bad-words.yaml

rules:
  - id: raptor-bad-words
    metadata:
      author: Marco Ivaldi <raptor@0xdeadbeef.info>
      category: security
      subcategory: audit
      vulnerability_class: Mishandled Sensitive Information
      likelihood: LOW
      impact: LOW
      confidence: LOW
      technology:
        - c
        - cpp
      cwe:
        - "CWE-546: Suspicious Comment"
        - "CWE-615: Inclusion of Sensitive Information in Source Code Comments"
      references:
        - https://btlr.dev/blog/how-to-find-vulnerabilities-in-code-bad-words
    message: >-
      The code contains comments that suggest the presence of bugs,
      incomplete functionality, or weaknesses.
      Many suspicious comments, such as BUG, HACK, FIXME, LATER, LATER2,
      TODO, in the code indicate missing security functionality and
      checking. Others indicate code problems that programmers should fix,
      such as hard-coded variables, error handling, not using stored
      procedures, and performance issues.
    severity: INFO
    languages:
      - generic
    pattern-either:
      # interesting comments
      - pattern-regex: (TODO|XXX|FIXME|BUG|HACK|LATER|CVE-)
      - pattern-regex: (?i)(unsafe|insecure|dangerous|warning|overflow)
      # credentials
      - pattern-regex: (?i)(password|private|token|secret)
        # - pattern-regex: (?i)(key|JWT|JKS|JWK|JKU)
      # other "bad words" examples
      # privilege management
      # - pattern-regex: (?i)(privilege|permission|capabilit|role|rbac|polic|authorization|claim)
      # - pattern-regex: (?i)(validate|verify)
      # memory management
      # - pattern-regex: (?i)(alloc|free)
      # lower level abstractions
      # - pattern-regex: (?i)(raw)
      # code injection
      # - pattern-regex: (eval|run)
      # command injection
      # - pattern-regex: (process|system|popen|exec|spawn)
      # reflection
      # - pattern-regex: (?i)(reflect|klass|constantize|forname)
      # serialization
      # - pattern-regex: (?i)(pickle|yaml|serialize|marshal|objectinput)
      # merge or clone
      # - pattern-regex: (?i)(merge|clone)
      # file access
      # - pattern-regex: (?i)(parse|open|request)
      # crypto
      # - pattern-regex: (?i)(AES|RSA|DSA|DES|CBC|ECB|HMAC|GCM|MD5|SHA)
      # xml
      # - pattern-regex: (?i)(xml|xerces|sax|etree|xpath|documentbuilder)
      # other words of power, words of destruction (Vulns1001)
      # see also https://github.com/parsiya/semgrep-hotspots/blob/main/cpp/encode-decode-function-name.yaml
      # and https://github.com/parsiya/semgrep-hotspots/blob/main/cpp/encrypt-decrypt-function-name.yaml
      # - pattern-regex: (?i)(encode|decode|convert|interpret|compress|fragment|reassemble)
      # other words of power, words of destruction (Vulns1002)
      # - pattern-regex: (?i)(mutex|lock|toctou|parallelism|semaphore|retain|release|garbage|mutual)