mcp-server-semgrep/semgrep-rules/ruby/rails/security/audit/avoid-tainted-shell-call.yaml

MCP Server for Semgrep Integration - static code analysis with AI

rules:
- id: avoid-tainted-shell-call
  metadata:
    owasp:
    - A01:2017 - Injection
    - A03:2021 - Injection
    cwe:
    - "CWE-78: Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')"
    references:
    - https://github.com/presidentbeef/brakeman/blob/main/docs/warning_types/file_access/index.markdown
    category: security
    technology:
    - rails
    cwe2022-top25: true
    cwe2021-top25: true
    subcategory:
    - vuln
    likelihood: HIGH
    impact: MEDIUM
    confidence: MEDIUM
  message: >-
    Using user input when accessing files is potentially dangerous. A malicious actor could use this to
    modify or access files
    they have no right to.
  languages: [ruby]
  severity: ERROR
  mode: taint
  pattern-sources:
  - pattern-either:
    - pattern: params[...]
    - pattern: cookies
    - pattern: request.env
  pattern-sinks:
  - patterns:
    - pattern-either:
      - patterns:
          - pattern: Kernel.$X(...)
      - patterns:
        - pattern-either:
          - pattern: Shell.$X(...)
          - patterns:
            - pattern-inside: |
                $SHELL = Shell.$ANY(...)
                ...
                $SHELL.$X(...)
            - pattern: $SHELL.$X(...)
    - metavariable-pattern:
        metavariable: $X
        patterns:
        - pattern-either:
          - pattern: cat
          - pattern: chdir
          - pattern: chroot
          - pattern: delete
          - pattern: entries
          - pattern: exec
          - pattern: foreach
          - pattern: glob
          - pattern: install
          - pattern: lchmod
          - pattern: lchown
          - pattern: link
          - pattern: load
          - pattern: load_file
          - pattern: makedirs
          - pattern: move
          - pattern: new
          - pattern: open
          - pattern: read
          - pattern: readlines
          - pattern: rename
          - pattern: rmdir
          - pattern: safe_unlink
          - pattern: symlink
          - pattern: syscopy
          - pattern: sysopen
          - pattern: system
          - pattern: truncate
          - pattern: unlink