Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

"new" keyword in C# throws error #10205

Open
2 of 3 tasks
jagprog5 opened this issue May 4, 2024 · 1 comment
Open
2 of 3 tasks

"new" keyword in C# throws error #10205

jagprog5 opened this issue May 4, 2024 · 1 comment
Labels
good first issue Good for newcomers

Comments

@jagprog5
Copy link

jagprog5 commented May 4, 2024

semgrep version v1.70.0

rules:
  - id: id-here
    languages:
      - csharp
    severity: WARNING
    message: HashAlgorithm $NAME detected
    patterns:
      - pattern: new System.Security.Cryptography.HashAlgorithmName("$NAME")
      - metavariable-pattern:
          metavariable: $NAME
          pattern-either:
            - pattern: SHA3_384
            - pattern: SHA3_256
            - pattern: SHA384
            - pattern: SHA256
            - pattern: SHA1
            - pattern: MD5
            - pattern: SHA3_512
            - pattern: SHA512

test code:

using System.Security.Cryptography;

class Program {
    static void Main() {
        HashAlgorithmName name = new HashAlgorithmName("SHA1");
    }
}

Adding the word "new" in the above rule causes the following error:

Internal matching error when running hashname-standard-lib-c-sharp on target.cs:
 An error occurred while invoking the Semgrep engine. Please help us fix this by creating an issue at https://github.com/returntocorp/semgrep

metavariable-pattern failed because $NAME does not bind to a sub-program, please check your rule

My workaround is to replace the above metavariable-pattern with an equivalent metavariable-regex.

What is the priority of the bug to you?

  • P0: blocking your adoption of Semgrep or workflow
  • P1: important to fix or quite annoying
  • P2: regular bug that should get fixed

Environment
Semgrep playground

@brandonspark brandonspark added the good first issue Good for newcomers label May 8, 2024
@amchiclet
Copy link
Collaborator

Reduced the test. The issue seems to be language-agnostic.

# python code
f("some-name")

This rule causes the error: metavariable-pattern failed because $NAME does not bind to a sub-program, please check your rule

rules:
  - id: some-id
    languages:
      - python
    severity: WARNING
    message: some-message
    patterns:
      - pattern: f("$NAME")
      - metavariable-pattern:
          metavariable: $NAME
          pattern: some-name

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
good first issue Good for newcomers
Development

No branches or pull requests

3 participants