mcp-server-semgrep/semgrep-rules/php/laravel/security/laravel-cookie-secure-set.yaml

MCP Server for Semgrep Integration - static code analysis with AI

rules:
- id: laravel-cookie-secure-set
  patterns:
  - pattern: |
      'cookie'
  - pattern-inside: |
      return [
        ...,
        'cookie' => env(...),
        ...
      ];
  - pattern-not-inside: |
      return [
        ...,
        'secure' => true,
        ...
      ];
  - pattern-not-inside: |
      return [
        ...,
        'secure' => env('$NAME', $DEFAULT),
        ...
      ];
  paths:
    include:
    - '*session.php'
  message: >-
    Found a configuration file where the secure attribute is not set to 'true'.
    Setting 'secure' to 'true' prevents the client from transmitting the cookie over unencrypted channels
    and therefore prevents cookies from being
    stolen through man in the middle attacks. 
  languages:
  - php
  severity: ERROR
  metadata:
    category: security
    cwe:
    - "CWE-614: Sensitive Cookie in HTTPS Session Without 'Secure' Attribute"
    owasp:
    - A05:2021 - Security Misconfiguration
    technology:
    - php
    - laravel
    references:
    - https://github.com/OWASP/CheatSheetSeries/blob/master/cheatsheets/Laravel_Cheat_Sheet.md
    subcategory:
    - audit
    likelihood: LOW
    impact: LOW
    confidence: LOW