mcp-server-semgrep/semgrep-rules/generic/secrets/security/detected-username-and-password-in-uri.yaml

MCP Server for Semgrep Integration - static code analysis with AI

rules:
- id: detected-username-and-password-in-uri
  patterns:
  - pattern: $PROTOCOL://$...USERNAME:$...PASSWORD@$END
  - metavariable-regex:
      metavariable: $...USERNAME
      regex: \A({?)([A-Za-z])([A-Za-z0-9_-]){5,31}(}?)\Z
  - metavariable-regex:
      metavariable: $...PASSWORD
      regex: (?!.*[\s])(?=.*[0-9])(?=.*[a-z])(?=.*[A-Z])(?=.*[!"#$%&'()*+,-./:;<=>?@[\]^_`{|}~]){6,32}
  - metavariable-regex:
      metavariable: $PROTOCOL
      regex: (.*http.*)|(.*sql.*)|(.*ftp.*)|(.*smtp.*)
  languages:
  - generic
  message: Username and password in URI detected
  severity: ERROR
  metadata:
    owasp:
    - A07:2021 - Identification and Authentication Failures
    cwe:
    - 'CWE-798: Use of Hard-coded Credentials'
    references:
    - https://github.com/grab/secret-scanner/blob/master/scanner/signatures/pattern.go
    category: security
    technology:
    - secrets
    confidence: MEDIUM
    cwe2022-top25: true
    cwe2021-top25: true
    subcategory:
    - vuln
    likelihood: MEDIUM
    impact: MEDIUM