mcp-server-semgrep/semgrep-rules/javascript/lang/security/detect-eval-with-expression.yaml

MCP Server for Semgrep Integration - static code analysis with AI

rules:
- id: detect-eval-with-expression
  message: >-
    Detected use of dynamic execution of JavaScript which may come from
    user-input, which can lead to Cross-Site-Scripting (XSS). Where possible
    avoid including user-input in functions which dynamically execute user-input.
  metadata:
    cwe:
    - "CWE-95: Improper Neutralization of Directives in Dynamically Evaluated Code ('Eval Injection')"
    owasp:
    - A03:2021 - Injection
    source-rule-url: https://github.com/nodesecurity/eslint-plugin-security/blob/master/rules/detect-eval-with-expression.js
    references:
    - https://developer.mozilla.org/en-US/docs/Web/JavaScript/Reference/Global_Objects/eval#never_use_eval!
    category: security
    technology:
    - javascript
    subcategory:
    - vuln
    likelihood: MEDIUM
    impact: MEDIUM
    confidence: MEDIUM
  languages:
  - javascript
  - typescript
  severity: WARNING
  mode: taint
  pattern-sources:
  - patterns:
    - pattern-either:
      - pattern-inside: |
          $PROP = new URLSearchParams($WINDOW. ... .location.search).get('...')
            ...
      - pattern-inside: |
          $PROP = new URLSearchParams(location.search).get('...')
            ...
      - pattern-inside: |
          $PROP = new URLSearchParams($WINDOW. ... .location.hash.substring(1)).get('...')
            ...
      - pattern-inside: |
          $PROP = new URLSearchParams(location.hash.substring(1)).get('...')
            ...
    - focus-metavariable: $PROP
  - patterns:
    - pattern-either:
      - pattern-inside: |
          $PROPS = new URLSearchParams($WINDOW. ... .location.search)
            ...
      - pattern-inside: |
          $PROPS = new URLSearchParams(location.search)
            ...
      - pattern-inside: |
          $PROPS = new
          URLSearchParams($WINDOW. ... .location.hash.substring(1))
            ...
      - pattern-inside: |
          $PROPS = new URLSearchParams(location.hash.substring(1))
          ...
    - pattern: $PROPS.get('...')
    - focus-metavariable: $PROPS
  - patterns:
    - pattern-either:
      - pattern: location.href
      - pattern: location.hash
      - pattern: location.search
      - pattern: $WINDOW. ... .location.href
      - pattern: $WINDOW. ... .location.hash
      - pattern: $WINDOW. ... .location.search
  pattern-sinks:
  - patterns:
    - pattern-either:
      - pattern: eval(<... $SINK ...>)
      - pattern: window.eval(<... $SINK ...>)
      - pattern: new Function(<... $SINK ...>)
      - pattern: new Function(<... $SINK ...>)(...)
      - pattern: setTimeout(<... $SINK ...>,...)
      - pattern: setInterval(<... $SINK ...>,...)
    - focus-metavariable: $SINK
  pattern-sanitizers:
  - patterns:
    - pattern-either:
      - pattern: location.href = $FUNC(...)
      - pattern: location.hash = $FUNC(...)
      - pattern: location.search = $FUNC(...)
      - pattern: $WINDOW. ... .location.href = $FUNC(...)
      - pattern: $WINDOW. ... .location.hash = $FUNC(...)
      - pattern: $WINDOW. ... .location.search = $FUNC(...)