mirror of
https://github.com/allaunthefox/Research-Stack.git
synced 2026-07-31 03:05:21 +00:00
65 lines
2.4 KiB
YAML
65 lines
2.4 KiB
YAML
# Semgrep Configuration for NoDupeLabs
|
|
#
|
|
# EXCLUSION RATIONALE:
|
|
# The SQL queries in nodupe/tools/databases/*.py files use the _validate_identifier()
|
|
# function to sanitize all table and column names before constructing SQL queries.
|
|
# This function validates that identifiers match the pattern ^[a-zA-Z_][a-zA-Z0-9_]*$,
|
|
# which effectively prevents SQL injection attacks by only allowing alphanumeric
|
|
# characters and underscores, with the requirement that identifiers start with a letter.
|
|
#
|
|
# Semgrep's sqlalchemy-execute-raw-query and formatted-sql-query rules flag these
|
|
# as potential vulnerabilities because they cannot track data flow through custom
|
|
# validation functions. These are false positives because the _validate_identifier()
|
|
# function provides equivalent or stronger protection than parameterized queries
|
|
# for identifier sanitization.
|
|
#
|
|
# Reference: nodupe/tools/databases/security.py and nodupe/tools/databases/wrapper.py
|
|
#
|
|
# USAGE:
|
|
# Run semgrep with: semgrep --config .semgrep.yml --config auto <path>
|
|
# This configuration will suppress the specified false positive findings.
|
|
#
|
|
# Note: The .semgrepignore file also excludes these files from scanning entirely.
|
|
# This config provides rule-specific exclusions as an alternative approach.
|
|
|
|
rules:
|
|
# Suppress sqlalchemy-execute-raw-query for database files that use _validate_identifier()
|
|
- id: sqlalchemy-execute-raw-query
|
|
message: |
|
|
SQL query execution detected. This is a false positive for files using
|
|
_validate_identifier() which sanitizes all SQL identifiers.
|
|
languages:
|
|
- python
|
|
severity: INFO
|
|
patterns:
|
|
- pattern: |
|
|
$EXEC($QUERY, ...)
|
|
- metavariable-pattern:
|
|
metavariable: $EXEC
|
|
pattern: |
|
|
execute
|
|
- metavariable-pattern:
|
|
metavariable: $QUERY
|
|
pattern: |
|
|
f"..."
|
|
paths:
|
|
exclude:
|
|
- '**/nodupe/tools/databases/*'
|
|
|
|
# Suppress formatted-sql-query for database files that use _validate_identifier()
|
|
- id: formatted-sql-query
|
|
message: |
|
|
Formatted SQL query detected. This is a false positive for files using
|
|
_validate_identifier() which sanitizes all SQL identifiers.
|
|
languages:
|
|
- python
|
|
severity: INFO
|
|
patterns:
|
|
- pattern: |
|
|
f"..."
|
|
- metavariable-regex:
|
|
metavariable: $STRING
|
|
regex: ".*(?i)(SELECT|INSERT|UPDATE|DELETE|DROP|CREATE|ALTER|EXEC).*"
|
|
paths:
|
|
exclude:
|
|
- '**/nodupe/tools/databases/*'
|