mcp-server-semgrep/semgrep-rules/scala/lang/security/audit/insecure-random.yaml

MCP Server for Semgrep Integration - static code analysis with AI

rules:
- id: insecure-random
  metadata:
    cwe:
    - 'CWE-330: Use of Insufficiently Random Values'
    owasp:
    - A02:2021 - Cryptographic Failures
    category: security
    technology:
    - scala
    - cryptography
    resources:
    - https://find-sec-bugs.github.io/bugs.htm
    confidence: LOW
    references:
    - https://owasp.org/Top10/A02_2021-Cryptographic_Failures
    subcategory:
    - audit
    likelihood: LOW
    impact: MEDIUM
  message: >-
    Flags the use of a predictable random value from `scala.util.Random`. This can lead to vulnerabilities
    when used in security
    contexts, such as in a CSRF token, password reset token, or any other secret value. To fix this, use
    java.security.SecureRandom
    instead.
  severity: WARNING
  languages:
  - scala
  patterns:
  - pattern: |
      import scala.util.Random