skills/semgrep__skills
1
0
Fork 0
mirror of https://github.com/semgrep/skills.git synced 2026-09-20 14:21:26 +08:00
Code Issues Packages Projects Releases Wiki Activity
Files
823e429b925299fb625df9205b94778db461e099
semgrep__skills/packages/skill-build/test-cases-code-security.json
T
Drew Dennison 823e429b92 Add llm-security skill and make build tooling generic 
- Add llm-security skill covering OWASP Top 10 for LLM Applications 2025
  - 10 rules: Prompt Injection, Sensitive Disclosure, Supply Chain,
    Data Poisoning, Output Handling, Excessive Agency, System Prompt
    Leakage, Vector/Embedding Weaknesses, Misinformation, Unbounded
    Consumption
  - Python code examples with vulnerable/secure patterns

- Rename packages/code-security-build to packages/skill-build
  - Accept skill name as CLI argument: `pnpm validate llm-security`
  - Auto-discover skills with rules/ directories
  - Support Vulnerable/Secure labels (in addition to Incorrect/Correct)

- Update Makefile to build all skills automatically
  - `make validate` - validates all skills
  - `make build` - builds AGENTS.md for all skills
  - `make validate-skill SKILL=name` - single skill operations

- Update READMEs with llm-security documentation

Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>
2026-01-15 14:59:55 -08:00

2914 lines
135 KiB
JSON
Raw Blame History

[
{
"ruleId": "",
"ruleTitle": "Secure JWT Authentication",
"type": "bad",
"code": "const jwt = require('jsonwebtoken');\n\nfunction getUserData(token) {\n const decoded = jwt.decode(token, true);\n if (decoded.isAdmin) {\n return getAdminData();\n }\n}",
"language": "javascript",
"description": "JavaScript jsonwebtoken - decode without verify"
},
{
"ruleId": "",
"ruleTitle": "Secure JWT Authentication",
"type": "good",
"code": "const jwt = require('jsonwebtoken');\n\nfunction getUserData(token, secretKey) {\n jwt.verify(token, secretKey);\n const decoded = jwt.decode(token, true);\n if (decoded.isAdmin) {\n return getAdminData();\n }\n}",
"language": "javascript",
"description": "JavaScript jsonwebtoken - verify before decode"
},
{
"ruleId": "",
"ruleTitle": "Secure JWT Authentication",
"type": "bad",
"code": "import jwt\n\ndef get_user_claims(token, key):\n decoded = jwt.decode(token, key, options={\"verify_signature\": False})\n return decoded",
"language": "python",
"description": "Python PyJWT - verify_signature disabled"
},
{
"ruleId": "",
"ruleTitle": "Secure JWT Authentication",
"type": "good",
"code": "import jwt\n\ndef get_user_claims(token, key):\n decoded = jwt.decode(token, key, algorithms=[\"HS256\"])\n return decoded",
"language": "python",
"description": "Python PyJWT - verify_signature enabled"
},
{
"ruleId": "",
"ruleTitle": "Secure JWT Authentication",
"type": "bad",
"code": "import com.auth0.jwt.JWT;\nimport com.auth0.jwt.interfaces.DecodedJWT;\n\npublic class TokenHandler {\n public DecodedJWT getUserClaims(String token) {\n DecodedJWT jwt = JWT.decode(token);\n return jwt;\n }\n}",
"language": "java",
"description": "Java auth0 java-jwt - decode without verify"
},
{
"ruleId": "",
"ruleTitle": "Secure JWT Authentication",
"type": "good",
"code": "import com.auth0.jwt.JWT;\nimport com.auth0.jwt.algorithms.Algorithm;\nimport com.auth0.jwt.interfaces.DecodedJWT;\nimport com.auth0.jwt.interfaces.JWTVerifier;\n\npublic class TokenHandler {\n public DecodedJWT getUserClaims(String token, String secret) {\n Algorithm algorithm = Algorithm.HMAC256(secret);\n JWTVerifier verifier = JWT.require(algorithm)\n .withIssuer(\"auth0\")\n .build();\n DecodedJWT jwt = verifier.verify(token);\n return jwt;\n }\n}",
"language": "java",
"description": "Java auth0 java-jwt - verify before use"
},
{
"ruleId": "",
"ruleTitle": "Code Best Practices",
"type": "bad",
"code": "def func1():\n fd = open('foo')\n x = 123",
"language": "python",
"description": "Python"
},
{
"ruleId": "",
"ruleTitle": "Code Best Practices",
"type": "good",
"code": "def func2():\n with open('bar', encoding='utf-8') as fd:\n data = fd.read()",
"language": "python",
"description": "Python - using context manager"
},
{
"ruleId": "",
"ruleTitle": "Code Best Practices",
"type": "bad",
"code": "fd = open('foo', mode=\"w\")",
"language": "python",
"description": "Incorrect example for Code Best Practices"
},
{
"ruleId": "",
"ruleTitle": "Code Best Practices",
"type": "good",
"code": "fd = open('foo', encoding='utf-8', mode=\"w\")",
"language": "python",
"description": "Correct example for Code Best Practices"
},
{
"ruleId": "",
"ruleTitle": "Code Best Practices",
"type": "bad",
"code": "import requests\nr = requests.get(url)",
"language": "python",
"description": "Python"
},
{
"ruleId": "",
"ruleTitle": "Code Best Practices",
"type": "good",
"code": "r = requests.get(url, timeout=30)",
"language": "python",
"description": "Python"
},
{
"ruleId": "",
"ruleTitle": "Code Best Practices",
"type": "bad",
"code": "var name = prompt('what is your name');\nalert('your name is ' + name);\ndebugger;",
"language": "javascript",
"description": "JavaScript"
},
{
"ruleId": "",
"ruleTitle": "Code Best Practices",
"type": "bad",
"code": "function smth() {\n const mod = require('module-name')\n return mod();\n}",
"language": "javascript",
"description": "JavaScript"
},
{
"ruleId": "",
"ruleTitle": "Code Best Practices",
"type": "good",
"code": "const mod = require('module-name')\nfunction smth() {\n return mod();\n}",
"language": "javascript",
"description": "JavaScript"
},
{
"ruleId": "",
"ruleTitle": "Code Best Practices",
"type": "bad",
"code": "with open('/tmp/myfile.txt', 'w') as f:\n f.write(data)",
"language": "python",
"description": "Python"
},
{
"ruleId": "",
"ruleTitle": "Code Best Practices",
"type": "good",
"code": "import tempfile\nwith tempfile.NamedTemporaryFile(mode='w', delete=False) as f:\n f.write(data)",
"language": "python",
"description": "Python"
},
{
"ruleId": "",
"ruleTitle": "Code Best Practices",
"type": "bad",
"code": "res.cookie('session', value);",
"language": "javascript",
"description": "JavaScript/Express"
},
{
"ruleId": "",
"ruleTitle": "Code Best Practices",
"type": "good",
"code": "res.cookie('session', value, { httpOnly: true, secure: true });",
"language": "javascript",
"description": "JavaScript/Express"
},
{
"ruleId": "",
"ruleTitle": "Code Best Practices",
"type": "bad",
"code": "res.redirect(req.query.returnUrl);",
"language": "javascript",
"description": "JavaScript"
},
{
"ruleId": "",
"ruleTitle": "Code Best Practices",
"type": "good",
"code": "const allowedHosts = ['example.com'];\nconst url = new URL(req.query.returnUrl, 'https://example.com');\nif (allowedHosts.includes(url.hostname)) {\n res.redirect(url.href);\n}",
"language": "javascript",
"description": "JavaScript"
},
{
"ruleId": "",
"ruleTitle": "Code Best Practices",
"type": "bad",
"code": "import moment from 'moment';",
"language": "javascript",
"description": "JavaScript - Moment.js is deprecated"
},
{
"ruleId": "",
"ruleTitle": "Code Best Practices",
"type": "good",
"code": "import dayjs from 'dayjs';",
"language": "javascript",
"description": "JavaScript - use dayjs"
},
{
"ruleId": "",
"ruleTitle": "Prevent Code Injection",
"type": "bad",
"code": "def unsafe(request):\n code = request.POST.get('code')\n eval(code)",
"language": "python",
"description": "Python - eval with user input"
},
{
"ruleId": "",
"ruleTitle": "Prevent Code Injection",
"type": "good",
"code": "eval(\"x = 1; x = x + 2\")\n\nblah = \"import requests; r = requests.get('https://example.com')\"\neval(blah)",
"language": "python",
"description": "Python - static eval with hardcoded strings"
},
{
"ruleId": "",
"ruleTitle": "Prevent Code Injection",
"type": "bad",
"code": "let dynamic = window.prompt()\n\neval(dynamic + 'possibly malicious code');\n\nfunction evalSomething(something) {\n eval(something);\n}",
"language": "javascript",
"description": "JavaScript - eval with dynamic content"
},
{
"ruleId": "",
"ruleTitle": "Prevent Code Injection",
"type": "good",
"code": "eval('var x = \"static strings are okay\";');\n\nconst constVar = \"function staticStrings() { return 'static strings are okay';}\";\neval(constVar);",
"language": "javascript",
"description": "JavaScript - static eval strings"
},
{
"ruleId": "",
"ruleTitle": "Prevent Code Injection",
"type": "bad",
"code": "public class ScriptEngineSample {\n\n private static ScriptEngineManager sem = new ScriptEngineManager();\n private static ScriptEngine se = sem.getEngineByExtension(\"js\");\n\n public static void scripting(String userInput) throws ScriptException {\n Object result = se.eval(\"test=1;\" + userInput);\n }\n}",
"language": "java",
"description": "Java - ScriptEngine injection"
},
{
"ruleId": "",
"ruleTitle": "Prevent Code Injection",
"type": "good",
"code": "public class ScriptEngineSample {\n\n public static void scriptingSafe() throws ScriptException {\n ScriptEngineManager scriptEngineManager = new ScriptEngineManager();\n ScriptEngine scriptEngine = scriptEngineManager.getEngineByExtension(\"js\");\n String code = \"var test=3;test=test*2;\";\n Object result = scriptEngine.eval(code);\n }\n}",
"language": "java",
"description": "Java - static ScriptEngine evaluation"
},
{
"ruleId": "",
"ruleTitle": "Prevent Code Injection",
"type": "bad",
"code": "b = params['something']\neval(b)\neval(params['cmd'])",
"language": "ruby",
"description": "Ruby - dangerous eval"
},
{
"ruleId": "",
"ruleTitle": "Prevent Code Injection",
"type": "good",
"code": "eval(\"def zen; 42; end\")\n\nclass Thing\nend\na = %q{def hello() \"Hello there!\" end}\nThing.module_eval(a)",
"language": "ruby",
"description": "Ruby - static eval"
},
{
"ruleId": "",
"ruleTitle": "Prevent Code Injection",
"type": "bad",
"code": "exec($user_input);\npassthru($user_input);\n$output = shell_exec($user_input);\n$output = system($user_input, $retval);\n\n$username = $_COOKIE['username'];\nexec(\"wto -n \\\"$username\\\" -g\", $ret);",
"language": "php",
"description": "PHP - dangerous exec functions with user input"
},
{
"ruleId": "",
"ruleTitle": "Prevent Code Injection",
"type": "good",
"code": "exec('whoami');\n\n$fullpath = $_POST['fullpath'];\n$filesize = trim(shell_exec('stat -c %s ' . escapeshellarg($fullpath)));",
"language": "php",
"description": "PHP - static commands with escapeshellarg"
},
{
"ruleId": "",
"ruleTitle": "Prevent Command Injection",
"type": "bad",
"code": "import subprocess\nimport flask\n\napp = flask.Flask(__name__)\n\n@app.route(\"/ping\")\ndef ping():\n ip = flask.request.args.get(\"ip\")\n subprocess.run(\"ping \" + ip, shell=True)",
"language": "python",
"description": "vulnerable to command injection via subprocess"
},
{
"ruleId": "",
"ruleTitle": "Prevent Command Injection",
"type": "good",
"code": "import subprocess\nimport flask\n\napp = flask.Flask(__name__)\n\n@app.route(\"/ping\")\ndef ping():\n ip = flask.request.args.get(\"ip\")\n subprocess.run([\"ping\", ip])",
"language": "python",
"description": "use array form without shell=True"
},
{
"ruleId": "",
"ruleTitle": "Prevent Command Injection",
"type": "bad",
"code": "const { exec } = require('child_process');\n\nfunction runCommand(userInput) {\n exec(`cat ${userInput}`, (error, stdout, stderr) => {\n console.log(stdout);\n });\n}",
"language": "javascript",
"description": "vulnerable child_process with user input"
},
{
"ruleId": "",
"ruleTitle": "Prevent Command Injection",
"type": "good",
"code": "const { spawn } = require('child_process');\n\nfunction runCommand(userInput) {\n const proc = spawn('cat', [userInput]);\n proc.stdout.on('data', (data) => {\n console.log(data.toString());\n });\n}",
"language": "javascript",
"description": "use spawn with array arguments"
},
{
"ruleId": "",
"ruleTitle": "Prevent Command Injection",
"type": "bad",
"code": "public class CommandRunner {\n\n public void runCommand(String userInput) throws IOException {\n String[] cmd = {\"/bin/bash\", \"-c\", userInput};\n ProcessBuilder builder = new ProcessBuilder(cmd);\n Process proc = builder.start();\n }\n}",
"language": "java",
"description": "ProcessBuilder with user input via shell"
},
{
"ruleId": "",
"ruleTitle": "Prevent Command Injection",
"type": "good",
"code": "public class CommandRunner {\n\n public void runCommand(String filename) throws IOException {\n ProcessBuilder builder = new ProcessBuilder(\"cat\", filename);\n Process proc = builder.start();\n }\n}",
"language": "java",
"description": "use ProcessBuilder with array arguments, no shell"
},
{
"ruleId": "",
"ruleTitle": "Prevent Command Injection",
"type": "bad",
"code": "import (\n \"fmt\"\n \"os/exec\"\n)\n\nfunc runCommand(userInput string) {\n cmd := exec.Command(\"bash\")\n cmdWriter, _ := cmd.StdinPipe()\n cmd.Start()\n\n cmdString := fmt.Sprintf(\"echo %s\", userInput)\n cmdWriter.Write([]byte(cmdString + \"\\n\"))\n\n cmd.Wait()\n}",
"language": "go",
"description": "dangerous command with user input via stdin"
},
{
"ruleId": "",
"ruleTitle": "Prevent Command Injection",
"type": "good",
"code": "import (\n \"os/exec\"\n)\n\nfunc runCommand(filename string) {\n cmd := exec.Command(\"cat\", filename)\n output, _ := cmd.Output()\n println(string(output))\n}",
"language": "go",
"description": "use exec.Command with explicit arguments"
},
{
"ruleId": "",
"ruleTitle": "Prevent Command Injection",
"type": "bad",
"code": "require 'shell'\n\ndef read_file(params)\n Shell.cat(params[:filename])\nend",
"language": "ruby",
"description": "Shell methods with tainted input"
},
{
"ruleId": "",
"ruleTitle": "Prevent Command Injection",
"type": "good",
"code": "require 'shell'\n\ndef read_log\n Shell.cat(\"/var/log/www/access.log\")\nend",
"language": "ruby",
"description": "use hardcoded or validated paths"
},
{
"ruleId": "",
"ruleTitle": "Code Correctness",
"type": "bad",
"code": "def append_func(default=[]):\n default.append(5)",
"language": "python",
"description": "INCORRECT example for Code Correctness"
},
{
"ruleId": "",
"ruleTitle": "Code Correctness",
"type": "good",
"code": "def append_func(default=None):\n if default is None:\n default = []\n default.append(5)",
"language": "python",
"description": "CORRECT example for Code Correctness"
},
{
"ruleId": "",
"ruleTitle": "Code Correctness",
"type": "bad",
"code": "items = [1, 2, 3, 4]\nfor i in items:\n items.pop(0)",
"language": "python",
"description": "INCORRECT example for Code Correctness"
},
{
"ruleId": "",
"ruleTitle": "Code Correctness",
"type": "good",
"code": "for i in list(items): # Iterate over a copy\n items.pop(0)",
"language": "python",
"description": "CORRECT example for Code Correctness"
},
{
"ruleId": "",
"ruleTitle": "Code Correctness",
"type": "bad",
"code": "try:\n raise ValueError()\nfinally:\n break # Suppresses the exception!",
"language": "python",
"description": "INCORRECT example for Code Correctness"
},
{
"ruleId": "",
"ruleTitle": "Code Correctness",
"type": "bad",
"code": "raise \"error\"",
"language": "python",
"description": "INCORRECT example for Code Correctness"
},
{
"ruleId": "",
"ruleTitle": "Code Correctness",
"type": "good",
"code": "raise Exception(\"error\")",
"language": "python",
"description": "CORRECT example for Code Correctness"
},
{
"ruleId": "",
"ruleTitle": "Code Correctness",
"type": "bad",
"code": "bad = [\"a\" \"b\" \"c\"] # Results in [\"abc\"]",
"language": "python",
"description": "INCORRECT example for Code Correctness"
},
{
"ruleId": "",
"ruleTitle": "Code Correctness",
"type": "good",
"code": "good = [\"a\", \"b\", \"c\"]",
"language": "python",
"description": "CORRECT example for Code Correctness"
},
{
"ruleId": "",
"ruleTitle": "Code Correctness",
"type": "bad",
"code": "return `value is {x}` // Missing $",
"language": "javascript",
"description": "INCORRECT example for Code Correctness"
},
{
"ruleId": "",
"ruleTitle": "Code Correctness",
"type": "good",
"code": "return `value is ${x}`",
"language": "javascript",
"description": "CORRECT example for Code Correctness"
},
{
"ruleId": "",
"ruleTitle": "Code Correctness",
"type": "bad",
"code": "for _, val := range values {\n funcs = append(funcs, func() {\n fmt.Println(&val) // Same pointer for all!\n })\n}",
"language": "go",
"description": "INCORRECT example for Code Correctness"
},
{
"ruleId": "",
"ruleTitle": "Code Correctness",
"type": "good",
"code": "for _, val := range values {\n val := val // Create new variable\n funcs = append(funcs, func() {\n fmt.Println(&val)\n })\n}",
"language": "go",
"description": "CORRECT example for Code Correctness"
},
{
"ruleId": "",
"ruleTitle": "Code Correctness",
"type": "bad",
"code": "bigValue, _ := strconv.Atoi(\"2147483648\")\nvalue := int16(bigValue) // Overflow!",
"language": "go",
"description": "INCORRECT example for Code Correctness"
},
{
"ruleId": "",
"ruleTitle": "Code Correctness",
"type": "bad",
"code": "if (a == \"hello\") return 1;",
"language": "java",
"description": "INCORRECT example for Code Correctness"
},
{
"ruleId": "",
"ruleTitle": "Code Correctness",
"type": "good",
"code": "if (\"hello\".equals(a)) return 1;",
"language": "java",
"description": "CORRECT example for Code Correctness"
},
{
"ruleId": "",
"ruleTitle": "Code Correctness",
"type": "bad",
"code": "if (myBoolean = true) { // Assignment, not comparison!",
"language": "java",
"description": "INCORRECT example for Code Correctness"
},
{
"ruleId": "",
"ruleTitle": "Code Correctness",
"type": "good",
"code": "if (myBoolean) {",
"language": "java",
"description": "CORRECT example for Code Correctness"
},
{
"ruleId": "",
"ruleTitle": "Code Correctness",
"type": "bad",
"code": "int i = atoi(buf);",
"language": "c",
"description": "INCORRECT example for Code Correctness"
},
{
"ruleId": "",
"ruleTitle": "Code Correctness",
"type": "good",
"code": "long l = strtol(buf, NULL, 10);",
"language": "c",
"description": "CORRECT example for Code Correctness"
},
{
"ruleId": "",
"ruleTitle": "Code Correctness",
"type": "bad",
"code": "exec $foo",
"language": "bash",
"description": "INCORRECT example for Code Correctness"
},
{
"ruleId": "",
"ruleTitle": "Code Correctness",
"type": "good",
"code": "exec \"$foo\"",
"language": "bash",
"description": "CORRECT example for Code Correctness"
},
{
"ruleId": "",
"ruleTitle": "Code Correctness",
"type": "bad",
"code": "if (list.indexOf(item) > 0) // Misses first element!",
"language": "scala",
"description": "INCORRECT example for Code Correctness"
},
{
"ruleId": "",
"ruleTitle": "Code Correctness",
"type": "good",
"code": "if (list.indexOf(item) >= 0)",
"language": "scala",
"description": "CORRECT example for Code Correctness"
},
{
"ruleId": "",
"ruleTitle": "Prevent Cross-Site Request Forgery",
"type": "bad",
"code": "from django.http import HttpResponse\nfrom django.views.decorators.csrf import csrf_exempt\n\n@csrf_exempt\ndef my_view(request):\n return HttpResponse('Hello world')",
"language": "python",
"description": "using @csrf_exempt decorator"
},
{
"ruleId": "",
"ruleTitle": "Prevent Cross-Site Request Forgery",
"type": "good",
"code": "from django.http import HttpResponse\n\ndef my_view(request):\n return HttpResponse('Hello world')",
"language": "python",
"description": "remove csrf_exempt decorator"
},
{
"ruleId": "",
"ruleTitle": "Prevent Cross-Site Request Forgery",
"type": "bad",
"code": "var express = require('express')\nvar bodyParser = require('body-parser')\n\nvar app = express()\n\napp.post('/process', bodyParser.urlencoded({ extended: false }), function(req, res) {\n res.send('data is being processed')\n})",
"language": "javascript",
"description": "Express app without csurf middleware"
},
{
"ruleId": "",
"ruleTitle": "Prevent Cross-Site Request Forgery",
"type": "good",
"code": "var csrf = require('csurf')\nvar express = require('express')\n\nvar app = express()\napp.use(csrf({ cookie: true }))",
"language": "javascript",
"description": "include csurf middleware"
},
{
"ruleId": "",
"ruleTitle": "Prevent Cross-Site Request Forgery",
"type": "bad",
"code": "@Configuration\n@EnableWebSecurity\npublic class WebSecurityConfig extends WebSecurityConfigurerAdapter {\n @Override\n protected void configure(HttpSecurity http) throws Exception {\n http\n .csrf().disable()\n .authorizeRequests()\n .antMatchers(\"/\", \"/home\").permitAll()\n .anyRequest().authenticated();\n }\n}",
"language": "java",
"description": "explicitly disabling CSRF protection"
},
{
"ruleId": "",
"ruleTitle": "Prevent Cross-Site Request Forgery",
"type": "good",
"code": "@Configuration\n@EnableWebSecurity\npublic class WebSecurityConfig extends WebSecurityConfigurerAdapter {\n @Override\n protected void configure(HttpSecurity http) throws Exception {\n http\n .authorizeRequests()\n .antMatchers(\"/\", \"/home\").permitAll()\n .anyRequest().authenticated();\n }\n}",
"language": "java",
"description": "CSRF protection enabled by default"
},
{
"ruleId": "",
"ruleTitle": "Prevent Cross-Site Request Forgery",
"type": "bad",
"code": "class DangerousController < ActionController::Base\n puts \"do more stuff\"\nend",
"language": "ruby",
"description": "controller without protect_from_forgery"
},
{
"ruleId": "",
"ruleTitle": "Prevent Cross-Site Request Forgery",
"type": "good",
"code": "class SafeController < ActionController::Base\n protect_from_forgery with: :exception\n\n puts \"do more stuff\"\nend",
"language": "ruby",
"description": "controller with protect_from_forgery"
},
{
"ruleId": "",
"ruleTitle": "Secure Docker Configurations",
"type": "bad",
"code": "FROM busybox\nRUN apt-get update && apt-get install -y some-package\nUSER appuser\nUSER root",
"language": "dockerfile",
"description": "Incorrect example for Secure Docker Configurations"
},
{
"ruleId": "",
"ruleTitle": "Secure Docker Configurations",
"type": "good",
"code": "FROM busybox\nUSER root\nRUN apt-get update && apt-get install -y some-package\nUSER appuser",
"language": "dockerfile",
"description": "Correct example for Secure Docker Configurations"
},
{
"ruleId": "",
"ruleTitle": "Secure Docker Configurations",
"type": "bad",
"code": "FROM debian",
"language": "dockerfile",
"description": "Incorrect example for Secure Docker Configurations"
},
{
"ruleId": "",
"ruleTitle": "Secure Docker Configurations",
"type": "good",
"code": "FROM debian:bookworm",
"language": "dockerfile",
"description": "Correct example for Secure Docker Configurations"
},
{
"ruleId": "",
"ruleTitle": "Secure Docker Configurations",
"type": "bad",
"code": "FROM debian:latest",
"language": "dockerfile",
"description": "Incorrect example for Secure Docker Configurations"
},
{
"ruleId": "",
"ruleTitle": "Secure Docker Configurations",
"type": "good",
"code": "FROM debian:bookworm",
"language": "dockerfile",
"description": "Correct example for Secure Docker Configurations"
},
{
"ruleId": "",
"ruleTitle": "Secure Docker Configurations",
"type": "bad",
"code": "version: \"3.9\"\nservices:\n worker:\n image: my-worker-image:1.0\n privileged: true",
"language": "yaml",
"description": "Incorrect example for Secure Docker Configurations"
},
{
"ruleId": "",
"ruleTitle": "Secure Docker Configurations",
"type": "good",
"code": "version: \"3.9\"\nservices:\n worker:\n image: my-worker-image:1.0\n privileged: false",
"language": "yaml",
"description": "Correct example for Secure Docker Configurations"
},
{
"ruleId": "",
"ruleTitle": "Secure Docker Configurations",
"type": "bad",
"code": "version: \"3.9\"\nservices:\n worker:\n image: my-worker-image:1.0\n volumes:\n - /var/run/docker.sock:/var/run/docker.sock",
"language": "yaml",
"description": "Incorrect example for Secure Docker Configurations"
},
{
"ruleId": "",
"ruleTitle": "Secure Docker Configurations",
"type": "good",
"code": "version: \"3.9\"\nservices:\n worker:\n image: my-worker-image:1.0\n volumes:\n - /tmp/data:/tmp/data",
"language": "yaml",
"description": "Correct example for Secure Docker Configurations"
},
{
"ruleId": "",
"ruleTitle": "Secure Docker Configurations",
"type": "bad",
"code": "import docker\nclient = docker.from_env()\n\ndef run_container(user_input):\n client.containers.run(user_input, 'echo hello world')",
"language": "python",
"description": "Incorrect example for Secure Docker Configurations"
},
{
"ruleId": "",
"ruleTitle": "Secure Docker Configurations",
"type": "good",
"code": "import docker\nclient = docker.from_env()\n\ndef run_container():\n client.containers.run(\"alpine\", 'echo hello world')",
"language": "python",
"description": "Correct example for Secure Docker Configurations"
},
{
"ruleId": "",
"ruleTitle": "Secure GitHub Actions",
"type": "bad",
"code": "jobs:\n build:\n runs-on: ubuntu-latest\n steps:\n - name: Check PR title\n run: |\n title=\"${{ github.event.pull_request.title }}\"\n echo \"$title\"",
"language": "yaml",
"description": "vulnerable to script injection via PR title"
},
{
"ruleId": "",
"ruleTitle": "Secure GitHub Actions",
"type": "good",
"code": "jobs:\n build:\n runs-on: ubuntu-latest\n steps:\n - name: Check PR title\n env:\n PR_TITLE: ${{ github.event.pull_request.title }}\n run: |\n echo \"$PR_TITLE\"",
"language": "yaml",
"description": "use environment variable"
},
{
"ruleId": "",
"ruleTitle": "Secure GitHub Actions",
"type": "bad",
"code": "on:\n pull_request_target:\n\njobs:\n build:\n runs-on: ubuntu-latest\n steps:\n - uses: actions/checkout@v2\n with:\n ref: ${{ github.event.pull_request.head.sha }}\n - run: npm install && npm build",
"language": "yaml",
"description": "checking out PR code with pull_request_target"
},
{
"ruleId": "",
"ruleTitle": "Secure GitHub Actions",
"type": "good",
"code": "on:\n pull_request_target:\n\njobs:\n safe-job:\n runs-on: ubuntu-latest\n steps:\n - name: echo\n run: echo \"Hello, world\"",
"language": "yaml",
"description": "no checkout of PR code"
},
{
"ruleId": "",
"ruleTitle": "Secure GitHub Actions",
"type": "bad",
"code": "on:\n workflow_run:\n workflows: [\"CI\"]\n types: [completed]\n\njobs:\n build:\n runs-on: ubuntu-latest\n steps:\n - uses: actions/checkout@v2\n with:\n ref: ${{ github.event.workflow_run.head.sha }}\n - run: npm install",
"language": "yaml",
"description": "checking out PR code with workflow_run"
},
{
"ruleId": "",
"ruleTitle": "Secure GitHub Actions",
"type": "good",
"code": "on:\n workflow_run:\n workflows: [\"CI\"]\n types: [completed]\n\njobs:\n safe-job:\n runs-on: ubuntu-latest\n steps:\n - run: echo \"Safe operation\"",
"language": "yaml",
"description": "no checkout of PR code"
},
{
"ruleId": "",
"ruleTitle": "Secure GitHub Actions",
"type": "bad",
"code": "jobs:\n build:\n runs-on: ubuntu-latest\n steps:\n - uses: fakerepo/comment-on-pr@v1\n with:\n message: \"Thank you!\"",
"language": "yaml",
"description": "using tag reference"
},
{
"ruleId": "",
"ruleTitle": "Secure GitHub Actions",
"type": "good",
"code": "jobs:\n build:\n runs-on: ubuntu-latest\n steps:\n - uses: fakerepo/comment-on-pr@5fd3084fc36e372ff1fff382a39b10d03659f355\n with:\n message: \"Thank you!\"",
"language": "yaml",
"description": "pinned to full commit SHA"
},
{
"ruleId": "",
"ruleTitle": "Avoid Insecure Cryptography",
"type": "bad",
"code": "import hashlib\n\nhash_val = hashlib.md5(data).hexdigest()\nhash_val = hashlib.sha1(data).hexdigest()",
"language": "python",
"description": "MD5/SHA1 hashing"
},
{
"ruleId": "",
"ruleTitle": "Avoid Insecure Cryptography",
"type": "good",
"code": "import hashlib\n\nhash_val = hashlib.sha256(data).hexdigest()",
"language": "python",
"description": "SHA256 hashing"
},
{
"ruleId": "",
"ruleTitle": "Avoid Insecure Cryptography",
"type": "bad",
"code": "from Crypto.Cipher import DES\n\nkey = b'-8B key-'\ncipher = DES.new(key, DES.MODE_CTR, counter=ctr)",
"language": "python",
"description": "DES cipher"
},
{
"ruleId": "",
"ruleTitle": "Avoid Insecure Cryptography",
"type": "good",
"code": "from Crypto.Cipher import AES\n\nkey = b'Sixteen byte key'\ncipher = AES.new(key, AES.MODE_EAX, nonce=nonce)",
"language": "python",
"description": "AES cipher"
},
{
"ruleId": "",
"ruleTitle": "Avoid Insecure Cryptography",
"type": "bad",
"code": "const crypto = require(\"crypto\");\n\nfunction hashPassword(pwtext) {\n return crypto.createHash(\"md5\").update(pwtext).digest(\"hex\");\n}",
"language": "javascript",
"description": "MD5 hashing"
},
{
"ruleId": "",
"ruleTitle": "Avoid Insecure Cryptography",
"type": "good",
"code": "const crypto = require(\"crypto\");\n\nfunction hashPassword(pwtext) {\n return crypto.createHash(\"sha256\").update(pwtext).digest(\"hex\");\n}",
"language": "javascript",
"description": "SHA256 hashing"
},
{
"ruleId": "",
"ruleTitle": "Avoid Insecure Cryptography",
"type": "bad",
"code": "import java.security.MessageDigest;\n\nMessageDigest md5 = MessageDigest.getInstance(\"MD5\");\nmd5.update(password.getBytes());\nbyte[] hash = md5.digest();\n\nMessageDigest sha1 = MessageDigest.getInstance(\"SHA-1\");",
"language": "java",
"description": "MD5/SHA1 hashing"
},
{
"ruleId": "",
"ruleTitle": "Avoid Insecure Cryptography",
"type": "good",
"code": "import java.security.MessageDigest;\n\nMessageDigest sha512 = MessageDigest.getInstance(\"SHA-512\");\nsha512.update(password.getBytes());\nbyte[] hash = sha512.digest();",
"language": "java",
"description": "SHA-512 hashing"
},
{
"ruleId": "",
"ruleTitle": "Avoid Insecure Cryptography",
"type": "bad",
"code": "Cipher c = Cipher.getInstance(\"DES/ECB/PKCS5Padding\");\nc.init(Cipher.ENCRYPT_MODE, k, iv);",
"language": "java",
"description": "DES cipher"
},
{
"ruleId": "",
"ruleTitle": "Avoid Insecure Cryptography",
"type": "good",
"code": "Cipher c = Cipher.getInstance(\"AES/GCM/NoPadding\");\nc.init(Cipher.ENCRYPT_MODE, k, iv);",
"language": "java",
"description": "AES with GCM"
},
{
"ruleId": "",
"ruleTitle": "Avoid Insecure Cryptography",
"type": "bad",
"code": "import (\n \"crypto/md5\"\n \"fmt\"\n)\n\nfunc hashData(data []byte) {\n h := md5.New()\n h.Write(data)\n fmt.Printf(\"%x\", h.Sum(nil))\n}",
"language": "go",
"description": "MD5 hashing"
},
{
"ruleId": "",
"ruleTitle": "Avoid Insecure Cryptography",
"type": "good",
"code": "import (\n \"crypto/sha256\"\n \"fmt\"\n)\n\nfunc hashData(data []byte) {\n h := sha256.New()\n h.Write(data)\n fmt.Printf(\"%x\", h.Sum(nil))\n}",
"language": "go",
"description": "SHA256 hashing"
},
{
"ruleId": "",
"ruleTitle": "Avoid Insecure Cryptography",
"type": "bad",
"code": "import \"crypto/des\"\n\nfunc encrypt() {\n key := []byte(\"example key 1234\")\n block, _ := des.NewCipher(key[:8])\n}",
"language": "go",
"description": "DES cipher"
},
{
"ruleId": "",
"ruleTitle": "Avoid Insecure Cryptography",
"type": "good",
"code": "import \"crypto/aes\"\n\nfunc encrypt() {\n key := []byte(\"example key 12345678901234567890\")\n block, _ := aes.NewCipher(key[:32])\n}",
"language": "go",
"description": "AES cipher"
},
{
"ruleId": "",
"ruleTitle": "Prevent Insecure Deserialization",
"type": "bad",
"code": "import pickle\nfrom base64 import b64decode\nfrom flask import Flask, request\n\napp = Flask(__name__)\n\n@app.route('/', methods=['GET'])\ndef index():\n user_obj = request.cookies.get('uuid')\n return \"Hey there! {}!\".format(pickle.loads(b64decode(user_obj)))",
"language": "python",
"description": "using pickle with user input"
},
{
"ruleId": "",
"ruleTitle": "Prevent Insecure Deserialization",
"type": "good",
"code": "import pickle\nimport json\n\n@app.route(\"/ok\")\ndef ok():\n # Load from trusted local file\n data = pickle.load(open('./config/settings.dat', \"rb\"))\n\n # Or use JSON for untrusted data\n user_data = json.loads(request.data)\n return user_data",
"language": "python",
"description": "use JSON or load from trusted file"
},
{
"ruleId": "",
"ruleTitle": "Prevent Insecure Deserialization",
"type": "bad",
"code": "var node_serialize = require(\"node-serialize\")\n\nmodule.exports.handler = function (req, res) {\n var data = req.files.products.data.toString('utf8')\n node_serialize.unserialize(data)\n}",
"language": "typescript",
"description": "using insecure deserialization libraries"
},
{
"ruleId": "",
"ruleTitle": "Prevent Insecure Deserialization",
"type": "good",
"code": "module.exports.handler = function (req, res) {\n var data = req.body.toString('utf8')\n var parsed = JSON.parse(data)\n return parsed\n}",
"language": "javascript",
"description": "use JSON.parse for untrusted data"
},
{
"ruleId": "",
"ruleTitle": "Prevent Insecure Deserialization",
"type": "bad",
"code": "import java.io.InputStream;\nimport java.io.ObjectInputStream;\n\npublic class Deserializer {\n public Object deserializeObject(InputStream receivedData) throws Exception {\n ObjectInputStream in = new ObjectInputStream(receivedData);\n return in.readObject();\n }\n}",
"language": "java",
"description": "using ObjectInputStream to deserialize untrusted data"
},
{
"ruleId": "",
"ruleTitle": "Prevent Insecure Deserialization",
"type": "good",
"code": "import com.fasterxml.jackson.databind.ObjectMapper;\nimport java.io.InputStream;\n\npublic class SafeDeserializer {\n public MyClass deserialize(InputStream data) throws Exception {\n ObjectMapper mapper = new ObjectMapper();\n return mapper.readValue(data, MyClass.class);\n }\n}",
"language": "java",
"description": "use JSON or implement input validation"
},
{
"ruleId": "",
"ruleTitle": "Prevent Insecure Deserialization",
"type": "bad",
"code": "def bad_deserialization\n data = params['data']\n obj = Marshal.load(data)\n\n yaml_data = params['yaml']\n config = YAML.load(yaml_data)\nend",
"language": "ruby",
"description": "using Marshal.load or YAML.load with user input"
},
{
"ruleId": "",
"ruleTitle": "Prevent Insecure Deserialization",
"type": "good",
"code": "def ok_deserialization\n # Use YAML.safe_load for untrusted data\n config = YAML.safe_load(params['yaml'])\n\n # Load from trusted file\n obj = YAML.load(File.read(\"config.yml\"))\n\n # Use JSON for untrusted data\n data = JSON.parse(params['data'])\nend",
"language": "ruby",
"description": "use safe options or trusted data"
},
{
"ruleId": "",
"ruleTitle": "Prevent Insecure Deserialization",
"type": "bad",
"code": "using System.Runtime.Serialization.Formatters.Binary;\n\npublic class InsecureDeserialization {\n public void Deserialize(string data) {\n BinaryFormatter formatter = new BinaryFormatter();\n MemoryStream stream = new MemoryStream(Encoding.UTF8.GetBytes(data));\n object obj = formatter.Deserialize(stream);\n }\n}",
"language": "csharp",
"description": "using BinaryFormatter which is inherently insecure"
},
{
"ruleId": "",
"ruleTitle": "Prevent Insecure Deserialization",
"type": "good",
"code": "using System.Text.Json;\n\npublic class SafeDeserialization {\n public MyClass Deserialize(string json) {\n return JsonSerializer.Deserialize<MyClass>(json);\n }\n}",
"language": "csharp",
"description": "use System.Text.Json or Newtonsoft with safe settings"
},
{
"ruleId": "",
"ruleTitle": "Prevent Insecure Deserialization",
"type": "bad",
"code": "<?php\n$data = $_GET[\"data\"];\n$object = unserialize($data);",
"language": "php",
"description": "unserializing user-controlled data"
},
{
"ruleId": "",
"ruleTitle": "Prevent Insecure Deserialization",
"type": "good",
"code": "<?php\n// Use json_decode for untrusted data\n$object = json_decode($_GET[\"data\"], true);\n\n// Or use unserialize only with hardcoded strings\n$object = unserialize('O:1:\"a\":1:{s:5:\"value\";s:3:\"100\";}');",
"language": "php",
"description": "use JSON or hardcoded data"
},
{
"ruleId": "",
"ruleTitle": "Use Secure Transport",
"type": "bad",
"code": "const http = require('http');\n\nhttp.get('http://nodejs.org/dist/index.json', (res) => {\n const { statusCode } = res;\n});",
"language": "javascript",
"description": "HTTP requests without TLS"
},
{
"ruleId": "",
"ruleTitle": "Use Secure Transport",
"type": "good",
"code": "const https = require('https');\n\nhttps.get('https://nodejs.org/dist/index.json', (res) => {\n const { statusCode } = res;\n});",
"language": "javascript",
"description": "HTTPS requests with TLS"
},
{
"ruleId": "",
"ruleTitle": "Use Secure Transport",
"type": "bad",
"code": "process.env[\"NODE_TLS_REJECT_UNAUTHORIZED\"] = 0;\n\nvar req = https.request({\n host: '192.168.1.1',\n port: 443,\n path: '/',\n method: 'GET',\n rejectUnauthorized: false\n});",
"language": "javascript",
"description": "disabled TLS verification"
},
{
"ruleId": "",
"ruleTitle": "Use Secure Transport",
"type": "good",
"code": "var req = https.request({\n host: '192.168.1.1',\n port: 443,\n path: '/',\n method: 'GET',\n rejectUnauthorized: true\n});",
"language": "javascript",
"description": "TLS verification enabled"
},
{
"ruleId": "",
"ruleTitle": "Use Secure Transport",
"type": "bad",
"code": "func bad() {\n resp, err := http.Get(\"http://example.com/\")\n}",
"language": "go",
"description": "HTTP requests without TLS"
},
{
"ruleId": "",
"ruleTitle": "Use Secure Transport",
"type": "good",
"code": "func ok() {\n resp, err := http.Get(\"https://example.com/\")\n}",
"language": "go",
"description": "HTTPS requests"
},
{
"ruleId": "",
"ruleTitle": "Use Secure Transport",
"type": "bad",
"code": "import (\n \"crypto/tls\"\n \"net/http\"\n)\n\nfunc bad() {\n client := &http.Client{\n Transport: &http.Transport{\n TLSClientConfig: &tls.Config{\n InsecureSkipVerify: true,\n },\n },\n }\n}",
"language": "go",
"description": "disabled TLS verification"
},
{
"ruleId": "",
"ruleTitle": "Use Secure Transport",
"type": "good",
"code": "func ok() {\n client := &http.Client{\n Transport: &http.Transport{\n TLSClientConfig: &tls.Config{\n InsecureSkipVerify: false,\n },\n },\n }\n}",
"language": "go",
"description": "TLS verification enabled"
},
{
"ruleId": "",
"ruleTitle": "Use Secure Transport",
"type": "bad",
"code": "import requests\n\nrequests.get(\"http://example.com\")",
"language": "python",
"description": "HTTP requests without TLS"
},
{
"ruleId": "",
"ruleTitle": "Use Secure Transport",
"type": "good",
"code": "import requests\n\nrequests.get(\"https://example.com\")",
"language": "python",
"description": "HTTPS requests"
},
{
"ruleId": "",
"ruleTitle": "Use Secure Transport",
"type": "bad",
"code": "import requests\n\nr = requests.get(\"https://example.com\", verify=False)",
"language": "python",
"description": "disabled certificate verification"
},
{
"ruleId": "",
"ruleTitle": "Use Secure Transport",
"type": "good",
"code": "import requests\n\nr = requests.get(\"https://example.com\")",
"language": "python",
"description": "certificate verification enabled"
},
{
"ruleId": "",
"ruleTitle": "Use Secure Transport",
"type": "bad",
"code": "HttpClient client = HttpClient.newHttpClient();\nHttpRequest request = HttpRequest.newBuilder()\n .uri(URI.create(\"http://openjdk.java.net/\"))\n .build();\n\nclient.sendAsync(request, BodyHandlers.ofString())\n .thenApply(HttpResponse::body)\n .thenAccept(System.out::println)\n .join();",
"language": "java",
"description": "HTTP requests without TLS"
},
{
"ruleId": "",
"ruleTitle": "Use Secure Transport",
"type": "good",
"code": "HttpClient client = HttpClient.newHttpClient();\nHttpRequest request = HttpRequest.newBuilder()\n .uri(URI.create(\"https://openjdk.java.net/\"))\n .build();\n\nclient.sendAsync(request, BodyHandlers.ofString())\n .thenApply(HttpResponse::body)\n .thenAccept(System.out::println)\n .join();",
"language": "java",
"description": "HTTPS requests"
},
{
"ruleId": "",
"ruleTitle": "Use Secure Transport",
"type": "bad",
"code": "new X509TrustManager() {\n public X509Certificate[] getAcceptedIssuers() { return null; }\n public void checkClientTrusted(X509Certificate[] certs, String authType) { }\n public void checkServerTrusted(X509Certificate[] certs, String authType) { }\n}",
"language": "java",
"description": "disabled TLS verification via empty X509TrustManager"
},
{
"ruleId": "",
"ruleTitle": "Use Secure Transport",
"type": "good",
"code": "new X509TrustManager() {\n public X509Certificate[] getAcceptedIssuers() { return null; }\n public void checkClientTrusted(X509Certificate[] certs, String authType) { }\n public void checkServerTrusted(X509Certificate[] certs, String authType) {\n try {\n checkValidity();\n } catch (Exception e) {\n throw new CertificateException(\"Certificate not valid or trusted.\");\n }\n }\n}",
"language": "java",
"description": "proper certificate validation"
},
{
"ruleId": "",
"ruleTitle": "Secure Kubernetes Configurations",
"type": "bad",
"code": "apiVersion: v1\nkind: Pod\nspec:\n containers:\n - name: nginx\n image: nginx\n securityContext:\n privileged: true",
"language": "yaml",
"description": "Incorrect example for Secure Kubernetes Configurations"
},
{
"ruleId": "",
"ruleTitle": "Secure Kubernetes Configurations",
"type": "good",
"code": "apiVersion: v1\nkind: Pod\nspec:\n containers:\n - name: redis\n image: redis\n securityContext:\n privileged: false",
"language": "yaml",
"description": "Correct example for Secure Kubernetes Configurations"
},
{
"ruleId": "",
"ruleTitle": "Secure Kubernetes Configurations",
"type": "bad",
"code": "apiVersion: v1\nkind: Pod\nspec:\n securityContext:\n runAsNonRoot: false\n containers:\n - name: redis\n image: redis",
"language": "yaml",
"description": "Incorrect example for Secure Kubernetes Configurations"
},
{
"ruleId": "",
"ruleTitle": "Secure Kubernetes Configurations",
"type": "good",
"code": "apiVersion: v1\nkind: Pod\nspec:\n securityContext:\n runAsNonRoot: true\n containers:\n - name: nginx\n image: nginx",
"language": "yaml",
"description": "Correct example for Secure Kubernetes Configurations"
},
{
"ruleId": "",
"ruleTitle": "Secure Kubernetes Configurations",
"type": "bad",
"code": "apiVersion: v1\nkind: Pod\nspec:\n containers:\n - name: redis\n image: redis\n securityContext:\n allowPrivilegeEscalation: true",
"language": "yaml",
"description": "Incorrect example for Secure Kubernetes Configurations"
},
{
"ruleId": "",
"ruleTitle": "Secure Kubernetes Configurations",
"type": "good",
"code": "apiVersion: v1\nkind: Pod\nspec:\n containers:\n - name: haproxy\n image: haproxy\n securityContext:\n allowPrivilegeEscalation: false",
"language": "yaml",
"description": "Correct example for Secure Kubernetes Configurations"
},
{
"ruleId": "",
"ruleTitle": "Secure Kubernetes Configurations",
"type": "bad",
"code": "apiVersion: v1\nkind: Pod\nmetadata:\n name: view-pid\nspec:\n hostPID: true\n containers:\n - name: nginx\n image: nginx",
"language": "yaml",
"description": "Incorrect example for Secure Kubernetes Configurations"
},
{
"ruleId": "",
"ruleTitle": "Secure Kubernetes Configurations",
"type": "good",
"code": "apiVersion: v1\nkind: Pod\nmetadata:\n name: secure-pod\nspec:\n containers:\n - name: nginx\n image: nginx",
"language": "yaml",
"description": "Correct example for Secure Kubernetes Configurations"
},
{
"ruleId": "",
"ruleTitle": "Secure Kubernetes Configurations",
"type": "bad",
"code": "apiVersion: v1\nkind: Pod\nmetadata:\n name: view-network\nspec:\n hostNetwork: true\n containers:\n - name: nginx\n image: nginx",
"language": "yaml",
"description": "Incorrect example for Secure Kubernetes Configurations"
},
{
"ruleId": "",
"ruleTitle": "Secure Kubernetes Configurations",
"type": "good",
"code": "apiVersion: v1\nkind: Pod\nmetadata:\n name: secure-pod\nspec:\n containers:\n - name: nginx\n image: nginx",
"language": "yaml",
"description": "Correct example for Secure Kubernetes Configurations"
},
{
"ruleId": "",
"ruleTitle": "Secure Kubernetes Configurations",
"type": "bad",
"code": "apiVersion: v1\nkind: Pod\nmetadata:\n name: view-ipc\nspec:\n hostIPC: true\n containers:\n - name: nginx\n image: nginx",
"language": "yaml",
"description": "Incorrect example for Secure Kubernetes Configurations"
},
{
"ruleId": "",
"ruleTitle": "Secure Kubernetes Configurations",
"type": "good",
"code": "apiVersion: v1\nkind: Pod\nmetadata:\n name: secure-pod\nspec:\n containers:\n - name: nginx\n image: nginx",
"language": "yaml",
"description": "Correct example for Secure Kubernetes Configurations"
},
{
"ruleId": "",
"ruleTitle": "Secure Kubernetes Configurations",
"type": "bad",
"code": "apiVersion: v1\nkind: Pod\nspec:\n containers:\n - image: gcr.io/google_containers/test-webserver\n name: test-container\n volumeMounts:\n - mountPath: /var/run/docker.sock\n name: docker-sock-volume\n volumes:\n - name: docker-sock-volume\n hostPath:\n type: File\n path: /var/run/docker.sock",
"language": "yaml",
"description": "Incorrect example for Secure Kubernetes Configurations"
},
{
"ruleId": "",
"ruleTitle": "Secure Kubernetes Configurations",
"type": "good",
"code": "apiVersion: v1\nkind: Pod\nspec:\n containers:\n - image: gcr.io/google_containers/test-webserver\n name: test-container\n volumeMounts:\n - mountPath: /data\n name: data-volume\n volumes:\n - name: data-volume\n emptyDir: {}",
"language": "yaml",
"description": "Correct example for Secure Kubernetes Configurations"
},
{
"ruleId": "",
"ruleTitle": "Secure Kubernetes Configurations",
"type": "bad",
"code": "apiVersion: v1\nkind: Secret\nmetadata:\n name: mysecret\ntype: Opaque\ndata:\n USERNAME: Y2FsZWJraW5uZXk=\n PASSWORD: UzNjcmV0UGEkJHcwcmQ=",
"language": "yaml",
"description": "Incorrect example for Secure Kubernetes Configurations"
},
{
"ruleId": "",
"ruleTitle": "Secure Kubernetes Configurations",
"type": "good",
"code": "apiVersion: bitnami.com/v1alpha1\nkind: SealedSecret\nmetadata:\n name: mysecret\nspec:\n encryptedData:\n password: AgBy8hCi8...encrypted...",
"language": "yaml",
"description": "use Sealed Secrets or external secrets management"
},
{
"ruleId": "",
"ruleTitle": "Code Maintainability",
"type": "bad",
"code": "if a:\n print('1')\nelif a:\n print('2')",
"language": "python",
"description": "Python - duplicate if condition"
},
{
"ruleId": "",
"ruleTitle": "Code Maintainability",
"type": "good",
"code": "if a:\n print('1')\nelif b:\n print('2')",
"language": "python",
"description": "Python - distinct conditions"
},
{
"ruleId": "",
"ruleTitle": "Code Maintainability",
"type": "bad",
"code": "if a:\n print('1')\nelse:\n print('1')",
"language": "python",
"description": "Python - identical if/else branches"
},
{
"ruleId": "",
"ruleTitle": "Code Maintainability",
"type": "good",
"code": "print('1')",
"language": "python",
"description": "Python - different branches or simplified"
},
{
"ruleId": "",
"ruleTitle": "Code Maintainability",
"type": "bad",
"code": "def A():\n def B():\n print('never used')\n return None",
"language": "python",
"description": "Python - unused inner function"
},
{
"ruleId": "",
"ruleTitle": "Code Maintainability",
"type": "good",
"code": "def A():\n def B():\n print('used')\n return B()",
"language": "python",
"description": "Python - inner function called or returned"
},
{
"ruleId": "",
"ruleTitle": "Code Maintainability",
"type": "bad",
"code": "if example.is_positive:\n do_something()",
"language": "python",
"description": "Python - function reference without call"
},
{
"ruleId": "",
"ruleTitle": "Code Maintainability",
"type": "good",
"code": "if example.is_positive():\n do_something()",
"language": "python",
"description": "Python - function called with parentheses"
},
{
"ruleId": "",
"ruleTitle": "Code Maintainability",
"type": "bad",
"code": "urlpatterns = [\n path('path/to/view', views.example_view),\n path('path/to/view', views.other_view),\n]",
"language": "python",
"description": "Django - duplicate URL paths"
},
{
"ruleId": "",
"ruleTitle": "Code Maintainability",
"type": "good",
"code": "urlpatterns = [\n path('path/to/view1', views.example_view),\n path('path/to/view2', views.other_view),\n]",
"language": "python",
"description": "Django - unique URL paths"
},
{
"ruleId": "",
"ruleTitle": "Code Maintainability",
"type": "bad",
"code": "from flask import json_available\nblueprint = request.module",
"language": "python",
"description": "Flask - deprecated APIs"
},
{
"ruleId": "",
"ruleTitle": "Code Maintainability",
"type": "good",
"code": "from flask import Flask, request\napp = Flask(__name__)",
"language": "python",
"description": "Flask - modern alternatives"
},
{
"ruleId": "",
"ruleTitle": "Ensure Memory Safety",
"type": "bad",
"code": "int bad_code() {\n char *var = malloc(sizeof(char) * 10);\n free(var);\n free(var); // Double free vulnerability\n return 0;\n}",
"language": "c",
"description": "Incorrect example for Ensure Memory Safety"
},
{
"ruleId": "",
"ruleTitle": "Ensure Memory Safety",
"type": "good",
"code": "int safe_code() {\n char *var = malloc(sizeof(char) * 10);\n free(var);\n var = NULL; // Set to NULL after free\n free(var); // Safe: freeing NULL is a no-op\n return 0;\n}",
"language": "c",
"description": "Correct example for Ensure Memory Safety"
},
{
"ruleId": "",
"ruleTitle": "Ensure Memory Safety",
"type": "bad",
"code": "typedef struct name {\n char *myname;\n void (*func)(char *str);\n} NAME;\n\nint bad_code() {\n NAME *var;\n var = (NAME *)malloc(sizeof(struct name));\n free(var);\n var->func(\"use after free\"); // Accessing freed memory\n return 0;\n}",
"language": "c",
"description": "Incorrect example for Ensure Memory Safety"
},
{
"ruleId": "",
"ruleTitle": "Ensure Memory Safety",
"type": "good",
"code": "typedef struct name {\n char *myname;\n void (*func)(char *str);\n} NAME;\n\nint safe_code() {\n NAME *var;\n var = (NAME *)malloc(sizeof(struct name));\n free(var);\n var = NULL; // Prevents accidental reuse\n // Any access to var now causes immediate crash (easier to debug)\n return 0;\n}",
"language": "c",
"description": "Correct example for Ensure Memory Safety"
},
{
"ruleId": "",
"ruleTitle": "Ensure Memory Safety",
"type": "bad",
"code": "void bad_code(char *user_input) {\n char buffer[64];\n strcpy(buffer, user_input); // No bounds checking\n}",
"language": "c",
"description": "Incorrect example for Ensure Memory Safety"
},
{
"ruleId": "",
"ruleTitle": "Ensure Memory Safety",
"type": "good",
"code": "void safe_code(char *user_input) {\n char buffer[64];\n strncpy(buffer, user_input, sizeof(buffer) - 1);\n buffer[sizeof(buffer) - 1] = '\\0'; // Ensure null termination\n}",
"language": "c",
"description": "Correct example for Ensure Memory Safety"
},
{
"ruleId": "",
"ruleTitle": "Ensure Memory Safety",
"type": "bad",
"code": "void bad_printf(char *user_input) {\n printf(user_input); // User controls format string\n}",
"language": "c",
"description": "Incorrect example for Ensure Memory Safety"
},
{
"ruleId": "",
"ruleTitle": "Ensure Memory Safety",
"type": "good",
"code": "void safe_printf(char *user_input) {\n printf(\"%s\", user_input); // Format string is fixed\n}",
"language": "c",
"description": "Correct example for Ensure Memory Safety"
},
{
"ruleId": "",
"ruleTitle": "Prevent Path Traversal",
"type": "bad",
"code": "def unsafe(request):\n filename = request.POST.get('filename')\n f = open(filename, 'r')\n data = f.read()\n f.close()\n return HttpResponse(data)",
"language": "python",
"description": "vulnerable to path traversal"
},
{
"ruleId": "",
"ruleTitle": "Prevent Path Traversal",
"type": "good",
"code": "def safe(request):\n filename = \"/tmp/data.txt\"\n f = open(filename)\n data = f.read()\n f.close()\n return HttpResponse(data)",
"language": "python",
"description": "static path"
},
{
"ruleId": "",
"ruleTitle": "Prevent Path Traversal",
"type": "bad",
"code": "const fs = require('fs');\n\nfunction readUserFile(fileName) {\n fs.readFile(fileName, (err, data) => {\n if (err) throw err;\n console.log(data);\n });\n}",
"language": "javascript",
"description": "vulnerable to path traversal"
},
{
"ruleId": "",
"ruleTitle": "Prevent Path Traversal",
"type": "good",
"code": "const fs = require('fs');\n\nfunction readConfigFile() {\n fs.readFile('config/settings.json', (err, data) => {\n if (err) throw err;\n console.log(data);\n });\n}",
"language": "javascript",
"description": "safe with literal path"
},
{
"ruleId": "",
"ruleTitle": "Prevent Path Traversal",
"type": "bad",
"code": "const path = require('path');\n\nfunction getFile(entry) {\n var extractPath = path.join(opts.path, entry.path);\n return extractFile(extractPath);\n}",
"language": "javascript",
"description": "vulnerable to path traversal"
},
{
"ruleId": "",
"ruleTitle": "Prevent Path Traversal",
"type": "good",
"code": "const path = require('path');\n\nfunction getFileSafe(req, res) {\n let somePath = req.body.path;\n somePath = somePath.replace(/^(\\.\\.(\\/|\\\\|$))+/, '');\n return path.join(opts.path, somePath);\n}",
"language": "javascript",
"description": "path sanitized"
},
{
"ruleId": "",
"ruleTitle": "Prevent Path Traversal",
"type": "bad",
"code": "public class FileServlet extends HttpServlet {\n public void doPost(HttpServletRequest request, HttpServletResponse response)\n throws ServletException, IOException {\n String image = request.getParameter(\"image\");\n File file = new File(\"static/images/\", image);\n if (!file.exists()) {\n response.sendError(404);\n }\n }\n}",
"language": "java",
"description": "vulnerable to path traversal"
},
{
"ruleId": "",
"ruleTitle": "Prevent Path Traversal",
"type": "good",
"code": "public class FileServlet extends HttpServlet {\n public void doPost(HttpServletRequest request, HttpServletResponse response)\n throws ServletException, IOException {\n String image = request.getParameter(\"image\");\n File file = new File(\"static/images/\", FilenameUtils.getName(image));\n if (!file.exists()) {\n response.sendError(404);\n }\n }\n}",
"language": "java",
"description": "sanitized with FilenameUtils"
},
{
"ruleId": "",
"ruleTitle": "Prevent Path Traversal",
"type": "bad",
"code": "func main() {\n mux := http.NewServeMux()\n mux.HandleFunc(\"/file\", func(w http.ResponseWriter, r *http.Request) {\n filename := filepath.Clean(r.URL.Path)\n filename = filepath.Join(root, strings.Trim(filename, \"/\"))\n contents, err := ioutil.ReadFile(filename)\n if err != nil {\n w.WriteHeader(http.StatusNotFound)\n return\n }\n w.Write(contents)\n })\n}",
"language": "go",
"description": "Clean does not prevent traversal"
},
{
"ruleId": "",
"ruleTitle": "Prevent Path Traversal",
"type": "good",
"code": "func main() {\n mux := http.NewServeMux()\n mux.HandleFunc(\"/file\", func(w http.ResponseWriter, r *http.Request) {\n filename := path.Clean(\"/\" + r.URL.Path)\n filename = filepath.Join(root, strings.Trim(filename, \"/\"))\n contents, err := ioutil.ReadFile(filename)\n if err != nil {\n w.WriteHeader(http.StatusNotFound)\n return\n }\n w.Write(contents)\n })\n}",
"language": "go",
"description": "prefix with \"/\" before Clean"
},
{
"ruleId": "",
"ruleTitle": "Prevent Path Traversal",
"type": "bad",
"code": "<?php\n$user_input = $_GET[\"page\"];\ninclude($user_input);\n?>",
"language": "php",
"description": "vulnerable to path traversal/RFI"
},
{
"ruleId": "",
"ruleTitle": "Prevent Path Traversal",
"type": "good",
"code": "<?php\ninclude('templates/header.php');\nrequire_once(CONFIG_DIR . '/settings.php');\n?>",
"language": "php",
"description": "constant paths"
},
{
"ruleId": "",
"ruleTitle": "Prevent Path Traversal",
"type": "bad",
"code": "<?php\n$data = $_GET[\"file\"];\nunlink(\"/storage/\" . $data);\n?>",
"language": "php",
"description": "vulnerable to path traversal"
},
{
"ruleId": "",
"ruleTitle": "Prevent Path Traversal",
"type": "good",
"code": "<?php\nunlink('/storage/cache/temp.txt');\n?>",
"language": "php",
"description": "constant path"
},
{
"ruleId": "",
"ruleTitle": "Performance Best Practices",
"type": "bad",
"code": "def get_user_id(item):\n return item.user.id",
"language": "python",
"description": "INCORRECT - Extra query to fetch related object example for Performance Best Practices"
},
{
"ruleId": "",
"ruleTitle": "Performance Best Practices",
"type": "good",
"code": "def get_user_id(item):\n return item.user_id",
"language": "python",
"description": "CORRECT - Use the foreign key directly example for Performance Best Practices"
},
{
"ruleId": "",
"ruleTitle": "Performance Best Practices",
"type": "bad",
"code": "total = len(persons.all())",
"language": "python",
"description": "INCORRECT - Fetches all records into memory example for Performance Best Practices"
},
{
"ruleId": "",
"ruleTitle": "Performance Best Practices",
"type": "good",
"code": "total = persons.count()",
"language": "python",
"description": "CORRECT - Count performed server-side example for Performance Best Practices"
},
{
"ruleId": "",
"ruleTitle": "Performance Best Practices",
"type": "bad",
"code": "for song in songs:\n db.session.add(song)",
"language": "python",
"description": "INCORRECT - Adding one at a time in a loop example for Performance Best Practices"
},
{
"ruleId": "",
"ruleTitle": "Performance Best Practices",
"type": "good",
"code": "db.session.add_all(songs)",
"language": "python",
"description": "CORRECT - Batch add all at once example for Performance Best Practices"
},
{
"ruleId": "",
"ruleTitle": "Performance Best Practices",
"type": "bad",
"code": "import styled from \"styled-components\";\n\nfunction FunctionalComponent() {\n const StyledDiv = styled.div`\n color: blue;\n `\n return <StyledDiv />\n}",
"language": "tsx",
"description": "INCORRECT - Styled component declared inside function example for Performance Best Practices"
},
{
"ruleId": "",
"ruleTitle": "Performance Best Practices",
"type": "good",
"code": "import styled from \"styled-components\";\n\nconst StyledDiv = styled.div`\n color: blue;\n`\n\nfunction FunctionalComponent() {\n return <StyledDiv />\n}",
"language": "tsx",
"description": "CORRECT - Styled component declared at module level example for Performance Best Practices"
},
{
"ruleId": "",
"ruleTitle": "Performance Best Practices",
"type": "bad",
"code": "if (items.length === 0) { /* empty */ }",
"language": "javascript",
"description": "INCORRECT - Inefficient length check example for Performance Best Practices"
},
{
"ruleId": "",
"ruleTitle": "Performance Best Practices",
"type": "good",
"code": "if (!items.length) { /* empty */ }",
"language": "javascript",
"description": "CORRECT - Direct comparison when possible example for Performance Best Practices"
},
{
"ruleId": "",
"ruleTitle": "Performance Best Practices",
"type": "bad",
"code": "const found = items.filter(x => x.id === targetId)[0];",
"language": "javascript",
"description": "INCORRECT - Full iteration to find one item example for Performance Best Practices"
},
{
"ruleId": "",
"ruleTitle": "Performance Best Practices",
"type": "good",
"code": "const found = items.find(x => x.id === targetId);",
"language": "javascript",
"description": "CORRECT - Short-circuit on first match example for Performance Best Practices"
},
{
"ruleId": "",
"ruleTitle": "Prevent Prototype Pollution",
"type": "bad",
"code": "app.get('/test/:id', (req, res) => {\n let id = req.params.id;\n let items = req.session.todos[id];\n if (!items) {\n items = req.session.todos[id] = {};\n }\n items[req.query.name] = req.query.text;\n res.end(200);\n});",
"language": "javascript",
"description": "JavaScript - dynamic property assignment from user input"
},
{
"ruleId": "",
"ruleTitle": "Prevent Prototype Pollution",
"type": "good",
"code": "app.post('/test/:id', (req, res) => {\n let id = req.params.id;\n if (id !== 'constructor' && id !== '__proto__') {\n let items = req.session.todos[id];\n if (!items) {\n items = req.session.todos[id] = {};\n }\n items[req.query.name] = req.query.text;\n }\n res.end(200);\n});",
"language": "javascript",
"description": "JavaScript - validate against dangerous keys"
},
{
"ruleId": "",
"ruleTitle": "Prevent Prototype Pollution",
"type": "bad",
"code": "function setNestedValue(obj, props, value) {\n props = props.split('.');\n var lastProp = props.pop();\n while ((thisProp = props.shift())) {\n if (typeof obj[thisProp] == 'undefined') {\n obj[thisProp] = {};\n }\n obj = obj[thisProp];\n }\n obj[lastProp] = value;\n}",
"language": "javascript",
"description": "JavaScript - nested property assignment in loop"
},
{
"ruleId": "",
"ruleTitle": "Prevent Prototype Pollution",
"type": "good",
"code": "function safeIteration(name) {\n let config = this.config;\n name = name.split('.');\n for (let i = 0; i < name.length; i++) {\n config = config[i];\n }\n return this;\n}",
"language": "javascript",
"description": "JavaScript - use numeric index or Map"
},
{
"ruleId": "",
"ruleTitle": "Prevent Prototype Pollution",
"type": "bad",
"code": "function controller(req, res) {\n const defaultData = {foo: true}\n let data = Object.assign(defaultData, req.body)\n doSmthWith(data)\n}",
"language": "javascript",
"description": "JavaScript - Object.assign with user input"
},
{
"ruleId": "",
"ruleTitle": "Prevent Prototype Pollution",
"type": "good",
"code": "function controller(req, res) {\n const defaultData = {foo: {bar: true}}\n let data = Object.assign(defaultData, {foo: getTrustedFoo()})\n doSmthWith(data)\n}",
"language": "javascript",
"description": "JavaScript - use trusted data sources"
},
{
"ruleId": "",
"ruleTitle": "Prevent Race Conditions",
"type": "bad",
"code": "(* ruleid:ocamllint-tempfile *)\nlet ofile = Filename.temp_file \"test\" \"\" in\nPrintf.printf \"%s\\n\" ofile",
"language": "ocaml",
"description": "vulnerable to race condition"
},
{
"ruleId": "",
"ruleTitle": "Prevent Race Conditions",
"type": "good",
"code": "(* Use open_temp_file which returns both the filename and an open channel *)\nlet (filename, oc) = Filename.open_temp_file \"test\" \"\" in\nPrintf.fprintf oc \"data\\n\";\nclose_out oc",
"language": "ocaml",
"description": "use safer alternatives"
},
{
"ruleId": "",
"ruleTitle": "Prevent Race Conditions",
"type": "bad",
"code": "import tempfile as tf\n\n# ruleid: tempfile-insecure\nx = tempfile.mktemp()\n# ruleid: tempfile-insecure\nx = tempfile.mktemp(dir=\"/tmp\")",
"language": "python",
"description": "vulnerable to race condition"
},
{
"ruleId": "",
"ruleTitle": "Prevent Race Conditions",
"type": "good",
"code": "import tempfile\n\n# Use NamedTemporaryFile which atomically creates and opens the file\nwith tempfile.NamedTemporaryFile(mode='w', delete=False) as f:\n f.write(\"data\")\n filename = f.name\n\n# Or use mkstemp which returns both file descriptor and name\nfd, path = tempfile.mkstemp()\ntry:\n with os.fdopen(fd, 'w') as f:\n f.write(\"data\")\nfinally:\n os.unlink(path)",
"language": "python",
"description": "use secure alternatives"
},
{
"ruleId": "",
"ruleTitle": "Prevent Race Conditions",
"type": "bad",
"code": "def test1():\n # ruleid:hardcoded-tmp-path\n f = open(\"/tmp/blah.txt\", 'w')\n f.write(\"hello world\")\n f.close()\n\ndef test2():\n # ruleid:hardcoded-tmp-path\n f = open(\"/tmp/blah/blahblah/blah.txt\", 'r')\n data = f.read()\n f.close()\n\ndef test4():\n # ruleid:hardcoded-tmp-path\n with open(\"/tmp/blah.txt\", 'r') as fin:\n data = fin.read()",
"language": "python",
"description": "hardcoded tmp path"
},
{
"ruleId": "",
"ruleTitle": "Prevent Race Conditions",
"type": "good",
"code": "def test3():\n # ok:hardcoded-tmp-path\n f = open(\"./tmp/blah.txt\", 'w')\n f.write(\"hello world\")\n f.close()\n\ndef test3a():\n # ok:hardcoded-tmp-path\n f = open(\"/var/log/something/else/tmp/blah.txt\", 'w')\n f.write(\"hello world\")\n f.close()\n\ndef test5():\n # ok:hardcoded-tmp-path\n with open(\"./tmp/blah.txt\", 'w') as fout:\n fout.write(\"hello world\")",
"language": "python",
"description": "use tempfile module or relative paths"
},
{
"ruleId": "",
"ruleTitle": "Prevent Race Conditions",
"type": "bad",
"code": "package samples\n\nimport (\n\t\"fmt\"\n\t\"io/ioutil\"\n)\n\nfunc main() {\n\t// ruleid:bad-tmp-file-creation\n\terr := ioutil.WriteFile(\"/tmp/demo2\", []byte(\"This is some data\"), 0644)\n\tif err != nil {\n\t\tfmt.Println(\"Error while writing!\")\n\t}\n}",
"language": "go",
"description": "hardcoded tmp path"
},
{
"ruleId": "",
"ruleTitle": "Prevent Race Conditions",
"type": "good",
"code": "import \"os\"\n\nfunc secureTemp() error {\n // Atomically creates a file with a random suffix\n f, err := os.CreateTemp(\"\", \"prefix-*.txt\")\n if err != nil {\n return err\n }\n defer f.Close()\n\n _, err = f.WriteString(\"secure data\")\n return err\n}",
"language": "go",
"description": "use TempFile for atomic creation"
},
{
"ruleId": "",
"ruleTitle": "Prevent Regular Expression DoS",
"type": "bad",
"code": "const re = new RegExp(\"([a-z]+)+$\", \"i\");\n\nvar emailRegex = /^\\w+([-_+.]\\w+)*@\\w+([-.]\\w+)*\\.\\w+([-.]\\w+)*$/;\nemailRegex.test(userInput);",
"language": "javascript",
"description": "vulnerable ReDoS pattern"
},
{
"ruleId": "",
"ruleTitle": "Prevent Regular Expression DoS",
"type": "good",
"code": "// Use atomic patterns without nested quantifiers\nconst safeRegex = /^[a-z]+$/i;\n\n// Or use a library with ReDoS protection\nimport { RE2 } from 're2';\nconst re = new RE2(\"([a-z]+)+$\");",
"language": "javascript",
"description": "safe regex patterns"
},
{
"ruleId": "",
"ruleTitle": "Prevent Regular Expression DoS",
"type": "bad",
"code": "function searchHandler(userPattern) {\n const reg = new RegExp(\"\\\\w+\" + userPattern);\n return reg.exec(data);\n}",
"language": "javascript",
"description": "non-literal RegExp with user input"
},
{
"ruleId": "",
"ruleTitle": "Prevent Regular Expression DoS",
"type": "good",
"code": "function searchHandler(userInput) {\n const reg = new RegExp(\"\\\\w+\");\n return reg.exec(userInput);\n}",
"language": "javascript",
"description": "hardcoded regex patterns"
},
{
"ruleId": "",
"ruleTitle": "Prevent Regular Expression DoS",
"type": "bad",
"code": "function escapeQuotes(s) {\n return s.replace(\"'\", \"''\"); // Only replaces first occurrence\n}",
"language": "javascript",
"description": "incomplete string sanitization"
},
{
"ruleId": "",
"ruleTitle": "Prevent Regular Expression DoS",
"type": "good",
"code": "function escapeQuotes(s) {\n return s.replace(/'/g, \"''\"); // Replaces all occurrences\n}",
"language": "javascript",
"description": "use regex with global flag"
},
{
"ruleId": "",
"ruleTitle": "Prevent Regular Expression DoS",
"type": "bad",
"code": "import re\n\nredos_pattern = r\"^(a+)+$\"\ndata = \"aaaaaaaaaaaaaaaaaaaaaaaaaaaaX\"\n\npattern = re.compile(redos_pattern)\npattern.match(data) # Catastrophic backtracking",
"language": "python",
"description": "inefficient regex pattern"
},
{
"ruleId": "",
"ruleTitle": "Prevent Regular Expression DoS",
"type": "good",
"code": "import re\n\nsafe_pattern = r\"^a+$\"\ndata = \"aaaaaaaaaaaaaaaaaaaaaaaaaaaaX\"\n\npattern = re.compile(safe_pattern)\npattern.match(data) # Fast failure, no backtracking",
"language": "python",
"description": "safe regex patterns"
},
{
"ruleId": "",
"ruleTitle": "Avoid Hardcoded Secrets",
"type": "bad",
"code": "import boto3\n\nclient(\"s3\", aws_secret_access_key=\"jWnyxxxxxxxxxxxxxxxxX7ZQxxxxxxxxxxxxxxxx\")\n\ns3 = boto3.resource(\n \"s3\",\n aws_access_key_id=\"AKIAxxxxxxxxxxxxxxxx\",\n aws_secret_access_key=\"jWnyxxxxxxxxxxxxxxxxX7ZQxxxxxxxxxxxxxxxx\",\n region_name=\"us-east-1\",\n)",
"language": "python",
"description": "Python - hardcoded AWS credentials"
},
{
"ruleId": "",
"ruleTitle": "Avoid Hardcoded Secrets",
"type": "good",
"code": "import boto3\nimport os\n\nkey = os.environ.get(\"ACCESS_KEY_ID\")\nsecret = os.environ.get(\"SECRET_ACCESS_KEY\")\ns3 = boto3.resource(\n \"s3\",\n aws_access_key_id=key,\n aws_secret_access_key=secret,\n region_name=\"us-east-1\",\n)",
"language": "python",
"description": "Python - AWS credentials from environment"
},
{
"ruleId": "",
"ruleTitle": "Avoid Hardcoded Secrets",
"type": "bad",
"code": "const jsonwt = require('jsonwebtoken')\n\nfunction signToken() {\n const payload = {foo: 'bar'}\n const token = jsonwt.sign(payload, 'my-secret-key')\n return token\n}",
"language": "javascript",
"description": "JavaScript - hardcoded JWT secret"
},
{
"ruleId": "",
"ruleTitle": "Avoid Hardcoded Secrets",
"type": "good",
"code": "const jsonwt = require('jsonwebtoken')\n\nfunction signToken() {\n const payload = {foo: 'bar'}\n const secret = process.env.JWT_SECRET\n const token = jsonwt.sign(payload, secret)\n return token\n}",
"language": "javascript",
"description": "JavaScript - JWT secret from environment"
},
{
"ruleId": "",
"ruleTitle": "Avoid Hardcoded Secrets",
"type": "bad",
"code": "var jwt = require('express-jwt');\n\napp.get('/protected', jwt({ secret: 'shhhhhhared-secret' }), function(req, res) {\n if (!req.user.admin) return res.sendStatus(401);\n res.sendStatus(200);\n});",
"language": "javascript",
"description": "JavaScript - hardcoded express-jwt secret"
},
{
"ruleId": "",
"ruleTitle": "Avoid Hardcoded Secrets",
"type": "good",
"code": "var jwt = require('express-jwt');\n\napp.get('/protected', jwt({ secret: process.env.JWT_SECRET }), function(req, res) {\n if (!req.user.admin) return res.sendStatus(401);\n res.sendStatus(200);\n});",
"language": "javascript",
"description": "JavaScript - express-jwt secret from environment"
},
{
"ruleId": "",
"ruleTitle": "Avoid Hardcoded Secrets",
"type": "bad",
"code": "import flask\napp = flask.Flask(__name__)\n\napp.config[\"SECRET_KEY\"] = '_5#y2L\"F4Q8z\\n\\xec]/'",
"language": "python",
"description": "Python Flask - hardcoded SECRET_KEY"
},
{
"ruleId": "",
"ruleTitle": "Avoid Hardcoded Secrets",
"type": "good",
"code": "import os\nimport flask\napp = flask.Flask(__name__)\n\napp.config[\"SECRET_KEY\"] = os.environ[\"SECRET_KEY\"]",
"language": "python",
"description": "Python Flask - SECRET_KEY from environment"
},
{
"ruleId": "",
"ruleTitle": "Avoid Hardcoded Secrets",
"type": "bad",
"code": "from models import UserProfile\n\ndef set_user_password(user_profile: UserProfile) -> None:\n password = \"\"\n user_profile.set_password(password)\n user_profile.save()",
"language": "python",
"description": "Python - empty password string"
},
{
"ruleId": "",
"ruleTitle": "Avoid Hardcoded Secrets",
"type": "good",
"code": "from models import UserProfile\n\ndef set_user_password(user_profile: UserProfile, password: str) -> None:\n user_profile.set_password(password)\n user_profile.save()",
"language": "python",
"description": "Python - password from secure source"
},
{
"ruleId": "",
"ruleTitle": "Avoid Hardcoded Secrets",
"type": "bad",
"code": "const stripe = require('stripe');\n\nconst client = stripe('sk_test_20cbqx6v2hpftsbq203r36yqccazez');",
"language": "javascript",
"description": "JavaScript - hardcoded Stripe token"
},
{
"ruleId": "",
"ruleTitle": "Avoid Hardcoded Secrets",
"type": "good",
"code": "const stripe = require('stripe');\n\nconst client = stripe(process.env.STRIPE_SECRET_KEY);",
"language": "javascript",
"description": "JavaScript - Stripe token from environment"
},
{
"ruleId": "",
"ruleTitle": "Avoid Hardcoded Secrets",
"type": "bad",
"code": "import requests\n\nheaders = {\"Authorization\": \"token ghp_emmtytndiqky5a98w0s98w36fakekey\"}\nresponse = requests.get(\"https://api.github.com/user\", headers=headers)",
"language": "python",
"description": "Python - hardcoded GitHub token"
},
{
"ruleId": "",
"ruleTitle": "Avoid Hardcoded Secrets",
"type": "good",
"code": "import os\nimport requests\n\nheaders = {\"Authorization\": f\"token {os.environ['GITHUB_TOKEN']}\"}\nresponse = requests.get(\"https://api.github.com/user\", headers=headers)",
"language": "python",
"description": "Python - GitHub token from environment"
},
{
"ruleId": "",
"ruleTitle": "Prevent SQL Injection",
"type": "bad",
"code": "import psycopg2\n\ndef get_user(user_input):\n conn = psycopg2.connect(\"dbname=test\")\n cur = conn.cursor()\n query = \"SELECT * FROM users WHERE name = '\" + user_input + \"'\"\n cur.execute(query)",
"language": "python",
"description": "string concatenation"
},
{
"ruleId": "",
"ruleTitle": "Prevent SQL Injection",
"type": "bad",
"code": "def get_user(user_input):\n cur.execute(\"SELECT * FROM users WHERE id = {}\".format(user_input))",
"language": "python",
"description": "format string"
},
{
"ruleId": "",
"ruleTitle": "Prevent SQL Injection",
"type": "bad",
"code": "def get_user(user_input):\n cur.execute(f\"SELECT * FROM users WHERE id = {user_input}\")",
"language": "python",
"description": "f-string"
},
{
"ruleId": "",
"ruleTitle": "Prevent SQL Injection",
"type": "good",
"code": "def get_user(user_input):\n conn = psycopg2.connect(\"dbname=test\")\n cur = conn.cursor()\n cur.execute(\"SELECT * FROM users WHERE name = %s\", [user_input])",
"language": "python",
"description": "parameterized query"
},
{
"ruleId": "",
"ruleTitle": "Prevent SQL Injection",
"type": "bad",
"code": "const { Pool } = require('pg')\nconst pool = new Pool()\n\nasync function getUser(userId) {\n const sql = `SELECT * FROM users WHERE id = ${userId}`\n const { rows } = await pool.query(sql)\n return rows\n}",
"language": "javascript",
"description": "template literal with variable"
},
{
"ruleId": "",
"ruleTitle": "Prevent SQL Injection",
"type": "bad",
"code": "async function getUser(userId) {\n const sql = \"SELECT * FROM users WHERE id = \" + userId\n const { rows } = await pool.query(sql)\n return rows\n}",
"language": "javascript",
"description": "string concatenation"
},
{
"ruleId": "",
"ruleTitle": "Prevent SQL Injection",
"type": "good",
"code": "async function getUser(userId) {\n const sql = 'SELECT * FROM users WHERE id = $1'\n const { rows } = await pool.query(sql, [userId])\n return rows\n}",
"language": "javascript",
"description": "parameterized query"
},
{
"ruleId": "",
"ruleTitle": "Prevent SQL Injection",
"type": "bad",
"code": "public ResultSet getUser(String input) throws SQLException {\n Statement stmt = connection.createStatement();\n String sql = \"SELECT * FROM users WHERE name = '\" + input + \"'\";\n return stmt.executeQuery(sql);\n}",
"language": "java",
"description": "string concatenation with Statement"
},
{
"ruleId": "",
"ruleTitle": "Prevent SQL Injection",
"type": "bad",
"code": "public ResultSet getUser(String input) throws SQLException {\n Statement stmt = connection.createStatement();\n return stmt.executeQuery(String.format(\"SELECT * FROM users WHERE name = '%s'\", input));\n}",
"language": "java",
"description": "String.format"
},
{
"ruleId": "",
"ruleTitle": "Prevent SQL Injection",
"type": "good",
"code": "public ResultSet getUser(String input) throws SQLException {\n PreparedStatement pstmt = connection.prepareStatement(\n \"SELECT * FROM users WHERE name = ?\");\n pstmt.setString(1, input);\n return pstmt.executeQuery();\n}",
"language": "java",
"description": "PreparedStatement with parameters"
},
{
"ruleId": "",
"ruleTitle": "Prevent SQL Injection",
"type": "bad",
"code": "func getUser(db *sql.DB, userInput string) {\n query := \"SELECT * FROM users WHERE name = '\" + userInput + \"'\"\n db.Query(query)\n}",
"language": "go",
"description": "string concatenation"
},
{
"ruleId": "",
"ruleTitle": "Prevent SQL Injection",
"type": "bad",
"code": "func getUser(db *sql.DB, email string) {\n query := fmt.Sprintf(\"SELECT * FROM users WHERE email = '%s'\", email)\n db.Query(query)\n}",
"language": "go",
"description": "fmt.Sprintf"
},
{
"ruleId": "",
"ruleTitle": "Prevent SQL Injection",
"type": "good",
"code": "func getUser(db *sql.DB, userInput string) {\n db.Query(\"SELECT * FROM users WHERE name = $1\", userInput)\n}",
"language": "go",
"description": "parameterized query"
},
{
"ruleId": "",
"ruleTitle": "Prevent SQL Injection",
"type": "bad",
"code": "def get_user(user_input)\n conn = PG.connect(dbname: 'test')\n query = \"SELECT * FROM users WHERE name = '\" + user_input + \"'\"\n conn.exec(query)\nend",
"language": "ruby",
"description": "string concatenation"
},
{
"ruleId": "",
"ruleTitle": "Prevent SQL Injection",
"type": "bad",
"code": "def get_user(user_input)\n conn = PG.connect(dbname: 'test')\n conn.exec(\"SELECT * FROM users WHERE name = '#{user_input}'\")\nend",
"language": "ruby",
"description": "string interpolation"
},
{
"ruleId": "",
"ruleTitle": "Prevent SQL Injection",
"type": "good",
"code": "def get_user(user_input)\n conn = PG.connect(dbname: 'test')\n conn.exec_params('SELECT * FROM users WHERE name = $1', [user_input])\nend",
"language": "ruby",
"description": "parameterized query"
},
{
"ruleId": "",
"ruleTitle": "Prevent SQL Injection",
"type": "bad",
"code": "public void GetUser(string userInput)\n{\n SqlCommand command = connection.CreateCommand();\n command.CommandText = String.Format(\n \"SELECT * FROM users WHERE name = '{0}'\", userInput);\n}",
"language": "csharp",
"description": "String.Format"
},
{
"ruleId": "",
"ruleTitle": "Prevent SQL Injection",
"type": "bad",
"code": "public void GetUser(string userInput)\n{\n SqlCommand command = new SqlCommand(\n \"SELECT * FROM users WHERE name = '\" + userInput + \"'\");\n}",
"language": "csharp",
"description": "string concatenation"
},
{
"ruleId": "",
"ruleTitle": "Prevent SQL Injection",
"type": "good",
"code": "public void GetUser(string userInput)\n{\n string sql = \"SELECT * FROM users WHERE name = @Name\";\n SqlCommand command = new SqlCommand(sql);\n command.Parameters.Add(\"@Name\", SqlDbType.NVarChar);\n command.Parameters[\"@Name\"].Value = userInput;\n}",
"language": "csharp",
"description": "SqlParameter"
},
{
"ruleId": "",
"ruleTitle": "Prevent Server-Side Request Forgery",
"type": "bad",
"code": "from django.http import HttpResponse\nimport requests\n\ndef fetch_user_data(request):\n host = request.POST.get('host')\n user_id = request.POST.get('user_id')\n response = requests.get(f\"https://{host}/api/users/{user_id}\")\n return HttpResponse(response.content)",
"language": "python",
"description": "user input flows into URL host"
},
{
"ruleId": "",
"ruleTitle": "Prevent Server-Side Request Forgery",
"type": "good",
"code": "from django.http import HttpResponse\nimport requests\n\ndef fetch_user_data(request):\n user_id = request.POST.get('user_id')\n response = requests.get(f\"https://api.example.com/users/{user_id}\")\n return HttpResponse(response.content)",
"language": "python",
"description": "fixed host, user data only in path"
},
{
"ruleId": "",
"ruleTitle": "Prevent Server-Side Request Forgery",
"type": "bad",
"code": "const express = require('express');\nconst axios = require('axios');\nconst app = express();\n\napp.get('/fetch', async (req, res) => {\n const url = req.query.url;\n const response = await axios.get(url);\n res.send(response.data);\n});",
"language": "javascript",
"description": "user input in URL"
},
{
"ruleId": "",
"ruleTitle": "Prevent Server-Side Request Forgery",
"type": "good",
"code": "const express = require('express');\nconst axios = require('axios');\nconst app = express();\n\napp.get('/fetch', async (req, res) => {\n const resourceId = req.query.id;\n const response = await axios.get(`https://api.example.com/resources/${resourceId}`);\n res.send(response.data);\n});",
"language": "javascript",
"description": "fixed host, user data only in path"
},
{
"ruleId": "",
"ruleTitle": "Prevent Server-Side Request Forgery",
"type": "bad",
"code": "import java.net.URL;\nimport java.net.URLConnection;\nimport org.springframework.web.bind.annotation.RequestParam;\n\n@RestController\npublic class FetchController {\n @GetMapping(\"/fetch\")\n public byte[] fetchImage(@RequestParam(\"url\") String imageUrl) throws Exception {\n URL u = new URL(imageUrl);\n URLConnection conn = u.openConnection();\n return conn.getInputStream().readAllBytes();\n }\n}",
"language": "java",
"description": "user-controlled URL"
},
{
"ruleId": "",
"ruleTitle": "Prevent Server-Side Request Forgery",
"type": "good",
"code": "import java.net.URL;\nimport org.springframework.web.bind.annotation.RequestParam;\n\n@RestController\npublic class FetchController {\n @GetMapping(\"/fetch\")\n public byte[] fetchImage(@RequestParam(\"id\") String imageId) throws Exception {\n String url = String.format(\"https://images.example.com/%s\", imageId);\n URL u = new URL(url);\n return u.openConnection().getInputStream().readAllBytes();\n }\n}",
"language": "java",
"description": "fixed host, user data in path"
},
{
"ruleId": "",
"ruleTitle": "Prevent Server-Side Request Forgery",
"type": "bad",
"code": "package main\n\nimport (\n \"fmt\"\n \"net/http\"\n)\n\nfunc handler(w http.ResponseWriter, r *http.Request) {\n host := r.URL.Query().Get(\"host\")\n url := fmt.Sprintf(\"https://%s/api/data\", host)\n resp, _ := http.Get(url)\n defer resp.Body.Close()\n}",
"language": "go",
"description": "user input in URL host"
},
{
"ruleId": "",
"ruleTitle": "Prevent Server-Side Request Forgery",
"type": "good",
"code": "package main\n\nimport (\n \"fmt\"\n \"net/http\"\n)\n\nfunc handler(w http.ResponseWriter, r *http.Request) {\n resourceId := r.URL.Query().Get(\"id\")\n url := fmt.Sprintf(\"https://api.example.com/data/%s\", resourceId)\n resp, _ := http.Get(url)\n defer resp.Body.Close()\n}",
"language": "go",
"description": "fixed host, user data in path"
},
{
"ruleId": "",
"ruleTitle": "Prevent Server-Side Request Forgery",
"type": "bad",
"code": "<?php\nfunction fetchData() {\n $url = $_GET['url'];\n $ch = curl_init($url);\n curl_setopt($ch, CURLOPT_RETURNTRANSFER, true);\n $response = curl_exec($ch);\n curl_close($ch);\n return $response;\n}\n?>",
"language": "php",
"description": "user input in URL"
},
{
"ruleId": "",
"ruleTitle": "Prevent Server-Side Request Forgery",
"type": "good",
"code": "<?php\nfunction fetchData() {\n $resourceId = $_GET['id'];\n $url = 'https://api.example.com/resources/' . $resourceId;\n $ch = curl_init($url);\n curl_setopt($ch, CURLOPT_RETURNTRANSFER, true);\n $response = curl_exec($ch);\n curl_close($ch);\n return $response;\n}\n?>",
"language": "php",
"description": "fixed host, user data in path"
},
{
"ruleId": "",
"ruleTitle": "Prevent Server-Side Request Forgery",
"type": "bad",
"code": "require 'net/http'\n\ndef fetch_data\n url = params[:url]\n uri = URI(url)\n Net::HTTP.get_response(uri)\nend",
"language": "ruby",
"description": "user input in HTTP request"
},
{
"ruleId": "",
"ruleTitle": "Prevent Server-Side Request Forgery",
"type": "good",
"code": "require 'net/http'\n\ndef fetch_data\n resource_id = params[:id]\n uri = URI(\"https://api.example.com/resources/#{resource_id}\")\n Net::HTTP.get_response(uri)\nend",
"language": "ruby",
"description": "fixed host, user data in path"
},
{
"ruleId": "",
"ruleTitle": "Secure AWS Terraform Configurations",
"type": "bad",
"code": "resource \"aws_s3_bucket_object\" \"fail\" {\n bucket = aws_s3_bucket.bucket.bucket\n key = \"my-object\"\n content = \"data\"\n}",
"language": "hcl",
"description": "Incorrect example for Secure AWS Terraform Configurations"
},
{
"ruleId": "",
"ruleTitle": "Secure AWS Terraform Configurations",
"type": "good",
"code": "resource \"aws_s3_bucket_object\" \"pass\" {\n bucket = aws_s3_bucket.bucket.bucket\n key = \"my-object\"\n content = \"data\"\n kms_key_id = aws_kms_key.example.arn\n}",
"language": "hcl",
"description": "Correct example for Secure AWS Terraform Configurations"
},
{
"ruleId": "",
"ruleTitle": "Secure AWS Terraform Configurations",
"type": "bad",
"code": "resource \"aws_iam_policy\" \"fail\" {\n policy = <<POLICY\n{\"Version\":\"2012-10-17\",\"Statement\":[{\"Action\":\"*\",\"Effect\":\"Allow\",\"Resource\":\"*\"}]}\nPOLICY\n}",
"language": "hcl",
"description": "wildcard admin"
},
{
"ruleId": "",
"ruleTitle": "Secure AWS Terraform Configurations",
"type": "good",
"code": "resource \"aws_iam_policy\" \"pass\" {\n policy = <<POLICY\n{\"Version\":\"2012-10-17\",\"Statement\":[{\"Action\":[\"s3:GetObject*\"],\"Effect\":\"Allow\",\"Resource\":\"arn:aws:s3:::bucket/*\"}]}\nPOLICY\n}",
"language": "hcl",
"description": "least privilege"
},
{
"ruleId": "",
"ruleTitle": "Secure AWS Terraform Configurations",
"type": "bad",
"code": "resource \"aws_iam_role\" \"fail\" {\n assume_role_policy = <<POLICY\n{\"Version\":\"2012-10-17\",\"Statement\":[{\"Effect\":\"Allow\",\"Principal\":{\"AWS\":\"*\"},\"Action\":\"sts:AssumeRole\"}]}\nPOLICY\n}",
"language": "hcl",
"description": "wildcard AssumeRole"
},
{
"ruleId": "",
"ruleTitle": "Secure AWS Terraform Configurations",
"type": "good",
"code": "resource \"aws_iam_role\" \"pass\" {\n assume_role_policy = <<POLICY\n{\"Version\":\"2012-10-17\",\"Statement\":[{\"Effect\":\"Allow\",\"Principal\":{\"AWS\":\"arn:aws:iam::123456789012:root\"},\"Action\":\"sts:AssumeRole\"}]}\nPOLICY\n}",
"language": "hcl",
"description": "restricted AssumeRole"
},
{
"ruleId": "",
"ruleTitle": "Secure AWS Terraform Configurations",
"type": "bad",
"code": "resource \"aws_ebs_volume\" \"fail\" {\n availability_zone = \"us-west-2a\"\n encrypted = false\n}",
"language": "hcl",
"description": "EBS"
},
{
"ruleId": "",
"ruleTitle": "Secure AWS Terraform Configurations",
"type": "good",
"code": "resource \"aws_ebs_volume\" \"pass\" {\n availability_zone = \"us-west-2a\"\n encrypted = true\n}",
"language": "hcl",
"description": "EBS"
},
{
"ruleId": "",
"ruleTitle": "Secure AWS Terraform Configurations",
"type": "bad",
"code": "resource \"aws_db_instance\" \"fail\" { backup_retention_period = 0 }",
"language": "hcl",
"description": "RDS no backup"
},
{
"ruleId": "",
"ruleTitle": "Secure AWS Terraform Configurations",
"type": "good",
"code": "resource \"aws_db_instance\" \"pass\" { backup_retention_period = 35 }",
"language": "hcl",
"description": "RDS with backup"
},
{
"ruleId": "",
"ruleTitle": "Secure AWS Terraform Configurations",
"type": "bad",
"code": "resource \"aws_dynamodb_table\" \"fail\" {\n name = \"Table\"; hash_key = \"Id\"\n attribute { name = \"Id\"; type = \"S\" }\n}",
"language": "hcl",
"description": "DynamoDB"
},
{
"ruleId": "",
"ruleTitle": "Secure AWS Terraform Configurations",
"type": "good",
"code": "resource \"aws_dynamodb_table\" \"pass\" {\n name = \"Table\"; hash_key = \"Id\"\n attribute { name = \"Id\"; type = \"S\" }\n server_side_encryption { enabled = true; kms_key_arn = \"arn:aws:kms:...\" }\n}",
"language": "hcl",
"description": "DynamoDB with CMK"
},
{
"ruleId": "",
"ruleTitle": "Secure AWS Terraform Configurations",
"type": "bad",
"code": "resource \"aws_sqs_queue\" \"fail\" { name = \"queue\" }\nresource \"aws_sns_topic\" \"fail\" {}",
"language": "hcl",
"description": "SQS/SNS"
},
{
"ruleId": "",
"ruleTitle": "Secure AWS Terraform Configurations",
"type": "good",
"code": "resource \"aws_sqs_queue\" \"pass\" { name = \"queue\"; sqs_managed_sse_enabled = true }\nresource \"aws_sns_topic\" \"pass\" { kms_master_key_id = \"alias/aws/sns\" }",
"language": "hcl",
"description": "SQS/SNS encrypted"
},
{
"ruleId": "",
"ruleTitle": "Secure AWS Terraform Configurations",
"type": "bad",
"code": "resource \"aws_security_group_rule\" \"fail\" {\n type = \"ingress\"; protocol = \"tcp\"; from_port = 22; to_port = 22\n cidr_blocks = [\"0.0.0.0/0\"]\n}",
"language": "hcl",
"description": "public SSH"
},
{
"ruleId": "",
"ruleTitle": "Secure AWS Terraform Configurations",
"type": "good",
"code": "resource \"aws_security_group_rule\" \"pass\" {\n type = \"ingress\"; protocol = \"tcp\"; from_port = 22; to_port = 22\n cidr_blocks = [\"10.0.0.0/8\"]\n}",
"language": "hcl",
"description": "restricted CIDR"
},
{
"ruleId": "",
"ruleTitle": "Secure AWS Terraform Configurations",
"type": "bad",
"code": "resource \"aws_instance\" \"fail\" {\n ami = \"ami-12345\"; instance_type = \"t3.micro\"\n associate_public_ip_address = true\n}",
"language": "hcl",
"description": "public IP"
},
{
"ruleId": "",
"ruleTitle": "Secure AWS Terraform Configurations",
"type": "good",
"code": "resource \"aws_instance\" \"pass\" {\n ami = \"ami-12345\"; instance_type = \"t3.micro\"\n associate_public_ip_address = false\n}",
"language": "hcl",
"description": "no public IP"
},
{
"ruleId": "",
"ruleTitle": "Secure AWS Terraform Configurations",
"type": "bad",
"code": "resource \"aws_kms_key\" \"fail\" { enable_key_rotation = false }",
"language": "hcl",
"description": "KMS no rotation"
},
{
"ruleId": "",
"ruleTitle": "Secure AWS Terraform Configurations",
"type": "good",
"code": "resource \"aws_kms_key\" \"pass\" { enable_key_rotation = true }",
"language": "hcl",
"description": "KMS with rotation"
},
{
"ruleId": "",
"ruleTitle": "Secure AWS Terraform Configurations",
"type": "bad",
"code": "resource \"aws_cloudtrail\" \"fail\" { name = \"trail\"; s3_bucket_name = \"bucket\" }",
"language": "hcl",
"description": "CloudTrail"
},
{
"ruleId": "",
"ruleTitle": "Secure AWS Terraform Configurations",
"type": "good",
"code": "resource \"aws_cloudtrail\" \"pass\" {\n name = \"trail\"; s3_bucket_name = \"bucket\"; kms_key_id = aws_kms_key.key.arn\n}",
"language": "hcl",
"description": "CloudTrail encrypted"
},
{
"ruleId": "",
"ruleTitle": "Secure AWS Terraform Configurations",
"type": "bad",
"code": "provider \"aws\" {\n region = \"us-west-2\"; access_key = \"AKIAEXAMPLE\"; secret_key = \"secret\"\n}",
"language": "hcl",
"description": "hardcoded"
},
{
"ruleId": "",
"ruleTitle": "Secure AWS Terraform Configurations",
"type": "good",
"code": "provider \"aws\" {\n region = \"us-west-2\"; shared_credentials_file = \"~/.aws/creds\"; profile = \"myprofile\"\n}",
"language": "hcl",
"description": "external credentials"
},
{
"ruleId": "",
"ruleTitle": "Secure Azure Terraform Configurations",
"type": "bad",
"code": "resource \"azurerm_storage_account\" \"bad\" {\n name = \"storageaccountname\"\n resource_group_name = azurerm_resource_group.example.name\n location = azurerm_resource_group.example.location\n min_tls_version = \"TLS1_0\"\n enable_https_traffic_only = false\n}\n\nresource \"azurerm_storage_container\" \"bad\" {\n name = \"vhds\"\n storage_account_name = azurerm_storage_account.example.name\n container_access_type = \"blob\"\n}",
"language": "hcl",
"description": "Incorrect example for Secure Azure Terraform Configurations"
},
{
"ruleId": "",
"ruleTitle": "Secure Azure Terraform Configurations",
"type": "good",
"code": "resource \"azurerm_storage_account\" \"good\" {\n name = \"storageaccountname\"\n resource_group_name = azurerm_resource_group.example.name\n location = azurerm_resource_group.example.location\n min_tls_version = \"TLS1_2\"\n enable_https_traffic_only = true\n network_rules {\n default_action = \"Deny\"\n ip_rules = [\"100.0.0.1\"]\n virtual_network_subnet_ids = [azurerm_subnet.example.id]\n bypass = [\"Metrics\", \"AzureServices\"]\n }\n}\n\nresource \"azurerm_storage_container\" \"good\" {\n name = \"vhds\"\n storage_account_name = azurerm_storage_account.example.name\n container_access_type = \"private\"\n}",
"language": "hcl",
"description": "Correct example for Secure Azure Terraform Configurations"
},
{
"ruleId": "",
"ruleTitle": "Secure Azure Terraform Configurations",
"type": "bad",
"code": "resource \"azurerm_app_service\" \"bad\" {\n name = \"example-app-service\"\n location = azurerm_resource_group.example.location\n resource_group_name = azurerm_resource_group.example.name\n app_service_plan_id = azurerm_app_service_plan.example.id\n https_only = false\n remote_debugging_enabled = true\n site_config {\n min_tls_version = \"1.0\"\n cors { allowed_origins = [\"*\"] }\n }\n auth_settings { enabled = false }\n}",
"language": "hcl",
"description": "Incorrect example for Secure Azure Terraform Configurations"
},
{
"ruleId": "",
"ruleTitle": "Secure Azure Terraform Configurations",
"type": "good",
"code": "resource \"azurerm_app_service\" \"good\" {\n name = \"example-app-service\"\n location = azurerm_resource_group.example.location\n resource_group_name = azurerm_resource_group.example.name\n app_service_plan_id = azurerm_app_service_plan.example.id\n https_only = true\n remote_debugging_enabled = false\n site_config {\n min_tls_version = \"1.2\"\n cors { allowed_origins = [\"https://example.com\"] }\n }\n auth_settings { enabled = true }\n}",
"language": "hcl",
"description": "Correct example for Secure Azure Terraform Configurations"
},
{
"ruleId": "",
"ruleTitle": "Secure Azure Terraform Configurations",
"type": "bad",
"code": "resource \"azurerm_key_vault\" \"bad\" {\n name = \"examplekeyvault\"\n location = azurerm_resource_group.example.location\n purge_protection_enabled = false\n network_acls { bypass = \"AzureServices\"; default_action = \"Allow\" }\n}\n\nresource \"azurerm_key_vault_key\" \"bad\" {\n name = \"mykey\"\n key_vault_id = azurerm_key_vault.example.id\n key_type = \"RSA\"\n key_size = 2048\n key_opts = [\"decrypt\", \"encrypt\", \"sign\", \"unwrapKey\", \"verify\", \"wrapKey\"]\n}",
"language": "hcl",
"description": "Incorrect example for Secure Azure Terraform Configurations"
},
{
"ruleId": "",
"ruleTitle": "Secure Azure Terraform Configurations",
"type": "good",
"code": "resource \"azurerm_key_vault\" \"good\" {\n name = \"examplekeyvault\"\n location = azurerm_resource_group.example.location\n soft_delete_retention_days = 7\n purge_protection_enabled = true\n network_acls { bypass = \"AzureServices\"; default_action = \"Deny\" }\n}\n\nresource \"azurerm_key_vault_key\" \"good\" {\n name = \"mykey\"\n key_vault_id = azurerm_key_vault.example.id\n key_type = \"RSA\"\n key_size = 2048\n expiration_date = \"2025-12-31T00:00:00Z\"\n key_opts = [\"decrypt\", \"encrypt\", \"sign\", \"unwrapKey\", \"verify\", \"wrapKey\"]\n}",
"language": "hcl",
"description": "Correct example for Secure Azure Terraform Configurations"
},
{
"ruleId": "",
"ruleTitle": "Secure Azure Terraform Configurations",
"type": "bad",
"code": "resource \"azurerm_mssql_server\" \"bad\" {\n name = \"mssqlserver\"\n resource_group_name = azurerm_resource_group.example.name\n location = azurerm_resource_group.example.location\n version = \"12.0\"\n minimum_tls_version = \"1.0\"\n public_network_access_enabled = true\n}\n\nresource \"azurerm_mysql_firewall_rule\" \"bad\" {\n name = \"office\"\n server_name = azurerm_mysql_server.example.name\n start_ip_address = \"0.0.0.0\"\n end_ip_address = \"255.255.255.255\"\n}",
"language": "hcl",
"description": "Incorrect example for Secure Azure Terraform Configurations"
},
{
"ruleId": "",
"ruleTitle": "Secure Azure Terraform Configurations",
"type": "good",
"code": "resource \"azurerm_mssql_server\" \"good\" {\n name = \"mssqlserver\"\n resource_group_name = azurerm_resource_group.example.name\n location = azurerm_resource_group.example.location\n version = \"12.0\"\n minimum_tls_version = \"1.2\"\n public_network_access_enabled = false\n azuread_administrator {\n login_username = \"AzureAD Admin\"\n object_id = \"00000000-0000-0000-0000-000000000000\"\n }\n}\n\nresource \"azurerm_mysql_firewall_rule\" \"good\" {\n name = \"office\"\n server_name = azurerm_mysql_server.example.name\n start_ip_address = \"40.112.8.12\"\n end_ip_address = \"40.112.8.17\"\n}",
"language": "hcl",
"description": "Correct example for Secure Azure Terraform Configurations"
},
{
"ruleId": "",
"ruleTitle": "Secure Azure Terraform Configurations",
"type": "bad",
"code": "resource \"azurerm_kubernetes_cluster\" \"bad\" {\n name = \"example-aks1\"\n location = azurerm_resource_group.example.location\n resource_group_name = azurerm_resource_group.example.name\n dns_prefix = \"exampleaks1\"\n private_cluster_enabled = false\n api_server_authorized_ip_ranges = []\n default_node_pool { name = \"default\"; node_count = 1; vm_size = \"Standard_D2_v2\" }\n identity { type = \"SystemAssigned\" }\n}",
"language": "hcl",
"description": "Incorrect example for Secure Azure Terraform Configurations"
},
{
"ruleId": "",
"ruleTitle": "Secure Azure Terraform Configurations",
"type": "good",
"code": "resource \"azurerm_kubernetes_cluster\" \"good\" {\n name = \"example-aks1\"\n location = azurerm_resource_group.example.location\n resource_group_name = azurerm_resource_group.example.name\n dns_prefix = \"exampleaks1\"\n private_cluster_enabled = true\n disk_encryption_set_id = azurerm_disk_encryption_set.example.id\n api_server_authorized_ip_ranges = [\"192.168.0.0/16\"]\n default_node_pool { name = \"default\"; node_count = 1; vm_size = \"Standard_D2_v2\" }\n identity { type = \"SystemAssigned\" }\n}",
"language": "hcl",
"description": "Correct example for Secure Azure Terraform Configurations"
},
{
"ruleId": "",
"ruleTitle": "Secure Azure Terraform Configurations",
"type": "bad",
"code": "resource \"azurerm_linux_virtual_machine_scale_set\" \"bad\" {\n name = \"example-vmss\"\n resource_group_name = azurerm_resource_group.example.name\n location = azurerm_resource_group.example.location\n sku = \"Standard_F2\"\n admin_username = \"adminuser\"\n admin_password = \"P@55w0rd1234!\"\n encryption_at_host_enabled = false\n disable_password_authentication = false\n}",
"language": "hcl",
"description": "Incorrect example for Secure Azure Terraform Configurations"
},
{
"ruleId": "",
"ruleTitle": "Secure Azure Terraform Configurations",
"type": "good",
"code": "resource \"azurerm_linux_virtual_machine_scale_set\" \"good\" {\n name = \"example-vmss\"\n resource_group_name = azurerm_resource_group.example.name\n location = azurerm_resource_group.example.location\n sku = \"Standard_F2\"\n admin_username = \"adminuser\"\n encryption_at_host_enabled = true\n disable_password_authentication = true\n admin_ssh_key { username = \"adminuser\"; public_key = tls_private_key.new.public_key_pem }\n}",
"language": "hcl",
"description": "Correct example for Secure Azure Terraform Configurations"
},
{
"ruleId": "",
"ruleTitle": "Secure Azure Terraform Configurations",
"type": "bad",
"code": "resource \"azurerm_cosmosdb_account\" \"bad\" {\n name = \"tfex-cosmos-db\"\n location = azurerm_resource_group.example.location\n resource_group_name = azurerm_resource_group.example.name\n offer_type = \"Standard\"\n kind = \"GlobalDocumentDB\"\n public_network_access_enabled = true\n}\n\nresource \"azurerm_container_group\" \"bad\" {\n name = \"example-continst\"\n location = azurerm_resource_group.example.location\n resource_group_name = azurerm_resource_group.example.name\n ip_address_type = \"public\"\n os_type = \"Linux\"\n container { name = \"hello-world\"; image = \"microsoft/aci-helloworld:latest\"; cpu = \"0.5\"; memory = \"1.5\" }\n}",
"language": "hcl",
"description": "Incorrect example for Secure Azure Terraform Configurations"
},
{
"ruleId": "",
"ruleTitle": "Secure Azure Terraform Configurations",
"type": "good",
"code": "resource \"azurerm_cosmosdb_account\" \"good\" {\n name = \"tfex-cosmos-db\"\n location = azurerm_resource_group.example.location\n resource_group_name = azurerm_resource_group.example.name\n offer_type = \"Standard\"\n kind = \"GlobalDocumentDB\"\n public_network_access_enabled = false\n key_vault_key_id = azurerm_key_vault_key.example.versionless_id\n}\n\nresource \"azurerm_container_group\" \"good\" {\n name = \"example-continst\"\n location = azurerm_resource_group.example.location\n resource_group_name = azurerm_resource_group.example.name\n ip_address_type = \"private\"\n os_type = \"Linux\"\n network_profile_id = azurerm_network_profile.example.id\n container { name = \"hello-world\"; image = \"microsoft/aci-helloworld:latest\"; cpu = \"0.5\"; memory = \"1.5\" }\n}",
"language": "hcl",
"description": "Correct example for Secure Azure Terraform Configurations"
},
{
"ruleId": "",
"ruleTitle": "Secure Azure Terraform Configurations",
"type": "bad",
"code": "resource \"azurerm_role_definition\" \"bad\" {\n name = \"my-custom-role\"\n scope = data.azurerm_subscription.primary.id\n permissions { actions = [\"*\"]; not_actions = [] }\n assignable_scopes = [data.azurerm_subscription.primary.id]\n}",
"language": "hcl",
"description": "Incorrect example for Secure Azure Terraform Configurations"
},
{
"ruleId": "",
"ruleTitle": "Secure Azure Terraform Configurations",
"type": "good",
"code": "resource \"azurerm_role_definition\" \"good\" {\n name = \"my-custom-role\"\n scope = data.azurerm_subscription.primary.id\n permissions {\n actions = [\n \"Microsoft.Authorization/*/read\",\n \"Microsoft.Insights/alertRules/*\",\n \"Microsoft.Resources/deployments/write\",\n \"Microsoft.Support/*\"\n ]\n not_actions = []\n }\n assignable_scopes = [data.azurerm_subscription.primary.id]\n}",
"language": "hcl",
"description": "Correct example for Secure Azure Terraform Configurations"
},
{
"ruleId": "",
"ruleTitle": "Secure GCP Terraform Configurations",
"type": "bad",
"code": "resource \"google_storage_bucket\" \"insecure\" {\n name = \"example\"\n location = \"EU\"\n uniform_bucket_level_access = false\n}\nresource \"google_storage_bucket_iam_member\" \"public\" {\n bucket = google_storage_bucket.default.name\n role = \"roles/storage.admin\"\n member = \"allUsers\"\n}",
"language": "hcl",
"description": "Incorrect example for Secure GCP Terraform Configurations"
},
{
"ruleId": "",
"ruleTitle": "Secure GCP Terraform Configurations",
"type": "good",
"code": "resource \"google_storage_bucket\" \"secure\" {\n name = \"example\"\n location = \"EU\"\n uniform_bucket_level_access = true\n versioning { enabled = true }\n logging { log_bucket = \"my-logging-bucket\" }\n}\nresource \"google_storage_bucket_iam_member\" \"restricted\" {\n bucket = google_storage_bucket.default.name\n role = \"roles/storage.admin\"\n member = \"user:jane@example.com\"\n}",
"language": "hcl",
"description": "Correct example for Secure GCP Terraform Configurations"
},
{
"ruleId": "",
"ruleTitle": "Secure GCP Terraform Configurations",
"type": "bad",
"code": "resource \"google_compute_instance\" \"insecure\" {\n name = \"test\"; machine_type = \"n1-standard-1\"; zone = \"us-central1-a\"\n can_ip_forward = true; boot_disk {}\n metadata = { serial-port-enable = true, enable-oslogin = false }\n network_interface { network = \"default\"; access_config {} }\n}\nresource \"google_compute_firewall\" \"open\" {\n name = \"allow-all\"; network = \"google_compute_network.vpc.name\"\n allow { protocol = \"tcp\"; ports = [22, 3389] }\n source_ranges = [\"0.0.0.0/0\"]\n}",
"language": "hcl",
"description": "Incorrect example for Secure GCP Terraform Configurations"
},
{
"ruleId": "",
"ruleTitle": "Secure GCP Terraform Configurations",
"type": "good",
"code": "resource \"google_compute_instance\" \"secure\" {\n name = \"test\"; machine_type = \"n1-standard-1\"; zone = \"us-central1-a\"\n can_ip_forward = false\n boot_disk { kms_key_self_link = google_kms_crypto_key.key.id }\n metadata = { enable-oslogin = true }\n network_interface { network = \"default\" }\n shielded_instance_config { enable_vtpm = true; enable_integrity_monitoring = true }\n}\nresource \"google_compute_firewall\" \"restricted\" {\n name = \"allow-ssh\"; network = \"google_compute_network.vpc.name\"\n allow { protocol = \"tcp\"; ports = [\"22\"] }\n source_ranges = [\"172.1.2.3/32\"]; target_tags = [\"ssh\"]\n}",
"language": "hcl",
"description": "Correct example for Secure GCP Terraform Configurations"
},
{
"ruleId": "",
"ruleTitle": "Secure GCP Terraform Configurations",
"type": "bad",
"code": "resource \"google_container_cluster\" \"insecure\" {\n name = \"my-cluster\"; location = \"us-central1-a\"; initial_node_count = 3\n enable_legacy_abac = true; logging_service = \"none\"\n master_auth { username = \"admin\"; password = \"password123\" }\n}",
"language": "hcl",
"description": "Incorrect example for Secure GCP Terraform Configurations"
},
{
"ruleId": "",
"ruleTitle": "Secure GCP Terraform Configurations",
"type": "good",
"code": "resource \"google_container_cluster\" \"secure\" {\n name = \"my-cluster\"; location = \"us-central1-a\"; initial_node_count = 3\n enable_legacy_abac = false; enable_shielded_nodes = true; enable_binary_authorization = true\n private_cluster_config { enable_private_nodes = true; master_ipv4_cidr_block = \"10.0.0.0/28\" }\n master_authorized_networks_config { cidr_blocks { cidr_block = \"10.0.0.0/8\" } }\n master_auth { client_certificate_config { issue_client_certificate = false } }\n network_policy { enabled = true }\n}\nresource \"google_container_node_pool\" \"secure\" {\n name = \"my-pool\"; cluster = \"my-cluster\"\n management { auto_repair = true; auto_upgrade = true }\n}",
"language": "hcl",
"description": "Correct example for Secure GCP Terraform Configurations"
},
{
"ruleId": "",
"ruleTitle": "Secure GCP Terraform Configurations",
"type": "bad",
"code": "resource \"google_sql_database_instance\" \"insecure\" {\n database_version = \"MYSQL_8_0\"; name = \"instance\"\n settings {\n tier = \"db-f1-micro\"\n ip_configuration { ipv4_enabled = true; authorized_networks { value = \"0.0.0.0/0\" } }\n }\n}",
"language": "hcl",
"description": "Incorrect example for Secure GCP Terraform Configurations"
},
{
"ruleId": "",
"ruleTitle": "Secure GCP Terraform Configurations",
"type": "good",
"code": "resource \"google_sql_database_instance\" \"secure\" {\n database_version = \"MYSQL_8_0\"; name = \"instance\"\n settings {\n tier = \"db-f1-micro\"\n ip_configuration { ipv4_enabled = false; require_ssl = true; private_network = google_compute_network.net.id }\n }\n}",
"language": "hcl",
"description": "Correct example for Secure GCP Terraform Configurations"
},
{
"ruleId": "",
"ruleTitle": "Secure GCP Terraform Configurations",
"type": "bad",
"code": "resource \"google_project_iam_member\" \"dangerous\" {\n project = \"your-project-id\"; role = \"roles/iam.serviceAccountTokenCreator\"\n member = \"serviceAccount:test-compute@developer.gserviceaccount.com\"\n}\nresource \"google_compute_subnetwork\" \"no_logs\" {\n name = \"example\"; ip_cidr_range = \"10.0.0.0/16\"; network = \"google_compute_network.vpc.id\"\n}\nresource \"google_project\" \"default_network\" {\n name = \"My Project\"; project_id = \"your-project-id\"; org_id = \"1234567\"\n}",
"language": "hcl",
"description": "Incorrect example for Secure GCP Terraform Configurations"
},
{
"ruleId": "",
"ruleTitle": "Secure GCP Terraform Configurations",
"type": "good",
"code": "resource \"google_project_iam_member\" \"safe\" {\n project = \"your-project-id\"; role = \"roles/viewer\"; member = \"user:jane@example.com\"\n}\nresource \"google_compute_subnetwork\" \"with_logs\" {\n name = \"example\"; ip_cidr_range = \"10.0.0.0/16\"; network = \"google_compute_network.vpc.self_link\"\n log_config { aggregation_interval = \"INTERVAL_10_MIN\"; flow_sampling = 0.5 }\n}\nresource \"google_project\" \"no_default_network\" {\n name = \"My Project\"; project_id = \"your-project-id\"; org_id = \"1234567\"; auto_create_network = false\n}",
"language": "hcl",
"description": "Correct example for Secure GCP Terraform Configurations"
},
{
"ruleId": "",
"ruleTitle": "Secure GCP Terraform Configurations",
"type": "bad",
"code": "resource \"google_kms_crypto_key\" \"unprotected\" {\n name = \"key\"; key_ring = google_kms_key_ring.keyring.id; rotation_period = \"15552000s\"\n}\nresource \"google_redis_instance\" \"insecure\" { name = \"my-instance\"; memory_size_gb = 1; auth_enabled = false }\nresource \"google_bigquery_dataset\" \"unencrypted\" { dataset_id = \"example\"; location = \"EU\" }\nresource \"google_pubsub_topic\" \"unencrypted\" { name = \"example-topic\" }",
"language": "hcl",
"description": "Incorrect example for Secure GCP Terraform Configurations"
},
{
"ruleId": "",
"ruleTitle": "Secure GCP Terraform Configurations",
"type": "good",
"code": "resource \"google_kms_crypto_key\" \"protected\" {\n name = \"key\"; key_ring = google_kms_key_ring.keyring.id; rotation_period = \"15552000s\"\n lifecycle { prevent_destroy = true }\n}\nresource \"google_redis_instance\" \"secure\" {\n name = \"my-instance\"; memory_size_gb = 1; auth_enabled = true; transit_encryption_mode = \"SERVER_AUTHENTICATION\"\n}\nresource \"google_bigquery_dataset\" \"encrypted\" {\n dataset_id = \"example\"; location = \"EU\"\n default_encryption_configuration { kms_key_name = google_kms_crypto_key.example.name }\n}\nresource \"google_pubsub_topic\" \"encrypted\" { name = \"topic\"; kms_key_name = google_kms_crypto_key.key.id }",
"language": "hcl",
"description": "Correct example for Secure GCP Terraform Configurations"
},
{
"ruleId": "",
"ruleTitle": "Secure GCP Terraform Configurations",
"type": "bad",
"code": "resource \"google_cloud_run_service_iam_member\" \"public\" {\n location = google_cloud_run_service.default.location; service = google_cloud_run_service.default.name\n role = \"roles/run.invoker\"; member = \"allUsers\"\n}\nresource \"google_cloudbuild_worker_pool\" \"public\" { name = \"pool\"; location = \"eu-west1\"; worker_config { no_external_ip = false } }\nresource \"google_dataproc_cluster\" \"public\" { name = \"cluster\"; region = \"us-central1\"; cluster_config { gce_cluster_config { internal_ip_only = false } } }\nresource \"google_notebooks_instance\" \"public\" {\n name = \"instance\"; location = \"us-west1-a\"; machine_type = \"e2-medium\"\n vm_image { project = \"deeplearning-platform-release\"; image_family = \"tf-latest-cpu\" }; no_public_ip = false\n}",
"language": "hcl",
"description": "Incorrect example for Secure GCP Terraform Configurations"
},
{
"ruleId": "",
"ruleTitle": "Secure GCP Terraform Configurations",
"type": "good",
"code": "resource \"google_cloud_run_service_iam_member\" \"restricted\" {\n location = google_cloud_run_service.default.location; service = google_cloud_run_service.default.name\n role = \"roles/run.invoker\"; member = \"user:jane@example.com\"\n}\nresource \"google_cloudbuild_worker_pool\" \"private\" { name = \"pool\"; location = \"eu-west1\"; worker_config { no_external_ip = true } }\nresource \"google_dataproc_cluster\" \"private\" { name = \"cluster\"; region = \"us-central1\"; cluster_config { gce_cluster_config { internal_ip_only = true } } }\nresource \"google_notebooks_instance\" \"private\" {\n name = \"instance\"; location = \"us-west1-a\"; machine_type = \"e2-medium\"\n vm_image { project = \"deeplearning-platform-release\"; image_family = \"tf-latest-cpu\" }; no_public_ip = true\n}",
"language": "hcl",
"description": "Correct example for Secure GCP Terraform Configurations"
},
{
"ruleId": "",
"ruleTitle": "Secure GCP Terraform Configurations",
"type": "bad",
"code": "resource \"google_compute_ssl_policy\" \"weak\" { name = \"weak\"; min_tls_version = \"TLS_1_0\" }\nresource \"google_dns_managed_zone\" \"weak\" {\n name = \"zone\"; dns_name = \"example.com.\"\n dnssec_config { state = \"on\"; default_key_specs { algorithm = \"rsasha1\"; key_length = 2048; key_type = \"keySigning\" } }\n}",
"language": "hcl",
"description": "Incorrect example for Secure GCP Terraform Configurations"
},
{
"ruleId": "",
"ruleTitle": "Secure GCP Terraform Configurations",
"type": "good",
"code": "resource \"google_compute_ssl_policy\" \"strong\" { name = \"strong\"; min_tls_version = \"TLS_1_2\"; profile = \"MODERN\" }\nresource \"google_dns_managed_zone\" \"strong\" {\n name = \"zone\"; dns_name = \"example.com.\"\n dnssec_config { state = \"on\"; default_key_specs { algorithm = \"rsasha256\"; key_length = 2048; key_type = \"keySigning\" } }\n}",
"language": "hcl",
"description": "Correct example for Secure GCP Terraform Configurations"
},
{
"ruleId": "",
"ruleTitle": "Avoid Unsafe Functions",
"type": "bad",
"code": "int bad_strcpy(src, dst) {\n n = DST_BUFFER_SIZE;\n if ((dst != NULL) && (src != NULL) && (strlen(dst)+strlen(src)+1 <= n))\n {\n // ruleid: insecure-use-strcat-fn\n strcat(dst, src);\n\n // ruleid: insecure-use-strcat-fn\n strncat(dst, src, 100);\n }\n}",
"language": "c",
"description": "C - strcat buffer overflow"
},
{
"ruleId": "",
"ruleTitle": "Avoid Unsafe Functions",
"type": "good",
"code": "// Use strcat_s which performs bounds checking",
"language": "c",
"description": "C - use strcat_s with bounds checking"
},
{
"ruleId": "",
"ruleTitle": "Avoid Unsafe Functions",
"type": "bad",
"code": "int bad_strcpy(src, dst) {\n n = DST_BUFFER_SIZE;\n if ((dst != NULL) && (src != NULL) && (strlen(dst)+strlen(src)+1 <= n))\n {\n // ruleid: insecure-use-string-copy-fn\n strcpy(dst, src);\n\n // ruleid: insecure-use-string-copy-fn\n strncpy(dst, src, 100);\n }\n}",
"language": "c",
"description": "C - strcpy buffer overflow"
},
{
"ruleId": "",
"ruleTitle": "Avoid Unsafe Functions",
"type": "good",
"code": "// Use strcpy_s which performs bounds checking",
"language": "c",
"description": "C - use strcpy_s with bounds checking"
},
{
"ruleId": "",
"ruleTitle": "Avoid Unsafe Functions",
"type": "bad",
"code": "int bad_code() {\n char str[DST_BUFFER_SIZE];\n fgets(str, DST_BUFFER_SIZE, stdin);\n // ruleid:insecure-use-strtok-fn\n strtok(str, \" \");\n printf(\"%s\", str);\n return 0;\n}",
"language": "c",
"description": "C - strtok modifies buffer"
},
{
"ruleId": "",
"ruleTitle": "Avoid Unsafe Functions",
"type": "good",
"code": "int main() {\n char str[DST_BUFFER_SIZE];\n char dest[DST_BUFFER_SIZE];\n fgets(str, DST_BUFFER_SIZE, stdin);\n // ok:insecure-use-strtok-fn\n strtok_r(str, \" \", *dest);\n printf(\"%s\", str);\n return 0;\n}",
"language": "c",
"description": "C - use strtok_r instead"
},
{
"ruleId": "",
"ruleTitle": "Avoid Unsafe Functions",
"type": "bad",
"code": "int bad_code() {\n char str[DST_BUFFER_SIZE];\n // ruleid:insecure-use-scanf-fn\n scanf(\"%s\", str);\n printf(\"%s\", str);\n return 0;\n}",
"language": "c",
"description": "C - scanf buffer overflow"
},
{
"ruleId": "",
"ruleTitle": "Avoid Unsafe Functions",
"type": "good",
"code": "int main() {\n char str[DST_BUFFER_SIZE];\n // ok:insecure-use-scanf-fn\n fgets(str);\n printf(\"%s\", str);\n return 0;\n}",
"language": "c",
"description": "C - use fgets instead"
},
{
"ruleId": "",
"ruleTitle": "Avoid Unsafe Functions",
"type": "bad",
"code": "int bad_code() {\n char str[DST_BUFFER_SIZE];\n // ruleid:insecure-use-gets-fn\n gets(str);\n printf(\"%s\", str);\n return 0;\n}",
"language": "c",
"description": "C - gets buffer overflow"
},
{
"ruleId": "",
"ruleTitle": "Avoid Unsafe Functions",
"type": "good",
"code": "int main() {\n char str[DST_BUFFER_SIZE];\n // ok:insecure-use-gets-fn\n fgets(str);\n printf(\"%s\", str);\n return 0;\n}",
"language": "c",
"description": "C - use fgets or gets_s instead"
},
{
"ruleId": "",
"ruleTitle": "Avoid Unsafe Functions",
"type": "bad",
"code": "<?php\n\n// ruleid: mcrypt-use\nmcrypt_ecb(MCRYPT_BLOWFISH, $key, base64_decode($input), MCRYPT_DECRYPT);\n\n// ruleid: mcrypt-use\nmcrypt_create_iv($iv_size, MCRYPT_RAND);\n\n// ruleid: mcrypt-use\nmdecrypt_generic($td, $c_t);",
"language": "php",
"description": "PHP - deprecated mcrypt functions"
},
{
"ruleId": "",
"ruleTitle": "Avoid Unsafe Functions",
"type": "good",
"code": "<?php\n\n// ok: mcrypt-use\nsodium_crypto_secretbox(\"Hello World!\", $nonce, $key);\n\n// ok: mcrypt-use\nopenssl_encrypt($plaintext, $cipher, $key, $options=0, $iv, $tag);",
"language": "php",
"description": "PHP - use Sodium or OpenSSL"
},
{
"ruleId": "",
"ruleTitle": "Avoid Unsafe Functions",
"type": "bad",
"code": "import tempfile as tf\n\n# ruleid: tempfile-insecure\nx = tempfile.mktemp()\n# ruleid: tempfile-insecure\nx = tempfile.mktemp(dir=\"/tmp\")",
"language": "python",
"description": "Python - tempfile.mktemp race condition"
},
{
"ruleId": "",
"ruleTitle": "Avoid Unsafe Functions",
"type": "good",
"code": "import tempfile\n\n# Use NamedTemporaryFile instead\nwith tempfile.NamedTemporaryFile() as tmp:\n tmp.write(b\"data\")",
"language": "python",
"description": "Python - use NamedTemporaryFile"
},
{
"ruleId": "",
"ruleTitle": "Avoid Unsafe Functions",
"type": "bad",
"code": "package main\n\nimport (\n\t\"fmt\"\n\t\"unsafe\"\n\n\tfoobarbaz \"unsafe\"\n)\n\ntype Fake struct{}\n\nfunc (Fake) Good() {}\nfunc main() {\n\tunsafeM := Fake{}\n\tunsafeM.Good()\n\tintArray := [...]int{1, 2}\n\tfmt.Printf(\"\\nintArray: %v\\n\", intArray)\n\tintPtr := &intArray[0]\n\tfmt.Printf(\"\\nintPtr=%p, *intPtr=%d.\\n\", intPtr, *intPtr)\n\t// ruleid: use-of-unsafe-block\n\taddressHolder := uintptr(foobarbaz.Pointer(intPtr)) + unsafe.Sizeof(intArray[0])\n\t// ruleid: use-of-unsafe-block\n\tintPtr = (*int)(foobarbaz.Pointer(addressHolder))\n\tfmt.Printf(\"\\nintPtr=%p, *intPtr=%d.\\n\\n\", intPtr, *intPtr)\n}",
"language": "go",
"description": "Go - unsafe package bypasses type safety"
},
{
"ruleId": "",
"ruleTitle": "Avoid Unsafe Functions",
"type": "good",
"code": "// Avoid using the unsafe package. Use Go's type-safe alternatives for memory operations.",
"language": "go",
"description": "Go - avoid unsafe package"
},
{
"ruleId": "",
"ruleTitle": "Avoid Unsafe Functions",
"type": "bad",
"code": "// ruleid: unsafe-usage\nlet pid = unsafe { libc::getpid() as u32 };",
"language": "rust",
"description": "Rust - unsafe block bypasses safety"
},
{
"ruleId": "",
"ruleTitle": "Avoid Unsafe Functions",
"type": "good",
"code": "// ok: unsafe-usage\nlet pid = libc::getpid() as u32;",
"language": "rust",
"description": "Rust - use safe alternatives"
},
{
"ruleId": "",
"ruleTitle": "Avoid Unsafe Functions",
"type": "bad",
"code": "let cb = Array.make 10 2 in\n(* ruleid:ocamllint-unsafe *)\nPrintf.printf \"%d\\n\" (Array.unsafe_get cb 12)",
"language": "ocaml",
"description": "OCaml - unsafe functions skip bounds checks"
},
{
"ruleId": "",
"ruleTitle": "Avoid Unsafe Functions",
"type": "good",
"code": "let cb = Array.make 10 2 in\n(* Use bounds-checked version *)\nPrintf.printf \"%d\\n\" (Array.get cb 0)",
"language": "ocaml",
"description": "OCaml - use bounds-checked functions"
},
{
"ruleId": "",
"ruleTitle": "Prevent Cross-Site Scripting (XSS)",
"type": "bad",
"code": "function renderUserContent(userInput) {\n document.body.innerHTML = '<div>' + userInput + '</div>';\n}",
"language": "javascript",
"description": "vulnerable to XSS"
},
{
"ruleId": "",
"ruleTitle": "Prevent Cross-Site Scripting (XSS)",
"type": "good",
"code": "function renderUserContent(userInput) {\n const div = document.createElement('div');\n div.textContent = userInput;\n document.body.appendChild(div);\n}",
"language": "javascript",
"description": "use textContent or sanitization"
},
{
"ruleId": "",
"ruleTitle": "Prevent Cross-Site Scripting (XSS)",
"type": "bad",
"code": "from flask import make_response, request\n\ndef search():\n query = request.args.get(\"q\")\n return make_response(f\"Results for: {query}\")",
"language": "python",
"description": "user input in response"
},
{
"ruleId": "",
"ruleTitle": "Prevent Cross-Site Scripting (XSS)",
"type": "good",
"code": "from flask import make_response, request\nfrom markupsafe import escape\n\ndef search():\n query = request.args.get(\"q\")\n return make_response(f\"Results for: {escape(query)}\")",
"language": "python",
"description": "escape output"
},
{
"ruleId": "",
"ruleTitle": "Prevent Cross-Site Scripting (XSS)",
"type": "bad",
"code": "from django.http import HttpResponse\n\ndef greet(request):\n name = request.GET.get(\"name\", \"\")\n return HttpResponse(f\"Hello, {name}!\")",
"language": "python",
"description": "request data in HttpResponse"
},
{
"ruleId": "",
"ruleTitle": "Prevent Cross-Site Scripting (XSS)",
"type": "good",
"code": "from django.http import HttpResponse\nfrom django.utils.html import escape\n\ndef greet(request):\n name = request.GET.get(\"name\", \"\")\n return HttpResponse(f\"Hello, {escape(name)}!\")",
"language": "python",
"description": "use template or escape"
},
{
"ruleId": "",
"ruleTitle": "Prevent Cross-Site Scripting (XSS)",
"type": "bad",
"code": "public class UserServlet extends HttpServlet {\n protected void doGet(HttpServletRequest req, HttpServletResponse resp)\n throws ServletException, IOException {\n String name = req.getParameter(\"name\");\n resp.getWriter().write(\"<h1>Hello \" + name + \"</h1>\");\n }\n}",
"language": "java",
"description": "writing request parameters directly"
},
{
"ruleId": "",
"ruleTitle": "Prevent Cross-Site Scripting (XSS)",
"type": "good",
"code": "import org.owasp.encoder.Encode;\n\npublic class UserServlet extends HttpServlet {\n protected void doGet(HttpServletRequest req, HttpServletResponse resp)\n throws ServletException, IOException {\n String name = req.getParameter(\"name\");\n resp.getWriter().write(\"<h1>Hello \" + Encode.forHtml(name) + \"</h1>\");\n }\n}",
"language": "java",
"description": "encode output"
},
{
"ruleId": "",
"ruleTitle": "Prevent Cross-Site Scripting (XSS)",
"type": "bad",
"code": "func greetHandler(w http.ResponseWriter, r *http.Request) {\n name := r.URL.Query().Get(\"name\")\n template := \"<html><body><h1>Hello %s</h1></body></html>\"\n w.Write([]byte(fmt.Sprintf(template, name)))\n}",
"language": "go",
"description": "writing user input to ResponseWriter"
},
{
"ruleId": "",
"ruleTitle": "Prevent Cross-Site Scripting (XSS)",
"type": "good",
"code": "func greetHandler(w http.ResponseWriter, r *http.Request) {\n name := r.URL.Query().Get(\"name\")\n tmpl := template.Must(template.New(\"greet\").Parse(\n \"<html><body><h1>Hello {{.}}</h1></body></html>\"))\n tmpl.Execute(w, name)\n}",
"language": "go",
"description": "use html/template"
},
{
"ruleId": "",
"ruleTitle": "Prevent Cross-Site Scripting (XSS)",
"type": "bad",
"code": "<?php\nfunction greet() {\n $name = $_REQUEST['name'];\n echo \"Hello: \" . $name;\n}",
"language": "php",
"description": "echoing user input"
},
{
"ruleId": "",
"ruleTitle": "Prevent Cross-Site Scripting (XSS)",
"type": "good",
"code": "<?php\nfunction greet() {\n $name = $_REQUEST['name'];\n echo \"Hello: \" . htmlspecialchars($name, ENT_QUOTES, 'UTF-8');\n}",
"language": "php",
"description": "use htmlspecialchars"
},
{
"ruleId": "",
"ruleTitle": "Prevent XML External Entity (XXE) Injection",
"type": "bad",
"code": "class BadDocumentBuilderFactory {\n public void parseXml() throws ParserConfigurationException {\n DocumentBuilderFactory dbf = DocumentBuilderFactory.newInstance();\n dbf.newDocumentBuilder();\n }\n}",
"language": "java",
"description": "vulnerable to XXE"
},
{
"ruleId": "",
"ruleTitle": "Prevent XML External Entity (XXE) Injection",
"type": "good",
"code": "class GoodDocumentBuilderFactory {\n public void parseXml() throws ParserConfigurationException {\n DocumentBuilderFactory dbf = DocumentBuilderFactory.newInstance();\n dbf.setFeature(\"http://apache.org/xml/features/disallow-doctype-decl\", true);\n dbf.newDocumentBuilder();\n }\n}",
"language": "java",
"description": "XXE disabled"
},
{
"ruleId": "",
"ruleTitle": "Prevent XML External Entity (XXE) Injection",
"type": "bad",
"code": "def parse_xml():\n from xml.etree import ElementTree\n tree = ElementTree.parse('data.xml')\n root = tree.getroot()",
"language": "python",
"description": "vulnerable to XXE"
},
{
"ruleId": "",
"ruleTitle": "Prevent XML External Entity (XXE) Injection",
"type": "good",
"code": "def parse_xml():\n from defusedxml.etree import ElementTree\n tree = ElementTree.parse('data.xml')\n root = tree.getroot()",
"language": "python",
"description": "safe usage"
},
{
"ruleId": "",
"ruleTitle": "Prevent XML External Entity (XXE) Injection",
"type": "bad",
"code": "var libxmljs = require(\"libxmljs\");\n\nmodule.exports.parseXml = function(req, res) {\n libxmljs.parseXml(req.body, { noent: true, noblanks: true });\n}",
"language": "javascript",
"description": "vulnerable to XXE"
},
{
"ruleId": "",
"ruleTitle": "Prevent XML External Entity (XXE) Injection",
"type": "good",
"code": "var libxmljs = require(\"libxmljs\");\n\nmodule.exports.parseXml = function(req, res) {\n libxmljs.parseXml(req.body, { noent: false, noblanks: true });\n}",
"language": "javascript",
"description": "XXE disabled"
},
{
"ruleId": "",
"ruleTitle": "Prevent XML External Entity (XXE) Injection",
"type": "bad",
"code": "public void ParseXml(string input) {\n XmlReaderSettings rs = new XmlReaderSettings();\n rs.DtdProcessing = DtdProcessing.Parse;\n XmlReader myReader = XmlReader.Create(new StringReader(input), rs);\n\n while (myReader.Read()) {\n Console.WriteLine(myReader.Value);\n }\n}",
"language": "csharp",
"description": "vulnerable to XXE"
},
{
"ruleId": "",
"ruleTitle": "Prevent XML External Entity (XXE) Injection",
"type": "good",
"code": "public void ParseXml(string input) {\n XmlReaderSettings rs = new XmlReaderSettings();\n rs.DtdProcessing = DtdProcessing.Prohibit;\n XmlReader myReader = XmlReader.Create(new StringReader(input), rs);\n\n while (myReader.Read()) {\n Console.WriteLine(myReader.Value);\n }\n}",
"language": "csharp",
"description": "XXE disabled"
},
{
"ruleId": "",
"ruleTitle": "Prevent XML External Entity (XXE) Injection",
"type": "bad",
"code": "import (\n \"fmt\"\n \"github.com/lestrrat-go/libxml2/parser\"\n)\n\nfunc parseXml() {\n const s = `<!DOCTYPE d [<!ENTITY e SYSTEM \"file:///etc/passwd\">]><t>&e;</t>`\n p := parser.New(parser.XMLParseNoEnt)\n doc, err := p.ParseString(s)\n if err != nil {\n fmt.Println(err)\n return\n }\n fmt.Println(doc)\n}",
"language": "go",
"description": "vulnerable to XXE"
},
{
"ruleId": "",
"ruleTitle": "Prevent XML External Entity (XXE) Injection",
"type": "good",
"code": "import (\n \"fmt\"\n \"github.com/lestrrat-go/libxml2/parser\"\n)\n\nfunc parseXml() {\n const s = `<!DOCTYPE d [<!ENTITY e SYSTEM \"file:///etc/passwd\">]><t>&e;</t>`\n p := parser.New()\n doc, err := p.ParseString(s)\n if err != nil {\n fmt.Println(err)\n return\n }\n fmt.Println(doc)\n}",
"language": "go",
"description": "XXE disabled"
}
]
Reference in New Issue View Git Blame Copy Permalink