mcp-server-semgrep/semgrep-rules/csharp/lang/security/sqli/csharp-sqli.yaml

MCP Server for Semgrep Integration - static code analysis with AI

rules:
  - id: csharp-sqli
    mode: taint
    pattern-sources:
      - patterns:
          - pattern: |
              (string $X)
          - pattern-not: |
              "..."
    pattern-propagators:
      - pattern: (StringBuilder $B).$ANY(...,(string $X),...)
        from: $X
        to: $B
    pattern-sinks:
      - patterns:
          - pattern-either:
            - patterns:
              - pattern: |
                  new $PATTERN($CMD,...)
              - focus-metavariable: $CMD
            - patterns:
              - pattern: |
                  $CMD.$PATTERN = $VALUE;
              - focus-metavariable: $VALUE
          - metavariable-regex:
              metavariable: $PATTERN
              regex: ^(SqlCommand|CommandText|OleDbCommand|OdbcCommand|OracleCommand)$
    pattern-sanitizers:
      - pattern-either:
          - pattern: |
              $CMD.Parameters.add(...)
          - pattern: |
              $CMD.Parameters[$IDX] = ...
        by-side-effect: true
    message: Detected a formatted string in a SQL statement. This could lead to SQL
      injection if variables in the SQL statement are not properly sanitized.
      Use a prepared statements instead. You can obtain a PreparedStatement
      using 'SqlCommand' and 'SqlParameter'.
    metadata:
      category: security
      technology:
        - csharp
      owasp:
        - A01:2017 - Injection
        - A03:2021 - Injection
      cwe:
        - "CWE-89: Improper Neutralization of Special Elements used in an SQL
          Command ('SQL Injection')"
      confidence: MEDIUM
      references:
        - https://owasp.org/Top10/A03_2021-Injection
      cwe2022-top25: true
      cwe2021-top25: true
      subcategory:
        - audit
      likelihood: LOW
      impact: HIGH
    languages:
      - csharp
    severity: ERROR