mcp-server-semgrep/semgrep-rules/php/symfony/security/audit/symfony-csrf-protection-disabled.yaml

MCP Server for Semgrep Integration - static code analysis with AI

rules:
- id: symfony-csrf-protection-disabled
  patterns:
  - pattern-either:
    - pattern: $X->createForm($TYPE, $TASK, [..., 'csrf_protection' => false, ...], ...)
    - pattern: $X->prependExtensionConfig('framework', [..., 'csrf_protection' => false, ...], ...)
    - pattern: $X->loadFromExtension('framework', [..., 'csrf_protection' => false, ...], ...)
    - pattern: $X->setDefaults([..., 'csrf_protection' => false, ...], ...)
    - patterns:
      - pattern-either:
        - pattern: $X->createForm($TYPE, $TASK, [..., 'csrf_protection' => $VAL, ...], ...)
        - pattern: $X->prependExtensionConfig('framework', [..., 'csrf_protection' => $VAL, ...], ...)
        - pattern: $X->loadFromExtension('framework', [..., 'csrf_protection' => $VAL, ...], ...)
        - pattern: $X->setDefaults([..., 'csrf_protection' => $VAL, ...], ...)
      - pattern-inside: |
          $VAL = false;
          ...
  message: >-
    CSRF protection is disabled for this configuration. This is a security risk.
    Make sure that it is safe or consider setting `csrf_protection` property to `true`.
  metadata:
    references:
    - https://symfony.com/doc/current/security/csrf.html
    cwe:
    - 'CWE-352: Cross-Site Request Forgery (CSRF)'
    owasp:
    - A01:2021 - Broken Access Control
    category: security
    technology:
    - symfony
    cwe2022-top25: true
    cwe2021-top25: true
    subcategory:
    - audit
    likelihood: LOW
    impact: MEDIUM
    confidence: LOW
  languages: [php]
  severity: WARNING