mcp-server-semgrep/semgrep-rules/problem-based-packs/insecure-transport/go-stdlib/sling-http-request.yaml

MCP Server for Semgrep Integration - static code analysis with AI

rules:
- id: sling-http-request
  message: >-
    Checks for requests to http (unencrypted) sites using gorequest, a popular HTTP client library.
    This is dangerous because it could result in plaintext PII being passed around the network.
  severity: WARNING
  metadata:
    likelihood: MEDIUM
    impact: MEDIUM
    confidence: MEDIUM
    category: security
    cwe: 'CWE-319: Cleartext Transmission of Sensitive Information'
    owasp: 'A03:2017 - Sensitive Data Exposure'
    references:
    - https://godoc.org/github.com/dghubble/sling#Sling.Add
    - https://github.com/dghubble/sling
    subcategory:
    - vuln
    technology:
    - sling
    vulnerability: Insecure Transport
  languages: [go]
  pattern-either:
  - patterns:
    - pattern-inside: |
        $REQ = sling.New()
        ...
        $RES = ...
    - pattern: |
        $REQ.$FUNC("=~/[hH][tT][tT][pP]://.*/")
    - metavariable-regex:
        metavariable: $FUNC
        regex: (Get|Post|Delete|Head|Put|Options|Patch|Base|Connect)
  - patterns:
    - pattern: sling.New().$FUNC("=~/[hH][tT][tT][pP]://.*/")
    - metavariable-regex:
        metavariable: $FUNC
        regex: (Get|Post|Delete|Head|Put|Options|Patch|Base|Connect)
  - patterns:
    - pattern-inside: |
        $REQ = sling.New()
        ...
        $URL = "=~/[hH][tT][tT][pP]://.*/"
        ...
        $RES = ...
    - pattern: |
        $REQ.$FUNC($URL)
    - metavariable-regex:
        metavariable: $FUNC
        regex: (Get|Post|Delete|Head|Put|Options|Patch|Base|Connect)
  - patterns:
    - pattern-inside: |
        $URL = "=~/[hH][tT][tT][pP]://.*/"
        ...
        $RES = ...
    - pattern: |
        sling.New().$FUNC($URL)
    - metavariable-regex:
        metavariable: $FUNC
        regex: (Get|Post|Delete|Head|Put|Options|Patch|Base|Connect)