mcp-server-semgrep/semgrep-rules/python/flask/security/insecure-deserialization.yaml

MCP Server for Semgrep Integration - static code analysis with AI

rules:
- id: insecure-deserialization
  metadata:
    owasp:
    - A08:2017 - Insecure Deserialization
    - A08:2021 - Software and Data Integrity Failures
    cwe:
    - 'CWE-502: Deserialization of Untrusted Data'
    references:
    - https://docs.python.org/3/library/pickle.html
    category: security
    technology:
    - flask
    cwe2022-top25: true
    cwe2021-top25: true
    subcategory:
    - audit
    likelihood: LOW
    impact: MEDIUM
    confidence: LOW
  message: >-
    Detected the use of an insecure deserialization library in a Flask route. These libraries
    are prone to code execution vulnerabilities. Ensure user data does not enter this function.
    To fix this, try to avoid serializing whole objects. Consider instead using a serializer
    such as JSON.
  languages:
  - python
  severity: ERROR
  patterns:
  - pattern-inside: |
      @app.route(...)
      def $X(...):
        ...
  - pattern-not: $MODULE.$FUNC("...")
  - pattern-not: $MODULE.$FUNC(open("...", ...))
  - pattern-either:
    - pattern: pickle.$FUNC(...)
    - pattern: _pickle.$FUNC(...)
    - pattern: cPickle.$FUNC(...)
    - pattern: dill.$FUNC(...)
    - pattern: shelve.$FUNC(...)
    - pattern: yaml.load(...)