semgrep text4shell

semgrep-text4shell-test.yaml

rules:
  - id: CVE-2022-42889
    languages:
      - java
    options:
      symbolic_propagation: true
    severity: ERROR
    message: Detected Text4Shell
    metadata:
      references:
        - https://nvd.nist.gov/vuln/detail/CVE-2022-42889
        - https://www.lunasec.io/docs/blog/text4shell-java-rce-cve-2022-42889/
    patterns:
      - pattern-either:
        - pattern: |
            StringSubstitutor.createInterpolator()
        - pattern: |
            StringLookupFactory.$INSTANCE.interpolatorStringLookup().$METHOD(...)
        - pattern: |
            (InterpolatorStringLookup $X).$METHOD(...)
        # this will introduce false-positives, can't find a way to determine actual type outside of a typed  meta-variable
        - pattern: |
            (StringSubstitutor $X).$METHOD(...)
      # https://semgrep.dev/docs/experiments/r2c-internal-project-depends-on/
      # seems to fail at the moment parsing pom.xml files
      # r2c-internal-project-depends-on:
      #   namespace: maven
      #   package: commons-text
      #   version: "< 1.10"