rules:
- id: razor-template-injection
  message: User-controllable string passed to Razor.Parse. This leads directly to code execution in the
    context of the process.
  severity: WARNING
  metadata:
    likelihood: MEDIUM
    impact: MEDIUM
    confidence: MEDIUM
    category: security
    cwe:
    - "CWE-94: Improper Control of Generation of Code ('Code Injection')"
    cwe2022-top25: true
    owasp:
    - A03:2021 - Injection
    - A05:2025 - Injection
    references:
    - https://clement.notin.org/blog/2020/04/15/Server-Side-Template-Injection-(SSTI)-in-ASP.NET-Razor/
    subcategory:
    - vuln
    technology:
    - .net
    - razor
    - asp
  languages:
  - csharp
  mode: taint
  pattern-sources:
  - patterns:
    - focus-metavariable: $ARG
    - pattern-inside: |
        public ActionResult $METHOD(..., string $ARG,...){...}
  pattern-sinks:
  - pattern: |
      Razor.Parse(...)
  pattern-sanitizers:
  - not_conflicting: true
    pattern: $F(...)