rules:
- id: bash-world-writable-permissions
  message: >-
    Detected use of chmod 777 (world-readable/writable/executable). This
    grants full permissions to all users, creating a significant security
    risk. Use restrictive permissions like 600 or 700 instead.
  metadata:
    cwe:
    - 'CWE-732: Incorrect Permission Assignment for Critical Resource'
    owasp:
    - A01:2021 - Broken Access Control
    category: security
    technology:
    - bash
    subcategory:
    - vuln
    likelihood: HIGH
    impact: HIGH
    confidence: HIGH
    references:
    - https://owasp.org/www-community/vulnerabilities/Unrestricted_File_Upload
  severity: ERROR
  languages: [bash]
  pattern-either:
    - pattern: chmod 777 ...
    - pattern: chmod a+rwx ...
    - pattern: chmod ugo+rwx ...

- id: bash-world-readable-sensitive-files
  message: >-
    Detected overly permissive permissions (666 or a+rw) on files. This
    makes files world-readable and writable. Use restrictive permissions
    like 600 for sensitive files.
  metadata:
    cwe:
    - 'CWE-732: Incorrect Permission Assignment for Critical Resource'
    owasp:
    - A01:2021 - Broken Access Control
    category: security
    technology:
    - bash
    subcategory:
    - vuln
    likelihood: HIGH
    impact: MEDIUM
    confidence: HIGH
    references:
    - https://cwe.mitre.org/data/definitions/732.html
  severity: WARNING
  languages: [bash]
  pattern-either:
    - pattern: chmod 666 ...
    - pattern: chmod a+rw ...
    - pattern: chmod ugo+rw ...

- id: bash-insecure-temp-file
  message: >-
    Detected predictable temporary file creation. Using predictable filenames
    like /tmp/tempfile_$$ creates race condition vulnerabilities. Use
    `mktemp` to create secure temporary files.
  metadata:
    cwe:
    - 'CWE-377: Insecure Temporary File'
    - 'CWE-379: Creation of Temporary File in Directory with Incorrect Permissions'
    owasp:
    - A01:2021 - Broken Access Control
    category: security
    technology:
    - bash
    subcategory:
    - vuln
    likelihood: MEDIUM
    impact: MEDIUM
    confidence: HIGH
    references:
    - https://cwe.mitre.org/data/definitions/377.html
  severity: WARNING
  languages: [bash]
  pattern-either:
    - pattern: |
        $X="/tmp/...$$..."
    - pattern: |
        "/tmp/tempfile_$$"
    - pattern: |
        "/tmp/temp_$$"
    - pattern: temp_file="/tmp/tempfile_$$"
    - pattern: |
        temp_file="/tmp/tempfile_$$"

- id: bash-umask-permissive
  message: >-
    Detected overly permissive umask setting. A umask of 000 allows
    world-readable/writable files to be created by default. Use
    restrictive umask like 077 or 027.
  metadata:
    cwe:
    - 'CWE-732: Incorrect Permission Assignment for Critical Resource'
    owasp:
    - A01:2021 - Broken Access Control
    category: security
    technology:
    - bash
    subcategory:
    - vuln
    likelihood: MEDIUM
    impact: MEDIUM
    confidence: HIGH
    references:
    - https://man7.org/linux/man-pages/man2/umask.2.html
  severity: WARNING
  languages: [bash]
  pattern-either:
    - pattern: umask 000
    - pattern: umask 0000

- id: bash-chown-recursive-dangerous
  message: >-
    Detected recursive chmod on root directory or critical system paths.
    This can break system security by modifying permissions on system files.
    Be extremely careful with recursive permission changes.
  metadata:
    cwe:
    - 'CWE-732: Incorrect Permission Assignment for Critical Resource'
    owasp:
    - A01:2021 - Broken Access Control
    category: security
    technology:
    - bash
    subcategory:
    - vuln
    likelihood: MEDIUM
    impact: CRITICAL
    confidence: MEDIUM
    references:
    - https://cwe.mitre.org/data/definitions/732.html
  severity: ERROR
  languages: [bash]
  pattern-either:
    - pattern: chmod -R 777 /
    - pattern: chmod -R ... /etc
    - pattern: chmod -R ... /usr
    - pattern: chmod -R ... /bin
    - pattern: chown -R ... /

- id: bash-script-world-writable
  message: >-
    Detected making the current script world-writable. This allows any
    user to modify the script, leading to code execution vulnerabilities.
    Scripts should have restrictive permissions (700 or 755).
  metadata:
    cwe:
    - 'CWE-732: Incorrect Permission Assignment for Critical Resource'
    owasp:
    - A01:2021 - Broken Access Control
    category: security
    technology:
    - bash
    subcategory:
    - vuln
    likelihood: HIGH
    impact: CRITICAL
    confidence: HIGH
    references:
    - https://cwe.mitre.org/data/definitions/732.html
  severity: ERROR
  languages: [bash]
  pattern-either:
    - pattern: chmod 777 "$0"
    - pattern: chmod 777 $0
    - pattern: chmod a+w "$0"
    - pattern: chmod a+w $0
