May 2020 Summaries

HTTP verbs, commonly known as GET and POST, can actually be arbitrary, according to the HTTP/1.1 specification, which allows for custom verbs that can be manipulated and potentially exploited in applications. This potential vulnerability was discovered while scanning for cross-site scripting (XSS) in Django apps, where an HTTP request's method was not properly handled, leading to a possible XSS vulnerability. The issue arises because the HTTP protocol recognizes the first sequence of characters as the verb, and browsers transform these to uppercase, complicating traditional JavaScript injection attempts. This vulnerability can be detected using tools like Semgrep, which provides rules to identify security issues by scanning code for patterns that reflect user input without proper sanitization. Although modern browsers generally prevent exploitation through weird characters in HTTP verbs, vigilance is essential as attackers may still find creative ways to exploit such vulnerabilities.

Semgrep is an open-source tool designed to bridge the gap between the simplicity of grep and the robustness of abstract syntax tree (AST) parsers, offering a more precise and language-aware code analysis. Unlike traditional static analysis tools that are often slow and focused on language-level defects, Semgrep provides a faster, more versatile approach by enabling users to write code-aware search patterns that can match code structures across multiple programming languages. It uses semantic logic to identify code equivalences and employs metavariables and ellipsis to streamline pattern matching, making it easier for developers to catch framework-specific bugs that traditional methods might miss. Originally developed at Facebook to enforce code rules across their codebase, Semgrep supports various languages including Python, JavaScript, Java, and Golang, with ongoing development to expand its language coverage and capabilities. This tool aims to enhance code security and quality by allowing developers to write and share tailored search patterns, providing a community-driven approach to modern code analysis.

Semgrep is an open-source analysis tool that simplifies the process of rule writing across multiple programming languages by allowing developers to write analysis in a way that mirrors their coding style, unlike traditional AST-based frameworks that require complex graph algorithms. Developed by r2c and originally designed at Facebook, Semgrep utilizes features like metavariables, ellipsis operators, and smart pattern matching to facilitate concise and precise code analysis, reducing the need for extensive boilerplate code. This approach not only enhances the efficiency of static analysis, significantly decreasing false positive rates, but also supports easy adaptation of rules across different languages. Semgrep's capabilities extend beyond pattern matching, offering advanced functionalities such as type hints, module path awareness, and custom post-analysis filtering, making it a robust alternative to both AST and grep-based tools. Overall, Semgrep provides a more intuitive and efficient experience for developers, especially when prototyping rules against real code, by eliminating the complexities associated with traditional code analysis methodologies.

SQL Injection (SQLi) is a severe web vulnerability that occurs when user inputs are improperly included in SQL queries, potentially leading to data breaches or database damage. While frameworks like Django's ORM mitigate many SQLi risks by using parameterized statements, developers must remain vigilant, especially when using raw SQL queries or custom ORM additions. Effective prevention involves never trusting user data, consistently using parameterized queries, and employing code analysis tools like Bento, which can detect and prevent SQLi patterns throughout the development process. Although Django's ORM offers robust protection, cautious auditing of custom and third-party code is essential to maintain security, as SQLi vulnerabilities, though rare, can have devastating consequences.

Hella Secure hosted a successful virtual AppSec conference, HellaConf 2020, where r2c's CTO, Drew, presented on Semgrep, an open-source code analysis tool designed for security and correctness queries across multiple programming languages using a simple interface similar to grep. Semgrep, which evolved from its predecessor sgrep, was initially developed by Yoann Padioleau, who previously worked on Coccinelle for Linux kernel refactoring and later contributed to sgrep at Facebook before joining the r2c team full-time. The presentation, along with the video recording and slides, is available thanks to Hella Secure's efforts, and the entire conference can be accessed on Twitch.