mcp-server-semgrep/semgrep-rules/javascript/express/security/audit/remote-property-injection.yaml

MCP Server for Semgrep Integration - static code analysis with AI

rules:
- id: remote-property-injection
  message: >-
    Bracket object notation with user input is present, this might allow an
    attacker to access all properties of the object and even it's prototype. Use
    literal values for object properties.
  metadata:
    confidence: LOW
    owasp:
    - A02:2017 - Broken Authentication
    - A04:2021 - Insecure Design
    cwe:
    - 'CWE-522: Insufficiently Protected Credentials'
    category: security
    technology:
    - express
    references:
    - https://github.com/nodesecurity/eslint-plugin-security/blob/3c7522ca1be800353513282867a1034c795d9eb4/docs/the-dangers-of-square-bracket-notation.md
    cwe2021-top25: true
    subcategory:
    - vuln
    likelihood: MEDIUM
    impact: MEDIUM
  languages:
  - javascript
  - typescript
  severity: ERROR
  mode: taint
  pattern-sources:
  - patterns:
    - pattern-either:
      - pattern-inside: function ... ($REQ, $RES) {...}
      - pattern-inside: function ... ($REQ, $RES, $NEXT) {...}
      - patterns:
        - pattern-either:
          - pattern-inside: $APP.$METHOD(..., function $FUNC($REQ, $RES) {...})
          - pattern-inside: $APP.$METHOD(..., function $FUNC($REQ, $RES, $NEXT) {...})
        - metavariable-regex:
            metavariable: $METHOD
            regex: ^(get|post|put|head|delete|options)$
    - pattern-either:
      - pattern: $REQ.query
      - pattern: $REQ.body
      - pattern: $REQ.params
      - pattern: $REQ.cookies
      - pattern: $REQ.headers
  - patterns:
    - pattern-either:
      - pattern-inside: |
          ({ $REQ }: Request,$RES: Response, $NEXT: NextFunction) =>
          {...}
      - pattern-inside: |
          ({ $REQ }: Request,$RES: Response) => {...}
    - focus-metavariable: $REQ
    - pattern-either:
      - pattern: params
      - pattern: query
      - pattern: cookies
      - pattern: headers
      - pattern: body
  pattern-sinks:
  - patterns:
    - pattern-inside: $OBJ[...] = ...
    - pattern-not-inside: $OBJ["..."] = ...
    - pattern-not-inside: $OBJ[...] = "..."
    - pattern: $INDEX
    - pattern-not: |
        "..." + $INDEX
    - pattern-not: |
        $INDEX + "..."
  pattern-sanitizers:
  - patterns:
    - pattern: var $X = ...
    - pattern-not: var $X = $REQ.$ANY