Skip to content

Commit a8c6de7

Browse files
r2c-argo[bot]kurt-r2cmjambonsemgreg0xDC0DE
authored
Merge Develop into Release (#3696)
* fix(rules): CODE-9032 (#3683) * fix for CODE-9032 * add test * Improve OCaml rule protecting against stray Not_founds (#3702) ## Link to an issue, if relevant (internal Slack thread) ### ~~Adding a new~~ Revising a rule? Look over this PR checklist - The issue or PR has links, references, or examples. - The rule has **true positive** and **true negative** test cases in a file that matches the rule name. > If the rule is `my-rule`, the test file name should be `my-rule.js`. > > True positives are marked by comments with `ruleid: <my-rule>` and true negatives are marked by comments with `ok: <my-rule>`. - The rule has a good message. A good message includes: > 1. A description of the pattern (e.g., missing parameter, dangerous flag, out-of-order function calls). > 1. A description of why this pattern was detected (e.g., logic bug, introduces a security vulnerability, bad practice). > 1. An alternative that resolves the issue (e.g., use another function, validate data first, discard the dangerous flag). * Update aws-cloudfront-insecure-tls rule (#3705) This updates aws-cloudfront-insecure-tls rule to account for the addition of aws cloudfront support for TLSv1.2_2025 and TLSv1.3_2025 * Add rule to detect backdoor github action placed by Sha1-Hulud (#3714) Co-authored-by: Pieter De Cremer <[email protected]> * Fixed message in shai hulud backdoor rule (#3715) Co-authored-by: Pieter De Cremer <[email protected]> --------- Co-authored-by: Kurt Boberg <[email protected]> Co-authored-by: Martin Jambon <[email protected]> Co-authored-by: Greg M <[email protected]> Co-authored-by: Pieter De Cremer (Semgrep) <[email protected]> Co-authored-by: Pieter De Cremer <[email protected]>
1 parent a5ecf93 commit a8c6de7

File tree

6 files changed

+160
-24
lines changed

6 files changed

+160
-24
lines changed

‎java/lang/security/audit/formatted-sql-string.java‎

Lines changed: 19 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -152,4 +152,23 @@ public void get(HttpServletRequest req) {
152152
// ruleid: formatted-sql-string
153153
ResultSet rs = statement.executeQuery();
154154
}
155+
}
156+
157+
public class SqlExampleNonStringBuilderConstructor{
158+
159+
public Retry<ResultSet> getRetry(final String mainQuery, final Connection connection) {
160+
// not a StringBuilder
161+
return new Retry<>(
162+
// also not a StringBuilder
163+
new Callable<ResultSet>() {
164+
public ResultSet call() throws SQLException {
165+
PreparedStatement statement = connection.prepareStatement(
166+
mainQuery, ResultSet.TYPE_FORWARD_ONLY, ResultSet.CONCUR_READ_ONLY);
167+
statement.setFetchSize(Integer.MIN_VALUE);
168+
// ok: formatted-sql-string
169+
return statement.executeQuery ();
170+
}
171+
},
172+
Retry.RETRY_FOREVER);
173+
}
155174
}

‎java/lang/security/audit/formatted-sql-string.yaml‎

Lines changed: 7 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -52,12 +52,17 @@ rules:
5252
- pattern-either:
5353
- pattern: $X + $INPUT
5454
- pattern: $X += $INPUT
55-
- pattern: $STRB.append($INPUT)
5655
- pattern: String.format(..., $INPUT, ...)
5756
- pattern: String.join(..., $INPUT, ...)
5857
- pattern: (String $STR).concat($INPUT)
5958
- pattern: $INPUT.concat(...)
60-
- pattern: new $STRB(..., $INPUT, ...)
59+
- patterns:
60+
- pattern-either:
61+
- pattern: $STRB.append($INPUT)
62+
- pattern: new $STRB(..., $INPUT, ...)
63+
- metavariable-type:
64+
metavariable: $STRB
65+
type: StringBuilder
6166
label: CONCAT
6267
requires: INPUT
6368
pattern-propagators:

‎ocaml/lang/best-practice/hashtbl.ml‎

Lines changed: 31 additions & 11 deletions
Original file line numberDiff line numberDiff line change
@@ -5,16 +5,36 @@ let test1 xs =
55
else 2
66

77
let test2 xs =
8-
(* ok *)
9-
try
10-
if Hashtbl.find h 1
11-
then 1
12-
else 2
13-
with Not_found -> 3
8+
(* ok *)
9+
try Hashtbl.find h 1
10+
with Not_found -> 3
11+
12+
let test2 xs =
13+
(* ok *)
14+
try
15+
if Hashtbl.find h 1
16+
then 1
17+
else 2
18+
with Not_found -> 3
1419

1520
let test3 xs =
16-
(* ok *)
17-
match Hashtbl.find h 1 with
18-
| true -> 1
19-
| false -> 2
20-
| exception Not_found -> 3
21+
try
22+
(* ruleid:hashtbl-find-outside-try *)
23+
if Hashtbl.find h 1
24+
then failwith "error"
25+
else 2
26+
with Failure _ -> 3
27+
28+
let test4 xs =
29+
(* ruleid:hashtbl-find-outside-try *)
30+
match Hashtbl.find h 1 with
31+
| true -> 1
32+
| false -> 2
33+
34+
let test5 xs =
35+
(* false positive, needs fixing. See notes in the rule. *)
36+
(* ruleid:hashtbl-find-outside-try *)
37+
match Hashtbl.find h 1 with
38+
| true -> 1
39+
| false -> 2
40+
| exception Not_found -> 3

‎ocaml/lang/best-practice/hashtbl.yaml‎

Lines changed: 16 additions & 10 deletions
Original file line numberDiff line numberDiff line change
@@ -4,16 +4,22 @@ rules:
44
- pattern: |
55
Hashtbl.find ...
66
- pattern-not-inside: |
7-
try ... with ... -> ...
8-
# TODO:
9-
# We should restrict this to match-with plus exception pattern:
10-
#
11-
# match ... with | exception ... -> ... | ... -> ...
12-
#
13-
# But first we need to switch to tree-sitter-ocaml for parsing patterns.
14-
- pattern-not-inside: |
15-
match ... with | ... -> ...
16-
message: You should not use Hashtbl.find outside of a try, or you should use Hashtbl.find_opt
7+
try ... with Not_found -> ...
8+
# TODO: add support for the syntax match ... with | exception ... -> ...
9+
# First, we'd need to switch to tree-sitter-ocaml for parsing
10+
# patterns.
11+
# - pattern-not-inside: |
12+
# match Hashtbl.find ... with exception Not_found -> ...
13+
message: >-
14+
'Hashtbl.find' raises the 'Not_found' exception.
15+
Handle the exception or use 'Hashtbl.find_opt' instead.
16+
If you have proof that the key exists in the table,
17+
use 'assert false' as the exception handler to demonstrate awareness
18+
of the issue.
19+
If your code uses the syntax 'match Hashtbl.find ... with
20+
exception Not_found -> ...', it's fine and we apologize for not
21+
detecting it. Consider using 'Hashtbl.find_opt' to please
22+
Semgrep and stay safe.
1723
languages: [ocaml]
1824
severity: WARNING
1925
metadata:

‎terraform/aws/security/aws-cloudfront-insecure-tls.yaml‎

Lines changed: 21 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -39,11 +39,31 @@ rules:
3939
}
4040
...
4141
}
42+
- pattern-not-inside: |
43+
resource "aws_cloudfront_distribution" $ANYTHING {
44+
...
45+
viewer_certificate {
46+
...
47+
minimum_protocol_version = "TLSv1.2_2025"
48+
...
49+
}
50+
...
51+
}
52+
- pattern-not-inside: |
53+
resource "aws_cloudfront_distribution" $ANYTHING {
54+
...
55+
viewer_certificate {
56+
...
57+
minimum_protocol_version = "TLSv1.3_2025"
58+
...
59+
}
60+
...
61+
}
4262
message: >-
4363
Detected an AWS CloudFront Distribution with an insecure TLS version.
4464
TLS versions less than 1.2 are considered insecure because they
4565
can be broken. To fix this, set your `minimum_protocol_version` to
46-
`"TLSv1.2_2018", "TLSv1.2_2019" or "TLSv1.2_2021"`.
66+
`"TLSv1.2_2018", "TLSv1.2_2019", "TLSv1.2_2021", "TLSv1.2_2025" or "TLSv1.3_2025"`.
4767
metadata:
4868
category: security
4969
technology:

‎yaml/github-actions/security/detect-shai-hulud-backdoor.yaml‎

Lines changed: 66 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,66 @@
1+
rules:
2+
- id: detect-shai-hulud-backdoor
3+
languages:
4+
- yaml
5+
message: The Shai-hulud backdoor creates a purposefully vulnerable github action
6+
with the name `discussion.yaml`.
7+
paths:
8+
include:
9+
- "**/.github/workflows/discussion.yaml"
10+
metadata:
11+
category: security
12+
cwe:
13+
- "CWE-509: Replicating Malicious Code (Virus or Worm)"
14+
owasp:
15+
- A01:2017 - Injection
16+
- A03:2021 - Injection
17+
technology:
18+
- github-actions
19+
cwe2022-top25: true
20+
cwe2021-top25: true
21+
subcategory:
22+
- vuln
23+
likelihood: HIGH
24+
impact: HIGH
25+
confidence: HIGH
26+
license: Semgrep Rules License v1.0. For more details, visit
27+
semgrep.dev/legal/rules-license
28+
vulnerability_class:
29+
- Command Injection
30+
source_rule_url: https://www.wiz.io/blog/shai-hulud-2-0-ongoing-supply-chain-attack
31+
references:
32+
- https://www.aikido.dev/blog/shai-hulud-strikes-again-hitting-zapier-ensdomains
33+
patterns:
34+
- pattern-inside: "steps: [...]"
35+
- pattern-inside: |
36+
- run: ...
37+
...
38+
- pattern: "run: $SHELL"
39+
- metavariable-pattern:
40+
language: generic
41+
metavariable: $SHELL
42+
patterns:
43+
- pattern-either:
44+
- pattern: ${{ github.event.issue.title }}
45+
- pattern: ${{ github.event.issue.body }}
46+
- pattern: ${{ github.event.pull_request.title }}
47+
- pattern: ${{ github.event.pull_request.body }}
48+
- pattern: ${{ github.event.comment.body }}
49+
- pattern: ${{ github.event.review.body }}
50+
- pattern: ${{ github.event.review_comment.body }}
51+
- pattern: ${{ github.event.pages. ... .page_name}}
52+
- pattern: ${{ github.event.head_commit.message }}
53+
- pattern: ${{ github.event.head_commit.author.email }}
54+
- pattern: ${{ github.event.head_commit.author.name }}
55+
- pattern: ${{ github.event.commits ... .author.email }}
56+
- pattern: ${{ github.event.commits ... .author.name }}
57+
- pattern: ${{ github.event.pull_request.head.ref }}
58+
- pattern: ${{ github.event.pull_request.head.label }}
59+
- pattern: ${{ github.event.pull_request.head.repo.default_branch }}
60+
- pattern: ${{ github.head_ref }}
61+
- pattern: ${{ github.event.inputs ... }}
62+
- pattern: ${{ github.event.discussion.title }}
63+
- pattern: ${{ github.event.discussion.body }}
64+
- pattern: ${{ inputs ... }}
65+
severity: ERROR
66+

0 commit comments

Comments
 (0)