mcp-server-semgrep/semgrep-rules/go/lang/security/injection/raw-html-format.yaml

MCP Server for Semgrep Integration - static code analysis with AI

rules:
- id: raw-html-format
  languages: [go]
  severity: WARNING
  message: >-
    Detected user input flowing into a manually constructed HTML string. You may be
    accidentally bypassing secure methods
    of rendering HTML by manually constructing HTML and this could create a cross-site
    scripting vulnerability, which could
    let attackers steal sensitive user data. Use the `html/template` package which
    will safely render HTML instead, or inspect
    that the HTML is rendered safely.
  metadata:
    cwe:
    - "CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')"
    owasp:
    - A07:2017 - Cross-Site Scripting (XSS)
    - A03:2021 - Injection
    category: security
    technology:
    - go
    references:
    - https://blogtitle.github.io/robn-go-security-pearls-cross-site-scripting-xss/
    confidence: MEDIUM
    cwe2022-top25: true
    cwe2021-top25: true
    subcategory:
    - vuln
    likelihood: HIGH
    impact: MEDIUM
  mode: taint
  pattern-sources:
  - patterns:
    - pattern-either:
      - pattern: |
          ($REQUEST : *http.Request).$ANYTHING
      - pattern: |
          ($REQUEST : http.Request).$ANYTHING
    - metavariable-regex:
        metavariable: $ANYTHING
        regex: ^(BasicAuth|Body|Cookie|Cookies|Form|FormValue|GetBody|Host|MultipartReader|ParseForm|ParseMultipartForm|PostForm|PostFormValue|Referer|RequestURI|Trailer|TransferEncoding|UserAgent|URL)$
  pattern-sanitizers:
  - pattern: html.EscapeString(...)
  pattern-sinks:
  - patterns:
    - pattern-either:
      - pattern: fmt.Printf("$HTMLSTR", ...)
      - pattern: fmt.Sprintf("$HTMLSTR", ...)
      - pattern: fmt.Fprintf($W, "$HTMLSTR", ...)
      - pattern: '"$HTMLSTR" + ...'
    - metavariable-pattern:
        metavariable: $HTMLSTR
        language: generic
        pattern: <$TAG ...