mcp-server-semgrep/semgrep-rules/java/lang/security/audit/http-response-splitting.yaml

MCP Server for Semgrep Integration - static code analysis with AI

rules:
- id: http-response-splitting
  metadata:
    cwe:
    - "CWE-113: Improper Neutralization of CRLF Sequences in HTTP Headers ('HTTP Request/Response Splitting')"
    owasp:
    - A03:2021 - Injection
    source-rule-url: https://find-sec-bugs.github.io/bugs.htm#HTTP_RESPONSE_SPLITTING
    references:
    - https://www.owasp.org/index.php/HTTP_Response_Splitting
    category: security
    technology:
    - java
    subcategory:
    - vuln
    likelihood: MEDIUM
    impact: MEDIUM
    confidence: MEDIUM
  message: >-
    Older Java application servers are vulnerable to HTTP response splitting, which
    may occur if an HTTP
    request can be injected with CRLF characters. This finding is reported for completeness;
    it is recommended
    to ensure your environment is not affected by testing this yourself.
  severity: INFO
  languages:
  - java
  pattern-either:
  - pattern: |
      $VAR = $REQ.getParameter(...);
      ...
      $COOKIE = new Cookie(..., $VAR, ...);
      ...
      $RESP.addCookie($COOKIE, ...);
  - patterns:
    - pattern-inside: |
        $RETTYPE $FUNC(...,@PathVariable $TYPE $VAR, ...) {
          ...
        }
    - pattern: |
        $COOKIE = new Cookie(..., $VAR, ...);
        ...
        $RESP.addCookie($COOKIE, ...);