mcp-server-semgrep/semgrep-rules/go/lang/security/decompression_bomb.yaml

MCP Server for Semgrep Integration - static code analysis with AI

rules:
- id: potential-dos-via-decompression-bomb
  message: >-
    Detected a possible denial-of-service via a zip bomb attack. By limiting the max
    bytes read, you can mitigate this attack.
    `io.CopyN()` can specify a size. 
  severity: WARNING
  languages: [go]
  patterns:
  - pattern-either:
    - pattern: io.Copy(...)
    - pattern: io.CopyBuffer(...)
  - pattern-either:
    - pattern-inside: |
        gzip.NewReader(...)
        ...
    - pattern-inside: |
        zlib.NewReader(...)
        ...
    - pattern-inside: |
        zlib.NewReaderDict(...)
        ...
    - pattern-inside: |
        bzip2.NewReader(...)
        ...
    - pattern-inside: |
        flate.NewReader(...)
        ...
    - pattern-inside: |
        flate.NewReaderDict(...)
        ...
    - pattern-inside: |
        lzw.NewReader(...)
        ...
    - pattern-inside: |
        tar.NewReader(...)
        ...
    - pattern-inside: |
        zip.NewReader(...)
        ...
    - pattern-inside: |
        zip.OpenReader(...)
        ...
  fix-regex:
    regex: (.*)(Copy|CopyBuffer)\((.*?),(.*?)(\)|,.*\))
    replacement: \1CopyN(\3, \4, 1024*1024*256)
  metadata:
    cwe:
    - 'CWE-400: Uncontrolled Resource Consumption'
    source-rule-url: https://github.com/securego/gosec
    references:
    - https://golang.org/pkg/io/#CopyN
    - https://github.com/securego/gosec/blob/master/rules/decompression-bomb.go
    category: security
    technology:
    - go
    confidence: LOW
    cwe2022-top25: true
    subcategory:
    - audit
    likelihood: LOW
    impact: MEDIUM