predictIQ/.semgrep.yml at main · petermuazu/predictIQ · GitHub

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
144
145
146
147
148
149
150
151
152
153
154
155
156
157
158
159
160
161
162
163
164
165
166
167
168
169
170
171
172
173
174
175
176
177
178
179
180
181
rules:
  - id: hardcoded-stellar-secret
    pattern: |
      "S[A-Z0-9]{55}"
    message: Hardcoded Stellar secret key detected
    severity: ERROR
    languages: [rust, typescript, javascript]
    metadata:
      category: security
      cwe: "CWE-798: Use of Hard-coded Credentials"

  - id: sql-injection-risk
    patterns:
      - pattern: |
          format!("... {} ...", $VAR)
      - pattern-inside: |
          sqlx::query(...)
    message: Potential SQL injection - use parameterized queries
    severity: ERROR
    languages: [rust]
    metadata:
      category: security
      cwe: "CWE-89: SQL Injection"

  - id: unsafe-deserialization
    pattern: |
      serde_json::from_str($INPUT)
    message: Ensure input is validated before deserialization
    severity: WARNING
    languages: [rust]
    metadata:
      category: security
      cwe: "CWE-502: Deserialization of Untrusted Data"

  - id: missing-auth-check
    patterns:
      - pattern: |
          pub async fn $FUNC(...) -> ... {
            ...
          }
      - pattern-not-inside: |
          pub async fn $FUNC(...) -> ... {
            ...
            $AUTH_CHECK(...)
            ...
          }
      - metavariable-regex:
          metavariable: $FUNC
          regex: (resolve_market|admin_.*|delete_.*|update_.*)
      - metavariable-regex:
          metavariable: $AUTH_CHECK
          regex: (require_admin|check_auth|verify_admin|assert_admin|ensure_authorized)
    message: Admin function may be missing authentication check
    severity: WARNING
    languages: [rust]
    metadata:
      category: security
      cwe: "CWE-306: Missing Authentication"

  - id: weak-random
    pattern: |
      rand::random()
    message: Use cryptographically secure random for security-sensitive operations
    severity: WARNING
    languages: [rust]
    metadata:
      category: security
      cwe: "CWE-338: Use of Cryptographically Weak PRNG"

  - id: eval-usage
    pattern: eval(...)
    message: Avoid eval() - it can execute arbitrary code
    severity: ERROR
    languages: [javascript, typescript]
    metadata:
      category: security
      cwe: "CWE-95: Improper Neutralization of Directives in Dynamically Evaluated Code"

  - id: dangerouslySetInnerHTML
    pattern: dangerouslySetInnerHTML={{...}}
    message: Avoid dangerouslySetInnerHTML - XSS risk
    severity: WARNING
    languages: [typescript, javascript]
    metadata:
      category: security
      cwe: "CWE-79: Cross-site Scripting"

  - id: console-log-production
    pattern: console.log(...)
    message: Remove console.log in production code
    severity: INFO
    languages: [typescript, javascript]
    paths:
      include:
        - "*/src/*"
      exclude:
        - "*/test/*"
        - "*/*.test.*"
    metadata:
      category: best-practice

  - id: todo-fixme-comments
    pattern-regex: (TODO|FIXME|HACK|XXX)
    message: Address TODO/FIXME comments before merging
    severity: INFO
    languages: [rust, typescript, javascript]
    metadata:
      category: best-practice

  # Soroban-specific vulnerability patterns
  - id: unchecked-arithmetic-overflow
    patterns:
      - pattern-either:
          - pattern: $A + $B
          - pattern: $A - $B
          - pattern: $A * $B
      - pattern-inside: |
          fn $FUNC(...) -> ... {
            ...
            $PAYOUT = ...
            ...
          }
      - metavariable-regex:
          metavariable: $FUNC
          regex: (calculate_payout|resolve_.*|settle_.*)
    message: Unchecked arithmetic in payout calculation - use checked_* methods
    severity: ERROR
    languages: [rust]
    metadata:
      category: security
      cwe: "CWE-190: Integer Overflow or Wraparound"

  - id: missing-require-auth
    patterns:
      - pattern: |
          pub fn $FUNC($ENV:Env, ...) -> ... {
            ...
          }
      - pattern-not-inside: |
          pub fn $FUNC($ENV:Env, ...) -> ... {
            ...
            $ENV.current_contract_address().require_auth()
            ...
          }
      - metavariable-regex:
          metavariable: $FUNC
          regex: (place_bet|resolve_market|settle_.*|admin_.*)
    message: Missing require_auth() call - contract function may be callable by anyone
    severity: ERROR
    languages: [rust]
    metadata:
      category: security
      cwe: "CWE-306: Missing Authentication"

  - id: storage-key-collision
    patterns:
      - pattern-either:
          - pattern: |
              DataKey::$KEY1(...)
              ...
              DataKey::$KEY1(...)
          - pattern: |
              Symbol::new(&$ENV, $STR1)
              ...
              Symbol::new(&$ENV, $STR1)
    message: Potential storage key collision - ensure unique keys for different data types
    severity: WARNING
    languages: [rust]
    metadata:
      category: security
      cwe: "CWE-1025: Comparison Using Wrong Factors"

  - id: unvalidated-contract-invocation
    pattern: |
      $CONTRACT.invoke(...)
    message: Validate contract address before invocation to prevent unauthorized calls
    severity: WARNING
    languages: [rust]
    metadata:
      category: security
      cwe: "CWE-95: Improper Neutralization of Directives in Dynamically Evaluated Code"