mcp-server-semgrep
Version:
MCP Server for Semgrep Integration - static code analysis with AI
46 lines (45 loc) • 1.41 kB
YAML
rules:
- id: http-request
message: >-
Checks for requests sent via http.$FUNC to http:// URLS. This is dangerous because
the server is attempting to connect to a website that does not encrypt traffic with TLS. Instead,
send requests only to
https:// URLS.
severity: WARNING
metadata:
likelihood: MEDIUM
impact: MEDIUM
confidence: MEDIUM
category: security
cwe: 'CWE-319: Cleartext Transmission of Sensitive Information'
owasp: 'A03:2017 - Sensitive Data Exposure'
references:
- https://golang.org/pkg/net/http/#Get
subcategory:
- vuln
technology:
- go
vulnerability: Insecure Transport
languages:
- go
fix-regex:
regex: '[Hh][Tt][Tt][Pp]://'
replacement: https://
count: 1
patterns:
- pattern-either:
- pattern: |
http.$FUNC("=~/[hH][tT][tT][pP]://.*/", ...)
- patterns:
- pattern-inside: |
$CLIENT := &http.Client{...}
...
- pattern: |
client.$FUNC("=~/[hH][tT][tT][pP]://.*/", ...)
- pattern-not: http.$FUNC("=~/[hH][tT][tT][pP]://127.0.0.1.*/", ...)
- pattern-not: client.$FUNC("=~/[hH][tT][tT][pP]://127.0.0.1.*/", ...)
- pattern-not: http.$FUNC("=~/[hH][tT][tT][pP]://localhost.*/", ...)
- pattern-not: client.$FUNC("=~/[hH][tT][tT][pP]://localhost.*/", ...)
- metavariable-regex:
metavariable: $FUNC
regex: (Get|Post|Head|PostForm)