Semgrep Rules skill for Claude Code

# Semgrep rule cookbook

Worked shapes to adapt. Each rule needs its own `ruleid`/`ok` test file before it ships.
Replace module and function names with the ones the codebase actually uses. Every rule
below passes `semgrep --validate` and fires on a minimal fixture with the open-source engine
(Semgrep 1.18x); real codebases will still need `ok:` cases for their own lookalikes.

## Contents

1. Python: unsafe YAML, raw SQL string building, Django ORM without tenant filter
2. JavaScript / TypeScript: Express taint to SQL, `child_process`, JWT decode without verify
3. Go: `database/sql` string building, `InsecureSkipVerify`
4. Java: Spring `@RequestMapping` without auth annotation
5. Internal API bans and architecture rules
6. Secrets-shaped identifiers with metavariable-regex
7. Generic and config files

---

## 1. Python

### yaml.load without a safe loader

```yaml
- id: yaml-load-unsafe
  languages: [python]
  severity: HIGH
  message: yaml.load() without SafeLoader can construct arbitrary objects. Use yaml.safe_load().
  patterns:
    - pattern: yaml.load(...)
    - pattern-not: yaml.load(..., Loader=yaml.SafeLoader, ...)
    - pattern-not: yaml.load(..., Loader=yaml.CSafeLoader, ...)

- id: yaml-load-single-arg-autofix
  languages: [python]
  severity: HIGH
  message: yaml.load($DATA) without a Loader. Use yaml.safe_load($DATA).
  pattern: yaml.load($DATA)
  fix: yaml.safe_load($DATA)
```

The autofix variant matches only the single-argument form, where the rewrite is always
correct. Prove it with a `.fixed.py` test file before enabling `--autofix` anywhere.

### String-built SQL passed to a cursor

```yaml
- id: sql-string-building
  languages: [python]
  severity: HIGH
  message: SQL built with string formatting. Use parameters, e.g. cur.execute("... WHERE id = %s", (user_id,)).
  patterns:
    - pattern-either:
        - pattern: $CUR.execute(f"...", ...)
        - pattern: $CUR.execute("..." % $X, ...)
        - pattern: $CUR.execute("..." + $X, ...)
        - pattern: $CUR.execute("...".format(...), ...)
        - patterns:
            - pattern-inside: |
                $Q = f"..."
                ...
            - pattern: $CUR.execute($Q, ...)
    - metavariable-regex:
        metavariable: $CUR
        regex: (?i).*(cur|cursor|conn|connection|session|db).*
```

### Model lookup missing a tenant filter (Django)

Encodes "every query on tenant-owned models must filter by account":

```yaml
- id: tenant-model-unscoped-get
  languages: [python]
  severity: HIGH
  message: $MODEL is tenant-owned; scope the lookup with account=request.user.account or use $MODEL.for_account(...).
  patterns:
    - pattern-either:
        - pattern: $MODEL.objects.get(...)
        - pattern: $MODEL.objects.filter(...)
    - pattern-not: $MODEL.objects.get(..., account=$A, ...)
    - pattern-not: $MODEL.objects.filter(..., account=$A, ...)
    - metavariable-regex:
        metavariable: $MODEL
        regex: ^(Invoice|Project|Document|Member)$
  paths:
    exclude: ["**/migrations/**", "**/management/commands/**"]
```

Maintain the model list from the code (for example, every model with an `account` FK).
A test should include a chained `.filter(account=a).get(id=x)` as `ok`, and that case may
require an extra `pattern-not-inside`.

---

## 2. JavaScript / TypeScript

### Express request data into a raw query (taint)

```yaml
- id: express-taint-raw-sql
  mode: taint
  languages: [javascript, typescript]
  severity: CRITICAL
  message: Request input reaches a raw SQL string. Use placeholders ($1 / ?) with a values array.
  pattern-sources:
    - pattern-either:
        - pattern: $REQ.query
        - pattern: $REQ.body
        - pattern: $REQ.params
  pattern-sanitizers:
    - pattern: Number($X)
    - pattern: parseInt($X, ...)
  pattern-sinks:
    - patterns:
        - pattern-either:
            - pattern: $DB.query($SQL, ...)
            - pattern: $DB.raw($SQL, ...)
            - pattern: $PRISMA.$queryRawUnsafe($SQL, ...)
        - focus-metavariable: $SQL
```

`$REQ.query` is broad; if it taints unrelated objects, constrain with
`pattern-inside: function $F($REQ, $RES, ...) { ... }` or the router callback shape.

### child_process.exec with a non-literal command

```yaml
- id: child-process-exec-dynamic
  languages: [javascript, typescript]
  severity: HIGH
  message: exec() runs a shell. Use execFile()/spawn() with an argument array.
  patterns:
    - pattern-either:
        - pattern: require("child_process").exec($CMD, ...)
        - pattern: $CP.exec($CMD, ...)
    - pattern-not: $CP.exec("...", ...)
    - metavariable-regex:
        metavariable: $CP
        regex: ^(cp|child_process|childProcess)$
```

### JWT decoded but never verified

```yaml
- id: jwt-decode-without-verify
  languages: [javascript, typescript]
  severity: HIGH
  message: jwt.decode() does not check the signature. Use jwt.verify() with an algorithm allowlist.
  patterns:
    - pattern: $JWT.decode($TOKEN, ...)
    - pattern-not-inside: |
        $JWT.verify($TOKEN, ...);
        ...
    - metavariable-regex:
        metavariable: $JWT
        regex: ^(jwt|jsonwebtoken)$
```

---

## 3. Go

```yaml
- id: go-sql-sprintf
  languages: [go]
  severity: HIGH
  message: SQL built with fmt.Sprintf. Use placeholders and pass args to Query/Exec.
  patterns:
    - pattern-either:
        - pattern: $DB.$METHOD(fmt.Sprintf($FMT, ...), ...)
        - patterns:
            - pattern-inside: |
                $Q := fmt.Sprintf($FMT, ...)
                ...
            - pattern: $DB.$METHOD($Q, ...)
    - metavariable-regex:
        metavariable: $METHOD
        regex: ^(Query|QueryRow|Exec|QueryContext|QueryRowContext|ExecContext)$

- id: go-tls-insecure-skip-verify
  languages: [go]
  severity: HIGH
  message: InsecureSkipVerify disables certificate checks. Configure RootCAs instead.
  pattern: "tls.Config{..., InsecureSkipVerify: true, ...}"
```

---

## 4. Java (Spring)

Handler methods that lack an authorization annotation:

```yaml
- id: spring-endpoint-missing-preauthorize
  languages: [java]
  severity: MEDIUM
  message: Endpoint has no @PreAuthorize/@Secured. Add one or annotate @PublicEndpoint with a reason.
  patterns:
    - pattern-either:
        - pattern: |
            @$MAPPING(...)
            $RET $METHOD(...) { ... }
    - metavariable-regex:
        metavariable: $MAPPING
        regex: ^(GetMapping|PostMapping|PutMapping|PatchMapping|DeleteMapping|RequestMapping)$
    - pattern-not: |
        @PreAuthorize(...)
        $RET $METHOD(...) { ... }
    - pattern-not: |
        @Secured(...)
        $RET $METHOD(...) { ... }
    - pattern-not: |
        @PublicEndpoint(...)
        $RET $METHOD(...) { ... }
```

Annotation order in source does not matter to Semgrep, but class-level annotations do:
add `pattern-not-inside` for `@PreAuthorize(...) class $C { ... }` if used.

---

## 5. Internal API bans and architecture rules

```yaml
- id: no-direct-stripe-outside-billing
  languages: [typescript]
  severity: MEDIUM
  message: Call Stripe only through src/billing/stripeClient.ts so idempotency keys and logging stay consistent.
  pattern-either:
    - pattern: import $X from "stripe"
    - pattern: import { $...X } from "stripe"
  paths:
    exclude: ["src/billing/**"]

- id: no-legacy-http-client
  languages: [python]
  severity: LOW
  message: legacy_http is deprecated (ADR-014). Use app.http.client, which sets timeouts and retries.
  pattern-either:
    - pattern: import legacy_http
    - pattern: from legacy_http import $X
```

Architecture rules are cheap to write and high value. Link the ADR in `metadata.references`.

---

## 6. Secret-shaped identifiers

```yaml
- id: hardcoded-credential-assignment-py
  languages: [python]
  severity: HIGH
  message: Credential-like value assigned from a string literal. Load it from the environment or secret manager.
  patterns:
    - pattern: $NAME = "$VALUE"
    - metavariable-regex:
        metavariable: $NAME
        regex: (?i).*(password|passwd|secret|api_?key|token|private_?key).*
    - metavariable-regex:
        metavariable: $VALUE
        regex: ^.{12,}$

- id: hardcoded-credential-assignment-js
  languages: [javascript, typescript]
  severity: HIGH
  message: Credential-like value assigned from a string literal. Read it from process.env or the secret manager.
  patterns:
    - pattern-either:
        - pattern: const $NAME = "$VALUE"
        - pattern: let $NAME = "$VALUE"
    - metavariable-regex:
        metavariable: $NAME
        regex: (?i).*(password|passwd|secret|api_?key|token|private_?key).*
    - metavariable-regex:
        metavariable: $VALUE
        regex: ^.{12,}$
```

This complements, not replaces, a real secret scanner such as gitleaks (see the
secrets-management skill).

---

## 7. Generic and config files

```yaml
- id: dockerfile-curl-pipe-shell
  languages: [dockerfile]
  severity: MEDIUM
  message: Piping a downloaded script to a shell skips integrity checks. Download, verify a checksum, then run.
  pattern-either:
    - pattern: RUN ... curl ... | sh ...
    - pattern: RUN ... curl ... | bash ...
    - pattern: RUN ... wget ... | sh ...

- id: gha-pull-request-target-checkout-head
  languages: [yaml]
  severity: HIGH
  message: pull_request_target with a checkout of the PR head runs untrusted code with secrets.
  patterns:
    - pattern-inside: |
        on:
          ...
          pull_request_target: ...
        ...
    - pattern: "ref: ${{ github.event.pull_request.head.sha }}"
```

Structural matching for Dockerfile and YAML shapes is less predictable than for code.
Prove each of these with a test fixture first; if the structural pattern does not match the
real files, fall back to `pattern-regex` with a narrow regex and keep the fixture.