Skip to content

Commit a5fcf17

Browse files
simon-idsimon-id
authored
update appsec rules to 1.16.1 (#7154)
1 parent 93ec9f5 commit a5fcf17

1 file changed

Lines changed: 230 additions & 3 deletions

File tree

‎packages/dd-trace/src/appsec/recommended.json‎

Lines changed: 230 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -1,7 +1,7 @@
11
{
22
"version": "2.2",
33
"metadata": {
4-
"rules_version": "1.15.1"
4+
"rules_version": "1.16.1"
55
},
66
"rules": [
77
{
@@ -4376,7 +4376,7 @@
43764376
"address": "graphql.server.resolver"
43774377
}
43784378
],
4379-
"regex": "java\\.lang\\.(?:runtime|processbuilder)",
4379+
"regex": "\\bjava\\.lang\\.(?:runtime|processbuilder)\\b",
43804380
"options": {
43814381
"case_sensitive": true,
43824382
"min_length": 17
@@ -8989,7 +8989,7 @@
89898989
"event": false,
89908990
"keep": false,
89918991
"attributes": {
8992-
"_dd.appsec.api.jwt_alg": {
8992+
"api.security.jwt.alg": {
89938993
"address": "server.request.jwt",
89948994
"key_path": [
89958995
"header",
@@ -9091,6 +9091,233 @@
90919091
}
90929092
}
90939093
},
9094+
{
9095+
"id": "api-010-100",
9096+
"name": "Monitor redirections to GET targets",
9097+
"tags": {
9098+
"type": "api10",
9099+
"category": "api_security",
9100+
"confidence": "0",
9101+
"module": "business-logic"
9102+
},
9103+
"min_version": "1.25.0",
9104+
"conditions": [
9105+
{
9106+
"parameters": {
9107+
"inputs": [
9108+
{
9109+
"address": "server.io.net.response.status"
9110+
}
9111+
],
9112+
"list": [
9113+
"301",
9114+
"302"
9115+
]
9116+
},
9117+
"operator": "exact_match"
9118+
}
9119+
],
9120+
"transformers": [],
9121+
"output": {
9122+
"event": false,
9123+
"keep": false,
9124+
"attributes": {
9125+
"api.security.redirection.move_target": {
9126+
"address": "server.io.net.response.headers",
9127+
"key_path": [
9128+
"Location"
9129+
]
9130+
}
9131+
}
9132+
}
9133+
},
9134+
{
9135+
"id": "api-010-110",
9136+
"name": "Monitor redirections to POST targets",
9137+
"tags": {
9138+
"type": "api10",
9139+
"category": "api_security",
9140+
"confidence": "0",
9141+
"module": "business-logic"
9142+
},
9143+
"min_version": "1.25.0",
9144+
"conditions": [
9145+
{
9146+
"parameters": {
9147+
"inputs": [
9148+
{
9149+
"address": "server.io.net.response.status"
9150+
}
9151+
],
9152+
"list": [
9153+
"307",
9154+
"308"
9155+
]
9156+
},
9157+
"operator": "exact_match"
9158+
}
9159+
],
9160+
"transformers": [],
9161+
"output": {
9162+
"event": false,
9163+
"keep": false,
9164+
"attributes": {
9165+
"api.security.redirection.redirect_target": {
9166+
"address": "server.io.net.response.headers",
9167+
"key_path": [
9168+
"Location"
9169+
]
9170+
}
9171+
}
9172+
}
9173+
},
9174+
{
9175+
"id": "api-010-200",
9176+
"name": "Large response bodies in downstream network calls",
9177+
"tags": {
9178+
"type": "api10",
9179+
"category": "api_security",
9180+
"confidence": "0",
9181+
"module": "business-logic"
9182+
},
9183+
"min_version": "1.25.0",
9184+
"conditions": [
9185+
{
9186+
"parameters": {
9187+
"inputs": [
9188+
{
9189+
"address": "server.io.net.response.headers",
9190+
"key_path": [
9191+
"content-length"
9192+
]
9193+
}
9194+
],
9195+
"regex": "\\d{7,}",
9196+
"options": {
9197+
"case_sensitive": true,
9198+
"min_length": 7
9199+
}
9200+
},
9201+
"operator": "match_regex"
9202+
}
9203+
],
9204+
"transformers": [],
9205+
"output": {
9206+
"event": false,
9207+
"keep": false,
9208+
"attributes": {
9209+
"api.security.large_response.length": {
9210+
"address": "server.io.net.response.headers",
9211+
"key_path": [
9212+
"content-length"
9213+
]
9214+
},
9215+
"api.security.large_response.url": {
9216+
"address": "server.io.net.url"
9217+
}
9218+
}
9219+
}
9220+
},
9221+
{
9222+
"id": "api-010-300",
9223+
"name": "Secrets transmitted in downstream URL parameters",
9224+
"tags": {
9225+
"type": "api10",
9226+
"category": "api_security",
9227+
"confidence": "0",
9228+
"module": "business-logic"
9229+
},
9230+
"min_version": "1.25.0",
9231+
"conditions": [
9232+
{
9233+
"parameters": {
9234+
"inputs": [
9235+
{
9236+
"address": "server.io.net.url"
9237+
}
9238+
],
9239+
"regex": "[?&](?:(?:api|access)?(_)?(?:key|secret|token|password|passwd|pwd))=",
9240+
"options": {
9241+
"case_sensitive": false
9242+
}
9243+
},
9244+
"operator": "match_regex"
9245+
}
9246+
],
9247+
"transformers": [],
9248+
"output": {
9249+
"event": false,
9250+
"keep": false,
9251+
"attributes": {
9252+
"api.security.secret.disclosed_in_url_params": {
9253+
"value": 1
9254+
}
9255+
}
9256+
}
9257+
},
9258+
{
9259+
"id": "api-010-400",
9260+
"name": "Unauthenticated MCP access",
9261+
"tags": {
9262+
"type": "api10",
9263+
"category": "api_security",
9264+
"confidence": "0",
9265+
"module": "business-logic"
9266+
},
9267+
"min_version": "1.25.0",
9268+
"conditions": [
9269+
{
9270+
"parameters": {
9271+
"inputs": [
9272+
{
9273+
"address": "server.io.net.url"
9274+
}
9275+
],
9276+
"regex": "/mcp/(?:tools|resources)/",
9277+
"options": {
9278+
"case_sensitive": false
9279+
}
9280+
},
9281+
"operator": "match_regex"
9282+
},
9283+
{
9284+
"parameters": {
9285+
"inputs": [
9286+
{
9287+
"address": "server.io.net.request.headers",
9288+
"key_path": [
9289+
"authorization"
9290+
]
9291+
}
9292+
]
9293+
},
9294+
"operator": "!exists"
9295+
},
9296+
{
9297+
"parameters": {
9298+
"inputs": [
9299+
{
9300+
"address": "server.io.net.response.status"
9301+
}
9302+
],
9303+
"list": [
9304+
"401"
9305+
]
9306+
},
9307+
"operator": "!exact_match"
9308+
}
9309+
],
9310+
"transformers": [],
9311+
"output": {
9312+
"event": false,
9313+
"keep": false,
9314+
"attributes": {
9315+
"api.security.mcp.broken_auth": {
9316+
"value": 1
9317+
}
9318+
}
9319+
}
9320+
},
90949321
{
90959322
"id": "ua0-600-551",
90969323
"name": "Datadog test scanner - scalar trace-tagging version: user-agent",

0 commit comments

Comments
 (0)