mcp-server-semgrep/semgrep-rules/javascript/express/security/audit/express-ssrf.yaml

MCP Server for Semgrep Integration - static code analysis with AI

rules:
  - id: express-ssrf
    message: >-
      The following request $REQUEST.$METHOD() was found to be crafted from
      user-input `$REQ` which can lead to Server-Side Request Forgery (SSRF)
      vulnerabilities. It is recommended where possible to not allow user-input
      to craft the base request, but to be treated as part of the path or query
      parameter. When user-input is necessary to craft the request, it is
      recommeneded to follow OWASP best practices to prevent abuse. 
    metadata:
      references:
        - https://cheatsheetseries.owasp.org/cheatsheets/Server_Side_Request_Forgery_Prevention_Cheat_Sheet.html
      cwe:
        - "CWE-918: Server-Side Request Forgery (SSRF)"
      technology:
        - express
      category: security
      owasp:
        - A10:2021 - Server-Side Request Forgery (SSRF)
      cwe2022-top25: true
      cwe2021-top25: true
      subcategory:
        - vuln
      likelihood: MEDIUM
      impact: HIGH
      confidence: MEDIUM
    languages:
      - javascript
      - typescript
    severity: WARNING
    mode: taint
    options:
      taint_unify_mvars: true
    pattern-sources:
      - patterns:
          - pattern-either:
              - pattern-inside: function ... ($REQ, ...) {...}
          - pattern-either:
              - pattern: $REQ.query
              - pattern: $REQ.body
              - pattern: $REQ.params
              - pattern: $REQ.cookies
              - pattern: $REQ.headers
      - patterns:
          - pattern-either:
              - pattern-inside: |
                  ({ $REQ }: Request,...) =>
                  {...}
              - pattern-inside: |
                  ({ $REQ }: $EXPRESS.Request,...) => {...}
          - focus-metavariable: $REQ
          - pattern-either:
              - pattern: params
              - pattern: query
              - pattern: cookies
              - pattern: headers
              - pattern: body
    # we have a deepsemgrep rule which will make this 10x smaller.          
    pattern-sinks:
      - patterns:
          - pattern-either:
              - pattern-inside: |
                  $REQUEST = require('request')
                  ...
              - pattern-inside: |
                  import * as $REQUEST from 'request'
                  ...
              - pattern-inside: |
                  import $REQUEST from 'request'
                  ...
          # Direct usage with http:// https:// and //
          - pattern-either:
              - pattern: $REQUEST.$METHOD("$HTTP"+$REQ. ... .$VALUE)
              - pattern: $REQUEST.$METHOD("$HTTP"+$REQ. ... .$VALUE + $...A)
              - pattern: $REQUEST.$METHOD(`$HTTP${$REQ. ... .$VALUE}...`)
              - pattern: $REQUEST.$METHOD("$HTTP"+$REQ.$VALUE[...])
              - pattern: $REQUEST.$METHOD("$HTTP"+$REQ.$VALUE[...] + $...A)
              - pattern: $REQUEST.$METHOD(`$HTTP${$REQ.$VALUE[...]}...`)
          - metavariable-regex:
              metavariable: $METHOD
              regex: ^(get|post|put|patch|del|head|delete)$
          - metavariable-regex:
              metavariable: $HTTP
              regex: ^(https?:\/\/|//)$
          - pattern-either:
              - pattern: $REQ. ... .$VALUE
      - patterns:
          - pattern-either:
              - pattern-inside: |
                  $REQUEST = require('request')
                  ...
              - pattern-inside: |
                  import * as $REQUEST from 'request'
                  ...
              - pattern-inside: |
                  import $REQUEST from 'request'
                  ...
          # Direct usage with req.body at start
          - pattern-either:
              - pattern: $REQUEST.$METHOD($REQ. ... .$VALUE,...)
              - pattern: $REQUEST.$METHOD($REQ. ... .$VALUE + $...A,...)
              - pattern: $REQUEST.$METHOD(`${$REQ. ... .$VALUE}...`,...)
          - pattern: $REQ. ... .$VALUE
          - metavariable-regex:
              metavariable: $METHOD
              regex: ^(get|post|put|patch|del|head|delete)$
      - patterns:
          - pattern-either:
              - pattern-inside: |
                  $REQUEST = require('request')
                  ...
              - pattern-inside: |
                  import * as $REQUEST from 'request'
                  ...
              - pattern-inside: |
                  import $REQUEST from 'request'
                  ...
          # Direct usage with req.body['value'] at start
          - pattern-either:
              - pattern: $REQUEST.$METHOD($REQ.$VALUE['...'],...)
              - pattern: $REQUEST.$METHOD($REQ.$VALUE['...'] + $...A,...)
              - pattern: $REQUEST.$METHOD(`${$REQ.$VALUE['...']}...`,...)
          - pattern: $REQ.$VALUE
          - metavariable-regex:
              metavariable: $METHOD
              regex: ^(get|post|put|patch|del|head|delete)$
      - patterns:
          - pattern-either:
              - pattern-inside: |
                  $REQUEST = require('request')
                  ...
              - pattern-inside: |
                  import * as $REQUEST from 'request'
                  ...
              - pattern-inside: |
                  import $REQUEST from 'request'
                  ...
          # Direct usage with req.body from assign
          - pattern-either:
              - pattern-inside: |
                  $ASSIGN = $REQ. ... .$VALUE
                  ...
              - pattern-inside: |
                  $ASSIGN = $REQ. ... .$VALUE['...']
                  ...
              - pattern-inside: |
                  $ASSIGN = $REQ. ... .$VALUE + $...A
                  ...
              - pattern-inside: |
                  $ASSIGN = $REQ. ... .$VALUE['...'] + $...A
                  ...     
              - pattern-inside: |
                  $ASSIGN = `${$REQ. ... .$VALUE}...`
                  ...
              - pattern-inside: |
                  $ASSIGN = `${$REQ. ... .$VALUE['...']}...`
                  ... 
              # Direct usage with req.body with http|https|// from assign
              - patterns:
                - pattern-either:
                    - pattern-inside: |
                            $ASSIGN = "$HTTP"+ $REQ. ... .$VALUE
                            ...
                    - pattern-inside: |
                            $ASSIGN = "$HTTP"+$REQ. ... .$VALUE + $...A
                            ...
                    - pattern-inside: |
                            $ASSIGN = "$HTTP"+$REQ.$VALUE[...]
                            ...
                    - pattern-inside: |
                            $ASSIGN = "$HTTP"+$REQ.$VALUE[...] + $...A
                            ...
                    - pattern-inside: |
                            $ASSIGN = `$HTTP${$REQ.$VALUE[...]}...`
                            ...
                - metavariable-regex:
                    metavariable: $HTTP
                    regex: ^(https?:\/\/|//)$                   
          - pattern-either:
              - pattern: $REQUEST.$METHOD($ASSIGN,...)
              - pattern: $REQUEST.$METHOD($ASSIGN + $...FOO,...)
              - pattern: $REQUEST.$METHOD(`${$ASSIGN}...`,...)
              - patterns:
                  - pattern-either:
                      - pattern: $REQUEST.$METHOD("$HTTP"+$ASSIGN,...)
                      - pattern: $REQUEST.$METHOD("$HTTP"+$ASSIGN + $...A,...)
                      - pattern: $REQUEST.$METHOD(`$HTTP${$ASSIGN}...`,...)
                  - metavariable-regex:
                      metavariable: $HTTP
                      regex: ^(https?:\/\/|//)$
          - pattern: $ASSIGN
          - metavariable-regex:
              metavariable: $METHOD
              regex: ^(get|post|put|patch|del|head|delete)$