mcp-server-semgrep/semgrep-rules/ruby/lang/security/dangerous-exec.yaml

MCP Server for Semgrep Integration - static code analysis with AI

rules:
- id: dangerous-exec
  mode: taint
  pattern-sources:
  - patterns:
    - pattern: |
        def $F(...,$ARG,...)
            ...
        end
    - focus-metavariable: $ARG
  - pattern: params
  - pattern: cookies
  pattern-sinks:
  - patterns:
    - pattern: |
        $EXEC(...)
    - pattern-not: |
        $EXEC("...","...","...",...)
    - pattern-not: |
        $EXEC(["...","...","...",...],...)
    - pattern-not: |
        $EXEC({...},"...","...","...",...)
    - pattern-not: |
        $EXEC({...},["...","...","...",...],...)
    - metavariable-regex:
        metavariable: $EXEC
        regex: ^(system|exec|spawn|Process.exec|Process.spawn|Open3.capture2|Open3.capture2e|Open3.capture3|Open3.popen2|Open3.popen2e|Open3.popen3|IO.popen|Gem::Util.popen|PTY.spawn)$
  message: >-
    Detected non-static command inside $EXEC. Audit the input to '$EXEC'.
    If unverified user data can reach this call site, this is a code injection
    vulnerability. A malicious actor can inject a malicious script to execute
    arbitrary code.
  metadata:
    source-rule-url: https://github.com/presidentbeef/brakeman/blob/main/lib/brakeman/checks/check_execute.rb
    cwe:
    - "CWE-94: Improper Control of Generation of Code ('Code Injection')"
    owasp:
    - A03:2021 - Injection
    category: security
    technology:
    - ruby
    - rails
    references:
    - https://guides.rubyonrails.org/security.html#command-line-injection
    cwe2022-top25: true
    subcategory:
    - vuln
    likelihood: MEDIUM
    impact: HIGH
    confidence: MEDIUM
  severity: WARNING
  languages: [ruby]