mcp-server-semgrep/semgrep-rules/csharp/lang/correctness/sslcertificatetrust/sslcertificatetrust-handshake-no-trust.yaml

MCP Server for Semgrep Integration - static code analysis with AI

rules:
- id: correctness-sslcertificatetrust-handshake-no-trust
  patterns:
    - pattern-either:
      - pattern: SslCertificateTrust.$METHOD($COLLECTION,sendTrustInHandshake=true)
      - pattern: SslCertificateTrust.$METHOD($COLLECTION,true)
    - metavariable-regex:
        metavariable: $METHOD
        regex: CreateForX509(Collection|Store)
  fix: SslCertificateTrust.$METHOD($COLLECTION,false)
  message: Sending the trusted CA list increases the size of the handshake request and can leak system configuration information.
  languages: [csharp]
  metadata:
    references: 
      - https://docs.microsoft.com/en-us/dotnet/api/system.net.security.sslcertificatetrust.createforx509collection?view=net-6.0#remarks
      - https://docs.microsoft.com/en-us/dotnet/api/system.net.security.sslcertificatetrust.createforx509store?view=net-6.0#remarks
    cwe: "CWE-200: Exposure of Sensitive Information to an Unauthorized Actor"
    owasp: "A03:2017 - Sensitive Data Exposure"
    category: correctness
    technology: 
      - .net
    confidence: HIGH
  severity: WARNING