mcp-server-semgrep/semgrep-rules/java/spring/security/injection/tainted-file-path.yaml

MCP Server for Semgrep Integration - static code analysis with AI

rules:
- id: tainted-file-path
  languages:
  - java
  severity: ERROR
  message: >-
    Detected user input controlling a file path. An attacker could control the location of this
    file, to include going backwards in the directory with '../'. To address this, ensure that user-controlled
    variables in file paths are sanitized. You may also consider using a utility method such as org.apache.commons.io.FilenameUtils.getName(...)
    to only retrieve the file name from the path.
  options:
    interfile: true
  metadata:
    cwe:
    - 'CWE-23: Relative Path Traversal'
    owasp:
    - A01:2021 - Broken Access Control
    references:
    - https://owasp.org/www-community/attacks/Path_Traversal
    category: security
    technology:
    - java
    - spring
    subcategory:
    - vuln
    impact: HIGH
    likelihood: MEDIUM
    confidence: HIGH
    interfile: true
  mode: taint
  pattern-sources:
  - patterns:
    - pattern-either:
      - pattern-inside: |
          $METHODNAME(..., @$REQ(...) $TYPE $SOURCE,...) {
            ...
          }
      - pattern-inside: |
          $METHODNAME(..., @$REQ $TYPE $SOURCE,...) {
            ...
          }
    - metavariable-regex:
        metavariable: $TYPE
        regex: ^(?!(Integer|Long|Float|Double|Char|Boolean|int|long|float|double|char|boolean))
    - metavariable-regex:
        metavariable: $REQ
        regex: (RequestBody|PathVariable|RequestParam|RequestHeader|CookieValue|ModelAttribute)
    - focus-metavariable: $SOURCE
  pattern-sinks:
  - patterns:
    - pattern-either:
      - pattern: new File(...)
      - pattern: new java.io.File(...)
      - pattern: new FileReader(...)
      - pattern: new java.io.FileReader(...)
      - pattern: new FileInputStream(...)
      - pattern: new java.io.FileInputStream(...)
      - pattern: (Paths $PATHS).get(...)
      - patterns:
        - pattern: |
            $CLASS.$FUNC(...)
        - metavariable-regex:
            metavariable: $FUNC
            regex: ^(getResourceAsStream|getResource)$
      - patterns:
        - pattern-either:
          - pattern: new ClassPathResource($FILE, ...)
          - pattern: ResourceUtils.getFile($FILE, ...)
          - pattern: new FileOutputStream($FILE, ...)
          - pattern: new java.io.FileOutputStream($FILE, ...)
          - pattern: new StreamSource($FILE, ...)
          - pattern: new javax.xml.transform.StreamSource($FILE, ...)
          - pattern: FileUtils.openOutputStream($FILE, ...)
        - focus-metavariable: $FILE
  pattern-sanitizers:
  - pattern: org.apache.commons.io.FilenameUtils.getName(...)