mcp-server-semgrep/semgrep-rules/ruby/lang/security/md5-used-as-password.yaml

MCP Server for Semgrep Integration - static code analysis with AI

rules:
- id: md5-used-as-password
  languages: [ruby]
  severity: WARNING
  message: >-
    It looks like MD5 is used as a password hash. MD5 is not considered a
    secure password hash because it can be cracked by an attacker in a short
    amount of time. Instead, use a suitable password hashing function such as
    bcrypt. You can use the `bcrypt` gem.
  metadata:
    category: security
    technology:
    - md5
    references:
    - https://tools.ietf.org/id/draft-lvelvindron-tls-md5-sha1-deprecate-01.html
    - https://security.stackexchange.com/questions/211/how-to-securely-hash-passwords
    - https://github.com/returntocorp/semgrep-rules/issues/1609
    owasp:
    - A03:2017 - Sensitive Data Exposure
    - A02:2021 - Cryptographic Failures
    cwe:
    - 'CWE-327: Use of a Broken or Risky Cryptographic Algorithm'
    subcategory:
    - vuln
    likelihood: HIGH
    impact: MEDIUM
    confidence: MEDIUM
  mode: taint
  pattern-sources:
  - pattern: Digest::MD5
  pattern-sinks:
  - patterns:
    - pattern: $FUNCTION(...);
    - metavariable-regex:
        metavariable: $FUNCTION
        regex: (?i)(.*password.*)