mcp-server-semgrep/semgrep-rules/c/lang/security/insecure-use-gets-fn.yaml

MCP Server for Semgrep Integration - static code analysis with AI

rules:
- id: insecure-use-gets-fn
  pattern: gets(...)
  message: >-
    Avoid 'gets()'. This function does not consider buffer boundaries and can lead
    to buffer overflows. Use 'fgets()' or 'gets_s()' instead.
  metadata:
    cwe:
    - 'CWE-676: Use of Potentially Dangerous Function'
    references:
    - https://us-cert.cisa.gov/bsi/articles/knowledge/coding-practices/fgets-and-gets_s
    category: security
    technology:
    - c
    confidence: MEDIUM
    subcategory:
    - audit
    likelihood: LOW
    impact: HIGH
  languages: [c]
  severity: ERROR