mcp-server-semgrep/semgrep-rules/python/pymongo/security/mongodb.yaml

MCP Server for Semgrep Integration - static code analysis with AI

rules:
- id: mongo-client-bad-auth
  pattern: |
    pymongo.MongoClient(..., authMechanism='MONGODB-CR')
  message: >-
    Warning MONGODB-CR was deprecated with the release of MongoDB 3.6 and is no longer supported by MongoDB
    4.0 (see https://api.mongodb.com/python/current/examples/authentication.html for details).
  fix-regex:
    regex: MONGODB-CR
    replacement: SCRAM-SHA-256
  severity: WARNING
  languages:
  - python
  metadata:
    cwe:
    - 'CWE-477: Use of Obsolete Function'
    category: security
    technology:
    - pymongo
    references:
    - https://cwe.mitre.org/data/definitions/477.html
    subcategory:
    - vuln
    likelihood: LOW
    impact: LOW
    confidence: MEDIUM