mcp-server-semgrep
Version:
MCP Server for Semgrep Integration - static code analysis with AI
35 lines (34 loc) • 1.12 kB
YAML
rules:
- id: defaulthttpclient-is-deprecated
metadata:
cwe:
- 'CWE-326: Inadequate Encryption Strength'
owasp:
- A03:2017 - Sensitive Data Exposure
- A02:2021 - Cryptographic Failures
source-rule-url: https://find-sec-bugs.github.io/bugs.htm#DEFAULT_HTTP_CLIENT
asvs:
section: V9 Communications Verification Requirements
control_id: 9.1.3 Weak TLS
control_url: https://github.com/OWASP/ASVS/blob/master/4.0/en/0x17-V9-Communications.md#v91-client-communications-security-requirements
version: '4'
category: security
technology:
- java
references:
- https://owasp.org/Top10/A02_2021-Cryptographic_Failures
subcategory:
- audit
likelihood: LOW
impact: LOW
confidence: LOW
message: >-
DefaultHttpClient is deprecated. Further, it does not support connections
using TLS1.2, which makes using DefaultHttpClient a security hazard.
Use HttpClientBuilder instead.
severity: WARNING
languages: [java]
pattern: new DefaultHttpClient(...);
fix-regex:
regex: DefaultHttpClient
replacement: HttpClientBuilder