mcp-server-semgrep/semgrep-rules/java/lang/security/audit/permissive-cors.yaml

MCP Server for Semgrep Integration - static code analysis with AI

rules:
- id: permissive-cors
  message: >-
    https://find-sec-bugs.github.io/bugs.htm#PERMISSIVE_CORS
    Permissive CORS policy will allow a malicious application to communicate with
    the victim application in an inappropriate way, leading to spoofing, data theft,
    relay and other attacks.
  metadata:
    cwe:
    - 'CWE-183: Permissive List of Allowed Inputs'
    asvs:
      section: 'V14: Configuration Verification Requirements'
      control_id: 14.4.8 Permissive CORS
      control_url: https://github.com/OWASP/ASVS/blob/master/4.0/en/0x22-V14-Config.md#v144-http-security-headers-requirements
      version: '4'
    category: security
    technology:
    - java
    owasp:
    - A04:2021 - Insecure Design
    references:
    - https://owasp.org/Top10/A04_2021-Insecure_Design
    subcategory:
    - audit
    likelihood: LOW
    impact: LOW
    confidence: LOW
  severity: WARNING
  languages: [java]
  pattern-either:
  - pattern: |
      HttpServletResponse $RES = ...;
      ...
      $RES.addHeader("=~/access-control-allow-origin/i", "=~/^\*|null$/i");
  - pattern: |
      HttpServletResponse $RES = ...;
      ...
      $RES.setHeader("=~/access-control-allow-origin/i", "=~/^\*|null$/i");
  - pattern: |
      ServerHttpResponse $RES = ...;
      ...
      $RES.getHeaders().add("=~/access-control-allow-origin/i", "=~/^\*|null$/i");
  - pattern: |
      HttpHeaders $HEADERS = ...;
      ...
      $HEADERS.set("=~/access-control-allow-origin/i", "=~/^\*|null$/i");
  - pattern: |
      ServerWebExchange $SWE = ...;
      ...
      $SWE.getResponse().getHeaders().add("Access-Control-Allow-Origin", "*");
  - pattern: |
      $X $METHOD(...,HttpServletResponse $RES,...) {
        ...
        $RES.addHeader("=~/access-control-allow-origin/i", "=~/^\*|null$/i");
        ...
      }
  - pattern: |
      $X $METHOD(...,HttpServletResponse $RES,...) {
        ...
        $RES.setHeader("=~/access-control-allow-origin/i", "=~/^\*|null$/i");
        ...
      }
  - pattern: |
      $X $METHOD(...,ServerHttpResponse $RES,...) {
        ...
        $RES.getHeaders().add("=~/access-control-allow-origin/i", "=~/^\*|null$/i");
        ...
      }
  - pattern: |
      $X $METHOD(...,ServerWebExchange $SWE,...) {
        ...
        $SWE.getResponse().getHeaders().add("=~/access-control-allow-origin/i", "=~/^\*|null$/i");
        ...
      }
  - pattern: ResponseEntity.$RES().header("=~/access-control-allow-origin/i", "=~/^\*|null$/i")
  - pattern: ServerResponse.$RES().header("=~/access-control-allow-origin/i", "=~/^\*|null$/i")