Welcome to elttam's public semgrep rules repository.
We regularly develop rules during our code-assisted security audits and software security research. We will be frequently adding new rules and improving what's here for the semgrep community. We hope product security engineers and code auditors who use semgrep find these useful!
If you find any bugs, please raise a GitHub issue.
This guide assumes you are familiar with Semgrep and have it already installed.
Test out this template repo with the following command:
git clone https://github.com/elttam/semgrep-rules.gitTo test out the rules template, run:
semgrep --config semgrep-rules/rules semgrep-rules/rules/| Rule Path | Language | Technology | Description |
|---|---|---|---|
| java/jackson/polymorphic-typing | Java | Jackson | Find polymorphic typing to aid in finding vulnerable Jackson deserialisation issues. |
| java/jackson/type-resolver-override | Java | Jackson | Find polymorphic typing using TypeResolveBuilder |
| java/jax-rs/security/audit/entrypoints/ | Java | JAX-RS | Find JAX-RS REST entrypoints |
| java/lang/security/audit/crypto/gcm-static-iv | Java | Find GCM using same values for key and IV | |
| java/spring/security/audit/entrypoints/ | Java | Spring | Find Spring REST entrypoints |
| java/spring/security/audit/remoting/ | Java | Spring | Find use of Spring Remoting |
| java/struts2/security/audit/devmode/ | Java | Struts2 | Find the use of devMode |
| java/struts2/security/audit/dmi/ | Java | Struts2 | Find the use of Dynamic Method Invocation |
| java/struts2/security/audit/entrypoints/ | Java | Struts2 | Find Struts2 REST entrypoints |
| java/xstream/security/audit/fromxml | Java | XStream | Find use of XStream.fromXML(...) |
| yaml/kubernetes/audit/network-policy-ingress-any | YAML | Kubernetes | Find container specs with NetworkPolicy with Ingress Permit ANY |
| yaml/kubernetes/audit/privileged-container | YAML | Kubernetes | Find container specs with security context privileged |
| yaml/kubernetes/security/allow-privileged-escalation | YAML | Kubernetes | Find container specs, including init containers, allowing privilege escalation (allowPrivilegeEscalation) |