mcp-server-semgrep/semgrep-rules/generic/nginx/security/header-injection.yaml

MCP Server for Semgrep Integration - static code analysis with AI

rules:
- id: header-injection
  pattern: |
    location ... <$VARIABLE> ... {
      ...
      add_header ... $$VARIABLE
      ...
    }
  paths:
    include:
    - '*.conf'
    - '*.vhost'
    - sites-available/*
    - sites-enabled/*
  languages:
  - generic
  severity: ERROR
  message: >-
    The $$VARIABLE path parameter is added as a header in the response.
    This could allow an attacker to inject a newline and add a new header into the response.
    This is called HTTP response splitting.
    To fix, do not allow whitespace in the path parameter: '[^\s]+'.
  metadata:
    cwe:
    - "CWE-113: Improper Neutralization of CRLF Sequences in HTTP Headers ('HTTP Request/Response Splitting')"
    references:
    - https://github.com/yandex/gixy/blob/master/docs/en/plugins/httpsplitting.md
    - https://owasp.org/www-community/attacks/HTTP_Response_Splitting
    category: security
    technology:
    - nginx
    confidence: MEDIUM
    owasp:
    - A03:2021 - Injection
    subcategory:
    - audit
    likelihood: LOW
    impact: MEDIUM