mcp-server-semgrep/semgrep-rules/javascript/jquery/security/audit/jquery-insecure-selector.yaml

MCP Server for Semgrep Integration - static code analysis with AI

rules:
- id: jquery-insecure-selector
  message: >-
    User controlled data in a `$(...)` is an anti-pattern that can lead to XSS vulnerabilities
  metadata:
    cwe:
    - "CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')"
    owasp:
    - A07:2017 - Cross-Site Scripting (XSS)
    - A03:2021 - Injection
    references:
    - https://owasp.org/www-community/attacks/xss/
    - https://bugs.jquery.com/ticket/9521
    category: security
    technology:
    - jquery
    cwe2022-top25: true
    cwe2021-top25: true
    subcategory:
    - audit
    likelihood: LOW
    impact: MEDIUM
    confidence: LOW
  languages:
  - javascript
  - typescript
  severity: WARNING
  patterns:
  - pattern-either:
    - pattern: |
        $(<... window ...>)
    - pattern: |
        $(<... location ...>)
    - patterns:
      - pattern: |
          $X = <... window ...>;
          ...
          $(<... $X ...>);
      - focus-metavariable: $X
    - patterns:
      - pattern: |
          $X = <... location ...>;
          ...
          $(<... $X ...>);
      - focus-metavariable: $X
    - patterns:
      - pattern-either:
        - pattern-inside: |
            function $FUNC(..., $Y, ...) {
              ...
            }
        - pattern-inside: |
            function (..., $Y, ...) {
              ...
            }
        - pattern-inside: |
            function $FUNC(...,$Z,...) {
              ...
              $Y = <... $Z ...>;
              ...
            }
        - pattern-inside: |
            function (...,$Z,...) {
              ...
              $Y = <... $Z ...>;
              ...
            }
      - pattern-either:
        - pattern: |
            $(<... $Y ...>)
        - pattern: |
            $("..." + (<... $Y ...>))
        - pattern: |
            $((<... $Y ...>) + "...")
      - pattern-not-inside: |
          $JQUERY.each(function($INDEX, $Y) {
            ...
          })
      - focus-metavariable: $Y
  - pattern-not: |
      $(window)
  - pattern-not: |
      $(document)
  - pattern-not: |
      $(this)