mcp-server-semgrep/semgrep-rules/php/laravel/security/laravel-unsafe-validator.yaml

MCP Server for Semgrep Integration - static code analysis with AI

rules:
- id: laravel-unsafe-validator
  mode: taint
  pattern-sources:
  - patterns:
    - pattern: |
        public function $F(...,Request $R,...){...}
    - focus-metavariable: $R
  - patterns:
    - pattern-either:
      - pattern: |
          $this->$PROPERTY
      - pattern: |
          $this->$PROPERTY->$GET
    - metavariable-pattern:
        metavariable: $PROPERTY
        patterns:
        - pattern-either:
          - pattern: query
          - pattern: request
          - pattern: headers
          - pattern: cookies
          - pattern: cookie
          - pattern: files
          - pattern: file
          - pattern: allFiles
          - pattern: input
          - pattern: all
          - pattern: post
          - pattern: json
    - pattern-either:
      - pattern-inside: |
          class $CL extends Illuminate\Http\Request {...}
      - pattern-inside: |
          class $CL extends Illuminate\Foundation\Http\FormRequest {...}
  pattern-sinks:
  - patterns:
    - pattern: |
        Illuminate\Validation\Rule::unique(...)->ignore(...,$IGNORE,...)
    - focus-metavariable: $IGNORE
  message: Found a request argument passed to an `ignore()` definition in a Rule constraint. This
    can lead to SQL injection.
  languages:
  - php
  severity: ERROR
  metadata:
    category: security
    cwe:
    - "CWE-89: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')"
    owasp:
    - A01:2017 - Injection
    - A03:2021 - Injection
    technology:
    - php
    - laravel
    references:
    - https://laravel.com/docs/9.x/validation#rule-unique
    cwe2022-top25: true
    cwe2021-top25: true
    subcategory:
    - vuln
    likelihood: HIGH
    impact: MEDIUM
    confidence: MEDIUM