mcp-server-semgrep/semgrep-rules/csharp/lang/security/cryptography/X509-subject-name-validation.yaml

MCP Server for Semgrep Integration - static code analysis with AI

rules:
- id: X509-subject-name-validation
  severity: WARNING
  languages:
  - csharp
  metadata:
    cwe:
    - 'CWE-295: Improper Certificate Validation'
    owasp:
    - A03:2017 - Sensitive Data Exposure
    - A07:2021 - Identification and Authentication Failures
    references:
    - https://docs.microsoft.com/en-us/dotnet/api/system.identitymodel.tokens.issuernameregistry?view=netframework-4.8
    category: security
    technology:
    - .net
    confidence: MEDIUM
    subcategory:
    - vuln
    likelihood: LOW
    impact: LOW
  message: >-
    Validating certificates based on subject name is bad practice. Use the X509Certificate2.Verify()
    method instead.
  patterns:
  - pattern-inside: |
      using System.IdentityModel.Tokens;
      ...
  - pattern-either:
    - patterns:
      - pattern-either:
        - pattern-inside: |
            X509SecurityToken $TOK = $RHS;
            ...
        - pattern-inside: |
            $T $M(..., X509SecurityToken $TOK, ...) {
                ...
            }
      - metavariable-pattern:
          metavariable: $RHS
          pattern-either:
          - pattern: $T as X509SecurityToken
          - pattern: new X509SecurityToken(...)
    - patterns:
      - pattern-either:
        - pattern-inside: |
            X509Certificate2 $CERT = new X509Certificate2(...);
            ...
        - pattern-inside: |
            $T $M(..., X509Certificate2 $CERT, ...) {
                ...
            }
        - pattern-inside: |
            foreach (X509Certificate2 $CERT in $COLLECTION) {
                ...
            }
  - patterns:
    - pattern-either:
      - pattern: String.Equals($NAME, "...")
      - pattern: String.Equals("...", $NAME)
      - pattern: $NAME.Equals("...")
      - pattern: $NAME == "..."
      - pattern: $NAME != "..."
      - pattern: |
          "..." == $NAME
      - pattern: |
          "..." != $NAME
    - metavariable-pattern:
        metavariable: $NAME
        pattern-either:
        - pattern: $TOK.Certificate.SubjectName.Name
        - pattern: $CERT.SubjectName.Name
        - pattern: $CERT.GetNameInfo(...)