mcp-server-semgrep/semgrep-rules/python/flask/security/injection/tainted-url-host.yaml

MCP Server for Semgrep Integration - static code analysis with AI

rules:
- id: tainted-url-host
  languages:
  - python
  message: >-
    User data flows into the host portion of this manually-constructed URL.
    This could allow an attacker to send data to their own server, potentially
    exposing sensitive data such as cookies or authorization information sent
    with this request. They could also probe internal servers or other
    resources that the server running this code can access. (This is called
    server-side request forgery, or SSRF.) Do not allow arbitrary hosts.
    Instead, create an allowlist for approved hosts, or hardcode the correct host.
  metadata:
    cwe:
    - 'CWE-918: Server-Side Request Forgery (SSRF)'
    owasp:
    - A10:2021 - Server-Side Request Forgery (SSRF)
    references:
    - https://cheatsheetseries.owasp.org/cheatsheets/Server_Side_Request_Forgery_Prevention_Cheat_Sheet.html
    category: security
    technology:
    - flask
    cwe2022-top25: true
    cwe2021-top25: true
    subcategory:
    - vuln
    impact: MEDIUM
    likelihood: MEDIUM
    confidence: MEDIUM
  mode: taint
  pattern-sinks:
  - patterns:
    - pattern-either:
      - patterns:
        - pattern: '"$URLSTR" % ...'
        - metavariable-pattern:
            metavariable: $URLSTR
            language: generic
            patterns:
            - pattern-either:
              - pattern: $SCHEME://%s
              - pattern: $SCHEME://%r
      - patterns:
        - pattern: '"$URLSTR".format(...)'
        - metavariable-pattern:
            metavariable: $URLSTR
            language: generic
            pattern: $SCHEME:// { ... }
      - patterns:
        - pattern: '"$URLSTR" + ...'
        - metavariable-regex:
            metavariable: $URLSTR
            regex: .*://$
      - patterns:
        - pattern: f"$URLSTR{...}..."
        - metavariable-regex:
            metavariable: $URLSTR
            regex: .*://$
      - patterns:
        - pattern-inside: |
            $URL = "$URLSTR"
            ...
        - pattern: $URL += ...
        - metavariable-regex:
            metavariable: $URLSTR
            regex: .*://$
  pattern-sources:
  - patterns:
    - pattern-either:
      - pattern: flask.request.$ANYTHING
      - patterns:
        - pattern-inside: |
            @$APP.route(...)
            def $FUNC(..., $ROUTEVAR, ...):
              ...
        - pattern: $ROUTEVAR
  severity: WARNING