Merge branch 'develop' into develop

semgrep · Sep 19, 2024 · e80a5f8 · e80a5f8
2 parents 4d6d0a3 + 6d1b466
commit e80a5f8
Show file tree

Hide file tree

Showing 8 changed files with 239 additions and 6 deletions.
diff --git a/generic/secrets/security/detected-onfido-live-api-token.txt b/generic/secrets/security/detected-onfido-live-api-token.txt
@@ -0,0 +1,8 @@
+# ruleid: detected-onfido-live-api-token
+api_live.abc123ABC-_.abc123ABC-_abc123ABC-_abc123ABC-
+
+# ruleid: detected-onfido-live-api-token
+api_live_ca.abc123ABC-_.abc123ABC-_abc123ABC-_abc123ABC-
+
+# ruleid: detected-onfido-live-api-token
+api_live_us.abc123ABC-_.abc123ABC-_abc123ABC-_abc123ABC-
diff --git a/generic/secrets/security/detected-onfido-live-api-token.yaml b/generic/secrets/security/detected-onfido-live-api-token.yaml
@@ -0,0 +1,20 @@
+rules:
+- id: detected-onfido-live-api-token
+  pattern-regex: (?:api_live(?:_[a-zA-Z]{2})?\.[a-zA-Z0-9-_]{11}\.[-_a-zA-Z0-9]{32})
+  languages: [regex]
+  message: Onfido live API Token detected
+  severity: ERROR
+  metadata:
+    cwe:
+    - 'CWE-798: Use of Hard-coded Credentials'
+    category: security
+    technology:
+    - secrets
+    - onfido
+    confidence: HIGH
+    references:
+    - https://documentation.onfido.com/api/latest/#api-tokens
+    subcategory:
+    - audit
+    likelihood: HIGH
+    impact: HIGH
diff --git a/php/lang/security/injection/tainted-callable.php b/php/lang/security/injection/tainted-callable.php
@@ -0,0 +1,12 @@
+<?php
+
+$foo = [2, 1, 3];
+
+// ok: tainted-callable
+var_dump(usort($foo, 'strcmp'));
+
+// ok: tainted-callable
+var_dump(usort($_GET['array'], 'strcmp'));
+
+// ruleid: tainted-callable
+var_dump(usort($foo, $_GET['sortfunc']));
diff --git a/php/lang/security/injection/tainted-callable.yaml b/php/lang/security/injection/tainted-callable.yaml
@@ -0,0 +1,115 @@
+rules:
+- id: tainted-callable
+  severity: WARNING
+  message: >-
+    Callable based on user input risks remote code execution.
+  metadata:
+    technology:
+    - php
+    category: security
+    cwe:
+    - "CWE-94: Improper Control of Generation of Code ('Code Injection')"
+    owasp:
+    - A03:2021 - Injection
+    references:
+    - https://www.php.net/manual/en/language.types.callable.php
+    subcategory:
+    - vuln
+    impact: HIGH
+    likelihood: MEDIUM
+    confidence: MEDIUM
+  languages: [php]
+  mode: taint
+  pattern-sources:
+  - patterns:
+    - pattern-either:
+      - pattern: $_GET
+      - pattern: $_POST
+      - pattern: $_COOKIE
+      - pattern: $_REQUEST
+      - pattern: file_get_contents('php://input')
+  pattern-sinks:
+  - patterns:
+    - pattern: $CALLABLE
+    - pattern-either:
+      - pattern-inside: $ARRAYITERATOR->uasort($CALLABLE)
+      - pattern-inside: $ARRAYITERATOR->uksort($CALLABLE)
+      - pattern-inside: $EVENTHTTP->setCallback($CALLABLE, ...)
+      - pattern-inside: $EVENTHTTPCONNECTION->setCloseCallback($CALLABLE, ...)
+      - pattern-inside: $EVLOOP->fork($CALLABLE, ...)
+      - pattern-inside: $EVLOOP->idle($CALLABLE, ...)
+      - pattern-inside: $EVLOOP->prepare($CALLABLE, ...)
+      - pattern-inside: $EVWATCHER->setCallback($CALLABLE)
+      - pattern-inside: $GEARMANCLIENT->setClientCallback($CALLABLE)
+      - pattern-inside: $GEARMANCLIENT->setCompleteCallback($CALLABLE)
+      - pattern-inside: $GEARMANCLIENT->setCreatedCallback($CALLABLE)
+      - pattern-inside: $GEARMANCLIENT->setDataCallback($CALLABLE)
+      - pattern-inside: $GEARMANCLIENT->setExceptionCallback($CALLABLE)
+      - pattern-inside: $GEARMANCLIENT->setFailCallback($CALLABLE)
+      - pattern-inside: $GEARMANCLIENT->setStatusCallback($CALLABLE)
+      - pattern-inside: $GEARMANCLIENT->setWarningCallback($CALLABLE)
+      - pattern-inside: $GEARMANCLIENT->setWorkloadCallback($CALLABLE)
+      - pattern-inside: $IMAGICK->setProgressMonitor($CALLABLE)
+      - pattern-inside: $OAUTHPROVIDER->consumerHandler($CALLABLE)
+      - pattern-inside: $OAUTHPROVIDER->tokenHandler($CALLABLE)
+      - pattern-inside: $PDO->sqliteCreateCollation($NAME, $CALLABLE)
+      - pattern-inside: $PDOSTATEMENT->fetchAll(PDO::FETCH_FUNC, $CALLABLE)
+      - pattern-inside: $SQLITE3->createCollation($NAME, $CALLABLE)
+      - pattern-inside: $SQLITE3->setAuthorizer($CALLABLE)
+      - pattern-inside: $ZIPARCHIVE->registerCancelCallback($CALLABLE)
+      - pattern-inside: $ZIPARCHIVE->registerProgressCallback($RATE, $CALLABLE)
+      - pattern-inside: $ZMQDEVICE->setIdleCallback($CALLABLE, ...)
+      - pattern-inside: $ZMQDEVICE->setTimerCallback($CALLABLE, ...)
+      - pattern-inside: apcu_entry($KEY, $CALLABLE, ...)
+      - pattern-inside: array_filter($ARRAY, $CALLABLE, ...)
+      - pattern-inside: array_map($CALLABLE, ...)
+      - pattern-inside: array_reduce($ARRAY, $CALLABLE, ...)
+      - pattern-inside: array_walk_recursive($ARRAY, $CALLABLE, ...)
+      - pattern-inside: array_walk($ARRAY, $CALLABLE, ...)
+      - pattern-inside: call_user_func_array($CALLABLE, ...)
+      - pattern-inside: call_user_func($CALLABLE, ...)
+      - pattern-inside: Closure::fromCallable($CALLABLE)
+      - pattern-inside: createCollation($NAME, $CALLABLE)
+      - pattern-inside: eio_grp($CALLABLE, ...)
+      - pattern-inside: eio_nop($PRI, $CALLABLE, ...)
+      - pattern-inside: eio_sync($PRI, $CALLABLE, ...)
+      - pattern-inside: EvPrepare::createStopped($CALLABLE, ...)
+      - pattern-inside: fann_set_callback($ANN, $CALLABLE)
+      - pattern-inside: fdf_enum_values($FDF_DOCUMENT, $CALLABLE, ...)
+      - pattern-inside: forward_static_call_array($CALLABLE, ...)
+      - pattern-inside: forward_static_call($CALLABLE, ...)
+      - pattern-inside: header_register_callback($CALLABLE)
+      - pattern-inside: ibase_set_event_handler($CALLABLE, ...)
+      - pattern-inside: IntlChar::enumCharTypes($CALLABLE)
+      - pattern-inside: iterator_apply($ITERATOR, $CALLABLE)
+      - pattern-inside: ldap_set_rebind_proc($LDAP, $CALLABLE)
+      - pattern-inside: libxml_set_external_entity_loader($CALLABLE, ...)
+      - pattern-inside: new CallbackFilterIterator($ITERATOR, $CALLABLE)
+      - pattern-inside: new EvCheck($CALLABLE, ...)
+      - pattern-inside: new EventHttpRequest($CALLABLE, ...)
+      - pattern-inside: new EvFork($CALLABLE, ...)
+      - pattern-inside: new EvIdle($CALLABLE, ...)
+      - pattern-inside: new Fiber($CALLABLE)
+      - pattern-inside: new Memcached($PERSISTENT_ID, $CALLABLE, ...)
+      - pattern-inside: new RecursiveCallbackFilterIterator($ITERATOR, $CALLABLE)
+      - pattern-inside: new Zookeeper($HOST, $CALLABLE, ...)
+      - pattern-inside: ob_start($CALLABLE, ...)
+      - pattern-inside: oci_register_taf_callback($CONNECTION, $CALLABLE)
+      - pattern-inside: readline_callback_handler_install($PROMPT, $CALLABLE)
+      - pattern-inside: readline_completion_function($CALLABLE)
+      - pattern-inside: register_shutdown_function($CALLABLE, ...)
+      - pattern-inside: register_tick_function($CALLABLE, ...)
+      - pattern-inside: rnp_ffi_set_pass_provider($FFI, $CALLABLE)
+      - pattern-inside: sapi_windows_set_ctrl_handler($CALLABLE, ...)
+      - pattern-inside: set_error_handler($CALLABLE, ...)
+      - pattern-inside: set_exception_handler($CALLABLE)
+      - pattern-inside: setAuthorizer($CALLABLE)
+      - pattern-inside: spl_autoload_register($CALLABLE, ...)
+      - pattern-inside: uasort($ARRAY, $CALLABLE)
+      - pattern-inside: uksort($ARRAY, $CALLABLE)
+      - pattern-inside: usort($ARRAY, $CALLABLE)
+      - pattern-inside: xml_set_character_data_handler($PARSER, $CALLABLE)
+      - pattern-inside: xml_set_default_handler($PARSER, $CALLABLE)
+      - pattern-inside: xml_set_element_handler($PARSER, $CALLABLE, $CALLABLE)
+      - pattern-inside: xml_set_notation_decl_handler($PARSER, $CALLABLE)
+      - pattern-inside: Yar_Concurrent_Client::loop($CALLABLE, ...)
diff --git a/php/lang/security/injection/tainted-exec.php b/php/lang/security/injection/tainted-exec.php
@@ -0,0 +1,21 @@
+<?php
+
+$userinput = $_GET['userinput'];
+
+// ruleid: tainted-exec
+system("ls $userinput");
+
+$escaped = escapeshellarg($userinput);
+// ok: tainted-exec
+system("ls $escaped");
+
+$descriptors = [["pipe", "r"], ["pipe", "w"], ["pipe", "w"]];
+$pipes = [];
+
+// ruleid: tainted-exec
+$p = proc_open("ls $userinput", $descriptors, $pipes);
+echo stream_get_contents($pipes[1]);
+
+// ok: tainted-exec
+$p = proc_open(["ls", $userinput], $descriptors, $pipes);
+echo stream_get_contents($pipes[1]);
diff --git a/php/lang/security/injection/tainted-exec.yaml b/php/lang/security/injection/tainted-exec.yaml
@@ -0,0 +1,51 @@
+rules:
+- id: tainted-exec
+  languages:
+  - php
+  severity: WARNING
+  message: >-
+    User input is passed to a function that executes a shell command. This can lead to remote code execution.
+  metadata:
+    cwe:
+    - "CWE-78: Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')"
+    category: security
+    technology:
+    - php
+    owasp:
+    - A03:2021 - Injection
+    references:
+    - https://owasp.org/Top10/A03_2021-Injection
+    subcategory:
+    - vuln
+    impact: HIGH
+    likelihood: MEDIUM
+    confidence: MEDIUM
+  mode: taint
+  pattern-sources:
+  - patterns:
+    - pattern-either:
+      - pattern: $_GET
+      - pattern: $_POST
+      - pattern: $_COOKIE
+      - pattern: $_REQUEST
+      - pattern: file_get_contents('php://input')
+  pattern-sanitizers:
+  - patterns:
+    - pattern-either:
+      - pattern: escapeshellcmd(...)
+      - pattern: escapeshellarg(...)
+  pattern-sinks:
+  - patterns:
+    - pattern-either:
+      - pattern: exec(...)
+      - pattern: system(...)
+      - pattern: passthru(...)
+      - patterns:
+        - pattern: proc_open(...)
+        - pattern-not: proc_open([...], ...)
+      - pattern: popen(...)
+      - pattern: expect_popen(...)
+      - pattern: shell_exec(...)
+      - pattern: |
+          `...`
+
diff --git a/python/django/security/injection/tainted-sql-string.py b/python/django/security/injection/tainted-sql-string.py
@@ -10,7 +10,8 @@ class Person(models.Model):
 ##### True Positives #########
 def get_user_age1(request):
     user_name = request.POST.get("user_name")
-    user_age = Person.objects.raw( # ruleid: tainted-sql-string
+    user_age = Person.objects.raw(
+        # ruleid: tainted-sql-string
         "SELECT user_age FROM myapp_person where user_name = %s" % user_name
     )
     html = "<html><body>User Age %s.</body></html>" % user_age
@@ -19,7 +20,8 @@ def get_user_age1(request):
 
 def get_user_age2(request):
     user_name = request.POST.get("user_name")
-    user_age = Person.objects.raw( # ruleid: tainted-sql-string
+    user_age = Person.objects.raw(
+        # ruleid: tainted-sql-string
         f"SELECT user_age FROM myapp_person where user_name = {user_name}"
     )
     html = "<html><body>User Age %s.</body></html>" % user_age
@@ -28,7 +30,8 @@ def get_user_age2(request):
 
 def get_user_age3(request):
     user_name = request.POST.get("user_name")
-    user_age = Person.objects.raw( # ruleid: tainted-sql-string
+    user_age = Person.objects.raw(
+        # ruleid: tainted-sql-string
         "SELECT user_age FROM myapp_person where user_name = %s".format(user_name)
     )
     html = "<html><body>User Age %s.</body></html>" % user_age
@@ -37,7 +40,8 @@ def get_user_age3(request):
 
 def get_user_age4(request):
     user_name = request.POST.get("user_name")
-    user_age = Person.objects.raw( # ruleid: tainted-sql-string
+    user_age = Person.objects.raw(
+        # ruleid: tainted-sql-string
         "SELECT user_age FROM myapp_person where user_name = " + user_name
     )
     html = "<html><body>User Age %s.</body></html>" % user_age
@@ -63,7 +67,8 @@ def get_user_age6(request):
 
 def get_users1(request):
     client_id = request.headers.get("client_id")
-    users = Person.objects.raw( # ruleid: tainted-sql-string
+    users = Person.objects.raw(
+        # ruleid: tainted-sql-string
         "SELECT * FROM myapp_person where client_id = %s" % client_id
     )
     html = "<html><body>Users %s.</body></html>" % users
@@ -72,7 +77,8 @@ def get_users1(request):
 
 def get_users2(request):
     client_id = request.headers.get("client_id")
-    users = Person.objects.raw( # ruleid: tainted-sql-string
+    users = Person.objects.raw(
+        # ruleid: tainted-sql-string
         f"SELECT * FROM myapp_person where client_id = {client_id}"
     )
     html = "<html><body>Users %s.</body></html>" % users

diff --git a/.../no-fractional-cpu-limits.test.fixed.yaml → .../no-fractional-cpu-limits.fixed.test.yaml b/.../no-fractional-cpu-limits.test.fixed.yaml → .../no-fractional-cpu-limits.fixed.test.yaml