Skip to content

Commit 3f81277

Browse files
fix it
1 parent ebd7b1c commit 3f81277

3 files changed

Lines changed: 34446 additions & 146 deletions

File tree

integration-tests/config-discover/expected/tools-configs/semgrep.yaml

Lines changed: 0 additions & 61 deletions
Original file line numberDiff line numberDiff line change
@@ -7290,67 +7290,6 @@ rules:
72907290
exports.handler = $FUNC
72917291
- pattern: $EVENT
72927292
severity: WARNING
7293-
- id: javascript.aws-lambda.security.tainted-sql-string.tainted-sql-string
7294-
languages:
7295-
- javascript
7296-
- typescript
7297-
message: Detected user input used to manually construct a SQL string. This is usually bad practice because manual construction could accidentally result in a SQL injection. An attacker could use a SQL injection to steal or modify contents of the database. Instead, use a parameterized query which is available by default in most database engines. Alternatively, consider using an object-relational mapper (ORM) such as Sequelize which will protect your queries.
7298-
metadata:
7299-
category: security
7300-
confidence: MEDIUM
7301-
cwe:
7302-
- 'CWE-89: Improper Neutralization of Special Elements used in an SQL Command (''SQL Injection'')'
7303-
cwe2021-top25: true
7304-
cwe2022-top25: true
7305-
impact: MEDIUM
7306-
likelihood: LOW
7307-
owasp:
7308-
- A01:2017 - Injection
7309-
- A03:2021 - Injection
7310-
references:
7311-
- https://owasp.org/www-community/attacks/SQL_Injection
7312-
subcategory:
7313-
- vuln
7314-
technology:
7315-
- aws-lambda
7316-
mode: taint
7317-
pattern-sinks:
7318-
- patterns:
7319-
- pattern-either:
7320-
- patterns:
7321-
- pattern-either:
7322-
- pattern: |
7323-
"$SQLSTR" + $EXPR
7324-
- pattern: |
7325-
"$SQLSTR".concat(...)
7326-
- pattern: util.format($SQLSTR, ...)
7327-
- metavariable-regex:
7328-
metavariable: $SQLSTR
7329-
regex: .*\b(?i)(select|delete|insert|create|update|alter|drop)\b.*
7330-
- patterns:
7331-
- pattern: |
7332-
`...${...}...`
7333-
- pattern-regex: |
7334-
.*\b(?i)(select|delete|insert|create|update|alter|drop)\b.*
7335-
- pattern-not-inside: |
7336-
console.$LOG(...)
7337-
pattern-sources:
7338-
- patterns:
7339-
- pattern-either:
7340-
- pattern-inside: |
7341-
exports.handler = function ($EVENT, ...) {
7342-
...
7343-
}
7344-
- pattern-inside: |
7345-
function $FUNC ($EVENT, ...) {...}
7346-
...
7347-
exports.handler = $FUNC
7348-
- pattern-inside: |
7349-
$FUNC = function ($EVENT, ...) {...}
7350-
...
7351-
exports.handler = $FUNC
7352-
- pattern: $EVENT
7353-
severity: ERROR
73547293
- id: javascript.aws-lambda.security.vm-runincontext-injection.vm-runincontext-injection
73557294
languages:
73567295
- javascript

0 commit comments

Comments
 (0)