my-semgrep-rules/dangerous-exec-cmd.yaml at master · imfht/my-semgrep-rules · GitHub

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
rules:
- id: dangerous-exec-cmd
  patterns:
  - pattern-either:
    - patterns:
      - pattern: |
          exec.Cmd {...,Path: $CMD,...}
      - pattern-not: |
          exec.Cmd {...,Path: "...",...}
      - pattern-not-inside: |
          $CMD,$ERR := exec.LookPath("...");
          ...
      - pattern-not-inside: |
          $CMD = "...";
          ...
    - patterns:
      - pattern: |
          exec.Cmd {...,Args: $ARGS,...}
      - pattern-not: |
          exec.Cmd {...,Args: []string{...},...}
      - pattern-not-inside: |
          $ARGS = []string{"...",...};
          ...
      - pattern-not-inside: |
          $CMD = "...";
          ...
          $ARGS = []string{$CMD,...};
          ...
      - pattern-not-inside: |
          $CMD = exec.LookPath("...");
          ...
          $ARGS = []string{$CMD,...};
          ...
    - patterns:
      - pattern: |
          exec.Cmd {...,Args: []string{$CMD,...},...}
      - pattern-not: |
          exec.Cmd {...,Args: []string{"...",...},...}
      - pattern-not-inside: |
          $CMD,$ERR := exec.LookPath("...");
          ...
      - pattern-not-inside: |
          $CMD = "...";
          ...
    - patterns:
      - pattern-either:
        - pattern: |
            exec.Cmd {...,Args: []string{"=~/(sh|bash|ksh|csh|tcsh|zsh)/","-c",$EXE,...},...}
        - patterns:
          - pattern: |
              exec.Cmd {...,Args: []string{$CMD,"-c",$EXE,...},...}
          - pattern-inside: |
              $CMD,$ERR := exec.LookPath("=~/(sh|bash|ksh|csh|tcsh|zsh)/");
              ...
      - pattern-not: |
          exec.Cmd {...,Args: []string{"...","...","...",...},...}
      - pattern-not-inside: |
          $EXE = "...";
          ...
  - pattern-inside: |
      import "os/exec"
      ...
  message: |
    Detected non-static command inside exec.Cmd. Audit the input to 'exec.Cmd'.
    If unverified user data can reach this call site, this is a code injection
    vulnerability. A malicious actor can inject a malicious script to execute
    arbitrary code.
  metadata:
    cwe: "CWE-94: Improper Control of Generation of Code ('Code Injection')"
    owasp: 'A1: Injection'
    category: security
  severity: WARNING
  languages: [go]