mcp-server-semgrep
Version:
MCP Server for Semgrep Integration - static code analysis with AI
34 lines (33 loc) • 1.16 kB
YAML
rules:
- id: bypass-tls-verification
message: >-
Checks for setting the environment variable NODE_TLS_REJECT_UNAUTHORIZED to 0, which disables TLS
verification.
This should only be used for debugging purposes. Setting the option rejectUnauthorized to false bypasses
verification
against the list of trusted CAs, which also leads to insecure transport. These options lead to vulnerability
to MTM attacks, and should not be used.
severity: WARNING
metadata:
likelihood: MEDIUM
impact: MEDIUM
confidence: MEDIUM
category: security
cwe: 'CWE-319: Cleartext Transmission of Sensitive Information'
owasp: 'A03:2017 - Sensitive Data Exposure'
references:
- https://nodejs.org/api/https.html#https_https_request_options_callback
- https://stackoverflow.com/questions/20433287/node-js-request-cert-has-expired#answer-29397100
subcategory:
- vuln
technology:
- node.js
vulnerability: Insecure Transport
languages:
- javascript
- typescript
pattern-either:
- pattern: |
process.env["NODE_TLS_REJECT_UNAUTHORIZED"] = 0;
- pattern: |
{rejectUnauthorized:false}