yaml.semgrep.metadata-confidence.metadata-confidence

returntocorp

Author

unknown

Download Count*

License

This Semgrep rule is missing a valid 'confidence' field in the 'metadata'. which should be either LOW, MEDIUM, or HIGH. For more information visit https://semgrep.dev/docs/contributing/contributing-to-semgrep-rules-repository/

Run Locally

Run in CI

Semgrep CI docs

Defintion

Edit Rule View Source

Open in Playground

rules:
  - id: metadata-confidence
    patterns:
      - pattern-inside: |
          rules: 
            ...
      - pattern-inside: |
          metadata: 
            ...
            category: security
            ...
      - pattern-not-inside: |
          metadata: 
            ...
            confidence: $VALUE
    message: This Semgrep rule is missing a valid 'confidence' field in the
      'metadata'. which should be either LOW, MEDIUM, or HIGH. For more
      information
      visit  https://semgrep.dev/docs/contributing/contributing-to-semgrep-rules-repository/
    languages:
      - yaml
    severity: WARNING
    metadata:
      references:
        - https://semgrep.dev/docs/contributing/contributing-to-semgrep-rules-repository
      category: correctness
      technology:
        - semgrep
      license: Commons Clause License Condition v1.0[LGPL-2.1-only]

Examples

metadata-confidence.test.yaml

rules:
  - id: require-request
    message: >-
      If an attacker controls the x in require(x) then they can cause code to load that was not intended to run on the server.
    severity: LOW
    languages: [javascript, typescript]
    # ok: metadata-confidence
    metadata:
      owasp: "A03:2021 - Injection"
      cwe: "CWE-706: Use of Incorrectly-Resolved Name or Reference"
      source-rule-url: https://nodesecroadmap.fyi/chapter-1/threat-UIR.html
      category: security
      likelihood: LOW
      impact: LOW
      confidence: LOW
      technology:
        - express
      references:
        - https://github.com/google/node-sec-roadmap/blob/master/chapter-2/dynamism.md#dynamism-when-you-need-it
    patterns: 
  - id: require-request
    message: >-
      If an attacker controls the x in require(x) then they can cause code to load that was not intended to run on the server.
    severity: LOW
    languages: [javascript, typescript]
    # ruleid: metadata-confidence
    metadata:
      owasp: "A03:2021 - Injection"
      cwe: "CWE-706: Use of Incorrectly-Resolved Name or Reference"
      source-rule-url: https://nodesecroadmap.fyi/chapter-1/threat-UIR.html
      category: security
      technology:
        - express
      references:
        - https://github.com/google/node-sec-roadmap/blob/master/chapter-2/dynamism.md#dynamism-when-you-need-it
    patterns:

Short Link: https://sg.run/B0x2