mcp-server-semgrep/semgrep-rules/ruby/rails/security/brakeman/check-redirect-to.yaml

MCP Server for Semgrep Integration - static code analysis with AI

rules:
- id: check-redirect-to
  mode: taint
  pattern-sources:
  - patterns:
    - pattern-either:
      - pattern: params
      - pattern: cookies
      - pattern: request.env
      - pattern: url_for(params[...],...,:only_path => false,...)
  pattern-sanitizers:
  - patterns:
    - pattern-either:
      - patterns:
        - pattern: |
            $F(...)
        - metavariable-pattern:
            metavariable: $F
            patterns:
            - pattern-not-regex: (params|url_for|cookies|request.env|permit|redirect_to)
      - pattern: |
          params.merge! :only_path => true
          ...
      - pattern: |
          params.slice(...)
          ...
      - pattern: |
          redirect_to [...]
      - patterns:
        - pattern: |
            $MODEL. ... .$M(...)
            ...
        - metavariable-regex:
            metavariable: $MODEL
            regex: '[A-Z]\w+'
        - metavariable-regex:
            metavariable: $M
            regex: (all|create|find|find_by|find_by_sql|first|last|new|from|group|having|joins|lock|order|reorder|select|where|take)
      - patterns:
        - pattern: |
            params.$UNSAFE_HASH.merge(...,:only_path => true,...)
            ...
        - metavariable-regex:
            metavariable: $UNSAFE_HASH
            regex: to_unsafe_h(ash)?
      - patterns:
        - pattern: params.permit(...,$X,...)
        - metavariable-pattern:
            metavariable: $X
            patterns:
            - pattern-not-regex: (host|port|(sub)?domain)
  pattern-sinks:
  - patterns:
    - pattern: $X
    - pattern-inside: |
        redirect_to $X, ...
    - pattern-not-regex: params\.\w+(?<!permit)\(.*?\)
  message: Found potentially unsafe handling of redirect behavior $X. Do not pass `params` to `redirect_to`
    without the `:only_path => true` hash value.
  languages:
  - ruby
  severity: WARNING
  metadata:
    source-rule-url: https://github.com/presidentbeef/brakeman/blob/main/lib/brakeman/checks/check_redirect.rb
    category: security
    cwe:
    - "CWE-601: URL Redirection to Untrusted Site ('Open Redirect')"
    technology:
    - ruby
    - rails
    references:
    - https://cheatsheetseries.owasp.org/cheatsheets/Unvalidated_Redirects_and_Forwards_Cheat_Sheet.html
    owasp:
    - A01:2021 - Broken Access Control
    subcategory:
    - vuln
    likelihood: MEDIUM
    impact: MEDIUM
    confidence: MEDIUM