mcp-server-semgrep/semgrep-rules/javascript/express/security/audit/express-libxml-vm-noent.yaml

MCP Server for Semgrep Integration - static code analysis with AI

rules:
- id: express-libxml-vm-noent
  message: Detected use of parseXml() function with the `noent` field set to `true`. This can lead to
    an XML External Entities (XXE) attack if untrusted data is passed into it.
  metadata:
    references:
    - https://cheatsheetseries.owasp.org/cheatsheets/XML_External_Entity_Prevention_Cheat_Sheet.html
    owasp:
    - A04:2017 - XML External Entities (XXE)
    - A05:2021 - Security Misconfiguration
    cwe:
    - 'CWE-611: Improper Restriction of XML External Entity Reference'
    category: security
    technology:
    - express
    cwe2022-top25: true
    cwe2021-top25: true
    subcategory:
    - audit
    likelihood: LOW
    impact: HIGH
    confidence: LOW
  languages:
  - javascript
  - typescript
  severity: WARNING
  patterns:
  - pattern-either:
    - patterns:
      - pattern-either:
        - pattern: $VM.runInContext("$CMD", ...)
        - pattern: $VM.runInNewContext("$CMD", ...)
        - pattern: $VM.runInThisContext("$CMD", ...)
        - pattern: $VM.compileFunction("$CMD", ...)
      - metavariable-pattern:
          metavariable: $CMD
          language: typescript
          pattern-either:
          - pattern: |
              $LIBXML.parseXml($DATA, {..., noent: true, ...}, ...)
          - patterns:
            - pattern-inside: |
                $OPTS = {..., noent: true, ...}
                ...
            - pattern: $LIBXML.parseXml( $DATA, $OPTS )
    - pattern: |
        $LIBXML.parseXml($DATA, {..., noent: true, ...}, ...)
    - patterns:
      - pattern-inside: |
          $OPTS = {..., noent: true, ...}
          ...
      - pattern: $LIBXML.parseXml( $DATA, $OPTS )