mcp-server-semgrep/semgrep-rules/python/django/security/injection/tainted-url-host.yaml

MCP Server for Semgrep Integration - static code analysis with AI

rules:
- id: tainted-url-host
  languages:
  - python
  message: User data flows into the host portion of this manually-constructed URL. This could allow an
    attacker to send data to their own server, potentially exposing sensitive data such as cookies or
    authorization information sent with this request. They could also probe internal servers or other
    resources that the server running this code can access. (This is called server-side request forgery,
    or SSRF.) Do not allow arbitrary hosts. Instead, create an allowlist for approved hosts, or hardcode the
    correct host.
  metadata:
    cwe:
    - 'CWE-918: Server-Side Request Forgery (SSRF)'
    owasp:
    - A10:2021 - Server-Side Request Forgery (SSRF)
    references:
    - https://cheatsheetseries.owasp.org/cheatsheets/Server_Side_Request_Forgery_Prevention_Cheat_Sheet.html
    category: security
    technology:
    - flask
    cwe2022-top25: true
    cwe2021-top25: true
    subcategory:
    - audit
    impact: MEDIUM
    likelihood: LOW
    confidence: LOW
  mode: taint
  pattern-sinks:
  - patterns:
    - pattern-either:
      - patterns:
        - pattern: '"$URLSTR" % ...'
        - metavariable-pattern:
            metavariable: $URLSTR
            language: generic
            patterns:
            - pattern-either:
              - pattern: $SCHEME://%s
              - pattern: $SCHEME://%r
      - patterns:
        - pattern: '"$URLSTR".format(...)'
        - metavariable-pattern:
            metavariable: $URLSTR
            language: generic
            pattern: $SCHEME:// { ... }
      - patterns:
        - pattern: '"$URLSTR" + ...'
        - metavariable-regex:
            metavariable: $URLSTR
            regex: .*://$
      - patterns:
        - pattern: f"$URLSTR{...}..."
        - metavariable-regex:
            metavariable: $URLSTR
            regex: .*://$
      - patterns:
        - pattern-inside: |
            $URL = "$URLSTR"
            ...
        - pattern: $URL += ...
        - metavariable-regex:
            metavariable: $URLSTR
            regex: .*://$
  pattern-sources:
  - patterns:
    - pattern: request.$ANYTHING
    - pattern-not: request.build_absolute_uri
  severity: WARNING