mcp-server-semgrep/semgrep-rules/python/lang/security/audit/insecure-transport/requests/request-session-with-http.yaml

MCP Server for Semgrep Integration - static code analysis with AI

rules:
  - id: request-session-with-http 
    options:
      symbolic_propagation: true
    mode: taint
    pattern-sources:
      - patterns:
          - pattern: |
              "$URL"
          - metavariable-pattern:
              metavariable: $URL
              language: regex
              patterns:
                - pattern-regex: http://
                - pattern-not-regex: >-
                    .*://localhost
                - pattern-not-regex: >-
                    .*://127\.0\.0\.1
    pattern-sinks:
      - patterns:
          - pattern-either:
              - pattern: requests.Session(...).$W($SINK, ...)
              - pattern: requests.Session(...).request($METHOD, $SINK, ...)
          - focus-metavariable: $SINK
    fix-regex:
      regex: "[Hh][Tt][Tt][Pp]://"
      replacement: https://
      count: 1
    message: Detected a request using 'http://'. This request will be unencrypted.
      Use 'https://' instead.
    languages:
      - python
    severity: INFO
    metadata:
      owasp:
      - A03:2017 - Sensitive Data Exposure
      - A02:2021 - Cryptographic Failures
      cwe:
      - 'CWE-319: Cleartext Transmission of Sensitive Information'
      asvs:
        section: V9 Communications Verification Requirements
        control_id: 9.1.1 Weak TLS
        control_url: https://github.com/OWASP/ASVS/blob/master/4.0/en/0x17-V9-Communications.md#v92-server-communications-security-requirements
        version: '4'
      category: security
      technology:
      - requests
      references:
      - https://owasp.org/Top10/A02_2021-Cryptographic_Failures
      subcategory:
      - audit
      likelihood: LOW
      impact: LOW
      confidence: MEDIUM