mcp-server-semgrep/semgrep-rules/python/flask/security/injection/ssrf-requests.yaml

MCP Server for Semgrep Integration - static code analysis with AI

rules:
- id: ssrf-requests
  languages:
  - python
  severity: ERROR
  message: Data from request object is passed to a new server-side request. This could lead to a server-side
    request forgery (SSRF). To mitigate, ensure that schemes and hosts are validated against an allowlist,
    do not forward the response to the user, and ensure proper authentication and transport-layer security
    in the proxied request.
  metadata:
    cwe:
    - 'CWE-918: Server-Side Request Forgery (SSRF)'
    owasp:
    - A10:2021 - Server-Side Request Forgery (SSRF)
    references:
    - https://owasp.org/www-community/attacks/Server_Side_Request_Forgery
    category: security
    technology:
    - flask
    cwe2022-top25: true
    cwe2021-top25: true
    subcategory:
    - vuln
    likelihood: MEDIUM
    impact: HIGH
    confidence: MEDIUM
  pattern-either:
  - patterns:
          # Written this way so that Semgrep only matches the requests call,
          # not the whole function def
    - pattern: requests.$FUNC(...)
    - pattern-either:
      - pattern-inside: |
          @$APP.$ROUTE_METHOD($ROUTE, ...)
          def $ROUTE_FUNC(..., $ROUTEVAR, ...):
            ...
            requests.$FUNC(..., <... $ROUTEVAR ...>, ...)
      - pattern-inside: |
          @$APP.$ROUTE_METHOD($ROUTE, ...)
          def $ROUTE_FUNC(..., $ROUTEVAR, ...):
            ...
            $INTERM = <... $ROUTEVAR ...>
            ...
            requests.$FUNC(..., <... $INTERM ...>, ...)
    - metavariable-regex:
        metavariable: $ROUTE_METHOD
        regex: ^(route|get|post|put|delete|patch)$
  - pattern: requests.$FUNC(..., <... flask.request.$W.get(...) ...>, ...)
  - pattern: requests.$FUNC(..., <... flask.request.$W[...] ...>, ...)
  - pattern: requests.$FUNC(..., <... flask.request.$W(...) ...>, ...)
  - pattern: requests.$FUNC(..., <... flask.request.$W ...>, ...)
  - patterns:
    - pattern-inside: |
        $INTERM = <... flask.request.$W.get(...) ...>
        ...
        requests.$FUNC(<... $INTERM ...>, ...)
    - pattern: requests.$FUNC(...)
  - patterns:
    - pattern-inside: |
        $INTERM = <... flask.request.$W[...] ...>
        ...
        requests.$FUNC(<... $INTERM ...>, ...)
    - pattern: requests.$FUNC(...)
  - patterns:
    - pattern-inside: |
        $INTERM = <... flask.request.$W(...) ...>
        ...
        requests.$FUNC(<... $INTERM ...>, ...)
    - pattern: requests.$FUNC(...)
  - patterns:
    - pattern-inside: |
        $INTERM = <... flask.request.$W ...>
        ...
        requests.$FUNC(<... $INTERM ...>, ...)
    - pattern: requests.$FUNC(...)