feat: add symfony insecure cookie rule

Bearer · Oct 10, 2023 · e777a3d · e777a3d
1 parent ccb0162
commit e777a3d
Show file tree

Hide file tree

Showing 5 changed files with 619 additions and 0 deletions.
diff --git a/rules/php/symfony/insecure_cookie.yml b/rules/php/symfony/insecure_cookie.yml
@@ -0,0 +1,125 @@
+imports:
+  - php_shared_lang_instance
+patterns:
+  - pattern: |
+      $<CLASS>::create($<_>, $<_>, $<_>, $<_>, $<_>, $<SECURE>$<...>)
+    filters:
+      - variable: CLASS
+        regex: \A(Symfony\\Component\\HttpFoundation\\)?Cookie\z
+      - variable: SECURE
+        detection: php_symfony_insecure_cookie_false
+        scope: cursor
+  - pattern: |
+      $<CLASS>::create(secure: $<SECURE>)
+    filters:
+      - variable: CLASS
+        regex: \A(Symfony\\Component\\HttpFoundation\\)?Cookie\z
+      - variable: SECURE
+        detection: php_symfony_insecure_cookie_false
+        scope: cursor
+  - pattern: |
+      $<CLASS>::create($<_>, $<_>, $<_>, $<_>, $<_>, $<_>, $<HTTP_ONLY>$<...>)
+    filters:
+      - variable: CLASS
+        regex: \A(Symfony\\Component\\HttpFoundation\\)?Cookie\z
+      - variable: HTTP_ONLY
+        detection: php_symfony_insecure_cookie_false
+        scope: cursor
+  - pattern: |
+      $<CLASS>::create(httpOnly: $<HTTP_ONLY>)
+    filters:
+      - variable: CLASS
+        regex: \A(Symfony\\Component\\HttpFoundation\\)?Cookie\z
+      - variable: HTTP_ONLY
+        detection: php_symfony_insecure_cookie_false
+        scope: cursor
+  - pattern: |
+      new $<CLASS>($<_>, $<_>, $<_>, $<_>, $<_>, $<SECURE>$<...>)
+    filters:
+      - variable: CLASS
+        regex: \A(Symfony\\Component\\HttpFoundation\\)?Cookie\z
+      - variable: SECURE
+        detection: php_symfony_insecure_cookie_false
+        scope: cursor
+  - pattern: |
+      new $<CLASS>(secure: $<SECURE>)
+    filters:
+      - variable: CLASS
+        regex: \A(Symfony\\Component\\HttpFoundation\\)?Cookie\z
+      - variable: SECURE
+        detection: php_symfony_insecure_cookie_false
+        scope: cursor
+  - pattern: |
+      new $<CLASS>($<_>, $<_>, $<_>, $<_>, $<_>, $<_>, $<HTTP_ONLY>$<...>)
+    filters:
+      - variable: CLASS
+        regex: \A(Symfony\\Component\\HttpFoundation\\)?Cookie\z
+      - variable: HTTP_ONLY
+        detection: php_symfony_insecure_cookie_false
+        scope: cursor
+  - pattern: |
+      new $<CLASS>(httpOnly: $<HTTP_ONLY>)
+    filters:
+      - variable: CLASS
+        regex: \A(Symfony\\Component\\HttpFoundation\\)?Cookie\z
+      - variable: HTTP_ONLY
+        detection: php_symfony_insecure_cookie_false
+        scope: cursor
+  - pattern: $<COOKIE>->withSecure($<SECURE>)
+    filters:
+      - variable: COOKIE
+        detection: php_symfony_insecure_cookie_instance
+        scope: cursor
+      - variable: SECURE
+        detection: php_symfony_insecure_cookie_false
+        scope: cursor
+  - pattern: $<COOKIE>->withHttpOnly($<HTTP_ONLY>)
+    filters:
+      - variable: COOKIE
+        detection: php_symfony_insecure_cookie_instance
+        scope: cursor
+      - variable: HTTP_ONLY
+        detection: php_symfony_insecure_cookie_false
+        scope: cursor
+auxiliary:
+  - id: php_symfony_insecure_cookie_false
+    patterns:
+      - "false;"
+  - id: php_symfony_insecure_cookie_instance
+    patterns:
+      - pattern: $<INSTANCE>;
+        filters:
+          - variable: INSTANCE
+            detection: php_shared_lang_instance
+            scope: cursor
+            filters:
+              - variable: CLASS
+                regex: \A(Symfony\\Component\\HttpFoundation\\)?Cookie\z
+      - pattern: |
+          $<CLASS>::create()
+        filters:
+          - variable: CLASS
+            regex: \A(Symfony\\Component\\HttpFoundation\\)?Cookie\z
+      - pattern: $<COOKIE>->$<_>()
+        filters:
+          - variable: COOKIE
+            detection: php_symfony_insecure_cookie_instance
+            scope: cursor
+languages:
+  - php
+metadata:
+  description: "Insecure options for cookie detected."
+  remediation_message: |
+    ## Description
+    To make sure cookies don't open your application up to exploits or
+    unauthorized access, make sure to set security options appropriately.
+
+    ## Remediations
+    ✅ Set `httpOnly` to `true` to avoid the cookie being sent by client-side scripts.
+
+    ✅ Set `secure`  to `true` to force cookies to only send over HTTPS.
+  cwe_id:
+    - 1004
+    - 614
+  id: php_symfony_insecure_cookie
+  documentation_url: https://docs.bearer.com/reference/rules/php_symfony_insecure_cookie