rules:
- id: curl-pipe-bash
  languages: [bash]
  severity: WARNING
  message: >-
    Data is being piped into `bash` from a `curl` command. An attacker with control of the server
    in the `curl` command could inject malicious code into the pipe, resulting in a
    system compromise. Avoid piping untrusted data into `bash` or any other shell if you can.
    If you must do this, consider checking the SHA sum of the content returned by the server to verify
    its
    integrity.
  metadata:
    owasp:
    - A03:2021 - Injection
    cwe:
    - "CWE-95: Improper Neutralization of Directives in Dynamically Evaluated Code ('Eval Injection')"
    category: security
    technology:
    - bash
    - curl
    confidence: LOW
    references:
    - https://owasp.org/Top10/A03_2021-Injection
    subcategory:
    - audit
    likelihood: LOW
    impact: LOW
  patterns:
    - pattern-either:
        - pattern: curl ... | ... bash ...
        - pattern: curl ... | ... /bin/bash ...
        - pattern: ... bash <(curl ...)
        - pattern: ... /bin/bash <(curl ...)
        - pattern: ... bash -c "$(curl ...)"
        - pattern: ... /bin/bash -c "$(curl ...)"