java-spring-demo/xss.yaml at main · seqra/java-spring-demo · GitHub

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
rules:
  - id: pattern-concat.xss
    languages:
      - java
    severity: ERROR
    message: Controller returns an untrusted unvalidated data
    metadata:
      cwe: CWE-79
      license: MIT
      shortDescription: Controller returns an untrusted unvalidated data
    patterns:
      - pattern: |
          @$ANNOTATION(...)
          $RETURNTYPE $METHOD(..., $TYPE $PARAM,...) {
            ...
            return "..." + $PARAM + "...";
            ...
          }
      - pattern-not: |
          @$ANNOTATION(...)
          $RETURNTYPE $METHOD(..., $TYPE $PARAM,...) {
            ...
            return "..." + HtmlUtils.htmlEscape($PARAM) + "...";
            ...
          }
      - metavariable-pattern:
          metavariable: $ANNOTATION
          pattern-either:
          - pattern: RequestMapping
          - pattern: DeleteMapping
          - pattern: GetMapping
          - pattern: PatchMapping
          - pattern: PostMapping
          - pattern: PutMapping

  - id: pattern.xss
    languages:
      - java
    severity: ERROR
    message: Controller returns an untrusted unvalidated data
    metadata:
      cwe: CWE-79
      license: MIT
      shortDescription: Controller returns an untrusted unvalidated data
    patterns:
      - pattern: |
          @$ANNOTATION(...)
          $RETURNTYPE $METHOD(..., $TYPE $PARAM,...) {
            ...
            return $PARAM;
            ...
          }
      - pattern-not: |
          @$ANNOTATION(...)
          $RETURNTYPE $METHOD(..., $TYPE $PARAM,...) {
            ...
            return HtmlUtils.htmlEscape($PARAM);
            ...
          }
      - metavariable-pattern:
          metavariable: $ANNOTATION
          pattern-either:
          - pattern: RequestMapping
          - pattern: DeleteMapping
          - pattern: GetMapping
          - pattern: PatchMapping
          - pattern: PostMapping
          - pattern: PutMapping
  - id: taint.xss
    languages:
      - java
    severity: ERROR
    message: Controller returns an untrusted unvalidated data
    metadata:
      cwe: CWE-79
      license: MIT
      shortDescription: Controller returns an untrusted unvalidated data
    mode: taint
    options:
      interfile: true
    pattern-sources:
    - patterns:
      - focus-metavariable: $PARAM
      - pattern: |
          @$ANNOTATION(...)
          $RETURNTYPE $METHOD(..., $TYPE $PARAM,...) {
            ...
          }
      - metavariable-pattern:
          metavariable: $ANNOTATION
          pattern-either:
          - pattern: RequestMapping
          - pattern: DeleteMapping
          - pattern: GetMapping
          - pattern: PatchMapping
          - pattern: PostMapping
          - pattern: PutMapping
    pattern-sanitizers:
    - pattern: HtmlUtils.htmlEscape(...)
    pattern-sinks:
    - patterns:
      - focus-metavariable: $SINK
      - pattern: |
          @$ANNOTATION(...)
          $RETURNTYPE $METHOD(...) {
            ...
            return $SINK;
            ...
          }
      - metavariable-pattern:
          metavariable: $ANNOTATION
          pattern-either:
          - pattern: RequestMapping
          - pattern: DeleteMapping
          - pattern: GetMapping
          - pattern: PatchMapping
          - pattern: PostMapping
          - pattern: PutMapping