mcp-server-semgrep/semgrep-rules/php/symfony/security/audit/symfony-permissive-cors.yaml

MCP Server for Semgrep Integration - static code analysis with AI

rules:
- id: symfony-permissive-cors
  patterns:
  - pattern-inside: |
      use Symfony\Component\HttpFoundation\Response;
      ...
  - pattern-either:
    - patterns:
      - pattern-either:
        - pattern: |
            new Symfony\Component\HttpFoundation\Response($X, $Y, $HEADERS, ...)
        - pattern: new Response($X, $Y, $HEADERS, ...)
      - pattern-either:
        - pattern: new $R($X, $Y, [$KEY => $VALUE], ...)
        - pattern-inside: |
            $HEADERS = [$KEY => $VALUE];
            ...
    - patterns:
      - pattern: $RES->headers->set($KEY, $VALUE)
  - metavariable-regex:
      metavariable: $KEY
      regex: (\'|\")\s*(Access-Control-Allow-Origin|access-control-allow-origin)\s*(\'|\")
  - metavariable-regex:
      metavariable: $VALUE
      regex: (\'|\")\s*(\*)\s*(\'|\")
  message: >-
    Access-Control-Allow-Origin response header is set to "*".
    This will disable CORS Same Origin Policy restrictions.
  metadata:
    references:
    - https://developer.mozilla.org/ru/docs/Web/HTTP/Headers/Access-Control-Allow-Origin
    owasp:
    - A07:2021 - Identification and Authentication Failures
    cwe:
    - 'CWE-346: Origin Validation Error'
    category: security
    technology:
    - symfony
    subcategory:
    - audit
    likelihood: LOW
    impact: MEDIUM
    confidence: LOW
  languages: [php]
  severity: WARNING