fedora-glow-kit/.semgrep.yml at main · daredoole/fedora-glow-kit · GitHub

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
rules:
  - id: glow-kit-no-eval
    message: Do not execute dynamically constructed shell content.
    severity: ERROR
    languages:
      - generic
    paths:
      include:
        - "*.sh"
        - "/bin/*"
      exclude:
        - "/configs/**"
    pattern-regex: '(^|[;&|[:space:]])eval[[:space:]]'

  - id: glow-kit-no-remote-pipe
    message: Remote content must never be piped directly into a shell.
    severity: ERROR
    languages:
      - generic
    paths:
      include:
        - "*.sh"
        - "/bin/*"
      exclude:
        - "/configs/**"
    pattern-regex: '(curl|wget)[^\n|]*\|[[:space:]]*(ba)?sh'

  - id: glow-kit-no-world-writable-files
    message: Do not make kit state or configuration world-writable.
    severity: ERROR
    languages:
      - generic
    paths:
      include:
        - "*.sh"
        - "/bin/*"
    pattern-regex: 'chmod[[:space:]]+(-R[[:space:]]+)?(666|777)'