brain/semgrep-rules/command-injection.yaml

136 lines · yaml

rules:
 
  - id: cyc-py-os-system-popen
    languages: [python]
    severity: ERROR
    message: >
      os.system / os.popen runs a shell command string -> command injection if any part is
      attacker-controlled. IMPACT GATE: Family 1 RCE.
    metadata:
      cwe: ["CWE-78: OS Command Injection"]
      confidence: HIGH
      archetype: [devops-infra, ai-agent-mcp]
      impact: rce
    patterns:
      - pattern-either:
          - pattern: os.system(...)
          - pattern: os.popen(...)
          - pattern: os.popen2(...)
          - pattern: os.posix_spawn(...)
 
  - id: cyc-py-subprocess-shell-true
    languages: [python]
    severity: ERROR
    message: >
      subprocess with shell=True passes the command through /bin/sh -> command injection. IMPACT
      GATE: Family 1. (shell=False with a list argv is the safe form and is not matched.)
    metadata:
      cwe: ["CWE-78: OS Command Injection"]
      confidence: HIGH
      archetype: [devops-infra, ai-agent-mcp, cicd-supplychain]
      impact: rce
    patterns:
      - pattern-either:
          - pattern: subprocess.call(..., shell=True, ...)
          - pattern: subprocess.run(..., shell=True, ...)
          - pattern: subprocess.Popen(..., shell=True, ...)
          - pattern: subprocess.check_call(..., shell=True, ...)
          - pattern: subprocess.check_output(..., shell=True, ...)
          - pattern: subprocess.getoutput(...)
          - pattern: subprocess.getstatusoutput(...)
 
  - id: cyc-py-eval-exec
    languages: [python]
    severity: ERROR
    message: >
      eval / exec / compile on attacker-influenced input is direct code execution. IMPACT GATE:
      Family 1.
    metadata:
      cwe: ["CWE-95: Eval Injection", "CWE-94: Code Injection"]
      confidence: HIGH
      archetype: [ai-agent-mcp, devops-infra]
      impact: rce
    patterns:
      - pattern-either:
          - pattern: eval(...)
          - pattern: exec(...)
      - pattern-not: eval("...")
      - pattern-not: exec("...")
 
  - id: cyc-js-child-process
    languages: [javascript, typescript]
    severity: ERROR
    message: >
      child_process.exec/execSync runs a shell string -> command injection. spawn/execFile with a
      tainted command or args is also injectable. IMPACT GATE: Family 1.
    metadata:
      cwe: ["CWE-78: OS Command Injection"]
      confidence: HIGH
      archetype: [electron-desktop, devops-infra, ai-agent-mcp]
      impact: rce
    patterns:
      - pattern-either:
          - pattern: $CP.exec(...)
          - pattern: $CP.execSync(...)
          - pattern: $CP.execFile(...)
          - pattern: $CP.execFileSync(...)
          - pattern: $CP.spawn(...)
          - pattern: $CP.spawnSync(...)
          - pattern: child_process.exec(...)
          - pattern: require('child_process').exec(...)
 
  - id: cyc-js-eval-function
    languages: [javascript, typescript]
    severity: ERROR
    message: >
      eval / new Function / vm.runIn*Context execute attacker-influenced source -> RCE. IMPACT GATE:
      Family 1.
    metadata:
      cwe: ["CWE-95: Eval Injection"]
      confidence: HIGH
      archetype: [electron-desktop, ai-agent-mcp]
      impact: rce
    patterns:
      - pattern-either:
          - pattern: eval(...)
          - pattern: new Function(...)
          - pattern: $VM.runInThisContext(...)
          - pattern: $VM.runInNewContext(...)
          - pattern: $VM.runInContext(...)
 
  - id: cyc-java-runtime-exec
    languages: [java]
    severity: ERROR
    message: >
      Runtime.exec / ProcessBuilder with attacker-influenced arguments -> command injection. IMPACT
      GATE: Family 1.
    metadata:
      cwe: ["CWE-78: OS Command Injection"]
      confidence: HIGH
      archetype: [devops-infra]
      impact: rce
    patterns:
      - pattern-either:
          - pattern: Runtime.getRuntime().exec(...)
          - pattern: new ProcessBuilder(...)
          - pattern: $SE.eval(...)
 
  - id: cyc-c-system-exec
    languages: [c, cpp]
    severity: ERROR
    message: >
      system() / popen() / exec*() with attacker-influenced strings -> command injection. IMPACT
      GATE: Family 1.
    metadata:
      cwe: ["CWE-78: OS Command Injection"]
      confidence: HIGH
      archetype: [memory-unsafe-parsers, devops-infra]
      impact: rce
    patterns:
      - pattern-either:
          - pattern: system(...)
          - pattern: popen(...)
          - pattern: execl(...)
          - pattern: execlp(...)
          - pattern: execve(...)
          - pattern: execvp(...)

1	rules:
2
3	- id: cyc-py-os-system-popen
4	languages: [python]
5	severity: ERROR
6	message: >
7	os.system / os.popen runs a shell command string -> command injection if any part is
8	attacker-controlled. IMPACT GATE: Family 1 RCE.
9	metadata:
10	cwe: ["CWE-78: OS Command Injection"]
11	confidence: HIGH
12	archetype: [devops-infra, ai-agent-mcp]
13	impact: rce
14	patterns:
15	- pattern-either:
16	- pattern: os.system(...)
17	- pattern: os.popen(...)
18	- pattern: os.popen2(...)
19	- pattern: os.posix_spawn(...)
20
21	- id: cyc-py-subprocess-shell-true
22	languages: [python]
23	severity: ERROR
24	message: >
25	subprocess with shell=True passes the command through /bin/sh -> command injection. IMPACT
26	GATE: Family 1. (shell=False with a list argv is the safe form and is not matched.)
27	metadata:
28	cwe: ["CWE-78: OS Command Injection"]
29	confidence: HIGH
30	archetype: [devops-infra, ai-agent-mcp, cicd-supplychain]
31	impact: rce
32	patterns:
33	- pattern-either:
34	- pattern: subprocess.call(..., shell=True, ...)
35	- pattern: subprocess.run(..., shell=True, ...)
36	- pattern: subprocess.Popen(..., shell=True, ...)
37	- pattern: subprocess.check_call(..., shell=True, ...)
38	- pattern: subprocess.check_output(..., shell=True, ...)
39	- pattern: subprocess.getoutput(...)
40	- pattern: subprocess.getstatusoutput(...)
41
42	- id: cyc-py-eval-exec
43	languages: [python]
44	severity: ERROR
45	message: >
46	eval / exec / compile on attacker-influenced input is direct code execution. IMPACT GATE:
47	Family 1.
48	metadata:
49	cwe: ["CWE-95: Eval Injection", "CWE-94: Code Injection"]
50	confidence: HIGH
51	archetype: [ai-agent-mcp, devops-infra]
52	impact: rce
53	patterns:
54	- pattern-either:
55	- pattern: eval(...)
56	- pattern: exec(...)
57	- pattern-not: eval("...")
58	- pattern-not: exec("...")
59
60	- id: cyc-js-child-process
61	languages: [javascript, typescript]
62	severity: ERROR
63	message: >
64	child_process.exec/execSync runs a shell string -> command injection. spawn/execFile with a
65	tainted command or args is also injectable. IMPACT GATE: Family 1.
66	metadata:
67	cwe: ["CWE-78: OS Command Injection"]
68	confidence: HIGH
69	archetype: [electron-desktop, devops-infra, ai-agent-mcp]
70	impact: rce
71	patterns:
72	- pattern-either:
73	- pattern: $CP.exec(...)
74	- pattern: $CP.execSync(...)
75	- pattern: $CP.execFile(...)
76	- pattern: $CP.execFileSync(...)
77	- pattern: $CP.spawn(...)
78	- pattern: $CP.spawnSync(...)
79	- pattern: child_process.exec(...)
80	- pattern: require('child_process').exec(...)
81
82	- id: cyc-js-eval-function
83	languages: [javascript, typescript]
84	severity: ERROR
85	message: >
86	eval / new Function / vm.runIn*Context execute attacker-influenced source -> RCE. IMPACT GATE:
87	Family 1.
88	metadata:
89	cwe: ["CWE-95: Eval Injection"]
90	confidence: HIGH
91	archetype: [electron-desktop, ai-agent-mcp]
92	impact: rce
93	patterns:
94	- pattern-either:
95	- pattern: eval(...)
96	- pattern: new Function(...)
97	- pattern: $VM.runInThisContext(...)
98	- pattern: $VM.runInNewContext(...)
99	- pattern: $VM.runInContext(...)
100
101	- id: cyc-java-runtime-exec
102	languages: [java]
103	severity: ERROR
104	message: >
105	Runtime.exec / ProcessBuilder with attacker-influenced arguments -> command injection. IMPACT
106	GATE: Family 1.
107	metadata:
108	cwe: ["CWE-78: OS Command Injection"]
109	confidence: HIGH
110	archetype: [devops-infra]
111	impact: rce
112	patterns:
113	- pattern-either:
114	- pattern: Runtime.getRuntime().exec(...)
115	- pattern: new ProcessBuilder(...)
116	- pattern: $SE.eval(...)
117
118	- id: cyc-c-system-exec
119	languages: [c, cpp]
120	severity: ERROR
121	message: >
122	system() / popen() / exec*() with attacker-influenced strings -> command injection. IMPACT
123	GATE: Family 1.
124	metadata:
125	cwe: ["CWE-78: OS Command Injection"]
126	confidence: HIGH
127	archetype: [memory-unsafe-parsers, devops-infra]
128	impact: rce
129	patterns:
130	- pattern-either:
131	- pattern: system(...)
132	- pattern: popen(...)
133	- pattern: execl(...)
134	- pattern: execlp(...)
135	- pattern: execve(...)
136	- pattern: execvp(...)