mcp-server-semgrep/semgrep-rules/go/lang/security/audit/unsafe-reflect-by-name.yaml

MCP Server for Semgrep Integration - static code analysis with AI

rules:
- id: unsafe-reflect-by-name
  patterns:
  - pattern-either:
    - pattern: |
        $SMTH.MethodByName($NAME,...)
    - pattern: |
        $SMTH.FieldByName($NAME,...)
  - pattern-not: |
      $SMTH.MethodByName("...",...)
  - pattern-not: |
      $SMTH.FieldByName("...",...)
  - pattern-inside: |
      import "reflect"
      ...
  message: >-
    If an attacker can supply values that the application then uses to determine which
    method or field to invoke,
    the potential exists for the attacker to create control flow paths through the
    application
    that were not intended by the application developers.
    This attack vector may allow the attacker to bypass authentication or access control
    checks
    or otherwise cause the application to behave in an unexpected manner.
  metadata:
    cwe:
    - "CWE-470: Use of Externally-Controlled Input to Select Classes or Code ('Unsafe Reflection')"
    owasp:
    - A03:2021 - Injection
    category: security
    technology:
    - go
    confidence: LOW
    references:
    - https://owasp.org/Top10/A03_2021-Injection
    subcategory:
    - audit
    likelihood: LOW
    impact: LOW
  severity: WARNING
  languages:
  - go