mcp-server-semgrep/semgrep-rules/javascript/lang/security/audit/unsafe-formatstring.yaml

MCP Server for Semgrep Integration - static code analysis with AI

rules:
- id: unsafe-formatstring
  message: >-
    Detected string concatenation with a non-literal variable in a util.format / console.log function.
    If an attacker injects
    a format specifier in the string, it will forge the log message. Try to use constant values for the
    format string.
  metadata:
    cwe:
    - 'CWE-134: Use of Externally-Controlled Format String'
    owasp:
    - "A01:2021 - Broken Access Control"
    category: security
    technology:
    - javascript
    subcategory:
    - audit
    likelihood: MEDIUM
    impact: LOW
    confidence: LOW
    references:
    - https://cwe.mitre.org/data/definitions/134.html
  languages:
  - javascript
  - typescript
  severity: INFO
  mode: taint
  pattern-sources:
  - patterns:
    - pattern-either:
      - pattern: $X + $Y
      - pattern: $X.concat($Y)
      - pattern: |
          `...${...}...`
    - pattern-not: |
        "..." + "..."
    - pattern-not: |
        $X.concat("...")
  pattern-sinks:
  - patterns:
    - focus-metavariable: $STR
    - pattern-either:
      - pattern: |
          console.$LOG($STR,$PARAM,...)
      - patterns:
        - pattern-inside: |
            $UTIL = require('util')
            ...
        - pattern: |
            $UTIL.format($STR,$PARAM,...)