mcp-server-semgrep
Version:
MCP Server for Semgrep Integration - static code analysis with AI
50 lines (49 loc) • 2.04 kB
YAML
rules:
- id: disallow-old-tls-versions1
message: >-
Detects direct creations of SSLConnectionSocketFactories that don't disallow SSL v2, SSL v3, and TLS
v1.
SSLSocketFactory can be used to validate the identity of the HTTPS server against a list of trusted
certificates.
These protocols are deprecated due to POODLE, man in the middle attacks, and other vulnerabilities.
severity: WARNING
metadata:
likelihood: HIGH
impact: MEDIUM
confidence: MEDIUM
category: security
cwe: 'CWE-319: Cleartext Transmission of Sensitive Information'
owasp: 'A03:2017 - Sensitive Data Exposure'
references:
- https://stackoverflow.com/questions/26429751/java-http-clients-and-poodle
subcategory:
- vuln
technology:
- java
vulnerability: Insecure Transport
languages: [java]
patterns:
- pattern: |
new SSLConnectionSocketFactory(...);
- pattern-not: |
new SSLConnectionSocketFactory(..., new String[] {"TLSv1.2", "TLSv1.3"}, ...);
- pattern-not: |
new SSLConnectionSocketFactory(..., new String[] {"TLSv1.3", "TLSv1.2"}, ...);
- pattern-not: |
new SSLConnectionSocketFactory(..., new String[] {"TLSv1.3"}, ...);
- pattern-not: |
new SSLConnectionSocketFactory(..., new String[] {"TLSv1.2"}, ...);
- pattern-not-inside: >
(SSLConnectionSocketFactory $SF) = new
SSLConnectionSocketFactory(...);
...
(TlsConfig $TLSCONFIG) = TlsConfig.custom(). ... .setSupportedProtocols(TLS.V_1_2). ... .build();
...
HttpClientConnectionManager cm = $CM.create(). ... .setSSLSocketFactory($SF). ... .setDefaultTlsConfig($TLSCONFIG). ... .build();
- pattern-not-inside: >
(SSLConnectionSocketFactory $SF) = new
SSLConnectionSocketFactory(...);
...
(TlsConfig $TLSCONFIG) = TlsConfig.custom(). ... .setSupportedProtocols(TLS.V_1_3). ... .build();
...
HttpClientConnectionManager cm = $CM.create(). ... .setSSLSocketFactory($SF). ... .setDefaultTlsConfig($TLSCONFIG). ... .build();