mcp-server-semgrep/semgrep-rules/java/spring/security/injection/tainted-url-host.yaml

MCP Server for Semgrep Integration - static code analysis with AI

rules:
- id: tainted-url-host
  languages:
  - java
  severity: ERROR
  message: >-
    User data flows into the host portion of this manually-constructed URL.
    This could allow an attacker to send data to their own server,
    potentially exposing sensitive data such as cookies or authorization
    information sent with this request. They could also probe internal
    servers or other resources that the server running this code can access.
    (This is called server-side request forgery, or SSRF.) Do not allow
    arbitrary hosts. Instead, create an allowlist for approved hosts, hardcode
    the correct host, or ensure that the user data can only affect the path or parameters.
  options:
    interfile: true
  metadata:
    cwe:
    - 'CWE-918: Server-Side Request Forgery (SSRF)'
    owasp:
    - A10:2021 - Server-Side Request Forgery (SSRF)
    references:
    - https://cheatsheetseries.owasp.org/cheatsheets/Server_Side_Request_Forgery_Prevention_Cheat_Sheet.html
    category: security
    technology:
    - java
    - spring
    cwe2022-top25: true
    cwe2021-top25: true
    subcategory:
    - vuln
    impact: MEDIUM
    likelihood: MEDIUM
    confidence: MEDIUM
    interfile: true
  mode: taint
  pattern-sources:
  - patterns:
    - pattern-either:
      - pattern-inside: |
          $METHODNAME(..., @$REQ(...) $TYPE $SOURCE,...) {
            ...
          }
      - pattern-inside: |
          $METHODNAME(..., @$REQ $TYPE $SOURCE,...) {
            ...
          }
    - metavariable-regex:
        metavariable: $TYPE
        regex: ^(?!(Integer|Long|Float|Double|Char|Boolean|int|long|float|double|char|boolean))
    - metavariable-regex:
        metavariable: $REQ
        regex: (RequestBody|PathVariable|RequestParam|RequestHeader|CookieValue|ModelAttribute)
    - focus-metavariable: $SOURCE
  pattern-sinks:
  - pattern-either:
    - pattern: new URL($ONEARG)
    - patterns:
      - pattern-either:
        - pattern: |
            "$URLSTR" + ...
        - pattern: |
            "$URLSTR".concat(...)
        - patterns:
          - pattern-inside: |
              StringBuilder $SB = new StringBuilder("$URLSTR");
              ...
          - pattern: $SB.append(...)
        - patterns:
          - pattern-inside: |
              $VAR = "$URLSTR";
              ...
          - pattern: $VAR += ...
        - patterns:
          - pattern: String.format("$URLSTR", ...)
          - pattern-not: String.format("$URLSTR", "...", ...)
        - patterns:
          - pattern-inside: |
              String $VAR = "$URLSTR";
              ...
          - pattern: String.format($VAR, ...)
      - metavariable-regex:
          metavariable: $URLSTR
          regex: http(s?)://%(v|s|q).*