mcp-server-semgrep
Version:
MCP Server for Semgrep Integration - static code analysis with AI
63 lines (62 loc) • 1.9 kB
YAML
rules:
- id: insecure-file-permissions
languages: [python]
severity: WARNING
metadata:
category: security
owasp:
- A01:2021 - Broken Access Control
cwe:
- 'CWE-276: Incorrect Default Permissions'
technology:
- python
references:
- https://owasp.org/Top10/A01_2021-Broken_Access_Control
cwe2022-top25: true
cwe2021-top25: true
subcategory:
- vuln
likelihood: LOW
impact: MEDIUM
confidence: MEDIUM
message: >-
These permissions `$BITS` are widely permissive and grant access
to more people than may be necessary. A good default is `0o644` which
gives read and write access to yourself and read access to everyone else.
patterns:
- pattern-inside: os.$METHOD(...)
- metavariable-pattern:
metavariable: $METHOD
patterns:
- pattern-either:
- pattern: chmod
- pattern: lchmod
- pattern: fchmod
- pattern-either:
- patterns:
- pattern: os.$METHOD($FILE, $BITS, ...)
- metavariable-comparison:
metavariable: $BITS
comparison: $BITS >= 0o650 and $BITS < 0o100000
- patterns:
- pattern: os.$METHOD($FILE, $BITS)
- metavariable-comparison:
metavariable: $BITS
comparison: $BITS >= 0o100650
- patterns:
- pattern: os.$METHOD($FILE, $BITS, ...)
- metavariable-pattern:
metavariable: $BITS
patterns:
- pattern-either:
- pattern: <... stat.S_IWGRP ...>
- pattern: <... stat.S_IXGRP ...>
- pattern: <... stat.S_IWOTH ...>
- pattern: <... stat.S_IXOTH ...>
- pattern: <... stat.S_IRWXO ...>
- pattern: <... stat.S_IRWXG ...>
- patterns:
- pattern: os.$METHOD($FILE, $EXPR | $MOD, ...)
- metavariable-comparison:
metavariable: $MOD
comparison: $MOD == 0o111