mcp-server-semgrep/semgrep-rules/java/lang/security/audit/xml-decoder.yaml

MCP Server for Semgrep Integration - static code analysis with AI

rules:
- id: xml-decoder
  message: >-
    XMLDecoder should not be used to parse untrusted data.
    Deserializing user input can lead to arbitrary code execution.
    Use an alternative and explicitly disable external entities.
    See https://cheatsheetseries.owasp.org/cheatsheets/XML_External_Entity_Prevention_Cheat_Sheet.html
    for alternatives and vulnerability prevention.
  metadata:
    cwe:
    - 'CWE-611: Improper Restriction of XML External Entity Reference'
    owasp:
    - A04:2017 - XML External Entities (XXE)
    - A05:2021 - Security Misconfiguration
    source-rule-url: https://find-sec-bugs.github.io/bugs.htm#XML_DECODER
    references:
    - https://semgrep.dev/blog/2022/xml-security-in-java
    - https://semgrep.dev/docs/cheat-sheets/java-xxe/
    - https://cheatsheetseries.owasp.org/cheatsheets/XML_External_Entity_Prevention_Cheat_Sheet.html
    category: security
    technology:
    - java
    cwe2022-top25: true
    cwe2021-top25: true
    subcategory:
    - audit
    likelihood: LOW
    impact: HIGH
    confidence: LOW
  severity: WARNING
  languages: [java]
  patterns:
  - pattern: |
      $X $METHOD(...) {
        ...
        new XMLDecoder(...);
        ...
      }
  - pattern-not: |
      $X $METHOD(...) {
        ...
        new XMLDecoder("...");
        ...
      }
  - pattern-not: |-
      $X $METHOD(...) {
        ...
        String $STR = "...";
        ...
        new XMLDecoder($STR);
        ...
      }