mcp-server-semgrep/semgrep-rules/ruby/rails/security/audit/detailed-exceptions.yaml

MCP Server for Semgrep Integration - static code analysis with AI

rules:
- id: detailed-exceptions
  metadata:
    owasp:
    - A01:2021 - Broken Access Control
    cwe:
    - 'CWE-200: Exposure of Sensitive Information to an Unauthorized Actor'
    source-rule-url: https://github.com/presidentbeef/brakeman/blob/main/lib/brakeman/checks/check_detailed_exceptions.rb
    category: security
    technology:
    - rails
    references:
    - https://owasp.org/Top10/A01_2021-Broken_Access_Control
    cwe2021-top25: true
    subcategory:
    - audit
    likelihood: LOW
    impact: MEDIUM
    confidence: LOW
  message: >-
    Found that the setting for providing detailed exception reports in Rails
    is set to true. This can lead to information exposure,
    where sensitive system or internal information is displayed to the end user. Instead, turn this setting
    off.
  languages: [ruby]
  severity: WARNING
  patterns:
  - pattern-either:
    - patterns:
      - pattern: |
          config.consider_all_requests_local = true
    - patterns:
      - pattern-inside: |
          class $CONTROLLER < ApplicationController
            ...
          end
      - pattern: |
          def show_detailed_exceptions? (...)
            ...
          return $RETURN
          end
      - metavariable-pattern:
          metavariable: $RETURN
          patterns:
          - pattern-not: |
              false