mcp-server-semgrep/semgrep-rules/java/lang/security/audit/cookie-missing-secure-flag.yaml

MCP Server for Semgrep Integration - static code analysis with AI

rules:
- id: cookie-missing-secure-flag
  metadata:
    cwe:
    - "CWE-614: Sensitive Cookie in HTTPS Session Without 'Secure' Attribute"
    owasp:
    - A05:2021 - Security Misconfiguration
    source-rule-url: https://find-sec-bugs.github.io/bugs.htm#INSECURE_COOKIE
    asvs:
      section: 'V3: Session Management Verification Requirements'
      control_id: 3.4.1 Missing Cookie Attribute
      control_url: https://github.com/OWASP/ASVS/blob/master/4.0/en/0x12-V3-Session-management.md#v34-cookie-based-session-management
      version: '4'
    category: security
    technology:
    - java
    references:
    - https://owasp.org/Top10/A05_2021-Security_Misconfiguration
    subcategory:
    - audit
    likelihood: LOW
    impact: LOW
    confidence: LOW
  message: >-
    A cookie was detected without setting the 'secure' flag. The 'secure' flag
    for cookies prevents the client from transmitting the cookie over insecure
    channels such as HTTP. Set the 'secure' flag by calling '$COOKIE.setSecure(true);'
  severity: WARNING
  languages: [java]
  patterns:
  - pattern-not-inside: $COOKIE.setValue(""); ...
  - pattern-either:
    - pattern: $COOKIE.setSecure(false);
    - patterns:
      - pattern-not-inside: $COOKIE.setSecure(...); ...
      - pattern-not-inside: $COOKIE = ResponseCookie.from(...). ...; ...
      - pattern: $RESPONSE.addCookie($COOKIE);