Skip to content

Commit f065874

Browse files
pedrobpereirapedrobpereira
committed
fix: semgrep rules updated CF-1809
1 parent b86f8b5 commit f065874

File tree

6 files changed

+27434
-96680
lines changed

6 files changed

+27434
-96680
lines changed

‎codacy-client/client.go‎

Lines changed: 13 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -177,7 +177,19 @@ func GetDefaultToolPatternsConfig(initFlags domain.InitFlags, toolUUID string, o
177177
baseURL += "?enabled=true"
178178
}
179179

180-
return getAllPages(baseURL, initFlags, parseDefaultPatternConfigurations)
180+
allPaterns, err := getAllPages(baseURL, initFlags, parseDefaultPatternConfigurations)
181+
if err != nil {
182+
return nil, err
183+
}
184+
185+
onlyRecommendedPatterns := make([]domain.PatternConfiguration, 0)
186+
for _, pattern := range allPaterns {
187+
if pattern.PatternDefinition.Enabled {
188+
onlyRecommendedPatterns = append(onlyRecommendedPatterns, pattern)
189+
}
190+
}
191+
192+
return onlyRecommendedPatterns, nil
181193
}
182194

183195
// GetRepositoryToolPatterns fetches the patterns for a tool in a repository

‎integration-tests/config-discover/expected/tools-configs/semgrep.yaml‎

Lines changed: 43 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -29501,6 +29501,43 @@ rules:
2950129501
}
2950229502
- focus-metavariable: $SECRET
2950329503
severity: WARNING
29504+
- id: terraform.aws.security.aws-provisioner-exec.aws-provisioner-exec
29505+
languages:
29506+
- terraform
29507+
message: Provisioners are a tool of last resort and should be avoided where possible. Provisioner behavior cannot be mapped by Terraform as part of a plan, and execute arbitrary shell commands by design.
29508+
metadata:
29509+
category: security
29510+
confidence: HIGH
29511+
cwe:
29512+
- 'CWE-77: Improper Neutralization of Special Elements used in a Command (''Command Injection'')'
29513+
- 'CWE-94: Improper Control of Generation of Code (''Code Injection'')'
29514+
impact: MEDIUM
29515+
likelihood: HIGH
29516+
owasp:
29517+
- A03:2021 - Injection
29518+
- A01:2017 - Injection
29519+
references:
29520+
- https://developer.hashicorp.com/terraform/language/resources/provisioners/remote-exec
29521+
- https://developer.hashicorp.com/terraform/language/resources/provisioners/local-exec
29522+
subcategory:
29523+
- guardrail
29524+
technology:
29525+
- terraform
29526+
patterns:
29527+
- pattern-either:
29528+
- pattern: |
29529+
provisioner "remote-exec" {
29530+
...
29531+
}
29532+
- pattern: |
29533+
provisioner "local-exec" {
29534+
...
29535+
}
29536+
- pattern-inside: |
29537+
resource "aws_instance" "..." {
29538+
...
29539+
}
29540+
severity: WARNING
2950429541
- id: terraform.aws.security.aws-rds-backup-no-retention.aws-rds-backup-no-retention
2950529542
languages:
2950629543
- hcl
@@ -34374,8 +34411,12 @@ rules:
3437434411
- A3:2017 Sensitive Data Exposure
3437534412
options:
3437634413
generic_ellipsis_max_span: 0
34377-
pattern: |
34378-
$PASSWORD VARCHAR2($LENGTH) := $...VALUE;
34414+
patterns:
34415+
- pattern: |
34416+
$PASSWORD VARCHAR2($LENGTH) := $...VALUE;
34417+
- metavariable-regex:
34418+
metavariable: $PASSWORD
34419+
regex: (?i).*(password|motdepasse|heslo|adgangskode|wachtwoord|salasana|passwort|passord|senha|geslo|clave|losenord|clave|parola|secret|pwd).*
3437934420
severity: ERROR
3438034421
- id: codacy.generic.plsql.resource-injection
3438134422
languages:

‎integration-tests/init-with-token/expected/tools-configs/semgrep.yaml‎

Lines changed: 72 additions & 41 deletions
Original file line numberDiff line numberDiff line change
@@ -1,43 +1,74 @@
11
rules:
2-
- id: clojure.lang.security.use-of-md5.use-of-md5
3-
languages:
2+
- id: bash.lang.correctness.unquoted-expansion.unquoted-variable-expansion-in-command
3+
languages:
4+
- bash
5+
message: Variable expansions must be double-quoted so as to prevent being split into multiple pieces according to whitespace or whichever separator is specified by the IFS variable. If you really wish to split the variable's contents, you may use a variable that starts with an underscore e.g. $_X instead of $X, and semgrep will ignore it. If what you need is an array, consider using a proper bash array.
6+
metadata:
7+
category: correctness
8+
technology:
9+
- bash
10+
patterns:
11+
- pattern-either:
12+
- pattern: |
13+
... ${$VAR} ...
14+
- pattern: |
15+
... ...${$VAR}... ...
16+
- metavariable-regex:
17+
metavariable: $VAR
18+
regex: '[*@0-9]|[A-Za-z].*'
19+
severity: INFO
20+
- id: clojure.lang.security.use-of-md5.use-of-md5
21+
languages:
22+
- clojure
23+
message: MD5 hash algorithm detected. This is not collision resistant and leads to easily-cracked password hashes. Replace with current recommended hashing algorithms.
24+
metadata:
25+
author: Gabriel Marquet <[email protected]>
26+
category: security
27+
confidence: HIGH
28+
cwe:
29+
- 'CWE-328: Use of Weak Hash'
30+
impact: HIGH
31+
likelihood: MEDIUM
32+
owasp:
33+
- A03:2017 - Sensitive Data Exposure
34+
- A02:2021 - Cryptographic Failures
35+
references:
36+
- https://cheatsheetseries.owasp.org/cheatsheets/Cryptographic_Storage_Cheat_Sheet.html
37+
- https://cheatsheetseries.owasp.org/cheatsheets/Password_Storage_Cheat_Sheet.html
38+
source-rule-url: https://github.com/clj-holmes/clj-holmes-rules/blob/main/security/weak-hash-function-md5.yml
39+
subcategory:
40+
- vuln
41+
technology:
442
- clojure
5-
message: MD5 hash algorithm detected. This is not collision resistant and leads to easily-cracked password hashes. Replace with current recommended hashing algorithms.
6-
metadata:
7-
author: Gabriel Marquet <[email protected]>
8-
category: security
9-
confidence: HIGH
10-
cwe:
11-
- 'CWE-328: Use of Weak Hash'
12-
impact: HIGH
13-
likelihood: MEDIUM
14-
owasp:
15-
- A03:2017 - Sensitive Data Exposure
16-
- A02:2021 - Cryptographic Failures
17-
references:
18-
- https://cheatsheetseries.owasp.org/cheatsheets/Cryptographic_Storage_Cheat_Sheet.html
19-
- https://cheatsheetseries.owasp.org/cheatsheets/Password_Storage_Cheat_Sheet.html
20-
source-rule-url: https://github.com/clj-holmes/clj-holmes-rules/blob/main/security/weak-hash-function-md5.yml
21-
subcategory:
22-
- vuln
23-
technology:
24-
- clojure
25-
pattern-either:
26-
- pattern: (MessageDigest/getInstance "MD5")
27-
- pattern: (MessageDigest/getInstance MessageDigestAlgorithms/MD5)
28-
- pattern: (MessageDigest/getInstance org.apache.commons.codec.digest.MessageDigestAlgorithms/MD5)
29-
- pattern: (java.security.MessageDigest/getInstance "MD5")
30-
- pattern: (java.security.MessageDigest/getInstance MessageDigestAlgorithms/MD5)
31-
- pattern: (java.security.MessageDigest/getInstance org.apache.commons.codec.digest.MessageDigestAlgorithms/MD5)
32-
severity: WARNING
33-
- id: codacy.generic.plsql.empty-strings
34-
languages:
35-
- generic
36-
message: Empty strings can lead to unexpected behavior and should be handled carefully.
37-
metadata:
38-
category: security
39-
confidence: MEDIUM
40-
description: Detects empty strings in the code which might cause issues or bugs.
41-
impact: MEDIUM
42-
pattern: $VAR VARCHAR2($LENGTH) := '';
43-
severity: WARNING
43+
pattern-either:
44+
- pattern: (MessageDigest/getInstance "MD5")
45+
- pattern: (MessageDigest/getInstance MessageDigestAlgorithms/MD5)
46+
- pattern: (MessageDigest/getInstance org.apache.commons.codec.digest.MessageDigestAlgorithms/MD5)
47+
- pattern: (java.security.MessageDigest/getInstance "MD5")
48+
- pattern: (java.security.MessageDigest/getInstance MessageDigestAlgorithms/MD5)
49+
- pattern: (java.security.MessageDigest/getInstance org.apache.commons.codec.digest.MessageDigestAlgorithms/MD5)
50+
severity: WARNING
51+
- fix: Bitwise.bnot($VAL)
52+
id: elixir.lang.best-practice.deprecated-bnot-operator.deprecated_bnot_operator
53+
languages:
54+
- elixir
55+
message: The bitwise operator (`^^^`) is already deprecated. Please use `Bitwise.bnot($VAL)` instead.
56+
metadata:
57+
category: best-practice
58+
references:
59+
- https://github.com/elixir-lang/elixir/commit/f1b9d3e818e5bebd44540f87be85979f24b9abfc
60+
technology:
61+
- elixir
62+
pattern: ~~~$VAL
63+
severity: WARNING
64+
- id: codacy.generic.plsql.empty-strings
65+
languages:
66+
- generic
67+
message: Empty strings can lead to unexpected behavior and should be handled carefully.
68+
metadata:
69+
category: security
70+
confidence: MEDIUM
71+
description: Detects empty strings in the code which might cause issues or bugs.
72+
impact: MEDIUM
73+
pattern: $VAR VARCHAR2($LENGTH) := '';
74+
severity: WARNING

0 commit comments

Comments
 (0)