Open_Ultra_SAST/benchmarks/measurements/2026-10-13-semgrep-arm/rules/java.yaml

rules:
- id: ousast.java.regex.java-command-exec
  languages:
  - java
  severity: WARNING
  message: Java runtime command execution needs review
  metadata:
    family: injection
    cwe: CWE-78
    origin: java-command-exec
    precision_estimate: '0.0'
    kind: regex
    tags:
    - syscall_entry
    status: enabled
    version: '1'
  pattern-regex: \b(exec)\s*\(
- id: ousast.java.regex.java-deserialization
  languages:
  - java
  severity: WARNING
  message: Java unsafe deserialization needs review
  metadata:
    family: deserialization
    cwe: CWE-502
    origin: java-deserialization
    precision_estimate: '0.0'
    kind: regex
    tags:
    - deserialization
    status: enabled
    version: '1'
  pattern-regex: \.(readObject)\s*\(
- id: ousast.java.regex.java-sql-injection
  languages:
  - java
  severity: WARNING
  message: Java SQL string composition needs review
  metadata:
    family: injection
    cwe: CWE-89
    origin: java-sql-injection
    precision_estimate: '0.0'
    kind: regex
    tags:
    - injection
    status: enabled
    version: '1'
  pattern-regex: (?i)\"\s*(select|insert|update|delete)\b[^\"]*\"\s*\+
- id: ousast.java.regex.java-weak-hash
  languages:
  - java
  severity: WARNING
  message: Java weak hash needs review
  metadata:
    family: config_secrets
    cwe: CWE-327
    origin: java-weak-hash
    precision_estimate: '0.0'
    kind: regex
    tags:
    - crypto
    status: enabled
    version: '1'
  pattern-regex: MessageDigest\.getInstance\s*\(\s*\"(MD5|SHA-1)\"
- id: ousast.java.weak.MessageDigest
  languages: &id001
  - java
  severity: WARNING
  message: 'MessageDigest: a weak literal reaches getInstance'
  metadata:
    family: config_secrets
    cwe: CWE-327
    origin: sink:java:MessageDigest
    precision_estimate: unmeasured
    kind: weak_literal
    weak_literals:
    - MD5
    - SHA-1
    - SHA1
  pattern-either:
  - patterns:
    - pattern: getInstance($ALGORITHM, ...)
    - metavariable-regex:
        metavariable: $ALGORITHM
        regex: ^["']?(MD5|SHA\-1|SHA1)["']?$
  - patterns:
    - pattern: $OBJ.getInstance($ALGORITHM, ...)
    - metavariable-regex:
        metavariable: $ALGORITHM
        regex: ^["']?(MD5|SHA\-1|SHA1)["']?$
- id: ousast.java.taint.exec
  mode: taint
  languages: *id001
  severity: ERROR
  message: 'exec: untrusted input reaches exec'
  metadata:
    family: injection
    cwe: CWE-78
    origin: sink:java:exec
    precision_estimate: unmeasured
    kind: taint
    calls:
    - exec
  pattern-sources:
  - pattern-either: &id002
    - pattern: getParameter
    - pattern: $OBJ.getParameter
    - pattern: getParameter(...)
    - pattern: $OBJ.getParameter(...)
    - pattern: getHeader
    - pattern: $OBJ.getHeader
    - pattern: getHeader(...)
    - pattern: $OBJ.getHeader(...)
    - pattern: getCookies
    - pattern: $OBJ.getCookies
    - pattern: getCookies(...)
    - pattern: $OBJ.getCookies(...)
    - pattern: getQueryString
    - pattern: $OBJ.getQueryString
    - pattern: getQueryString(...)
    - pattern: $OBJ.getQueryString(...)
    - pattern: readLine
    - pattern: $OBJ.readLine
    - pattern: readLine(...)
    - pattern: $OBJ.readLine(...)
  pattern-sinks:
  - pattern-either:
    - pattern: exec(...)
    - pattern: $OBJ.exec(...)
  pattern-sanitizers:
  - pattern-either:
    - &id003
      pattern: getCanonicalPath(...)
    - &id004
      pattern: $OBJ.getCanonicalPath(...)
    - &id005
      pattern: normalize(...)
    - &id006
      pattern: $OBJ.normalize(...)
    - &id007
      pattern: URLEncoder.encode(...)
    - &id008
      pattern: ESAPI.encoder(...)
    - &id009
      pattern: encodeForHTML(...)
    - &id010
      pattern: $OBJ.encodeForHTML(...)
    - &id011
      pattern: encodeForURL(...)
    - &id012
      pattern: $OBJ.encodeForURL(...)
    - &id013
      pattern: StringEscapeUtils.escapeHtml4(...)
- id: ousast.java.taint.executeQuery
  mode: taint
  languages: *id001
  severity: ERROR
  message: 'executeQuery: untrusted input reaches execute, executeQuery, prepareCall'
  metadata:
    family: injection
    cwe: CWE-89
    origin: sink:java:executeQuery
    precision_estimate: unmeasured
    kind: taint
    calls:
    - execute
    - executeQuery
    - prepareCall
  pattern-sources:
  - pattern-either: *id002
  pattern-sinks:
  - pattern-either:
    - pattern: execute(...)
    - pattern: $OBJ.execute(...)
    - pattern: executeQuery(...)
    - pattern: $OBJ.executeQuery(...)
    - pattern: prepareCall(...)
    - pattern: $OBJ.prepareCall(...)
  pattern-sanitizers:
  - pattern-either:
    - *id003
    - *id004
    - *id005
    - *id006
    - *id007
    - *id008
    - *id009
    - *id010
    - *id011
    - *id012
    - *id013
- id: ousast.java.taint.file-open
  mode: taint
  languages: *id001
  severity: ERROR
  message: 'file.open: untrusted input reaches File, FileInputStream, FileOutputStream, FileReader, FileWriter, Files.newInputStream, Files.readAllBytes, Paths.get, RandomAccessFile'
  metadata:
    family: path
    cwe: CWE-22
    origin: sink:java:file.open
    precision_estimate: unmeasured
    kind: taint
    calls:
    - File
    - FileInputStream
    - FileOutputStream
    - FileReader
    - FileWriter
    - Files.newInputStream
    - Files.readAllBytes
    - Paths.get
    - RandomAccessFile
  pattern-sources:
  - pattern-either: *id002
  pattern-sinks:
  - pattern-either:
    - pattern: new File(...)
    - pattern: new FileInputStream(...)
    - pattern: new FileOutputStream(...)
    - pattern: new FileReader(...)
    - pattern: new FileWriter(...)
    - pattern: Files.newInputStream(...)
    - pattern: Files.readAllBytes(...)
    - pattern: Paths.get(...)
    - pattern: new RandomAccessFile(...)
  pattern-sanitizers:
  - pattern-either:
    - *id003
    - *id004
    - *id005
    - *id006
    - *id007
    - *id008
    - *id009
    - *id010
    - *id011
    - *id012
    - *id013
- id: ousast.java.taint.outbound-request
  mode: taint
  languages: *id001
  severity: ERROR
  message: 'outbound.request: untrusted input reaches exchange, getForObject, openConnection, openStream, sendRedirect'
  metadata:
    family: untrusted_destination
    cwe: CWE-918
    origin: sink:java:outbound.request
    precision_estimate: unmeasured
    kind: taint
    calls:
    - exchange
    - getForObject
    - openConnection
    - openStream
    - sendRedirect
  pattern-sources:
  - pattern-either: *id002
  pattern-sinks:
  - pattern-either:
    - pattern: exchange(...)
    - pattern: $OBJ.exchange(...)
    - pattern: getForObject(...)
    - pattern: $OBJ.getForObject(...)
    - pattern: openConnection(...)
    - pattern: $OBJ.openConnection(...)
    - pattern: openStream(...)
    - pattern: $OBJ.openStream(...)
    - pattern: sendRedirect(...)
    - pattern: $OBJ.sendRedirect(...)
  pattern-sanitizers:
  - pattern-either:
    - *id003
    - *id004
    - *id005
    - *id006
    - *id007
    - *id008
    - *id009
    - *id010
    - *id011
    - *id012
    - *id013
- id: ousast.java.taint.readObject
  mode: taint
  languages: *id001
  severity: ERROR
  message: 'readObject: untrusted input reaches readObject'
  metadata:
    family: deserialization
    cwe: CWE-502
    origin: sink:java:readObject
    precision_estimate: unmeasured
    kind: taint
    calls:
    - readObject
  pattern-sources:
  - pattern-either: *id002
  pattern-sinks:
  - pattern-either:
    - pattern: readObject(...)
    - pattern: $OBJ.readObject(...)
  pattern-sanitizers:
  - pattern-either:
    - *id003
    - *id004
    - *id005
    - *id006
    - *id007
    - *id008
    - *id009
    - *id010
    - *id011
    - *id012
    - *id013
- id: ousast.java.taint.response-write
  mode: taint
  languages: *id001
  severity: ERROR
  message: 'response.write: untrusted input reaches addHeader, getWriter, print, println, setHeader, write'
  metadata:
    family: output_encoding
    cwe: CWE-79
    origin: sink:java:response.write
    precision_estimate: unmeasured
    kind: taint
    calls:
    - addHeader
    - getWriter
    - print
    - println
    - setHeader
    - write
  pattern-sources:
  - pattern-either: *id002
  pattern-sinks:
  - pattern-either:
    - pattern: addHeader(...)
    - pattern: $OBJ.addHeader(...)
    - pattern: getWriter(...)
    - pattern: $OBJ.getWriter(...)
    - pattern: print(...)
    - pattern: $OBJ.print(...)
    - pattern: println(...)
    - pattern: $OBJ.println(...)
    - pattern: setHeader(...)
    - pattern: $OBJ.setHeader(...)
    - pattern: write(...)
    - pattern: $OBJ.write(...)
  pattern-sanitizers:
  - pattern-either:
    - *id003
    - *id004
    - *id005
    - *id006
    - *id007
    - *id008
    - *id009
    - *id010
    - *id011
    - *id012
    - *id013