mcp-server-semgrep/semgrep-rules/go/gorilla/security/audit/handler-assignment-from-multiple-sources.yaml

MCP Server for Semgrep Integration - static code analysis with AI

rules:
- id: handler-assignment-from-multiple-sources
  metadata:
    cwe:
    - 'CWE-289: Authentication Bypass by Alternate Name'
    category: security
    technology:
    - gorilla
    confidence: MEDIUM
    references:
    - https://cwe.mitre.org/data/definitions/289.html
    subcategory:
    - audit
    impact: MEDIUM
    likelihood: LOW
  mode: taint
  pattern-sources:
  - patterns:
    - pattern-inside: |
        func $HANDLER(..., $R *http.Request, ...) {
          ...
        }
    - focus-metavariable: $R
    - pattern-either:
      - pattern: $R.query
  pattern-sinks:
  - patterns:
    - pattern: |
        $Y, err := store.Get(...)
        ...
        $VAR := $Y.Values[...]
        ...
        $VAR = $R
    - focus-metavariable: $R
  - patterns:
    - pattern: |
        $Y, err := store.Get(...)
        ...
        var $VAR $INT = $Y.Values["..."].($INT)
        ...
        $VAR = $R
    - focus-metavariable: $R
  message: >-
    Variable $VAR is assigned from two different sources: '$Y' and '$R'. Make sure this is intended,
    as this could cause logic bugs if they are treated as they are the same object.
  languages:
  - go
  severity: WARNING