mcp-server-semgrep/semgrep-rules/ruby/rails/security/audit/avoid-tainted-file-access.yaml

MCP Server for Semgrep Integration - static code analysis with AI

rules:
- id: avoid-tainted-file-access
  metadata:
    owasp:
    - A05:2017 - Broken Access Control
    - A01:2021 - Broken Access Control
    cwe:
    - "CWE-22: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')"
    references:
    - https://github.com/presidentbeef/brakeman/blob/main/docs/warning_types/file_access/index.markdown
    category: security
    technology:
    - rails
    cwe2022-top25: true
    cwe2021-top25: true
    subcategory:
    - vuln
    likelihood: HIGH
    impact: MEDIUM
    confidence: MEDIUM
  message: >-
    Using user input when accessing files is potentially dangerous. A malicious actor could use this to
    modify or access files
    they have no right to.
  languages: [ruby]
  severity: WARNING
  mode: taint
  pattern-sources:
  - pattern: params
  - pattern: cookies
  - pattern: request.env
  pattern-sinks:
  - patterns:
    - pattern-either:
      - pattern: Dir.$X(...)
      - pattern: File.$X(...)
      - pattern: IO.$X(...)
      - pattern: Kernel.$X(...)
      - pattern: PStore.$X(...)
      - pattern: Pathname.$X(...)
    - metavariable-pattern:
        metavariable: $X
        patterns:
        - pattern-either:
          - pattern: chdir
          - pattern: chroot
          - pattern: delete
          - pattern: entries
          - pattern: foreach
          - pattern: glob
          - pattern: install
          - pattern: lchmod
          - pattern: lchown
          - pattern: link
          - pattern: load
          - pattern: load_file
          - pattern: makedirs
          - pattern: move
          - pattern: new
          - pattern: open
          - pattern: read
          - pattern: readlines
          - pattern: rename
          - pattern: rmdir
          - pattern: safe_unlink
          - pattern: symlink
          - pattern: syscopy
          - pattern: sysopen
          - pattern: truncate
          - pattern: unlink