mcp-server-semgrep/semgrep-rules/php/doctrine/security/audit/doctrine-dbal-dangerous-query.yaml

MCP Server for Semgrep Integration - static code analysis with AI

rules:
- id: doctrine-dbal-dangerous-query
  languages:
  - php
  message: Detected string concatenation with a non-literal variable in a Doctrine DBAL query method.
    This could lead to SQL injection if the variable is user-controlled and not properly sanitized. In
    order to prevent SQL injection, use parameterized queries or prepared statements instead.
  metadata:
    category: security
    cwe:
    - "CWE-89: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')"
    owasp:
    - A01:2017 - Injection
    - A03:2021 - Injection
    references:
    - https://www.doctrine-project.org/projects/doctrine-dbal/en/current/reference/security.html
    - https://cheatsheetseries.owasp.org/cheatsheets/SQL_Injection_Prevention_Cheat_Sheet.html
    technology:
    - doctrine
    cwe2022-top25: true
    cwe2021-top25: true
    subcategory:
    - audit
    likelihood: LOW
    impact: HIGH
    confidence: LOW
  patterns:
  - pattern-either:
    - pattern: $CONNECTION->prepare($QUERY,...)
    - pattern: $CONNECTION->createQuery($QUERY,...)
    - pattern: $CONNECTION->executeQuery($QUERY,...)
  - pattern-either:
    - pattern-inside: |
        use Doctrine\DBAL\Connection;
        ...
    - pattern-inside: |
        $CONNECTION = $SMTH->getConnection(...);
        ...
  - pattern-not: $CONNECTION->prepare("...",...)
  - pattern-not: $CONNECTION->createQuery("...",...)
  - pattern-not: $CONNECTION->executeQuery("...",...)
  severity: WARNING