mcp-server-semgrep/semgrep-rules/terraform/azure/security/appservice/appservice-enable-http2.yaml

MCP Server for Semgrep Integration - static code analysis with AI

rules:
- id: appservice-enable-http2
  message: >-
    Use the latest version of HTTP to ensure you are benefiting from security fixes. Add `http2_enabled
    = true` to your appservice
    resource block
  patterns:
  - pattern: resource
  - pattern-not-inside: |
      resource "azurerm_app_service" "..." {
      ...
        site_config {
          ...
          http2_enabled = true
          ...
        }
      ...
      }
  - pattern-either:
    - pattern-inside: |
        resource "azurerm_app_service" "..." {
        ...
        }
    - pattern-inside: |
        resource "azurerm_app_service" "..." {
        ...
          site_config {
            ...
            http2_enabled = false
            ...
          }
        ...
        }
  metadata:
    cwe:
    - "CWE-444: Inconsistent Interpretation of HTTP Requests ('HTTP Request/Response Smuggling')"
    category: security
    technology:
    - terraform
    - azure
    references:
    - https://registry.terraform.io/providers/hashicorp/azurerm/latest/docs/resources/app_service#http2_enabled
    owasp:
    - A04:2021 - Insecure Design
    subcategory:
    - vuln
    likelihood: LOW
    impact: MEDIUM
    confidence: MEDIUM
  languages: [hcl]
  severity: INFO