mcp-server-semgrep/semgrep-rules/javascript/grpc/security/grpc-nodejs-insecure-connection.yaml

MCP Server for Semgrep Integration - static code analysis with AI

rules:
- id: grpc-nodejs-insecure-connection
  message: >-
    Found an insecure gRPC connection. This creates a connection without encryption to a gRPC client/server.
    A malicious attacker could tamper with the gRPC message, which could compromise the machine.
  metadata:
    owasp:
    - A08:2017 - Insecure Deserialization
    - A08:2021 - Software and Data Integrity Failures
    cwe:
    - 'CWE-502: Deserialization of Untrusted Data'
    category: security
    technology:
    - grpc
    references:
    - https://blog.gopheracademy.com/advent-2017/go-grpc-beyond-basics/#:~:text=disables%20transport%20security
    cwe2022-top25: true
    cwe2021-top25: true
    subcategory:
    - audit
    likelihood: LOW
    impact: MEDIUM
    confidence: LOW
  languages:
  - javascript
  - typescript
  severity: ERROR
  pattern-either:
  - pattern: |
      require('grpc');
      ...
      $GRPC($ADDR,...,$CREDENTIALS.createInsecure(),...);
  - pattern: |
      require('grpc');
      ...
      new $GRPC($ADDR,...,$CREDENTIALS.createInsecure(),...);
  - pattern: |-
      require('grpc');
      ...
      $CREDS = <... $CREDENTIALS.createInsecure() ...>;
      ...
      $GRPC($ADDR,...,$CREDS,...);
  - pattern: |-
      require('grpc');
      ...
      $CREDS = <... $CREDENTIALS.createInsecure() ...>;
      ...
      new $GRPC($ADDR,...,$CREDS,...);