Supported FP Rules
A false positive rule is a rule that Mobb executes against reported SAST findings to reliably identify if the code instances are not actually vulnerable.
All FP rules meet the following criteria:
High confidence that the identified finding is a false positive
Tested against real-world code samples to avoid suppressing true positives
Clear explanation is provided for why the finding is considered a false positive
Here are the categories of FP rules that Mobb currently supports. If there's an FP pattern you'd like to see added, please contact us at [email protected].
Since different SAST tools may report false positives under inconsistent names, the issue names shown are normalized by Mobb.
List of Supported Issue Types for Snyk
C#
Cross-site Scripting (XSS)
GO
Command Injection
Hardcoded Non Crypto Secret
Hardcoded Non CryptoSecret Test
Hardcoded Password
Hardcoded Password Test
Hardcoded Secret Test
No Hardcoded Credentials
No Hardcoded Credentials Test
SQL Injection
Java
No Hardcoded Credentials
NoHardcoded Credentials Test
JavaScript / TypeScript
PHP
Hardcoded Credential
Hardcoded Credential Test
Hardcoded Non Crypto Secret
Hardcoded Password
Hardcoded Password Test
Python
Cross Site Scripting (XSS)
Hardcoded Iv
Hardcoded Key
HardcodedNonCryptoSecret
HardcodedNonCryptoSecret/test
No Hardcoded Credentials Test
No Hardcoded Passwords Test
NoHardcodedCredentials
NoHardcodedPasswords
List of Supported Issue Types for Fortify
CPP
C#
Cross-Site Scripting: Persistent
DEFAULT
DOCKERFILE
GO
Java
JavaScript / TypeScript
PHP
Python
XML
YAML
List of Supported Issue Types for Checkmarx
C#
Dynamic SQL Queries
Hardcoded Credentials
Hardcoded password in Connection String
JWT Use Of Hardcoded Secret
Log Forging
Path Traversal
Reflected XSS
Reflected XSS All Clients
SQL Injection
Stored XSS
Use Of Broken Or Risky Cryptographic Algorithm
Use Of Hardcoded Password
Use of Insufficiently Random Values
GO
Command Injection
Hardcoded AWS Credentials
Hardcoded Password in Connection String
Log Forging
Second Order SQL Injection
SQL Injection
Use of Hardcoded Password
Java
Absolute Path Traversal
Improper Restriction of Stored XXE Ref
Improper Restriction of XXE Ref
Information Exposure Through an Error Message
Privacy Violation
Reflected XSS All Clients
Relative Path Traversal
SQL Injection
SQL Injection Evasion Attack
SSRF
Stored Absolute Path Traversal
Stored XSS
Unchecked Input for Loop Condition
JavaScript / TypeScript
Absolute Path Traversal
Client DOM Code Injection
Client DOM Open Redirect
Client DOM Stored XSS
Client DOM XSS
Client Password In Comment
Client Potential XSS
Client Regex Injection
Hardcoded password in Connection String
JWT Use Of Hardcoded Secret
Log Forging
Open Redirect
Relative Path Traversal
Secret_Leak
SQL Injection
SSRF
Stored XSS
Use Of Hardcoded Password
PHP
Hardcoded Salt
Use of Hardcoded Cryptographic IV
Use Of Hardcoded Password
Python
Command Argument Injection
Hardcoded AWS Credentials
Hardcoded Password in Connection String
Reversible One Way Hash
Use of Hardcoded Cryptographic Key
Use Of Hardcoded Password
List of Supported Issue Types for SonarQube
C#
Dropbox app credentials should not be disclosed
DEFAULT
DOCKERFILE
GO
Constructing arguments of system commands from user input is security-sensitive
Database queries should not be vulnerable to injection attacks
Formatting SQL queries is security-sensitive
Using weak hashing algorithms is security-sensitive
Java
JavaScript / TypeScript
PHP
Python
YAML
List of Supported Issue Types for CodeQL
CPP
C#
Hard-coded Connection String Credentials
Hard-coded credentials
SQL Injection
SQL Injection
GO
Command Injection
Hardcoded Credentials
SQL Injection
Java
JavaScript / TypeScript
Python
List of Supported Issue Types for Semgrep/Opengrep
C#
DEFAULT
DOCKERFILE
GO
Java
File Path Traversal in HttpServlet
java.mobb.custom_injection
java/mobb.pt_find_transitives
Path Traversal
Relative File Path Traversal in HttpServlet
SQL Injection
Tainted File Path
JavaScript / TypeScript
javascript.mobb.log_forging
Python
SQL
YAML
Last updated