mcp-server-semgrep/semgrep-rules/csharp/lang/security/ssrf/web-client.yaml

MCP Server for Semgrep Integration - static code analysis with AI

rules:
- id: ssrf
  severity: ERROR
  languages:
  - csharp
  metadata:
    cwe:
    - 'CWE-918: Server-Side Request Forgery (SSRF)'
    owasp:
    - A10:2021 - Server-Side Request Forgery (SSRF)
    references:
    - https://cheatsheetseries.owasp.org/cheatsheets/Server_Side_Request_Forgery_Prevention_Cheat_Sheet.html
    category: security
    technology:
    - .net
    confidence: LOW
    cwe2022-top25: true
    cwe2021-top25: true
    subcategory:
    - audit
    likelihood: LOW
    impact: MEDIUM
  message: >-
    SSRF is an attack vector that abuses an application to interact with the internal/external network
    or the machine itself.
  patterns:
  - pattern-inside: |
      using System.Net;
      ...
  - pattern-either:
    - pattern: |
        $T $F(..., $X, ...)
        {
        ...
        WebClient $Y = new WebClient();
        ...
        ... $Y.OpenRead(<... $X ...>);
        }
    - pattern: |
        $T $F(..., $X, ...)
        {
        ...
        $A $B = <... $X ...>;
        ...
        WebClient $Y = new WebClient();
        ...
        ... $Y.OpenRead($B);
        }
    - pattern: |
        $T $F(..., $X, ...)
        {
        ...
        WebClient $Y = new WebClient();
        ...
        ... $Y.OpenReadAsync(<... $X ...>, ...);
        }
    - pattern: |
        $T $F(..., $X, ...)
        {
        ...
        $A $B = <... $X ...>;
        ...
        WebClient $Y = new WebClient();
        ...
        ... $Y.OpenReadAsync($B, ...);
        }
    - pattern: |
        $T $F(..., $X, ...)
        {
        ...
        WebClient $Y = new WebClient();
        ...
        ... $Y.DownloadString(<... $X ...>);
        }
    - pattern: |
        $T $F(..., $X, ...)
        {
        ...
        $A $B = <... $X ...>;
        ...
        WebClient $Y = new WebClient();
        ...
        ... $Y.DownloadString($B);
        }