rules:
- id: bash-eval-usage
  message: >-
    Detected use of `eval` with variables. This can lead to arbitrary code
    execution if the input is not properly sanitized. Avoid using eval,
    especially with user input.
  metadata:
    cwe:
    - 'CWE-95: Improper Neutralization of Directives in Dynamically Evaluated Code'
    - 'CWE-78: OS Command Injection'
    owasp:
    - A03:2021 - Injection
    category: security
    technology:
    - bash
    subcategory:
    - vuln
    likelihood: HIGH
    impact: CRITICAL
    confidence: HIGH
    references:
    - https://owasp.org/www-community/attacks/Command_Injection
  severity: ERROR
  languages: [bash]
  pattern-either:
    - pattern: eval "$..."
    - pattern: eval $...
    - pattern: eval ...

- id: bash-unquoted-variable-in-command
  message: >-
    Detected unquoted variable in command execution. This can lead to
    command injection via word splitting or glob expansion. Always quote
    variables: "$var" instead of $var.
  metadata:
    cwe:
    - 'CWE-78: OS Command Injection'
    owasp:
    - A03:2021 - Injection
    category: security
    technology:
    - bash
    subcategory:
    - vuln
    likelihood: MEDIUM
    impact: HIGH
    confidence: MEDIUM
    references:
    - https://mywiki.wooledge.org/Quotes
  severity: WARNING
  languages: [bash]
  patterns:
    - pattern-either:
        - pattern: cat $...
        - pattern: rm $...
        - pattern: chmod $...
        - pattern: chown $...
    - pattern-not: cat "$..."
    - pattern-not: rm "$..."
    - pattern-not: chmod "$..."
    - pattern-not: chown "$..."

- id: bash-sql-injection
  message: >-
    Detected SQL query with unquoted variable interpolation. This can lead
    to SQL injection. Use parameterized queries or properly escape input.
  metadata:
    cwe:
    - 'CWE-89: SQL Injection'
    owasp:
    - A03:2021 - Injection
    category: security
    technology:
    - bash
    - sql
    subcategory:
    - vuln
    likelihood: HIGH
    impact: CRITICAL
    confidence: HIGH
    references:
    - https://owasp.org/www-community/attacks/SQL_Injection
  severity: ERROR
  languages: [bash]
  pattern-either:
    - pattern: mysql ... "SELECT * FROM ... WHERE ... $$..."
    - pattern: mysql ... "INSERT INTO ... VALUES ... $$..."
    - pattern: mysql ... "UPDATE ... SET ... $$..."
    - pattern: mysql ... "DELETE FROM ... WHERE ... $$..."
    - pattern: mysql -e "SELECT ... WHERE ... $$..."
    - pattern: mysql -e "UPDATE ... SET ... $$..."
    - pattern: |
        mysql -e "SELECT ... WHERE ... $$..."
    - pattern: psql ... "SELECT * FROM ... WHERE ... $$..."
    - pattern: psql ... "INSERT INTO ... VALUES ... $$..."
    - pattern: psql ... "UPDATE ... SET ... $$..."
    - pattern: psql ... "DELETE FROM ... WHERE ... $$..."

- id: bash-path-traversal
  message: >-
    Detected potential path traversal vulnerability. User-controlled input
    is used in file path without sanitization. Validate and sanitize file
    paths to prevent directory traversal attacks.
  metadata:
    cwe:
    - 'CWE-22: Path Traversal'
    owasp:
    - A01:2021 - Broken Access Control
    category: security
    technology:
    - bash
    subcategory:
    - vuln
    likelihood: MEDIUM
    impact: HIGH
    confidence: MEDIUM
    references:
    - https://owasp.org/www-community/attacks/Path_Traversal
  severity: WARNING
  languages: [bash]
  pattern-either:
    - pattern: cat /.../$$...
    - pattern: cat "/.../$$..."

- id: bash-backtick-command-substitution
  message: >-
    Detected use of backticks for command substitution with variables.
    Backticks can lead to command injection. Use $(...) instead and ensure
    proper quoting.
  metadata:
    cwe:
    - 'CWE-78: OS Command Injection'
    owasp:
    - A03:2021 - Injection
    category: security
    technology:
    - bash
    subcategory:
    - vuln
    likelihood: MEDIUM
    impact: HIGH
    confidence: MEDIUM
    references:
    - https://mywiki.wooledge.org/BashFAQ/082
  severity: WARNING
  languages: [bash]
  pattern: |
    `...$$...`

- id: bash-unsafe-sudo
  message: >-
    Detected use of sudo with unquoted variable. This can lead to privilege
    escalation if the variable contains malicious input. Always quote and
    validate input used with sudo.
  metadata:
    cwe:
    - 'CWE-78: OS Command Injection'
    - 'CWE-269: Improper Privilege Management'
    owasp:
    - A03:2021 - Injection
    category: security
    technology:
    - bash
    subcategory:
    - vuln
    likelihood: MEDIUM
    impact: CRITICAL
    confidence: MEDIUM
    references:
    - https://www.sudo.ws/
  severity: ERROR
  languages: [bash]
  patterns:
    - pattern: sudo $...
    - pattern-not: sudo "$..."

- id: bash-find-exec-injection
  message: >-
    Detected use of `find -exec` with potentially user-controlled pattern.
    This can lead to command injection or unintended file deletion. Be
    extremely careful with user input in find commands.
  metadata:
    cwe:
    - 'CWE-78: OS Command Injection'
    owasp:
    - A03:2021 - Injection
    category: security
    technology:
    - bash
    subcategory:
    - vuln
    likelihood: MEDIUM
    impact: HIGH
    confidence: MEDIUM
    references:
    - https://www.gnu.org/software/findutils/manual/html_node/find_005fhtml/
  severity: WARNING
  languages: [bash]
  pattern: find ... -name "$..." -exec ...
