semgrep-rules icon indicating copy to clipboard operation
semgrep-rules copied to clipboard

[Stability] Add tests for rules in the registry

Open LewisArdern opened this issue 2 years ago • 1 comments

Describe the bug Each rule should have a corresponding test, some of the earlier rules written in semgrep do not have a test, we should prioritize adding tests for these rules so we can have better informed knowledge if there is a bug with the rule or it needs to be improved:

  • https://github.com/returntocorp/semgrep-rules/tree/develop/contrib/dlint/dlint-equivalent.yaml
  • https://github.com/returntocorp/semgrep-rules/tree/develop/contrib/nodejsscan/error_disclosure.yaml
  • https://github.com/returntocorp/semgrep-rules/tree/develop/contrib/nodejsscan/eval_drpc_deserialize.yaml
  • https://github.com/returntocorp/semgrep-rules/tree/develop/contrib/nodejsscan/good_anti_csrf.yaml
  • https://github.com/returntocorp/semgrep-rules/tree/develop/contrib/nodejsscan/good_helmet_checks.yaml
  • https://github.com/returntocorp/semgrep-rules/tree/develop/contrib/nodejsscan/good_ratelimiting.yaml
  • https://github.com/returntocorp/semgrep-rules/tree/develop/contrib/nodejsscan/jwt_express_hardcoded.yaml
  • https://github.com/returntocorp/semgrep-rules/tree/develop/contrib/nodejsscan/jwt_hardcoded.yaml
  • https://github.com/returntocorp/semgrep-rules/tree/develop/contrib/nodejsscan/logic_bypass.yaml
  • https://github.com/returntocorp/semgrep-rules/tree/develop/contrib/nodejsscan/regex_injection.yaml
  • https://github.com/returntocorp/semgrep-rules/tree/develop/contrib/nodejsscan/resolve_path_traversal.yaml
  • https://github.com/returntocorp/semgrep-rules/tree/develop/contrib/nodejsscan/security_electronjs.yaml
  • https://github.com/returntocorp/semgrep-rules/tree/develop/contrib/nodejsscan/sql_injection.yaml
  • https://github.com/returntocorp/semgrep-rules/tree/develop/contrib/nodejsscan/timing_attack_node.yaml
  • https://github.com/returntocorp/semgrep-rules/tree/develop/contrib/nodejsscan/xml_entity_expansion_dos.yaml
  • https://github.com/returntocorp/semgrep-rules/tree/develop/contrib/nodejsscan/xss_mustache_escape.yaml
  • https://github.com/returntocorp/semgrep-rules/tree/develop/contrib/nodejsscan/xss_serialize_js.yaml
  • https://github.com/returntocorp/semgrep-rules/tree/develop/csharp/dotnet/security/mvc-missing-antiforgery.yaml
  • https://github.com/returntocorp/semgrep-rules/tree/develop/csharp/lang/security/injections/os-command.yaml
  • https://github.com/returntocorp/semgrep-rules/tree/develop/fingerprints/fingerprints.yaml
  • https://github.com/returntocorp/semgrep-rules/tree/develop/yaml/semgrep/consistency/lang-consistency-bash.yaml
  • https://github.com/returntocorp/semgrep-rules/tree/develop/yaml/semgrep/consistency/lang-consistency-cpp.yaml
  • https://github.com/returntocorp/semgrep-rules/tree/develop/yaml/semgrep/consistency/lang-consistency-csharp.yaml
  • https://github.com/returntocorp/semgrep-rules/tree/develop/yaml/semgrep/consistency/lang-consistency-dockerfile.yaml
  • https://github.com/returntocorp/semgrep-rules/tree/develop/yaml/semgrep/consistency/lang-consistency-elixir.yaml
  • https://github.com/returntocorp/semgrep-rules/tree/develop/yaml/semgrep/consistency/lang-consistency-go.yaml
  • https://github.com/returntocorp/semgrep-rules/tree/develop/yaml/semgrep/consistency/lang-consistency-hcl.yaml
  • https://github.com/returntocorp/semgrep-rules/tree/develop/yaml/semgrep/consistency/lang-consistency-js.yaml
  • https://github.com/returntocorp/semgrep-rules/tree/develop/yaml/semgrep/consistency/lang-consistency-kotlin.yaml
  • https://github.com/returntocorp/semgrep-rules/tree/develop/yaml/semgrep/consistency/lang-consistency-python.yaml
  • https://github.com/returntocorp/semgrep-rules/tree/develop/yaml/semgrep/consistency/lang-consistency-regex.yaml
  • https://github.com/returntocorp/semgrep-rules/tree/develop/yaml/semgrep/consistency/lang-consistency-solidity.yaml
  • https://github.com/returntocorp/semgrep-rules/tree/develop/yaml/semgrep/consistency/lang-consistency-ts.yaml

This one has a test, but its got a different name, meaning the registry cannot access it:

  • https://semgrep.dev/playground?registry=terraform.aws.security.aws-fsx-lustre-files-ystem.aws-fsx-lustre-filesystem-encrypted-with-cmk
  • https://github.com/returntocorp/semgrep-rules/tree/develop/terraform/aws/security/aws-fsx-lustre-files-ystem.yaml

LewisArdern avatar May 06 '22 14:05 LewisArdern

More:

  • mobsf.mobsfscan.xmldecoder_xxe.xml_decoder_xxe
  • mobsf.mobsfscan.xmlfactory_external_entities_enabled.xmlinputfactory_xxe_enabled
  • mobsf.mobsfscan.xmlfactory_xxe.xmlinputfactory_xxe
  • gitlab.find_sec_bugs.XXE_SAXPARSER-1
  • gitlab.find_sec_bugs.XXE_XMLREADER-1
  • gitlab.find_sec_bugs.XXE_XMLSTREAMREADER-1
  • gitlab.find_sec_bugs.XXE_XPATH-1.XXE_DOCUMENT-1

0xDC0DE avatar Jun 02 '22 12:06 0xDC0DE