semgrep / semgrep-rules

Semgrep rules registry

semgrep-rules

branch	using semgrep docker image	test status
develop	returntocorp/semgrep:develop

Welcome! This repository is the standard library for Semgrep rules. There are many more rules available in the Semgrep Registry written by Semgrep, Inc. and other contributors. The Semgrep Registry includes rules from this repository and additional rules that are accessible within Semgrep Cloud Platform. If there is a specific rule you are looking for, see the Semgrep registry search. To contribute, find details about contributing in the Contributing to Semgrep rules documentation.

Using Semgrep rules repository

Run existing and custom Semgrep rules locally with the Semgrep command line interface (Semgrep CLI) or continuously with Semgrep in CI while using Semgrep App. To start using Semgrep rules, see Semgrep tutorial, Getting started with Semgrep CLI, and Getting started with Semgrep App.

Contributing

We welcome Semgrep rule contributions directly to this repository! When you submit your contribution to the semgrep-rules repository we’ll ask you to make Semgrep, Inc. a joint owner of your contributions. While you still own copyright rights to your rule, joint ownership allows Semgrep, Inc. to license these contributions to other Semgrep Registry users pursuant to the LGPL 2.1 under the Commons Clause. See full license details.

Note: To contribute, review the Contributing to Semgrep rules documentation.

You can also contact us at [email protected] to make Semgrep rule contributions. We will import your rules for everyone to use!

Additional information

Help

Join Slack for the fastest answers to your questions! Or contact the team at [email protected].

GitHub action to run tests

If you fork this repository or create your own, you can add a special semgrep -rules-test GitHub Action to your workflow that will automatically test your rules using the latest version of Semgrep. See our semgrep-rules-test.

Rulesets

Rulesets are groups of rules organized by purpose, language, or framework sourced from the Semgrep Registry. If you want to modify existing rulesets or create your own, please contact us at [email protected].

semgrep-rules's Issues

prevent open redirects - user input in redirects - redirect() shortcut, HttpResponse

cf. https://cwe.mitre.org/data/definitions/601.html
cf. https://docs.djangoproject.com/en/3.0/topics/http/shortcuts/#redirect
cf. https://overiq.com/django-1-10/redirecting-urls-in-django/

use upload_to for FileField/ImageField

Django access-foreign-keys check is too broadly defined

The $X.user.id check defined in sgrep-rules/python/django/performance-improvements.yaml file is too broad and triggers on all sorts of unrelated user objects that define and .id field (which is quite common)

re-enable assert that rules don't fire on multiple lines

use JsonResponse instead of HttpResponse + json.dumps

Test Issue

This is @DrewDennison trying to test the "first issue" bot

avoid {% debug %}

don't root the admin at /admin

preferably completely other site

Improve Flask 0.0.0.0 check to fire only when it's a dev server

Slack conversation for context:

ulzii  2 hours ago
Per https://flask.palletsprojects.com/en/1.1.x/quickstart/#a-minimal-application

ulzii  2 hours ago
You should not set it to 0.0.0.0

ulzii  2 hours ago
And in production, you say “flaks run --host=0.0.0.0” which will pass the host as ENV variable to flask

ulzii  2 hours ago
That way you are not hardcoding bad config while still maintaining the flexibility for production configuration

grayson  2 hours ago
The relevant bit from that documentation is:

grayson  2 hours ago
Externally Visible ServerIf you run the server you will notice that the server is only accessible from your own computer, not from any other in the network. This is the default because in debugging mode a user of the application can execute arbitrary Python code on your computer.
If you have the debugger disabled or trust the users on your network, you can make the server publicly available simply by adding --host=0.0.0.0 to the command line:
$ flask run --host=0.0.0.0
This tells your operating system to listen on all public IPs.

grayson  2 hours ago
davidism is of the opinion that one should use flask run instead of python3 app.py and using flask run --host=0.0.0.0 to launch a prod server

grayson  2 hours ago
IMO, it's kind of a nit-pick

grayson  2 hours ago
It kind of depends on one's level of paranoia

grayson  2 hours ago
Perhaps an extension to the check could be only surfacing 0.0.0.0 if debug mode is on?

daghan  2 hours ago
I agree. This may be a better style but certainly not a security issue.

grayson  2 hours ago
Cool, I'll make a ticket

ulzii  1 hour ago
I do not think it is just a style issue: https://stackoverflow.com/questions/7023052/configure-flask-dev-server-to-be-visible-across-the-network. I think it is the proper way to deploy flask app. I would agree its not a security issue because exploitability of it is determined by firewall etc.
Stack OverflowStack Overflow
Configure Flask dev server to be visible across the network
I'm not sure if this is Flask specific, but when I run an app in dev mode (http://localhost:5000), I cannot access it from other machines on the network (with http://[dev-host-ip]:5000). With Rails...

connection.cursor() / cursor.execute() -- avoid, or use static strings + params

same as raw sql w/o ORM

settings from environ: SECRET_KEY, DATABASE_URL

don't use FloatField to store money (use DecimalField instead)

check for common money value field names?

don't use .extra()

avoid, use .raw() instead

avoid csrf_exempt decorator

only very occasionally is this ok

use select_related() to avoid N+1 queries -- look for queryset then iterate over FK

use django-environ (https://django-environ.readthedocs.io/en/latest/) instead of os.environ etc

avoid {% autoescape off %}, safe/safeseq filter

don't use ForeignKey(unique=True) - OneToOneField instead

avoid |striptags|safe -- it isn't

use e.g. bleach instead

find missing db indexes -- look for filter() against fields w/o indexes

Davidism Sgrep rules for flask

Based on https://returntocorp.quip.com/5VF2AdM8MLJA/Checks-Database#YEVACAUpbuG, lets write 5-10 more sgrep checks

• send_file checks: #4
• avoid_app_run_with_bad_host: #3
• app_run_without_guard: #3
• Flask Deprecated APIs
• accessing g request.form, request.json, request.data outside POST/PUT/DELETE handler #30

Model.save() should call super().save()

use null=True if blank=True on non-text-fields

avoid .all() before filter/exclude/count/etc

DEBUG=False or from environ

use prefetch_related(), as above

don't use globals()/locals() as template contexts

avoid Meta.ordering without an index

use Choices classes (Choices, TextChoices, IntegerChoices) instead of tuples

new in Django 3.0

don't use static.serve

avoid .raw() / RawSQL(), or only static strings + params

don't use deprecated apis

https://docs.djangoproject.com/en/3.0/internals/deprecation/

publish an sgrep rules repository

Label TP/FP for python-is

https://returntocorp.quip.com/BhPsAqgZiggP/Anatomy-of-a-Good-Check

[Check] avoid mark_safe function

should only be used with literals, or output from safe libraries (e.g. bleach, markdown + safe mode, etc)

use FileResponse instead of HttpResponse + open/read

if using pattern(), make sure it's anchored

models should define __str__

use queryset.update or delete instead of loops + instance update/delete

exception: custom save() methods

use .exists() instead of if qs or if len(qs)

use .count() instead of len(qs)

avoid `from local_settings import *` pattern

if using django-debug-toolbar, make sure it's protected with DEBUG

avoid or cache expensive operations (database) in middleware

No pattern in rule file causes parsing error

https://github.com/returntocorp/sgrep-rules/blob/master/python/deadcode/useless-literal.yaml#L14

Add testing infra for sgrep-rules

use earliest(field)/latest(field) instead of order_by(field)[0] etc

use slugs instead of ids in urls

if unique=True and blank=True, null=True must be set

prefer Meta.fields to Meta.exclude in ModelForms