mcp-server-semgrep/semgrep-rules/go/lang/security/injection/tainted-sql-string.yaml

MCP Server for Semgrep Integration - static code analysis with AI

rules:
- id: tainted-sql-string
  languages: [go]
  message: >-
    User data flows into this manually-constructed SQL string. User data
    can be safely inserted into SQL strings using prepared statements or an
    object-relational mapper (ORM). Manually-constructed SQL strings is a
    possible indicator of SQL injection, which could let an attacker steal
    or manipulate data from the database.
    Instead, use prepared statements (`db.Query("SELECT * FROM t WHERE id = ?", id)`)
    or a safe library.
  options:
    interfile: true
  metadata:
    cwe:
    - "CWE-89: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')"
    owasp:
    - A01:2017 - Injection
    - A03:2021 - Injection
    references:
    - https://golang.org/doc/database/sql-injection
    - https://www.stackhawk.com/blog/golang-sql-injection-guide-examples-and-prevention/
    category: security
    technology:
    - go
    confidence: HIGH
    cwe2022-top25: true
    cwe2021-top25: true
    subcategory:
    - vuln
    likelihood: HIGH
    impact: MEDIUM
    interfile: true
  mode: taint
  severity: ERROR
  pattern-sources:
  - patterns:
    - pattern-either:
      - pattern: |
          ($REQUEST : *http.Request).$ANYTHING
      - pattern: |
          ($REQUEST : http.Request).$ANYTHING
    - metavariable-regex:
        metavariable: $ANYTHING
        regex: ^(BasicAuth|Body|Cookie|Cookies|Form|FormValue|GetBody|Host|MultipartReader|ParseForm|ParseMultipartForm|PostForm|PostFormValue|Referer|RequestURI|Trailer|TransferEncoding|UserAgent|URL)$
  pattern-sinks:
  - patterns:
    - pattern-either:
      - patterns:
        - pattern-either:
          - pattern: |
              "$SQLSTR" + ...
          - patterns:
            - pattern-inside: |
                $VAR = "$SQLSTR";
                ...
            - pattern: $VAR += ...
          - patterns:
            - pattern-inside: |
                var $SB strings.Builder
                ...
            - pattern-inside: |
                $SB.WriteString("$SQLSTR")
                ...
                $SB.String(...)
            - pattern: |
                $SB.WriteString(...)
        - metavariable-regex:
            metavariable: $SQLSTR
            regex: (?i)(select|delete|insert|create|update|alter|drop).*
      - patterns:
        - pattern-either:
          - pattern: fmt.Fprintf($F, "$SQLSTR", ...)
          - pattern: fmt.Sprintf("$SQLSTR", ...)
          - pattern: fmt.Printf("$SQLSTR", ...)
        - metavariable-regex:
            metavariable: $SQLSTR
            regex: \s*(?i)(select|delete|insert|create|update|alter|drop)\b.*%(v|s|q).*
  pattern-sanitizers:
  - pattern-either:
    - pattern: strconv.Atoi(...)
    - pattern: |
        ($X: bool)