Add security rules for C# cookie flags and Java MD5 usage

rules/csharp/security/httponly-false-csharp.yml

@@ -0,0 +1,48 @@
+id: httponly-false-csharp
+language: csharp
+severity: warning
+message: >-
+  "Detected a cookie where the `HttpOnly` flag is either missing or
+      disabled. The `HttpOnly` cookie flag instructs the browser to forbid
+      client-side JavaScript to read the cookie. If JavaScript interaction is
+      required, you can ignore this finding. However, set the `HttpOnly` flag to
+      `true` in all other cases. If this wasn't intentional, it's recommended to
+      set the HttpOnly flag to true so the cookie will not be accessible through
+      client-side scripts or to use the Cookie Policy Middleware to globally set
+      the HttpOnly flag. You can then use the CookieOptions class when
+      instantiating the cookie, which inherits these settings and will require
+      future developers to have to explicitly override them on a case-by-case
+      basis if needed. This approach ensures cookies are secure by default."
+note: >-
+  [CWE-1004] Sensitive Cookie Without 'HttpOnly' Flag"
+  [REFERENCES]
+      - https://learn.microsoft.com/en-us/aspnet/core/security/authentication/cookie?view=aspnetcore-8.0#cookie-policy-middleware
+      - https://learn.microsoft.com/en-us/dotnet/api/microsoft.aspnetcore.http.cookieoptions
+      - https://owasp.org/Top10/A05_2021-Security_Misconfiguration
+
+ast-grep-essentials: true
+
+rule:
+  kind: boolean_literal
+  pattern: $LITERAL
+  follows:
+    regex: ^=$
+    follows:
+      kind: member_access_expression
+      inside:
+        kind: assignment_expression
+      all:
+        - has:
+            kind: member_access_expression
+            nthChild: 1
+            regex: \.Cookie$
+        - has:
+            kind: identifier
+            nthChild: 2
+            regex: ^HttpOnly$
+
+constraints:
+  LITERAL:
+    regex: ^false$
+
+

rules/java/security/use-of-md5-digest-utils-java.yml

@@ -0,0 +1,42 @@
+id: use-of-md5-digest-utils-java
+language: java
+severity: warning
+message: >-
+  'Detected MD5 hash algorithm which is considered insecure. MD5 is not
+      collision resistant and is therefore not suitable as a cryptographic
+      signature. Use HMAC instead.'
+note: >-
+  [CWE-328] Use of Weak Hash
+  [REFERENCES]
+      - https://owasp.org/Top10/A02_2021-Cryptographic_Failures
+
+ast-grep-essentials: true
+
+rule:
+  kind: identifier
+  regex: ^getMd5Digest$
+  nthChild: 2
+  precedes:
+    nthChild: 3
+    kind: argument_list
+    not:
+      has:
+        nthChild: 1
+  inside:
+    kind: method_invocation
+    nthChild: 1
+    inside:
+      kind: method_invocation
+      all:
+        - has:
+            kind: identifier
+            nthChild: 2
+            regex: ^digest$
+        - has:
+            kind: argument_list
+            nthChild: 3
+        - not:
+            has:
+              stopBy: end
+              kind: ERROR
+

tests/__snapshots__/httponly-false-csharp-snapshot.yml

@@ -0,0 +1,29 @@
+id: httponly-false-csharp
+snapshots:
+  ? |
+    options.Cookie.HttpOnly = false;
+  : labels:
+    - source: 'false'
+      style: primary
+      start: 26
+      end: 31
+    - source: options.Cookie
+      style: secondary
+      start: 0
+      end: 14
+    - source: HttpOnly
+      style: secondary
+      start: 15
+      end: 23
+    - source: options.Cookie.HttpOnly = false
+      style: secondary
+      start: 0
+      end: 31
+    - source: options.Cookie.HttpOnly
+      style: secondary
+      start: 0
+      end: 23
+    - source: =
+      style: secondary
+      start: 24
+      end: 25

tests/__snapshots__/use-of-md5-digest-utils-java-snapshot.yml

@@ -0,0 +1,29 @@
+id: use-of-md5-digest-utils-java
+snapshots:
+  ? |
+    byte[] hashValue = DigestUtils.getMd5Digest().digest(password.getBytes());
+  : labels:
+    - source: getMd5Digest
+      style: primary
+      start: 31
+      end: 43
+    - source: digest
+      style: secondary
+      start: 46
+      end: 52
+    - source: (password.getBytes())
+      style: secondary
+      start: 52
+      end: 73
+    - source: DigestUtils.getMd5Digest().digest(password.getBytes())
+      style: secondary
+      start: 19
+      end: 73
+    - source: DigestUtils.getMd5Digest()
+      style: secondary
+      start: 19
+      end: 45
+    - source: ()
+      style: secondary
+      start: 43
+      end: 45

tests/csharp/httponly-false-csharp-test.yml

@@ -0,0 +1,9 @@
+id: httponly-false-csharp
+valid:
+  - |
+    myHttpOnlyCookie.HttpOnly = true;
+  - |
+    options.Cookie.HttpOnly = true;
+invalid:
+  - |
+    options.Cookie.HttpOnly = false;

tests/java/use-of-md5-digest-utils-java-test.yml

@@ -0,0 +1,9 @@
+id: use-of-md5-digest-utils-java
+valid:
+  - |
+    MessageDigest md5Digest = MessageDigest.getInstance("MD5");
+  - |
+    byte[] hashValue = DigestUtils.getSha512Digest().digest(password.getBytes());
+invalid:
+  - |
+    byte[] hashValue = DigestUtils.getMd5Digest().digest(password.getBytes());