Skip to content

Commit 27d1d0e

Browse files
r2c-argo[bot]tean-laiLewisArdernscopgobind-singh
authored
Merge Develop into Release (#3642)
* fix query-set-extra tests (#3635) Co-authored-by: Lewis <[email protected]> * Update TLS version info in Go missing-ssl-minversion Closes #3643 * Regex update - Missing integrity HTML rule * new line * Add detail to message for TF GCP bucket access The message here was pretty vague and unhelpful - this adds some more specificity. * Update semgrep-rules-test-develop.yml (#3658) * Fix csharp-sqli sanitizers * update CWEs for terraform rules (#3666) --------- Co-authored-by: tean-lai <[email protected]> Co-authored-by: Lewis <[email protected]> Co-authored-by: Ville Skyttä <[email protected]> Co-authored-by: gobind-singh <[email protected]> Co-authored-by: Alexis Grant <[email protected]> Co-authored-by: Claudio <[email protected]> Co-authored-by: Alexis Grant <[email protected]> Co-authored-by: Vladislav Timakov <[email protected]> Co-authored-by: Kurt Boberg <[email protected]> Co-authored-by: Vasilii Ermilov <[email protected]>
1 parent 36bfa53 commit 27d1d0e

File tree

114 files changed

+188
-140
lines changed

Some content is hidden

Large Commits have some content hidden by default. Use the searchbox below for content that may be hidden.

114 files changed

+188
-140
lines changed

‎.github/workflows/semgrep-rules-test-develop.yml‎

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -28,6 +28,6 @@ jobs:
2828
#TODO: this actually currently fails because of errors in stats/ but GHA
2929
# still continue, weird
3030
- name: run osemgrep validate --pro
31-
run: docker run --rm -w /src -v ${GITHUB_WORKSPACE}/semgrep-rules:/src semgrep/semgrep:pro-develop semgrep validate --pro .
31+
run: docker run --rm -w /src -v ${GITHUB_WORKSPACE}/semgrep-rules:/src semgrep/semgrep-nightly:develop semgrep validate --pro .
3232
- name: run osemgrep test --pro
33-
run: docker run --rm -w /src -v ${GITHUB_WORKSPACE}/semgrep-rules:/src semgrep/semgrep:pro-develop semgrep test --pro .
33+
run: docker run --rm -w /src -v ${GITHUB_WORKSPACE}/semgrep-rules:/src semgrep/semgrep-nightly:develop semgrep test --pro .

‎csharp/lang/security/sqli/csharp-sqli.yaml‎

Lines changed: 6 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -28,9 +28,13 @@ rules:
2828
pattern-sanitizers:
2929
- pattern-either:
3030
- pattern: |
31-
$CMD.Parameters.add(...)
31+
$CMD.Parameters.Add(...)
3232
- pattern: |
33-
$CMD.Parameters[$IDX] = ...
33+
$CMD.Parameters.AddRange(...)
34+
- pattern: |
35+
$CMD.Parameters.AddWithValue(...)
36+
- pattern: |
37+
$CMD.Parameters[$IDX].Value = ...
3438
by-side-effect: true
3539
message: Detected a formatted string in a SQL statement. This could lead to SQL
3640
injection if variables in the SQL statement are not properly sanitized.

‎go/lang/security/audit/crypto/missing-ssl-minversion.yaml‎

Lines changed: 3 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -2,7 +2,7 @@ rules:
22
- id: missing-ssl-minversion
33
message: >-
44
`MinVersion` is missing from this TLS configuration.
5-
By default, TLS 1.2 is currently used as the minimum when acting as a client, and TLS 1.0 when acting as a server.
5+
By default, as of Go 1.22, TLS 1.2 is currently used as the minimum.
66
General purpose web applications should default to TLS 1.3 with all other protocols disabled.
77
Only where it is known that a web server must support legacy clients
88
with unsupported an insecure browsers (such as Internet Explorer 10), it may be necessary to enable TLS 1.0 to provide support.
@@ -15,8 +15,8 @@ rules:
1515
- A02:2021 - Cryptographic Failures
1616
source-rule-url: https://github.com/securego/gosec/blob/master/rules/tls_config.go
1717
references:
18-
- https://golang.org/doc/go1.14#crypto/tls
19-
- https://golang.org/pkg/crypto/tls/#:~:text=MinVersion
18+
- https://go.dev/doc/go1.22#minor_library_changes
19+
- https://pkg.go.dev/crypto/tls#:~:text=MinVersion
2020
- https://www.us-cert.gov/ncas/alerts/TA14-290A
2121
category: security
2222
technology:

‎html/security/audit/missing-integrity.html‎

Lines changed: 2 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -35,6 +35,8 @@
3535
<!-- ok: missing-integrity -->
3636
<link rel="stylesheet" href="https://someurl/style.css" integrity="sha256-somehashdigest">
3737
<!-- ok: missing-integrity -->
38+
<link rel="stylesheet" integrity="sha256-somehashdigest href="https://someurl/style.css">
39+
<!-- ok: missing-integrity -->
3840
<link rel="stylesheet" href="./css/mystyle.css">
3941
<!-- ok: missing-integrity -->
4042
<link rel="preconnect" href="https://fonts.gstatic.com/" />

‎html/security/audit/missing-integrity.yaml‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -31,7 +31,7 @@ rules:
3131
- pattern: src="//..."
3232
- pattern: href='//...'
3333
- pattern: href="//..."
34-
- pattern-not-regex: (?is).*integrity=
34+
- pattern-not-regex: (?is).*integrity=.*
3535
- pattern-not-regex: (google-analytics\.com|fonts\.googleapis\.com|fonts\.gstatic\.com|googletagmanager\.com)
3636
- pattern-not-regex: .*rel\s*=\s*['"]?preconnect.*
3737
paths:

‎python/django/security/audit/query-set-extra.py‎

Lines changed: 63 additions & 23 deletions
Original file line numberDiff line numberDiff line change
@@ -14,34 +14,74 @@
1414
Entry.objects.get({}).filter().update().extra()
1515

1616
# ok:avoid-query-set-extra
17-
findings = Finding.objects.filter(verified=True,
18-
severity__in=('Critical', 'High', 'Medium', 'Low', 'Info')).prefetch_related(
19-
'test__engagement__product',
20-
'test__engagement__product__prod_type',
21-
'test__engagement__risk_acceptance',
22-
'risk_acceptance_set',
23-
'reporter').extra(
17+
findings = (
18+
Finding.objects.filter(
19+
verified=True, severity__in=("Critical", "High", "Medium", "Low", "Info")
20+
)
21+
.prefetch_related(
22+
"test__engagement__product",
23+
"test__engagement__product__prod_type",
24+
"test__engagement__risk_acceptance",
25+
"risk_acceptance_set",
26+
"reporter",
27+
)
28+
.extra(
2429
select={
25-
'ra_count': 'SELECT COUNT(*) FROM dojo_risk_acceptance INNER JOIN '
26-
'dojo_risk_acceptance_accepted_findings ON '
27-
'( dojo_risk_acceptance.id = dojo_risk_acceptance_accepted_findings.risk_acceptance_id ) '
28-
'WHERE dojo_risk_acceptance_accepted_findings.finding_id = dojo_finding.id',
30+
"ra_count": "SELECT COUNT(*) FROM dojo_risk_acceptance INNER JOIN "
31+
"dojo_risk_acceptance_accepted_findings ON "
32+
"( dojo_risk_acceptance.id = dojo_risk_acceptance_accepted_findings.risk_acceptance_id ) "
33+
"WHERE dojo_risk_acceptance_accepted_findings.finding_id = dojo_finding.id",
2934
},
3035
)
36+
)
3137

32-
example = 1
38+
39+
example = input()
3340
# ruleid:avoid-query-set-extra
34-
active_findings = Finding.objects.filter(verified=True, active=True,
35-
severity__in=('Critical', 'High', 'Medium', 'Low', 'Info')).prefetch_related(
36-
'test__engagement__product',
37-
'test__engagement__product__prod_type',
38-
'test__engagement__risk_acceptance',
39-
'risk_acceptance_set',
40-
'reporter').extra(
41+
active_findings = (
42+
Finding.objects.filter(
43+
verified=True,
44+
active=True,
45+
severity__in=("Critical", "High", "Medium", "Low", "Info"),
46+
)
47+
.prefetch_related(
48+
"test__engagement__product",
49+
"test__engagement__product__prod_type",
50+
"test__engagement__risk_acceptance",
51+
"risk_acceptance_set",
52+
"reporter",
53+
)
54+
.extra(
55+
select={
56+
"ra_count": f"SELECT COUNT(*) FROM dojo_risk_acceptance INNER JOIN "
57+
f"dojo_risk_acceptance_accepted_findings ON "
58+
f"( dojo_risk_acceptance.id = dojo_risk_acceptance_accepted_findings.risk_acceptance_id ) "
59+
f"WHERE dojo_risk_acceptance_accepted_findings.finding_id = {example}",
60+
},
61+
)
62+
)
63+
64+
example = 1
65+
# ok:avoid-query-set-extra
66+
active_findings = (
67+
Finding.objects.filter(
68+
verified=True,
69+
active=True,
70+
severity__in=("Critical", "High", "Medium", "Low", "Info"),
71+
)
72+
.prefetch_related(
73+
"test__engagement__product",
74+
"test__engagement__product__prod_type",
75+
"test__engagement__risk_acceptance",
76+
"risk_acceptance_set",
77+
"reporter",
78+
)
79+
.extra(
4180
select={
42-
'ra_count': f'SELECT COUNT(*) FROM dojo_risk_acceptance INNER JOIN '
43-
f'dojo_risk_acceptance_accepted_findings ON '
44-
f'( dojo_risk_acceptance.id = dojo_risk_acceptance_accepted_findings.risk_acceptance_id ) '
45-
f'WHERE dojo_risk_acceptance_accepted_findings.finding_id = {example}',
81+
"ra_count": f"SELECT COUNT(*) FROM dojo_risk_acceptance INNER JOIN "
82+
f"dojo_risk_acceptance_accepted_findings ON "
83+
f"( dojo_risk_acceptance.id = dojo_risk_acceptance_accepted_findings.risk_acceptance_id ) "
84+
f"WHERE dojo_risk_acceptance_accepted_findings.finding_id = {example}",
4685
},
4786
)
87+
)

‎terraform/aws/security/aws-ec2-has-public-ip.yaml‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -31,7 +31,7 @@ rules:
3131
- A05:2017 - Broken Access Control
3232
- A01:2021 - Broken Access Control
3333
cwe:
34-
- 'CWE-284: Improper Access Control'
34+
- 'CWE-1220: Insufficient Granularity of Access Control'
3535
references:
3636
- https://owasp.org/Top10/A01_2021-Broken_Access_Control
3737
subcategory:

‎terraform/aws/security/aws-ec2-security-group-allows-public-ingress.yaml‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -73,7 +73,7 @@ rules:
7373
owasp:
7474
- A01:2021 - Broken Access Control
7575
cwe:
76-
- 'CWE-284: Improper Access Control'
76+
- 'CWE-1220: Insufficient Granularity of Access Control'
7777
references:
7878
- https://owasp.org/Top10/A01_2021-Broken_Access_Control/
7979
- https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/security_group

‎terraform/aws/security/aws-network-acl-allows-all-ports.yaml‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -49,7 +49,7 @@ rules:
4949
owasp:
5050
- A01:2021 - Broken Access Control
5151
cwe:
52-
- 'CWE-284: Improper Access Control'
52+
- 'CWE-1220: Insufficient Granularity of Access Control'
5353
references:
5454
- https://owasp.org/Top10/A01_2021-Broken_Access_Control/
5555
- https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/network_acl

‎terraform/aws/security/aws-network-acl-allows-public-ingress.yaml‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -72,7 +72,7 @@ rules:
7272
owasp:
7373
- A01:2021 - Broken Access Control
7474
cwe:
75-
- 'CWE-284: Improper Access Control'
75+
- 'CWE-1220: Insufficient Granularity of Access Control'
7676
references:
7777
- https://owasp.org/Top10/A01_2021-Broken_Access_Control/
7878
- https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/network_acl

0 commit comments

Comments
 (0)