12,"offset":11},"abstract_content":"RequestBody"},"$RET":{"start":{"line":14,"col":12,"offset":495},"end":{"line":14,"col":34,"offset":517},"abstract_content":"ResponseEntity"},"$METHOD":{"start":{"line":14,"col":35,"offset":518},"end":{"line":14,"col":56,"offset":539},"abstract_content":"unsafeDeserialization"},"$REQ":{"start":{"line":14,"col":58,"offset":541},"end":{"line":14,"col":69,"offset":552},"abstract_content":"RequestBody"},"$TYPE":{"start":{"line":14,"col":70,"offset":553},"end":{"line":14,"col":76,"offset":559},"abstract_content":"byte[]"},"$SOURCE":{"start":{"line":14,"col":77,"offset":560},"end":{"line":14,"col":81,"offset":564},"abstract_content":"data"},"$IN":{"start":{"line":16,"col":59,"offset":640},"end":{"line":16,"col":89,"offset":670},"abstract_content":"new ByteArrayInputStream(data)"}},"message":"The application may convert user-controlled data into an object, which can lead to an insecure deserialization vulnerability. An attacker can create a malicious serialized object, pass it to the application, and take advantage of the deserialization process to perform Denial-of-service (DoS), Remote code execution (RCE), or bypass access control measures. To prevent this vulnerability, leverage data formats such as JSON or XML as safer alternatives. If you need to deserialize user input in a specific format, consider digitally signing the data before serialization to prevent tampering. For more information, see: [Deserialization prevention](https://cheatsheetseries.owasp.org/cheatsheets/Deserialization_Cheat_Sheet.html) We do not recommend deserializing untrusted data with the `ObjectInputStream`. If you must, you can try overriding the `ObjectInputStream#resolveClass()` method or using a safe replacement for the generic `readObject()` method.","metadata":{"likelihood":"MEDIUM","impact":"HIGH","confidence":"HIGH","category":"security","subcategory":["vuln"],"cwe":["CWE-502: Deserialization of Untrusted Data"],"cwe2020-top25":true,"cwe2021-top25":true,"cwe2022-top25":true,"display-name":"Unsafe Deserialization with Spring","functional-categories":["deserialization::sink::load-object::apache.commons","deserialization::sink::load-object::java.io","web::source::cookie::Spring","web::source::header::Spring","web::source::http-body::Spring","web::source::http-params::Spring","web::source::url-path-params::Spring"],"owasp":["A08:2017 - Insecure Deserialization","A08:2021 - Software and Data Integrity Failures"],"references":["https://owasp.org/Top10/A08_2021-Software_and_Data_Integrity_Failures"],"supersedes":["java.servlets.security.objectinputstream-deserialization-servlets.objectinputstream-deserialization-servlets"],"technology":["Spring","java"],"license":"Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license","vulnerability_class":["Insecure Deserialization "],"source":"https://semgrep.dev/r/java.spring.security.objectinputstream-deserialization-spring.objectinputstream-deserialization-spring","shortlink":"https://sg.run/n1rY","semgrep.dev":{"rule":{"origin":"pro_rules","r_id":46836,"rule_id":"x8UbG3","rv_id":973726,"url":"https://semgrep.dev/playground/r/44TZ832/java.spring.security.objectinputstream-deserialization-spring.objectinputstream-deserialization-spring","version_id":"44TZ832"}}},"severity":"ERROR","fingerprint":"cf7d59dc3cc6ec8769d1ad54d6b20023fdc6a24ee7ca6c8f25038ac25f17038a6b41f6fdc82c002123e671f0a1de733e48b7071ad905fe83c69c36be56df73b4_0","lines":" ObjectInputStream ois = new ObjectInputStream(new ByteArrayInputStream(data));","is_ignored":false,"validation_state":"NO_VALIDATOR","dataflow_trace":{"taint_source":["CliLoc",[{"path":"insecure-java/src/main/java/com/example/insecurejava/UnsafeDeserializationController.java","start":{"line":14,"col":77,"offset":560},"end":{"line":14,"col":81,"offset":564}},"data"]],"intermediate_vars":[{"location":{"path":"insecure-java/src/main/java/com/example/insecurejava/UnsafeDeserializationController.java","start":{"line":14,"col":77,"offset":560},"end":{"line":14,"col":81,"offset":564}},"content":"data"}],"taint_sink":["CliLoc",[{"path":"insecure-java/src/main/java/com/example/insecurejava/UnsafeDeserializationController.java","start":{"line":16,"col":59,"offset":640},"end":{"line":16,"col":89,"offset":670}},"new ByteArrayInputStream(data)"]]},"engine_kind":"PRO"}},{"check_id":"java.lang.security.audit.active-debug-code-printstacktrace.active-debug-code-printstacktrace","path":"insecure-java/src/main/java/com/example/insecurejava/UnsafeDeserializationController.java","start":{"line":20,"col":13,"offset":870},"end":{"line":20,"col":32,"offset":889},"extra":{"metavars":{"$EXCEPTION":{"start":{"line":20,"col":13,"offset":870},"end":{"line":20,"col":14,"offset":871},"abstract_content":"e"}},"message":"Possible active debug code detected. Deploying an application with debug code can create unintended entry points or expose sensitive information.","metadata":{"likelihood":"LOW","impact":"LOW","confidence":"MEDIUM","category":"security","subcategory":["audit"],"cwe":["CWE-489: Active Debug Code"],"functional-categories":["debug::search::active-debug-code::java.lang"],"owasp":["A10:2004 - Insecure Configuration Management","A06:2017 - Security Misconfiguration","A05:2021 - Security Misconfiguration"],"references":["https://cwe.mitre.org/data/definitions/489.html","https://www.acunetix.com/vulnerabilities/web/stack-trace-disclosure-java/","https://owasp.org/www-project-web-security-testing-guide/v41/4-Web_Application_Security_Testing/08-Testing_for_Error_Handling/02-Testing_for_Stack_Traces","https://www.securecodewarrior.com/blog/coders-conquer-security-share-learn-series-information-exposure"],"technology":["java"],"license":"Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license","vulnerability_class":["Active Debug Code"],"source":"https://semgrep.dev/r/java.lang.security.audit.active-debug-code-printstacktrace.active-debug-code-printstacktrace","shortlink":"https://sg.run/4K8z","semgrep.dev":{"rule":{"origin":"pro_rules","r_id":27144,"rule_id":"v8U0rZ","rv_id":947426,"url":"https://semgrep.dev/playground/r/GxTP0lB/java.lang.security.audit.active-debug-code-printstacktrace.active-debug-code-printstacktrace","version_id":"GxTP0lB"}}},"severity":"WARNING","fingerprint":"2f2eab275674c6639e50192e695448a7c772946f53353aaee757181220ac95afd0f966ae7a8030ed35c10335559cfd3dc575ef1b0469ca831144c249ce451bd9_0","lines":" e.printStackTrace();","is_ignored":false,"validation_state":"NO_VALIDATOR","engine_kind":"PRO"}},{"check_id":"python.django.security.django-no-csrf-token.django-no-csrf-token","path":"insecure-java/src/main/resources/templates/addComment.html","start":{"line":10,"col":5,"offset":425},"end":{"line":14,"col":12,"offset":705},"extra":{"metavars":{"$1":{"start":{"line":1,"col":1,"offset":0},"end":{"line":1,"col":5,"offset":4},"abstract_content":"post"},"$METHOD":{"start":{"line":10,"col":57,"offset":477},"end":{"line":10,"col":61,"offset":481},"abstract_content":"post"}},"message":"Manually-created forms in django templates should specify a csrf_token to prevent CSRF attacks.","metadata":{"category":"security","cwe":"CWE-352: Cross-Site Request Forgery (CSRF)","references":["https://docs.djangoproject.com/en/4.2/howto/csrf/"],"confidence":"MEDIUM","likelihood":"MEDIUM","impact":"MEDIUM","subcategory":["audit"],"technology":["django"],"license":"Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license","vulnerability_class":["Cross-Site Request Forgery (CSRF)"],"source":"https://semgrep.dev/r/python.django.security.django-no-csrf-token.django-no-csrf-token","shortlink":"https://sg.run/N0Bp","semgrep.dev":{"rule":{"origin":"community","r_id":73471,"rule_id":"PeUyYG","rv_id":946160,"url":"https://semgrep.dev/playground/r/BjT1NRl/python.django.security.django-no-csrf-token.django-no-csrf-token","version_id":"BjT1NRl"}}},"severity":"WARNING","fingerprint":"5195968eb1be4ef8a2cfa22014b4dca0bacb3cf656e20ede1b9f6636541b678ca576e1417883fcaadd8acac0ab3296c32e9068ecb662d0b91e386e823c8d43df_0","lines":" ","is_ignored":false,"validation_state":"NO_VALIDATOR","engine_kind":"PRO"}},{"check_id":"python.django.security.django-no-csrf-token.django-no-csrf-token","path":"insecure-java/src/main/resources/templates/comments.html","start":{"line":13,"col":13,"offset":452},"end":{"line":16,"col":20,"offset":693},"extra":{"metavars":{"$1":{"start":{"line":1,"col":1,"offset":0},"end":{"line":1,"col":5,"offset":4},"abstract_content":"post"},"$METHOD":{"start":{"line":13,"col":68,"offset":507},"end":{"line":13,"col":72,"offset":511},"abstract_content":"post"}},"message":"Manually-created forms in django templates should specify a csrf_token to prevent CSRF attacks.","metadata":{"category":"security","cwe":"CWE-352: Cross-Site Request Forgery (CSRF)","references":["https://docs.djangoproject.com/en/4.2/howto/csrf/"],"confidence":"MEDIUM","likelihood":"MEDIUM","impact":"MEDIUM","subcategory":["audit"],"technology":["django"],"license":"Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license","vulnerability_class":["Cross-Site Request Forgery (CSRF)"],"source":"https://semgrep.dev/r/python.django.security.django-no-csrf-token.django-no-csrf-token","shortlink":"https://sg.run/N0Bp","semgrep.dev":{"rule":{"origin":"community","r_id":73471,"rule_id":"PeUyYG","rv_id":946160,"url":"https://semgrep.dev/playground/r/BjT1NRl/python.django.security.django-no-csrf-token.django-no-csrf-token","version_id":"BjT1NRl"}}},"severity":"WARNING","fingerprint":"83efea89720688f163f6bb09d1273d2c4207b38c65d2664660a5f8fa1ebbf337f1ffd9dbcb0351abbd51e711b53269ab547017075f90c945a0ea8c648efe78cf_0","lines":" ","is_ignored":false,"validation_state":"NO_VALIDATOR","engine_kind":"PRO"}},{"check_id":"python.django.security.django-no-csrf-token.django-no-csrf-token","path":"insecure-java/src/main/resources/templates/csrf_attack.html","start":{"line":9,"col":5,"offset":231},"end":{"line":11,"col":12,"offset":381},"extra":{"metavars":{"$1":{"start":{"line":1,"col":1,"offset":0},"end":{"line":1,"col":5,"offset":4},"abstract_content":"post"},"$METHOD":{"start":{"line":9,"col":64,"offset":290},"end":{"line":9,"col":68,"offset":294},"abstract_content":"post"}},"message":"Manually-created forms in django templates should specify a csrf_token to prevent CSRF attacks.","metadata":{"category":"security","cwe":"CWE-352: Cross-Site Request Forgery (CSRF)","references":["https://docs.djangoproject.com/en/4.2/howto/csrf/"],"confidence":"MEDIUM","likelihood":"MEDIUM","impact":"MEDIUM","subcategory":["audit"],"technology":["django"],"license":"Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license","vulnerability_class":["Cross-Site Request Forgery (CSRF)"],"source":"https://semgrep.dev/r/python.django.security.django-no-csrf-token.django-no-csrf-token","shortlink":"https://sg.run/N0Bp","semgrep.dev":{"rule":{"origin":"community","r_id":73471,"rule_id":"PeUyYG","rv_id":946160,"url":"https://semgrep.dev/playground/r/BjT1NRl/python.django.security.django-no-csrf-token.django-no-csrf-token","version_id":"BjT1NRl"}}},"severity":"WARNING","fingerprint":"a0bb982292e4d85d46ab7d43847c828d7cd9f14c12c773fbbe8ef38baec3a0a1e928441af3b460a47479a4e9b02cf13d7a298d0bc43ff6e93fcd5e5bd6f466e5_0","lines":" ","is_ignored":false,"validation_state":"NO_VALIDATOR","engine_kind":"PRO"}},{"check_id":"python.django.security.django-no-csrf-token.django-no-csrf-token","path":"insecure-java/src/main/resources/templates/delete.html","start":{"line":10,"col":5,"offset":366},"end":{"line":13,"col":12,"offset":562},"extra":{"metavars":{"$1":{"start":{"line":1,"col":1,"offset":0},"end":{"line":1,"col":5,"offset":4},"abstract_content":"post"},"$METHOD":{"start":{"line":10,"col":53,"offset":414},"end":{"line":10,"col":57,"offset":418},"abstract_content":"post"}},"message":"Manually-created forms in django templates should specify a csrf_token to prevent CSRF attacks.","metadata":{"category":"security","cwe":"CWE-352: Cross-Site Request Forgery (CSRF)","references":["https://docs.djangoproject.com/en/4.2/howto/csrf/"],"confidence":"MEDIUM","likelihood":"MEDIUM","impact":"MEDIUM","subcategory":["audit"],"technology":["django"],"license":"Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license","vulnerability_class":["Cross-Site Request Forgery (CSRF)"],"source":"https://semgrep.dev/r/python.django.security.django-no-csrf-token.django-no-csrf-token","shortlink":"https://sg.run/N0Bp","semgrep.dev":{"rule":{"origin":"community","r_id":73471,"rule_id":"PeUyYG","rv_id":946160,"url":"https://semgrep.dev/playground/r/BjT1NRl/python.django.security.django-no-csrf-token.django-no-csrf-token","version_id":"BjT1NRl"}}},"severity":"WARNING","fingerprint":"67d4cf1e50c6d8501e12adbe719f860782fb3b95872d174bd05fc16b23a18b575bea13c5bfa1d015c18ca55d2227d050dc25c734e4a26c4ebaa21c6242e07c20_0","lines":" ","is_ignored":false,"validation_state":"NO_VALIDATOR","engine_kind":"PRO"}},{"check_id":"python.django.security.django-no-csrf-token.django-no-csrf-token","path":"insecure-java/src/main/resources/templates/editProfile.html","start":{"line":10,"col":5,"offset":374},"end":{"line":15,"col":12,"offset":751},"extra":{"metavars":{"$1":{"start":{"line":1,"col":1,"offset":0},"end":{"line":1,"col":5,"offset":4},"abstract_content":"post"},"$METHOD":{"start":{"line":10,"col":58,"offset":427},"end":{"line":10,"col":62,"offset":431},"abstract_content":"post"}},"message":"Manually-created forms in django templates should specify a csrf_token to prevent CSRF attacks.","metadata":{"category":"security","cwe":"CWE-352: Cross-Site Request Forgery (CSRF)","references":["https://docs.djangoproject.com/en/4.2/howto/csrf/"],"confidence":"MEDIUM","likelihood":"MEDIUM","impact":"MEDIUM","subcategory":["audit"],"technology":["django"],"license":"Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license","vulnerability_class":["Cross-Site Request Forgery (CSRF)"],"source":"https://semgrep.dev/r/python.django.security.django-no-csrf-token.django-no-csrf-token","shortlink":"https://sg.run/N0Bp","semgrep.dev":{"rule":{"origin":"community","r_id":73471,"rule_id":"PeUyYG","rv_id":946160,"url":"https://semgrep.dev/playground/r/BjT1NRl/python.django.security.django-no-csrf-token.django-no-csrf-token","version_id":"BjT1NRl"}}},"severity":"WARNING","fingerprint":"50a333ae413c799b7d987efae64cf4bb1fd7dc290892f4dee02d5a3f60d4dcd449315a3e482a24eeca40411070879da85104760ab26a458c5c86ef7258207a34_0","lines":" ","is_ignored":false,"validation_state":"NO_VALIDATOR","engine_kind":"PRO"}},{"check_id":"python.django.security.django-no-csrf-token.django-no-csrf-token","path":"insecure-java/src/main/resources/templates/login.html","start":{"line":10,"col":5,"offset":362},"end":{"line":14,"col":12,"offset":662},"extra":{"metavars":{"$1":{"start":{"line":1,"col":1,"offset":0},"end":{"line":1,"col":5,"offset":4},"abstract_content":"post"},"$METHOD":{"start":{"line":10,"col":52,"offset":409},"end":{"line":10,"col":56,"offset":413},"abstract_content":"post"}},"message":"Manually-created forms in django templates should specify a csrf_token to prevent CSRF attacks.","metadata":{"category":"security","cwe":"CWE-352: Cross-Site Request Forgery (CSRF)","references":["https://docs.djangoproject.com/en/4.2/howto/csrf/"],"confidence":"MEDIUM","likelihood":"MEDIUM","impact":"MEDIUM","subcategory":["audit"],"technology":["django"],"license":"Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license","vulnerability_class":["Cross-Site Request Forgery (CSRF)"],"source":"https://semgrep.dev/r/python.django.security.django-no-csrf-token.django-no-csrf-token","shortlink":"https://sg.run/N0Bp","semgrep.dev":{"rule":{"origin":"community","r_id":73471,"rule_id":"PeUyYG","rv_id":946160,"url":"https://semgrep.dev/playground/r/BjT1NRl/python.django.security.django-no-csrf-token.django-no-csrf-token","version_id":"BjT1NRl"}}},"severity":"WARNING","fingerprint":"593d8048e3230f2f0fc122a66bf700f2fc4082170f52d319ec60abf29e3c47dcbe4341103ad3aace692bc30ca3a768fa687c5b5fb022c6b7b875bdf6aab94ccd_0","lines":" ","is_ignored":false,"validation_state":"NO_VALIDATOR","engine_kind":"PRO"}},{"check_id":"python.django.security.django-no-csrf-token.django-no-csrf-token","path":"insecure-java/src/main/resources/templates/register.html","start":{"line":10,"col":5,"offset":383},"end":{"line":14,"col":12,"offset":689},"extra":{"metavars":{"$1":{"start":{"line":1,"col":1,"offset":0},"end":{"line":1,"col":5,"offset":4},"abstract_content":"post"},"$METHOD":{"start":{"line":10,"col":55,"offset":433},"end":{"line":10,"col":59,"offset":437},"abstract_content":"post"}},"message":"Manually-created forms in django templates should specify a csrf_token to prevent CSRF attacks.","metadata":{"category":"security","cwe":"CWE-352: Cross-Site Request Forgery (CSRF)","references":["https://docs.djangoproject.com/en/4.2/howto/csrf/"],"confidence":"MEDIUM","likelihood":"MEDIUM","impact":"MEDIUM","subcategory":["audit"],"technology":["django"],"license":"Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license","vulnerability_class":["Cross-Site Request Forgery (CSRF)"],"source":"https://semgrep.dev/r/python.django.security.django-no-csrf-token.django-no-csrf-token","shortlink":"https://sg.run/N0Bp","semgrep.dev":{"rule":{"origin":"community","r_id":73471,"rule_id":"PeUyYG","rv_id":946160,"url":"https://semgrep.dev/playground/r/BjT1NRl/python.django.security.django-no-csrf-token.django-no-csrf-token","version_id":"BjT1NRl"}}},"severity":"WARNING","fingerprint":"966463a3a41588664e521d7b9641485c1573953f142a6a46199e114a0dddb3815617a2b6c2ed33569aa81d0ae57e1af6704692f376df4d5f396d9fe9ebdc041e_0","lines":" ","is_ignored":false,"validation_state":"NO_VALIDATOR","engine_kind":"PRO"}},{"check_id":"python.django.security.django-no-csrf-token.django-no-csrf-token","path":"insecure-java/src/main/resources/templates/search.html","start":{"line":10,"col":5,"offset":392},"end":{"line":13,"col":12,"offset":592},"extra":{"metavars":{"$1":{"start":{"line":1,"col":1,"offset":0},"end":{"line":1,"col":5,"offset":4},"abstract_content":"post"},"$METHOD":{"start":{"line":10,"col":53,"offset":440},"end":{"line":10,"col":57,"offset":444},"abstract_content":"post"}},"message":"Manually-created forms in django templates should specify a csrf_token to prevent CSRF attacks.","metadata":{"category":"security","cwe":"CWE-352: Cross-Site Request Forgery (CSRF)","references":["https://docs.djangoproject.com/en/4.2/howto/csrf/"],"confidence":"MEDIUM","likelihood":"MEDIUM","impact":"MEDIUM","subcategory":["audit"],"technology":["django"],"license":"Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license","vulnerability_class":["Cross-Site Request Forgery (CSRF)"],"source":"https://semgrep.dev/r/python.django.security.django-no-csrf-token.django-no-csrf-token","shortlink":"https://sg.run/N0Bp","semgrep.dev":{"rule":{"origin":"community","r_id":73471,"rule_id":"PeUyYG","rv_id":946160,"url":"https://semgrep.dev/playground/r/BjT1NRl/python.django.security.django-no-csrf-token.django-no-csrf-token","version_id":"BjT1NRl"}}},"severity":"WARNING","fingerprint":"b27e6297157b64351971325aa01d93bcbe09743a223a78cc98fad9eea9c1bdd310d078908dc9e0133d6ede7a975b687dcb74872bd980aeb587f2d07896a27f3d_0","lines":"