mcp-server-semgrep/semgrep-rules/generic/nginx/security/header-redefinition.yaml

MCP Server for Semgrep Integration - static code analysis with AI

rules:
- id: header-redefinition
  patterns:
  - pattern-inside: |
      server {
        ...
        add_header ...;
        ...
        ...
      }
  - pattern-inside: |
      location ... {
        ...
        ...
      }
  - pattern: add_header ...;
  paths:
    include:
    - '*.conf'
    - '*.vhost'
    - sites-available/*
    - sites-enabled/*
  languages:
  - generic
  severity: WARNING
  message: >-
    The 'add_header' directive is called in a 'location' block after headers have been set
    at the server block. Calling 'add_header' in the location block will actually overwrite the headers
    defined in the server block, no matter which headers are set.
    To fix this, explicitly set all headers or set all headers in the server block.
  metadata:
    cwe:
    - 'CWE-16: CWE CATEGORY: Configuration'
    references:
    - https://github.com/yandex/gixy/blob/master/docs/en/plugins/addheaderredefinition.md
    category: security
    technology:
    - nginx
    confidence: LOW
    owasp:
    - A06:2017 - Security Misconfiguration
    - A05:2021 - Security Misconfiguration
    subcategory:
    - audit
    likelihood: LOW
    impact: LOW