mcp-server-semgrep/semgrep-rules/csharp/dotnet/security/mvc-missing-antiforgery.yaml

MCP Server for Semgrep Integration - static code analysis with AI

rules:
- id: mvc-missing-antiforgery
  message: $METHOD is a state-changing MVC method that does not validate the antiforgery token or do strict
    content-type checking. State-changing controller methods should either enforce antiforgery tokens
    or do strict content-type checking to prevent simple HTTP request types from bypassing CORS preflight
    controls.
  severity: WARNING
  metadata:
    likelihood: LOW
    impact: MEDIUM
    confidence: LOW
    category: security
    cwe:
    - 'CWE-352: Cross-Site Request Forgery (CSRF)'
    cwe2021-top25: true
    cwe2022-top25: true
    owasp:
    - A01:2021 - Broken Access Control
    references:
    - https://cheatsheetseries.owasp.org/cheatsheets/DotNet_Security_Cheat_Sheet.html#cross-site-request-forgery
    - https://developer.mozilla.org/en-US/docs/Web/HTTP/CORS#simple_requests
    subcategory:
    - audit
    technology:
    - .net
    - mvc
  languages:
  - csharp
  patterns:
  - pattern: |
      [$HTTPMETHOD]
      public IActionResult $METHOD(...){
          ...
      }
  - pattern-inside: |
      using Microsoft.AspNetCore.Mvc;
      ...
  - pattern-not: |
      [ValidateAntiForgeryToken]
      public IActionResult $METHOD(...){
          ...
      }
  - pattern-not: |
      [Consumes(...)]
      public IActionResult $METHOD(...){
        ...
      }
  - metavariable-regex:
      metavariable: $HTTPMETHOD
      regex: Http(Post|Put|Delete|Patch)