mcp-server-semgrep/semgrep-rules/python/flask/security/injection/raw-html-concat.yaml

MCP Server for Semgrep Integration - static code analysis with AI

rules:
- id: raw-html-format
  languages:
  - python
  severity: WARNING
  message: >-
    Detected user input flowing into a manually constructed HTML string. You may be accidentally bypassing
    secure methods
    of rendering HTML by manually constructing HTML and this could create a cross-site scripting vulnerability,
    which could
    let attackers steal sensitive user data. To be sure this is safe, check that the HTML is rendered
    safely. Otherwise, use
    templates (`flask.render_template`) which will safely render HTML instead.
  metadata:
    cwe:
    - "CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')"
    owasp:
    - A07:2017 - Cross-Site Scripting (XSS)
    - A03:2021 - Injection
    category: security
    technology:
    - flask
    references:
    - https://flask.palletsprojects.com/en/2.0.x/security/#cross-site-scripting-xss
    cwe2022-top25: true
    cwe2021-top25: true
    subcategory:
    - vuln
    likelihood: MEDIUM
    impact: MEDIUM
    confidence: MEDIUM
  mode: taint
  pattern-sanitizers:
  - pattern: jinja2.escape(...)
  - pattern: flask.escape(...)
  - patterns:
    - pattern: flask.render_template($TPL, ...)
    - metavariable-regex:
        metavariable: $TPL
        regex: .*\.html
  pattern-sources:
  - patterns:
    - pattern-either:
      - pattern: flask.request.$ANYTHING
      - patterns:
        - pattern-inside: |
            @$APP.route(...)
            def $FUNC(..., $ROUTEVAR, ...):
              ...
        - pattern: $ROUTEVAR
  pattern-sinks:
  - patterns:
    - pattern-either:
      - patterns:
        - pattern-either:
          - pattern: '"$HTMLSTR" % ...'
          - pattern: '"$HTMLSTR".format(...)'
          - pattern: '"$HTMLSTR" + ...'
          - pattern: f"$HTMLSTR{...}..."
      - patterns:
        - pattern-inside: |
            $HTML = "$HTMLSTR"
            ...
        - pattern-either:
          - pattern: $HTML % ...
          - pattern: $HTML.format(...)
          - pattern: $HTML + ...
    - metavariable-pattern:
        metavariable: $HTMLSTR
        language: generic
        pattern: <$TAG ...