mcp-server-semgrep/semgrep-rules/go/lang/security/filepath-clean-misuse.yaml

MCP Server for Semgrep Integration - static code analysis with AI

rules:
- id: filepath-clean-misuse
  message: >-
    `Clean` is not intended to sanitize against path traversal attacks.
    This function is for finding the shortest path name equivalent to the given input.
    Using `Clean` to sanitize file reads may expose this application to
    path traversal attacks, where an attacker could access arbitrary files on the server.
    To fix this easily, write this: `filepath.FromSlash(path.Clean("/"+strings.Trim(req.URL.Path, "/")))`
    However, a better solution is using the `SecureJoin` function in the package `filepath-securejoin`.
    See https://pkg.go.dev/github.com/cyphar/filepath-securejoin#section-readme.
  severity: ERROR
  languages: [go]
  mode: taint
  pattern-sources:
  - patterns:
    - pattern-either:
      - pattern: |
          ($REQUEST : *http.Request).$ANYTHING
      - pattern: |
          ($REQUEST : http.Request).$ANYTHING
    - metavariable-regex:
        metavariable: $ANYTHING
        regex: ^(BasicAuth|Body|Cookie|Cookies|Form|FormValue|GetBody|Host|MultipartReader|ParseForm|ParseMultipartForm|PostForm|PostFormValue|Referer|RequestURI|Trailer|TransferEncoding|UserAgent|URL)$
  pattern-sinks:
  - patterns:
    - pattern-either:
      - pattern: filepath.Clean($...INNER)
      - pattern: path.Clean($...INNER)
  pattern-sanitizers:
  - pattern-either:
    - pattern: |
        "/" + ...
  fix: filepath.FromSlash(filepath.Clean("/"+strings.Trim($...INNER, "/")))
  options:
    interfile: true
  metadata:
    references:
    - https://pkg.go.dev/path#Clean
    - http://technosophos.com/2016/03/31/go-quickly-cleaning-filepaths.html
    - https://labs.detectify.com/2021/12/15/zero-day-path-traversal-grafana/
    - https://dzx.cz/2021/04/02/go_path_traversal/
    - https://pkg.go.dev/github.com/cyphar/filepath-securejoin#section-readme
    cwe:
    - "CWE-22: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')"
    owasp:
    - A05:2017 - Broken Access Control
    - A01:2021 - Broken Access Control
    category: security
    technology:
    - go
    cwe2022-top25: true
    cwe2021-top25: true
    subcategory:
    - vuln
    likelihood: MEDIUM
    impact: MEDIUM
    confidence: MEDIUM
    interfile: true