mcp-server-semgrep/semgrep-rules/java/lang/security/audit/tainted-session-from-http-request.yaml

MCP Server for Semgrep Integration - static code analysis with AI

rules:
- id: tainted-session-from-http-request
  message: >-
    Detected input from a HTTPServletRequest going into a session command, like `setAttribute`.
    User input into such a command could lead to an attacker inputting malicious code into your session
    parameters, blurring the line between what's trusted and untrusted, and therefore leading to a trust
    boundary violation.
    This could lead to programmers trusting unvalidated data.
    Instead, thoroughly sanitize user input before passing it
    into such function calls.
  languages: [java]
  severity: WARNING
  mode: taint
  pattern-sources:
  - patterns:
    - pattern-either:
      - patterns:
        - pattern: |
            (HttpServletRequest $REQ).$FUNC(...)
        - pattern-not: |
            (HttpServletRequest $REQ).getSession()
      - patterns:   # this pattern is a hack to get the rule to      recognize `map` as tainted source when `cookie. getValue(user_input)` is used.
        - pattern-inside: |
            (javax.servlet.http.Cookie[] $COOKIES) = (HttpServletRequest $REQ).getCookies(...);
            ...
            for (javax.servlet.http.Cookie $COOKIE: $COOKIES) {
              ...
            }
        - pattern: |
            $COOKIE.getValue(...)
      - patterns:   # use this pattern to catch cases where tainted  array values are assigned to a variable (not caught by taint)
        - pattern-inside: |
            $TYPE[] $VALS = (HttpServletRequest $REQ).$GETFUNC(... );
            ...
        - pattern: |
            $PARAM = $VALS[$INDEX];
      - patterns:   # use this pattern to catch cases where request headers are later decoded
        - pattern-inside: |
            $HEADERS = (HttpServletRequest $REQ).getHeaders(...);
            ...
            $PARAM = $HEADERS.$FUNC(...);
            ...
        - pattern: |
            java.net.URLDecoder.decode($PARAM, ...)
  pattern-sinks:
    - patterns:
        - pattern: (HttpServletRequest $REQ).getSession().$FUNC($NAME, $VALUE);
        - metavariable-regex:
            metavariable: $FUNC
            regex: ^(putValue|setAttribute)$
        - focus-metavariable: $VALUE
  options:
    interfile: true
  metadata:
    category: security
    technology:
    - java
    cwe:
    - 'CWE-501: Trust Boundary Violation'
    owasp:
    - A04:2021 - Insecure Design
    references:
    - https://owasp.org/Top10/A04_2021-Insecure_Design
    subcategory:
    - vuln
    impact: MEDIUM
    likelihood: MEDIUM
    confidence: MEDIUM
    interfile: true