mcp-server-semgrep/semgrep-rules/python/django/security/injection/code/user-exec.yaml

MCP Server for Semgrep Integration - static code analysis with AI

rules:
- id: user-exec
  message: >-
    Found user data in a call to 'exec'. This is extremely dangerous because it can enable an attacker
    to
    execute arbitrary remote code on the system. Instead, refactor your code to not use 'eval' and
    instead use a safe library for the specific functionality you need.
  metadata:
    cwe:
    - "CWE-95: Improper Neutralization of Directives in Dynamically Evaluated Code ('Eval Injection')"
    owasp:
    - A03:2021 - Injection
    category: security
    technology:
    - django
    references:
    - https://owasp.org/www-community/attacks/Code_Injection
    subcategory:
    - vuln
    likelihood: MEDIUM
    impact: HIGH
    confidence: MEDIUM
  patterns:
  - pattern-inside: |
      def $F(...):
        ...
  - pattern-either:
    - pattern: exec(..., request.$W.get(...), ...)
    - pattern: |
        $V = request.$W.get(...)
        ...
        exec(..., $V, ...)
    - pattern: exec(..., request.$W(...), ...)
    - pattern: |
        $V = request.$W(...)
        ...
        exec(..., $V, ...)
    - pattern: exec(..., request.$W[...], ...)
    - pattern: |
        $V = request.$W[...]
        ...
        exec(..., $V, ...)
    - pattern: |
        loop = asyncio.get_running_loop()
        ...
        await loop.run_in_executor(None, exec, request.$W[...])
    - pattern: |
        $V = request.$W[...]
        ...
        loop = asyncio.get_running_loop()
        ...
        await loop.run_in_executor(None, exec, $V)
    - pattern: |
        loop = asyncio.get_running_loop()
        ...
        await loop.run_in_executor(None, exec, request.$W.get(...))
    - pattern: |
        $V = request.$W.get(...)
        ...
        loop = asyncio.get_running_loop()
        ...
        await loop.run_in_executor(None, exec, $V)
  languages: [python]
  severity: WARNING