ci: add semgrep rule for HTTP API decode error status code.

hashicorp · Nov 18, 2022 · 9b55ffc · 9b55ffc
1 parent b2ad141
commit 9b55ffc
Showing 1 changed file with 22 additions and 0 deletions.
diff --git a/.semgrep/http_endpoint.yml b/.semgrep/http_endpoint.yml
@@ -0,0 +1,22 @@
+rules:
+  - id: "http-endpoint-request-decode-error-code"
+    patterns:
+      - pattern: |
+          if err := decodeBody(...); err != nil {
+          	return nil, CodedError(...)
+          }
+      - pattern-not-inside: |
+          if err := decodeBody(...); err != nil {
+          	return nil, CodedError(400, ...)
+          }
+      - pattern-not-inside: |
+          if err := decodeBody(...); err != nil {
+          	return nil, CodedError(http.StatusBadRequest, ...)
+          }
+    message: "HTTP endpoint request decode should return http.StatusBadRequest"
+    languages:
+      - "go"
+    severity: "ERROR"
+    paths:
+      include:
+        - "command/agent/*_endpoint.go"