mcp-server-semgrep/semgrep-rules/java/lang/security/audit/xss/no-direct-response-writer.yaml

MCP Server for Semgrep Integration - static code analysis with AI

rules:
- id: no-direct-response-writer
  message: Detected a request with potential user-input going into a OutputStream
      or Writer object. This bypasses any view or template environments,
      including HTML escaping, which may expose this application to cross-site
      scripting (XSS) vulnerabilities. Consider using a view technology such as
      JavaServer Faces (JSFs) which automatically escapes HTML views.
  severity: WARNING
  options:
    interfile: true
  metadata:
    likelihood: HIGH
    impact: MEDIUM
    confidence: MEDIUM
    category: security
    cwe:
      - "CWE-79: Improper Neutralization of Input During Web Page Generation
        ('Cross-site Scripting')"
    cwe2021-top25: true
    cwe2022-top25: true
    owasp:
      - A07:2017 - Cross-Site Scripting (XSS)
      - A03:2021 - Injection
    references:
      - https://www3.ntu.edu.sg/home/ehchua/programming/java/JavaServerFaces.html
    subcategory:
      - vuln
    technology:
      - java
      - servlets
    interfile: true
  languages:
    - java
  mode: taint
  pattern-sources:
    - patterns:
        - pattern-either:
            - pattern: |
                (HttpServletRequest $REQ).$REQFUNC(...)
            - pattern: |
                (ServletRequest $REQ).$REQFUNC(...) 
        - metavariable-regex:
            metavariable: $REQFUNC
            regex: (getInputStream|getParameter|getParameterMap|getParameterValues|getReader|getCookies|getHeader|getHeaderNames|getHeaders|getPart|getParts|getQueryString)
  pattern-sinks:
    - patterns:
        - pattern-either:
            - pattern: |
                (HttpServletResponse $RESPONSE).getWriter(...).$WRITE(...)
            - pattern: >
                (HttpServletResponse
                $RESPONSE).getOutputStream(...).$WRITE(...)
            - pattern: |
                (java.io.PrintWriter $WRITER).$WRITE(...)
            - pattern: |
                (PrintWriter $WRITER).$WRITE(...)
            - pattern: |
                (javax.servlet.ServletOutputStream $WRITER).$WRITE(...)
            - pattern: |
                (ServletOutputStream $WRITER).$WRITE(...)
            - pattern: |
                (java.io.OutputStream $WRITER).$WRITE(...)
            - pattern: |
                (OutputStream $WRITER).$WRITE(...)
  pattern-sanitizers:
    - pattern-either:
        - pattern: Encode.forHtml(...)
        - pattern: (PolicyFactory $POLICY).sanitize(...)
        - pattern: (AntiSamy $AS).scan(...)
        - pattern: JSoup.clean(...)
        - pattern: org.apache.commons.lang.StringEscapeUtils.escapeHtml(...)
        - pattern: org.springframework.web.util.HtmlUtils.htmlEscape(...)
        - pattern: org.owasp.esapi.ESAPI.encoder().encodeForHTML(...)