pixivfe/semgrep.yml

# Usage: semgrep scan -f semgrep.yml
rules:
- id: rule-0
  message: "http requests made without *fiber.Ctx"
  languages: [go]
  severity: WARNING
  patterns:
  - pattern-either:
    - pattern: |
        http.UnwrapWebAPIRequest(...)
    - pattern: |
        http.WebAPIRequest(...)
  - pattern-not-inside: |
      func $FUNC(c *http.Request, ...) $RET {
        ...
      }
# note: the below two rules autofix have slight problems. where `http` is sometimes "net/http". need minor manual tweaking after --autofix.
- id: rule-1-0
  message: "find http requests made to Pixiv"
  languages: [go]
  severity: INFO
  patterns:
  - pattern: |
      http.UnwrapWebAPIRequest($A, $B)
  fix: |
    http.UnwrapWebAPIRequest(c.Context(), $A, $B)
- id: rule-1-1
  message: "find http requests made to Pixiv"
  languages: [go]
  severity: INFO
  patterns:
  - pattern: |
      http.WebAPIRequest($A, $B)
  fix: |
    http.WebAPIRequest(c.Context(), $A, $B)
- id: rule-2
  message: "gjson.Get without gjson.Valid"
  languages: [go]
  severity: ERROR
  patterns:
  # - pattern-inside: |
  #     func $FUNC(...) $RET {
  #       ...
  #     }
  - pattern: |
      gjson.Get($X, ...)
  - pattern-not-inside: |
      if !gjson.Valid($X) {
        $...DISCARD
      }
      ...
- id: rule-3
  message: "http request without context"
  languages: [go]
  severity: WARNING
  # severity: INVENTORY
  patterns:
  - pattern: |
      $REQ, $ERR := http.NewRequestWithContext($...ARGV)
      if $ERR != nil {
        $...I
      }
      $REQ = $REQ.WithContext($CTX)
  fix: |
      $REQ, err := http.NewRequestWithContext($...ARGV)
      if err != nil {
        $...I
      }
- id: rule-3a
  message: "http request without context"
  languages: [go]
  severity: WARNING
  # severity: INVENTORY
  patterns:
  - pattern: |
      http.NewRequest($...ARGV)
  fix: |
      http.NewRequestWithContext(r.Context(), $...ARGV)
- id: rule-4
  message: "fmt.Sprint on string"
  languages: [go]
  severity: WARNING
  pattern: |
    fmt.Sprint(($S : string))
- id: rule-5
  message: "unhandled error"
  languages: [go]
  severity: WARNING
  pattern: |
    (_ : error) = ...
- id: rule-6
  message: "raw UserArtCategory string"
  languages: [go]
  severity: WARNING
  patterns:
  - pattern: |
      ($A : UserArtCategory) == $B
  - pattern-not: |
      ($A : UserArtCategory) == ($B : UserArtCategory)
- id: rule-7
  message: "c.Render"
  languages: [go]
  severity: INFO
  pattern: |
    c.Render("$NAME", fiber.Map{$...INSIDE})
  paths:
    exclude:
      - "render_types.go"
  fix: |
    Render(w, r, Data_$NAME{$...INSIDE})
- id: rule-8
  message: "c.Render"
  languages: [go]
  severity: INFO
  patterns:
  - pattern-inside: |
      c.Render(...)
  - pattern: |
      fiber.Map { $...BEFORE, "$A": $B, $...AFTER }
  fix: |
    fiber.Map { $...BEFORE, $A: $B, $...AFTER }
  paths:
    exclude:
      - "render.go"
- id: rule-9
  message: "still using *fiber.Ctx"
  languages: [go]
  severity: INVENTORY
  patterns:
  - pattern: |
      func $NAME(c *fiber.Ctx) error {
        $...I
      }
  fix: |
    func $NAME(w http.ResponseWriter, r *http.Request) error {
      $...I
    }
- id: rule-10
  message: "masquerading CompatRequest"
  languages: [go]
  severity: INFO
  patterns:
  - pattern: |
      $FUNC((r : *http.Request))
  # fix: |
  #   func $NAME(w http.ResponseWriter, r *http.Request) error {
  #     $...I
  #   }
- id: rule-11
  message: "Use StatusSeeOther or StatusPermanentRedirect"
  languages: [go]
  severity: WARNING
  patterns:
  - pattern: |
      StatusFound
- id: rule-12
  message: "response body not closed"
  comment: "Needed to reuse connections"
  languages: [go]
  severity: ERROR
  patterns:
  - pattern: |
      ($RESP : *http.Response), $ERR := ...
  - pattern-not-inside: |
      ...
      defer $RESP.Body.Close()