measure: Semgrep arm on the valid pilot, our rules and facts converted

0 of 12 positives; 12.6 false alarms per 100 ordinary pushes (2.1 on changed lines only). The misses come from what the rules and facts express (access control lives in obligations, which do not convert; sources cover request objects only), not from the engine. Comparison arm only: a Semgrep miss is never evidence against a hunter finding. Co-Authored-By: Claude Opus 5.5 <[email protected]>
2026-10-20 21:49:28 +00:00 · 2026-10-13 13:10:19 +02:00
parent d08dea19b8
commit c5bf52f47d
12 changed files with 4465 additions and 0 deletions
@@ -0,0 +1,679 @@
+rules:
+- id: ousast.javascript.regex.js-command-exec
+  languages:
+  - javascript
+  - typescript
+  severity: WARNING
+  message: Node child_process command execution needs review
+  metadata:
+    family: injection
+    cwe: CWE-78
+    origin: js-command-exec
+    precision_estimate: '0.0'
+    kind: regex
+    tags:
+    - syscall_entry
+    status: enabled
+    version: '1'
+  pattern-regex: \b(exec|execSync)\s*\(
+- id: ousast.javascript.regex.js-deserialize
+  languages:
+  - javascript
+  - typescript
+  severity: WARNING
+  message: JavaScript unsafe deserialization needs review
+  metadata:
+    family: deserialization
+    cwe: CWE-502
+    origin: js-deserialize
+    precision_estimate: '0.0'
+    kind: regex
+    tags:
+    - deserialization
+    status: enabled
+    version: '1'
+  pattern-regex: \b(unserialize)\s*\(
+- id: ousast.javascript.regex.js-dom-xss
+  languages:
+  - javascript
+  - typescript
+  severity: WARNING
+  message: DOM sink with untrusted input needs review
+  metadata:
+    family: output_encoding
+    cwe: CWE-79
+    origin: js-dom-xss
+    precision_estimate: '0.0'
+    kind: regex
+    tags:
+    - injection
+    status: enabled
+    version: '1'
+  pattern-regex: \.(innerHTML|outerHTML)\s*=\s*[^\n]*\b(?:req|request|location|document\.location)
+- id: ousast.javascript.regex.js-eval
+  languages:
+  - javascript
+  - typescript
+  severity: WARNING
+  message: Dynamic JavaScript evaluation needs review
+  metadata:
+    family: injection
+    cwe: CWE-95
+    origin: js-eval
+    precision_estimate: '0.0'
+    kind: regex
+    tags:
+    - syscall_entry
+    status: enabled
+    version: '1'
+  pattern-regex: \b(eval)\s*\(
+- id: ousast.javascript.regex.js-function-constructor
+  languages:
+  - javascript
+  - typescript
+  severity: WARNING
+  message: JavaScript Function constructor needs review
+  metadata:
+    family: injection
+    cwe: CWE-95
+    origin: js-function-constructor
+    precision_estimate: '0.0'
+    kind: regex
+    tags:
+    - syscall_entry
+    status: enabled
+    version: '1'
+  pattern-regex: new\s+(Function)\s*\(
+- id: ousast.javascript.regex.js-path-traversal
+  languages:
+  - javascript
+  - typescript
+  severity: WARNING
+  message: Node filesystem access with external input needs review
+  metadata:
+    family: path
+    cwe: CWE-22
+    origin: js-path-traversal
+    precision_estimate: '0.0'
+    kind: regex
+    tags:
+    - filesystem_entry
+    status: enabled
+    version: '1'
+  pattern-regex: \bfs\.(readFile|readFileSync|writeFile|writeFileSync|createReadStream|unlink|unlinkSync)\s*\(\s*[^\n]*\b(?:req|request)\.
+- id: ousast.javascript.regex.js-spawn-shell
+  languages:
+  - javascript
+  - typescript
+  severity: WARNING
+  message: Node spawn with shell needs review
+  metadata:
+    family: injection
+    cwe: CWE-78
+    origin: js-spawn-shell
+    precision_estimate: '0.0'
+    kind: regex
+    tags:
+    - syscall_entry
+    status: enabled
+    version: '1'
+  pattern-regex: \b(spawn|spawnSync)\s*\([^\n]*shell\s*:\s*true
+- id: ousast.javascript.regex.js-sql-injection
+  languages:
+  - javascript
+  - typescript
+  severity: WARNING
+  message: JavaScript SQL string composition needs review
+  metadata:
+    family: injection
+    cwe: CWE-89
+    origin: js-sql-injection
+    precision_estimate: '0.0'
+    kind: regex
+    tags:
+    - injection
+    status: enabled
+    version: '1'
+  pattern-regex: \.(query|execute)\s*\(\s*[^\n]*(?:\$\{|\+\s*[A-Za-z_$])
+- id: ousast.javascript.regex.js-ssrf
+  languages:
+  - javascript
+  - typescript
+  severity: WARNING
+  message: JavaScript outbound request with external input needs review
+  metadata:
+    family: untrusted_destination
+    cwe: CWE-918
+    origin: js-ssrf
+    precision_estimate: '0.0'
+    kind: regex
+    tags:
+    - network_entry
+    status: enabled
+    version: '1'
+  pattern-regex: \b(axios|fetch|got)\s*[.(][^\n]*\b(?:req|request)\.
+- id: ousast.javascript.regex.js-weak-hash
+  languages:
+  - javascript
+  - typescript
+  severity: WARNING
+  message: JavaScript weak hash needs review
+  metadata:
+    family: config_secrets
+    cwe: CWE-327
+    origin: js-weak-hash
+    precision_estimate: '0.0'
+    kind: regex
+    tags:
+    - crypto
+    status: enabled
+    version: '1'
+  pattern-regex: createHash\s*\(\s*[\"'](md5|sha1)[\"']
+- id: ousast.javascript.regex.js-xss-response
+  languages:
+  - javascript
+  - typescript
+  severity: WARNING
+  message: Unsanitized HTTP response reflection needs review
+  metadata:
+    family: output_encoding
+    cwe: CWE-79
+    origin: js-xss-response
+    precision_estimate: '0.0'
+    kind: regex
+    tags:
+    - injection
+    status: enabled
+    version: '1'
+  pattern-regex: \.(send|write|end)\s*\(\s*[^\n]*\b(?:req|request)\.(?:query|params|body)
+- id: ousast.javascript.taint.eval
+  mode: taint
+  languages: &id001
+  - javascript
+  - typescript
+  severity: ERROR
+  message: 'eval: untrusted input reaches eval'
+  metadata:
+    family: injection
+    cwe: CWE-95
+    origin: sink:javascript:eval
+    precision_estimate: unmeasured
+    kind: taint
+    calls:
+    - eval
+  pattern-sources:
+  - pattern-either: &id002
+    - pattern: req.query
+    - pattern: req.query(...)
+    - pattern: req.body
+    - pattern: req.body(...)
+    - pattern: req.params
+    - pattern: req.params(...)
+    - pattern: req.cookies
+    - pattern: req.cookies(...)
+    - pattern: req.headers
+    - pattern: req.headers(...)
+    - pattern: request.query
+    - pattern: request.query(...)
+    - pattern: req.url
+    - pattern: req.url(...)
+    - pattern: request.url
+    - pattern: request.url(...)
+    - pattern: req.rawHeaders
+    - pattern: req.rawHeaders(...)
+    - pattern: url.parse
+    - pattern: url.parse(...)
+    - pattern: parsedUrl
+    - pattern: $OBJ.parsedUrl
+    - pattern: parsedUrl(...)
+    - pattern: $OBJ.parsedUrl(...)
+  pattern-sinks:
+  - pattern-either:
+    - pattern: eval(...)
+    - pattern: $OBJ.eval(...)
+  pattern-sanitizers:
+  - pattern-either:
+    - &id003
+      pattern: path.normalize(...)
+    - &id004
+      pattern: path.resolve(...)
+    - &id005
+      pattern: encodeURIComponent(...)
+    - &id006
+      pattern: $OBJ.encodeURIComponent(...)
+    - &id007
+      pattern: encodeURI(...)
+    - &id008
+      pattern: $OBJ.encodeURI(...)
+    - &id009
+      pattern: escape(...)
+    - &id010
+      pattern: $OBJ.escape(...)
+    - &id011
+      pattern: escapeHtml(...)
+    - &id012
+      pattern: $OBJ.escapeHtml(...)
+    - &id013
+      pattern: sanitizeHtml(...)
+    - &id014
+      pattern: $OBJ.sanitizeHtml(...)
+    - &id015
+      pattern: DOMPurify.sanitize(...)
+- id: ousast.javascript.taint.exec
+  mode: taint
+  languages: *id001
+  severity: ERROR
+  message: 'exec: untrusted input reaches exec, execSync'
+  metadata:
+    family: injection
+    cwe: CWE-78
+    origin: sink:javascript:exec
+    precision_estimate: unmeasured
+    kind: taint
+    calls:
+    - exec
+    - execSync
+  pattern-sources:
+  - pattern-either: *id002
+  pattern-sinks:
+  - pattern-either:
+    - pattern: exec(...)
+    - pattern: $OBJ.exec(...)
+    - pattern: execSync(...)
+    - pattern: $OBJ.execSync(...)
+  pattern-sanitizers:
+  - pattern-either:
+    - *id003
+    - *id004
+    - *id005
+    - *id006
+    - *id007
+    - *id008
+    - *id009
+    - *id010
+    - *id011
+    - *id012
+    - *id013
+    - *id014
+    - *id015
+- id: ousast.javascript.taint.html-response
+  mode: taint
+  languages: *id001
+  severity: ERROR
+  message: 'html.response: untrusted input reaches res.end, res.send, res.write, response.end, response.send, response.write'
+  metadata:
+    family: output_encoding
+    cwe: CWE-79
+    origin: sink:javascript:html.response
+    precision_estimate: unmeasured
+    kind: taint
+    calls:
+    - res.end
+    - res.send
+    - res.write
+    - response.end
+    - response.send
+    - response.write
+  pattern-sources:
+  - pattern-either: *id002
+  pattern-sinks:
+  - pattern-either:
+    - pattern: res.end(...)
+    - pattern: res.send(...)
+    - pattern: res.write(...)
+    - pattern: response.end(...)
+    - pattern: response.send(...)
+    - pattern: response.write(...)
+  pattern-sanitizers:
+  - pattern-either:
+    - *id003
+    - *id004
+    - *id005
+    - *id006
+    - *id007
+    - *id008
+    - *id009
+    - *id010
+    - *id011
+    - *id012
+    - *id013
+    - *id014
+    - *id015
+- id: ousast.javascript.taint.html-unescaped
+  mode: taint
+  languages: *id001
+  severity: ERROR
+  message: 'html.unescaped: untrusted input reaches dangerouslySetInnerHTML, document.write, innerHTML, insertAdjacentHTML, outerHTML, v-html'
+  metadata:
+    family: output_encoding
+    cwe: CWE-79
+    origin: sink:javascript:html.unescaped
+    precision_estimate: unmeasured
+    kind: taint
+    calls:
+    - dangerouslySetInnerHTML
+    - document.write
+    - innerHTML
+    - insertAdjacentHTML
+    - outerHTML
+    - v-html
+  pattern-sources:
+  - pattern-either: *id002
+  pattern-sinks:
+  - pattern-either:
+    - patterns:
+      - pattern: '{__html: $VALUE}'
+      - focus-metavariable: $VALUE
+    - pattern: document.write(...)
+    - patterns:
+      - pattern: $OBJ.innerHTML = $VALUE
+      - focus-metavariable: $VALUE
+    - pattern: insertAdjacentHTML(...)
+    - pattern: $OBJ.insertAdjacentHTML(...)
+    - patterns:
+      - pattern: $OBJ.outerHTML = $VALUE
+      - focus-metavariable: $VALUE
+  pattern-sanitizers:
+  - pattern-either:
+    - *id003
+    - *id004
+    - *id005
+    - *id006
+    - *id007
+    - *id008
+    - *id009
+    - *id010
+    - *id011
+    - *id012
+    - *id013
+    - *id014
+    - *id015
+- id: ousast.javascript.taint.outbound-request
+  mode: taint
+  languages: *id001
+  severity: ERROR
+  message: 'outbound.request: untrusted input reaches axios, fetch, got, http.get, http.request, https.get, https.request, needle, request, superagent, undici, unirest'
+  metadata:
+    family: untrusted_destination
+    cwe: CWE-918
+    origin: sink:javascript:outbound.request
+    precision_estimate: unmeasured
+    kind: taint
+    calls:
+    - axios
+    - fetch
+    - got
+    - http.get
+    - http.request
+    - https.get
+    - https.request
+    - needle
+    - request
+    - superagent
+    - undici
+    - unirest
+  pattern-sources:
+  - pattern-either: *id002
+  pattern-sinks:
+  - pattern-either:
+    - pattern: axios(...)
+    - pattern: $OBJ.axios(...)
+    - pattern: fetch(...)
+    - pattern: $OBJ.fetch(...)
+    - pattern: got(...)
+    - pattern: $OBJ.got(...)
+    - pattern: http.get(...)
+    - pattern: http.request(...)
+    - pattern: https.get(...)
+    - pattern: https.request(...)
+    - pattern: needle(...)
+    - pattern: $OBJ.needle(...)
+    - pattern: request(...)
+    - pattern: $OBJ.request(...)
+    - pattern: superagent(...)
+    - pattern: $OBJ.superagent(...)
+    - pattern: undici(...)
+    - pattern: $OBJ.undici(...)
+    - pattern: unirest(...)
+    - pattern: $OBJ.unirest(...)
+  pattern-sanitizers:
+  - pattern-either:
+    - *id003
+    - *id004
+    - *id005
+    - *id006
+    - *id007
+    - *id008
+    - *id009
+    - *id010
+    - *id011
+    - *id012
+    - *id013
+    - *id014
+    - *id015
+- id: ousast.javascript.taint.path-open
+  mode: taint
+  languages: *id001
+  severity: ERROR
+  message: 'path.open: untrusted input reaches createReadStream, readFile, readFileSync, sendFile, unlink, unlinkSync'
+  metadata:
+    family: path
+    cwe: CWE-22
+    origin: sink:javascript:path.open
+    precision_estimate: unmeasured
+    kind: taint
+    calls:
+    - createReadStream
+    - readFile
+    - readFileSync
+    - sendFile
+    - unlink
+    - unlinkSync
+  pattern-sources:
+  - pattern-either: *id002
+  pattern-sinks:
+  - pattern-either:
+    - pattern: createReadStream(...)
+    - pattern: $OBJ.createReadStream(...)
+    - pattern: readFile(...)
+    - pattern: $OBJ.readFile(...)
+    - pattern: readFileSync(...)
+    - pattern: $OBJ.readFileSync(...)
+    - pattern: sendFile(...)
+    - pattern: $OBJ.sendFile(...)
+    - pattern: unlink(...)
+    - pattern: $OBJ.unlink(...)
+    - pattern: unlinkSync(...)
+    - pattern: $OBJ.unlinkSync(...)
+  pattern-sanitizers:
+  - pattern-either:
+    - *id003
+    - *id004
+    - *id005
+    - *id006
+    - *id007
+    - *id008
+    - *id009
+    - *id010
+    - *id011
+    - *id012
+    - *id013
+    - *id014
+    - *id015
+- id: ousast.javascript.taint.prototype-merge
+  mode: taint
+  languages: *id001
+  severity: ERROR
+  message: 'prototype.merge: untrusted input reaches Object.assign, defaultsDeep, extend, merge, mergeDeep, set, setWith'
+  metadata:
+    family: prototype
+    cwe: CWE-1321
+    origin: sink:javascript:prototype.merge
+    precision_estimate: unmeasured
+    kind: taint
+    calls:
+    - Object.assign
+    - defaultsDeep
+    - extend
+    - merge
+    - mergeDeep
+    - set
+    - setWith
+  pattern-sources:
+  - pattern-either: *id002
+  pattern-sinks:
+  - pattern-either:
+    - pattern: Object.assign(...)
+    - pattern: defaultsDeep(...)
+    - pattern: $OBJ.defaultsDeep(...)
+    - pattern: extend(...)
+    - pattern: $OBJ.extend(...)
+    - pattern: merge(...)
+    - pattern: $OBJ.merge(...)
+    - pattern: mergeDeep(...)
+    - pattern: $OBJ.mergeDeep(...)
+    - pattern: set(...)
+    - pattern: $OBJ.set(...)
+    - pattern: setWith(...)
+    - pattern: $OBJ.setWith(...)
+  pattern-sanitizers:
+  - pattern-either:
+    - *id003
+    - *id004
+    - *id005
+    - *id006
+    - *id007
+    - *id008
+    - *id009
+    - *id010
+    - *id011
+    - *id012
+    - *id013
+    - *id014
+    - *id015
+- id: ousast.javascript.taint.query
+  mode: taint
+  languages: *id001
+  severity: ERROR
+  message: 'query: untrusted input reaches execute, query'
+  metadata:
+    family: injection
+    cwe: CWE-89
+    origin: sink:javascript:query
+    precision_estimate: unmeasured
+    kind: taint
+    calls:
+    - execute
+    - query
+  pattern-sources:
+  - pattern-either: *id002
+  pattern-sinks:
+  - pattern-either:
+    - patterns:
+      - pattern: execute($QUERY)
+      - focus-metavariable: $QUERY
+    - patterns:
+      - pattern: $OBJ.execute($QUERY)
+      - focus-metavariable: $QUERY
+    - patterns:
+      - pattern: query($QUERY)
+      - focus-metavariable: $QUERY
+    - patterns:
+      - pattern: $OBJ.query($QUERY)
+      - focus-metavariable: $QUERY
+  pattern-sanitizers:
+  - pattern-either:
+    - *id003
+    - *id004
+    - *id005
+    - *id006
+    - *id007
+    - *id008
+    - *id009
+    - *id010
+    - *id011
+    - *id012
+    - *id013
+    - *id014
+    - *id015
+- id: ousast.javascript.taint.redirect
+  mode: taint
+  languages: *id001
+  severity: ERROR
+  message: 'redirect: untrusted input reaches location.assign, location.replace, redirect'
+  metadata:
+    family: untrusted_destination
+    cwe: CWE-601
+    origin: sink:javascript:redirect
+    precision_estimate: unmeasured
+    kind: taint
+    calls:
+    - location.assign
+    - location.replace
+    - redirect
+  pattern-sources:
+  - pattern-either: *id002
+  pattern-sinks:
+  - pattern-either:
+    - pattern: location.assign(...)
+    - pattern: location.replace(...)
+    - pattern: redirect(...)
+    - pattern: $OBJ.redirect(...)
+  pattern-sanitizers:
+  - pattern-either:
+    - *id003
+    - *id004
+    - *id005
+    - *id006
+    - *id007
+    - *id008
+    - *id009
+    - *id010
+    - *id011
+    - *id012
+    - *id013
+    - *id014
+    - *id015
+- id: ousast.javascript.taint.vm-eval
+  mode: taint
+  languages: *id001
+  severity: ERROR
+  message: 'vm.eval: untrusted input reaches compileFunction, runInContext, runInNewContext, runInThisContext'
+  metadata:
+    family: injection
+    cwe: CWE-95
+    origin: sink:javascript:vm.eval
+    precision_estimate: unmeasured
+    kind: taint
+    calls:
+    - compileFunction
+    - runInContext
+    - runInNewContext
+    - runInThisContext
+  pattern-sources:
+  - pattern-either: *id002
+  pattern-sinks:
+  - pattern-either:
+    - pattern: compileFunction(...)
+    - pattern: $OBJ.compileFunction(...)
+    - pattern: runInContext(...)
+    - pattern: $OBJ.runInContext(...)
+    - pattern: runInNewContext(...)
+    - pattern: $OBJ.runInNewContext(...)
+    - pattern: runInThisContext(...)
+    - pattern: $OBJ.runInThisContext(...)
+  pattern-sanitizers:
+  - pattern-either:
+    - *id003
+    - *id004
+    - *id005
+    - *id006
+    - *id007
+    - *id008
+    - *id009
+    - *id010
+    - *id011
+    - *id012
+    - *id013
+    - *id014
+    - *id015