mcp-server-semgrep/semgrep-rules/python/django/security/injection/path-traversal/path-traversal-join.yaml

MCP Server for Semgrep Integration - static code analysis with AI

rules:
- id: path-traversal-join
  message: >-
    Data from request is passed to os.path.join() and to open(). This is a path traversal vulnerability,
    which can lead to sensitive data being leaked. To mitigate, consider using os.path.abspath or os.path.realpath
    or Path library.
  metadata:
    cwe:
    - "CWE-22: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')"
    owasp:
    - A05:2017 - Broken Access Control
    - A01:2021 - Broken Access Control
    references:
    - https://owasp.org/www-community/attacks/Path_Traversal
    category: security
    technology:
    - django
    cwe2022-top25: true
    cwe2021-top25: true
    subcategory:
    - audit
    likelihood: LOW
    impact: LOW
    confidence: LOW
  patterns:
  - pattern-inside: |
      def $F(...):
        ...
  - pattern-not-inside: |
      def $F(...):
        ...
        os.path.abspath(...)
        ...
  - pattern-not-inside: |
      def $F(...):
        ...
        os.path.realpath(...)
        ...
  - pattern-either:
    - pattern: open(os.path.join(..., request.$W.get(...), ...), ...)
    - pattern: open(os.path.join(..., request.$W(...), ...), ...)
    - pattern: open(os.path.join(..., request.$W, ...), ...)
    - pattern: open(os.path.join(..., request.$W[...], ...), ...)
    - pattern: |
        $P = os.path.join(..., request.$W.get(...), ...)
        ...
        open($P, ...)
    - pattern: |
        $P = os.path.join(..., request.$W(...), ...)
        ...
        open($P, ...)
    - pattern: |
        $P = os.path.join(..., request.$W, ...)
        ...
        open($P, ...)
    - pattern: |
        $P = os.path.join(..., request.$W[...], ...)
        ...
        open($P, ...)
    - pattern: |
        $V = request.$W.get($X)
        ...
        $P = os.path.join(..., $V, ...)
        ...
        open($P, ...)
    - pattern: |
        $V = request.$W($X)
        ...
        $P = os.path.join(..., $V, ...)
        ...
        open($P, ...)
    - pattern: |
        $V = request.$W[$X]
        ...
        $P = os.path.join(..., $V, ...)
        ...
        open($P, ...)
    - pattern: |
        $V = request.$W
        ...
        $P = os.path.join(..., $V, ...)
        ...
        open($P, ...)
    - pattern: |
        $P = request.$W.get(...)
        ...
        open(os.path.join(..., $P, ...), ...)
    - pattern: |
        $P = request.$W(...)
        ...
        open(os.path.join(..., $P, ...), ...)
    - pattern: |
        $P = request.$W
        ...
        open(os.path.join(..., $P, ...), ...)
    - pattern: |
        $P = request.$W[...]
        ...
        open(os.path.join(..., $P, ...), ...)
  languages: [python]
  severity: WARNING