mcp-server-semgrep/semgrep-rules/go/lang/security/audit/net/dynamic-httptrace-clienttrace.yaml

MCP Server for Semgrep Integration - static code analysis with AI

rules:
- id: dynamic-httptrace-clienttrace
  message: >-
    Detected a potentially dynamic ClientTrace. This occurred because semgrep could
    not
    find a static definition for '$TRACE'. Dynamic ClientTraces are dangerous because
    they deserialize function code to run when certain Request events occur, which
    could lead
    to code being run without your knowledge. Ensure that your ClientTrace is statically
    defined.
  metadata:
    cwe:
    - 'CWE-913: Improper Control of Dynamically-Managed Code Resources'
    owasp:
    - A01:2021 - Broken Access Control
    references:
    - https://github.com/returntocorp/semgrep-rules/issues/518
      # Detects when a static ClientTrace is not defined in the same file as
      # WithClientTrace. Not a perfect detection, but sufficiently works in a
      # scan of ~1k repos: https://dev.massive.ret2.co/triager/filter/1007
    category: security
    technology:
    - go
    confidence: MEDIUM
    subcategory:
    - vuln
    likelihood: LOW
    impact: LOW
  patterns:
  - pattern-not-inside: |
      package $PACKAGE
      ...
      &httptrace.ClientTrace { ... }
      ...
  - pattern: httptrace.WithClientTrace($ANY, $TRACE)
  severity: WARNING
  languages:
  - go