yaml.semgrep.metadata-deepsemgrep.metadata-deepsemgrep

profile photo of semgrepsemgrep
Author
unknown
Download Count*
LGPL Commons Clause
License

We no longer support deepsemgrep: true, please use interfile:true

Run Locally

Run in CI

Semgrep CI docs

Defintion

Edit RuleView Source
Open in Playground 
rules:
  - id: metadata-deepsemgrep
    patterns:
      - pattern-inside: |
          rules: 
            ...
      - pattern-inside: |
          metadata: 
            ...
            $DEEPSEMGREP: true
            ...
      - focus-metavariable: $DEEPSEMGREP
      - metavariable-regex:
          metavariable: $DEEPSEMGREP
          regex: ^(deepsemgrep)$
    message: "We no longer support `deepsemgrep: true`, please use `interfile:true`"
    fix-regex:
      regex: deepsemgrep
      replacement: interfile
    languages:
      - yaml
    severity: WARNING
    metadata:
      category: correctness
      technology:
        - semgrep
      references:
        - https://semgrep.dev/
      license: Commons Clause License Condition v1.0[LGPL-2.1-only]

Examples

metadata-deepsemgrep.test.yaml

rules:
  - id: require-request
    message: >-
      If an attacker controls the x in require(x) then they can cause code to load that was not intended to run on the server.
    severity: LOW
    languages: [javascript, typescript]
    metadata:
      owasp: 
        - "A03:2021 - Injection"
      # ruleid: metadata-deepsemgrep
      deepsemgrep: true
      cwe: 
        - "CWE-706: Use of Incorrectly-Resolved Name or Reference"
      source-rule-url: https://nodesecroadmap.fyi/chapter-1/threat-UIR.html
      category: security
      likelihood: HIGH
      impact: HIGH
      confidence: HIGH
      subcategory: 
        - vuln
      technology:
        - express
      references:
        - https://github.com/google/node-sec-roadmap/blob/master/chapter-2/dynamism.md#dynamism-when-you-need-it
    patterns: 
  - id: require-request
    message: >-
      If an attacker controls the x in require(x) then they can cause code to load that was not intended to run on the server.
    severity: LOW
    languages: [javascript, typescript]
    metadata:
      owasp: 
        - "A03:2021 - Injection"
      # ruleid: metadata-deepsemgrep
      deepsemgrep: true
      cwe: 
        - "CWE-706: Use of Incorrectly-Resolved Name or Reference"
      source-rule-url: https://nodesecroadmap.fyi/chapter-1/threat-UIR.html
      category: security
      likelihood: HIGH
      impact: HIGH
      confidence: HIGH
      subcategory: 
        - vuln
      technology:
        - express
      references:
        - https://github.com/google/node-sec-roadmap/blob/master/chapter-2/dynamism.md#dynamism-when-you-need-it
    patterns: