Research-Stack/4-Infrastructure/NoDupeLabs/.semgrep.yml

65 lines
2.4 KiB
YAML

# Semgrep Configuration for NoDupeLabs
#
# EXCLUSION RATIONALE:
# The SQL queries in nodupe/tools/databases/*.py files use the _validate_identifier()
# function to sanitize all table and column names before constructing SQL queries.
# This function validates that identifiers match the pattern ^[a-zA-Z_][a-zA-Z0-9_]*$,
# which effectively prevents SQL injection attacks by only allowing alphanumeric
# characters and underscores, with the requirement that identifiers start with a letter.
#
# Semgrep's sqlalchemy-execute-raw-query and formatted-sql-query rules flag these
# as potential vulnerabilities because they cannot track data flow through custom
# validation functions. These are false positives because the _validate_identifier()
# function provides equivalent or stronger protection than parameterized queries
# for identifier sanitization.
#
# Reference: nodupe/tools/databases/security.py and nodupe/tools/databases/wrapper.py
#
# USAGE:
# Run semgrep with: semgrep --config .semgrep.yml --config auto <path>
# This configuration will suppress the specified false positive findings.
#
# Note: The .semgrepignore file also excludes these files from scanning entirely.
# This config provides rule-specific exclusions as an alternative approach.
rules:
# Suppress sqlalchemy-execute-raw-query for database files that use _validate_identifier()
- id: sqlalchemy-execute-raw-query
message: |
SQL query execution detected. This is a false positive for files using
_validate_identifier() which sanitizes all SQL identifiers.
languages:
- python
severity: INFO
patterns:
- pattern: |
$EXEC($QUERY, ...)
- metavariable-pattern:
metavariable: $EXEC
pattern: |
execute
- metavariable-pattern:
metavariable: $QUERY
pattern: |
f"..."
paths:
exclude:
- '**/nodupe/tools/databases/*'
# Suppress formatted-sql-query for database files that use _validate_identifier()
- id: formatted-sql-query
message: |
Formatted SQL query detected. This is a false positive for files using
_validate_identifier() which sanitizes all SQL identifiers.
languages:
- python
severity: INFO
patterns:
- pattern: |
f"..."
- metavariable-regex:
metavariable: $STRING
regex: ".*(?i)(SELECT|INSERT|UPDATE|DELETE|DROP|CREATE|ALTER|EXEC).*"
paths:
exclude:
- '**/nodupe/tools/databases/*'