rules:
- id: conf-csrf-headers-bypass
  patterns:
  - pattern-either:
    - pattern: X-Requested-With = "*"
    - pattern: Csrf-Token = "..."
  - pattern-inside: |
      bypassHeaders {...
      ...
      ...}
  - pattern-not-inside: |
      {...
        ...
        ...blackList = [..."application/x-www-form-urlencoded"..."multipart/form-data"..."text/plain"...]
        ...
      ...}
  - pattern-not-inside: |
      {...
        ...
        ...blackList = [..."application/x-www-form-urlencoded"..."text/plain"..."multipart/form-data"...]
        ...
      ...}
  - pattern-not-inside: |
      {...
        ...
        ...blackList = [..."multipart/form-data"..."application/x-www-form-urlencoded"..."text/plain"...]
        ...
      ...}
  - pattern-not-inside: |
      {...
        ...
        ...blackList = [..."multipart/form-data"..."text/plain"..."application/x-www-form-urlencoded"...]
        ...
      ...}
  - pattern-not-inside: |
      {...
        ...
        ...blackList = [..."text/plain"..."application/x-www-form-urlencoded"..."multipart/form-data"...]
        ...
      ...}
  - pattern-not-inside: |
      {...
        ...
        ...blackList = [..."text/plain"..."multipart/form-data"..."application/x-www-form-urlencoded"...]
        ...
      ...}
  message: >-
    Possibly bypassable CSRF configuration found.
    CSRF is an attack that forces an end user to execute unwanted actions on a web application in which
    they’re currently authenticated.
    Make sure that Content-Type black list is configured and CORS filter is turned on.
  languages: [generic]
  severity: ERROR
  paths:
    include:
    - '*.conf'
  metadata:
    references:
    - https://www.playframework.com/documentation/2.8.x/Migration25#CSRF-changes
    - https://owasp.org/www-community/attacks/csrf
    cwe:
    - 'CWE-352: Cross-Site Request Forgery (CSRF)'
    owasp:
    - A01:2021 - Broken Access Control
    category: security
    technology:
    - scala
    - play
    confidence: MEDIUM
    cwe2022-top25: true
    cwe2021-top25: true
    subcategory:
    - vuln
    likelihood: LOW
    impact: LOW