mcp-server-semgrep/semgrep-rules/python/lang/security/audit/insecure-transport/requests/request-with-http.yaml

MCP Server for Semgrep Integration - static code analysis with AI

rules:
- id: request-with-http
  fix-regex:
    regex: '[Hh][Tt][Tt][Pp]://'
    replacement: https://
    count: 1
  message: >-
    Detected a request using 'http://'. This request will be unencrypted,
    and attackers could listen into traffic on the network and be able
    to obtain sensitive information. Use 'https://' instead.
  metadata:
    owasp:
    - A03:2017 - Sensitive Data Exposure
    - A02:2021 - Cryptographic Failures
    cwe:
    - 'CWE-319: Cleartext Transmission of Sensitive Information'
    asvs:
      section: V9 Communications Verification Requirements
      control_id: 9.1.1 Weak TLS
      control_url: https://github.com/OWASP/ASVS/blob/master/4.0/en/0x17-V9-Communications.md#v92-server-communications-security-requirements
      version: '4'
    category: security
    technology:
    - requests
    references:
    - https://owasp.org/Top10/A02_2021-Cryptographic_Failures
    subcategory:
    - audit
    likelihood: LOW
    impact: LOW
    confidence: MEDIUM
  languages: [python]
  severity: INFO
  options:
      symbolic_propagation: true
  mode: taint
  pattern-sources:
    - patterns:
        - pattern: |
            "$URL"
        - metavariable-pattern:
            metavariable: $URL
            language: regex
            patterns:
              - pattern-regex: http://
              - pattern-not-regex: >-
                  .*://localhost
              - pattern-not-regex: >-
                  .*://127\.0\.0\.1
  pattern-sinks:
    - patterns:
        - pattern-either:
            - pattern: requests.$W($SINK, ...)
            - pattern: requests.request($METHOD, $SINK, ...)
            - pattern: requests.Request($METHOD, $SINK, ...)
        - focus-metavariable: $SINK