mcp-server-semgrep/semgrep-rules/scala/play/security/conf-csrf-headers-bypass.conf

MCP Server for Semgrep Integration - static code analysis with AI

play.filters.csrf.header.bypassHeaders {
  #ruleid: conf-csrf-headers-bypass
  X-Requested-With = "*"
  # ruleid: conf-csrf-headers-bypass
  Csrf-Token = "nocheck"
}


# not enough blacklisted types
play.filters.csrf {
  header {
    bypassHeaders {
      # ruleid: conf-csrf-headers-bypass
      X-Requested-With = "*"
      # ruleid: conf-csrf-headers-bypass
      Csrf-Token = "nocheck"
    }
    protectHeaders = null
  }
  bypassCorsTrustedOrigins = false
  method {
    whiteList = []
    blackList = ["POST"]
  }
  contentType.blackList = ["text/plain", "multipart/form-data", "something/weird"]
}

# safe configuration
play.filters.csrf {
  header {
    bypassHeaders {
      #ok: conf-csrf-headers-bypass
      X-Requested-With = "*"
      #ok: conf-csrf-headers-bypass
      Csrf-Token = "nocheck"
    }
    protectHeaders = null
  }
  bypassCorsTrustedOrigins = false
  method {
    whiteList = []
    blackList = ["POST"]
  }
  contentType.blackList = ["application/x-www-form-urlencoded", "multipart/form-data", "text/plain"]
}

# safe configuration
play.filters.csrf {
  header {
    bypassHeaders {
      #ok: conf-csrf-headers-bypass
      X-Requested-With = "*"
      #ok: conf-csrf-headers-bypass
      Csrf-Token = "nocheck"
    }
    protectHeaders = null
  }
  bypassCorsTrustedOrigins = false
  method {
    whiteList = []
    blackList = ["POST"]
  }
  contentType.blackList = [
    "application/x-www-form-urlencoded",
    "multipart/form-data",
    "text/plain"
  ]
}