@neralabs/rerail-pack-python 0.1.1

package/rules/bandit-b303-md5.json

@@ -0,0 +1,79 @@
+{
+  "format": "rerail.policy/v1",
+  "id": "bandit-b303-md5",
+  "revision": 1,
+  "mode": "steer",
+  "description": "An MD2, MD4, MD5 or SHA1 hash from PyCrypto, PyCryptodome or cryptography. `hashlib` is Bandit's B324, which this pack does not include.",
+  "scope": {
+    "include": [
+      "**/*.py",
+      "**/*.pyi"
+    ],
+    "exclude": [
+      "**/node_modules/**",
+      "**/dist/**",
+      "**/build/**",
+      "**/out/**",
+      "**/.next/**",
+      "**/coverage/**",
+      "**/vendor/**",
+      "**/.venv/**",
+      "**/.yarn/**",
+      "**/generated/**",
+      "**/__generated__/**",
+      "**/*.generated.*",
+      "**/*.gen.*",
+      "**/*.min.js"
+    ]
+  },
+  "clauses": [
+    {
+      "id": "weak-hash",
+      "forbid": {
+        "ast": {
+          "language": "python",
+          "rule": {
+            "kind": "call",
+            "has": {
+              "field": "function",
+              "any": [
+                {
+                  "kind": "identifier"
+                },
+                {
+                  "kind": "attribute"
+                }
+              ],
+              "resolves": {
+                "import": [
+                  "Crypto.Hash.MD2.new",
+                  "Crypto.Hash.MD4.new",
+                  "Crypto.Hash.MD5.new",
+                  "Crypto.Hash.SHA.new",
+                  "Cryptodome.Hash.MD2.new",
+                  "Cryptodome.Hash.MD4.new",
+                  "Cryptodome.Hash.MD5.new",
+                  "Cryptodome.Hash.SHA.new",
+                  "cryptography.hazmat.primitives.hashes.MD5",
+                  "cryptography.hazmat.primitives.hashes.SHA1"
+                ]
+              }
+            }
+          }
+        }
+      },
+      "violation": {
+        "anchor": "witness.span",
+        "code": "B303",
+        "message": "MD5 and SHA1 are broken for security use. Use SHA-256, or a password hash for passwords.",
+        "suppress": {
+          "nosec": {
+            "codes": [
+              "B303"
+            ]
+          }
+        }
+      }
+    }
+  ]
+}

package/rules/bandit-b305-cipher-modes.json

@@ -0,0 +1,47 @@
+{
+  "format": "rerail.policy/v1",
+  "id": "bandit-b305-cipher-modes",
+  "revision": 1,
+  "mode": "steer",
+  "description": "Detect use of the insecure ECB cipher mode",
+  "scope": {
+    "include": [
+      "**/*.py"
+    ],
+    "exclude": []
+  },
+  "clauses": [
+    {
+      "id": "bandit:B305",
+      "forbid": {
+        "ast": {
+          "language": "python",
+          "rule": {
+            "pattern": "$F($$$ARGS)"
+          },
+          "constraints": {
+            "F": {
+              "resolves": {
+                "import": [
+                  "cryptography.hazmat.primitives.ciphers.modes.ECB"
+                ]
+              }
+            }
+          }
+        }
+      },
+      "violation": {
+        "code": "B305",
+        "anchor": "witness.span",
+        "message": "Use of the insecure ECB cipher mode.",
+        "suppress": {
+          "nosec": {
+            "codes": [
+              "B305"
+            ]
+          }
+        }
+      }
+    }
+  ]
+}

package/rules/bandit-b306-mktemp-q.json

@@ -0,0 +1,54 @@
+{
+  "format": "rerail.policy/v1",
+  "id": "bandit-b306-mktemp-q",
+  "revision": 1,
+  "mode": "steer",
+  "description": "Detect use of insecure tempfile.mktemp",
+  "scope": {
+    "include": [
+      "**/*.py"
+    ],
+    "exclude": []
+  },
+  "clauses": [
+    {
+      "id": "bandit:B306",
+      "forbid": {
+        "ast": {
+          "language": "python",
+          "rule": {
+            "pattern": "$F($$$ARGS)"
+          },
+          "constraints": {
+            "F": {
+              "any": [
+                {
+                  "resolves": {
+                    "import": [
+                      "tempfile.mktemp"
+                    ]
+                  }
+                },
+                {
+                  "pattern": "tempfile.mktemp"
+                }
+              ]
+            }
+          }
+        }
+      },
+      "violation": {
+        "code": "B306",
+        "anchor": "witness.span",
+        "message": "Use of insecure and deprecated function mktemp.",
+        "suppress": {
+          "nosec": {
+            "codes": [
+              "B306"
+            ]
+          }
+        }
+      }
+    }
+  ]
+}

package/rules/bandit-b307-eval.json

@@ -0,0 +1,125 @@
+{
+  "format": "rerail.policy/v1",
+  "id": "bandit-b307-eval",
+  "revision": 2,
+  "mode": "steer",
+  "description": "Detect calls to Python's eval function, which evaluates supplied text as code and may be unsafe. Use ast.literal_eval when only Python literals need to be parsed.",
+  "scope": {
+    "include": [
+      "**/*.py"
+    ],
+    "exclude": []
+  },
+  "clauses": [
+    {
+      "id": "eval-call",
+      "forbid": {
+        "ast": {
+          "language": "python",
+          "rule": {
+            "kind": "call",
+            "has": {
+              "field": "function",
+              "matches": "eval-callee"
+            }
+          },
+          "utils": {
+            "eval-callee": {
+              "any": [
+                {
+                  "kind": "identifier",
+                  "regex": "^eval$",
+                  "not": {
+                    "resolves": {
+                      "binding": {
+                        "form": "import",
+                        "site": {
+                          "matches": "alias-to-other"
+                        }
+                      }
+                    }
+                  }
+                },
+                {
+                  "kind": "identifier",
+                  "resolves": {
+                    "binding": {
+                      "form": "import",
+                      "site": {
+                        "matches": "alias-to-eval"
+                      }
+                    }
+                  }
+                },
+                {
+                  "kind": "parenthesized_expression",
+                  "has": {
+                    "stopBy": "neighbor",
+                    "matches": "eval-callee"
+                  }
+                }
+              ]
+            },
+            "from-with-module": {
+              "kind": "import_from_statement",
+              "has": {
+                "field": "module_name",
+                "any": [
+                  {
+                    "kind": "dotted_name"
+                  },
+                  {
+                    "kind": "relative_import",
+                    "has": {
+                      "kind": "dotted_name"
+                    }
+                  }
+                ]
+              }
+            },
+            "alias-to-eval": {
+              "kind": "aliased_import",
+              "has": {
+                "field": "name",
+                "regex": "^eval$"
+              },
+              "not": {
+                "inside": {
+                  "matches": "from-with-module"
+                }
+              }
+            },
+            "alias-to-other": {
+              "any": [
+                {
+                  "kind": "aliased_import",
+                  "not": {
+                    "matches": "alias-to-eval"
+                  }
+                },
+                {
+                  "kind": "dotted_name",
+                  "inside": {
+                    "matches": "from-with-module"
+                  }
+                }
+              ]
+            }
+          }
+        }
+      },
+      "violation": {
+        "code": "B307",
+        "anchor": "witness.span",
+        "message": "This eval call executes supplied text as Python code and may be unsafe. Use ast.literal_eval when only Python literals need to be parsed.",
+        "suppress": {
+          "nosec": {
+            "codes": [
+              "B307"
+            ]
+          }
+        }
+      }
+    }
+  ]
+}

package/rules/bandit-b308-mark-safe.json

@@ -0,0 +1,47 @@
+{
+  "format": "rerail.policy/v1",
+  "id": "bandit-b308-mark-safe",
+  "revision": 1,
+  "mode": "steer",
+  "description": "Detect potentially unsafe django mark_safe calls",
+  "scope": {
+    "include": [
+      "**/*.py"
+    ],
+    "exclude": []
+  },
+  "clauses": [
+    {
+      "id": "bandit:B308",
+      "forbid": {
+        "ast": {
+          "language": "python",
+          "rule": {
+            "pattern": "$F($$$ARGS)"
+          },
+          "constraints": {
+            "F": {
+              "resolves": {
+                "import": [
+                  "django.utils.safestring.mark_safe"
+                ]
+              }
+            }
+          }
+        }
+      },
+      "violation": {
+        "code": "B308",
+        "anchor": "witness.span",
+        "message": "Use of mark_safe may expose cross-site scripting vulnerabilities and should be reviewed.",
+        "suppress": {
+          "nosec": {
+            "codes": [
+              "B308"
+            ]
+          }
+        }
+      }
+    }
+  ]
+}

package/rules/bandit-b310-urllib-urlopen.json

@@ -0,0 +1,54 @@
+{
+  "format": "rerail.policy/v1",
+  "id": "bandit-b310-urllib-urlopen",
+  "revision": 1,
+  "mode": "steer",
+  "description": "Detect URL-opening calls that require permitted-scheme review",
+  "scope": {
+    "include": [
+      "**/*.py"
+    ],
+    "exclude": []
+  },
+  "clauses": [
+    {
+      "id": "bandit:B310",
+      "forbid": {
+        "ast": {
+          "language": "python",
+          "rule": {
+            "pattern": "$F($$$ARGS)"
+          },
+          "constraints": {
+            "F": {
+              "resolves": {
+                "import": [
+                  "urllib.request.urlopen",
+                  "urllib.request.urlretrieve",
+                  "urllib.request.URLopener",
+                  "urllib.request.FancyURLopener",
+                  "six.moves.urllib.request.urlopen",
+                  "six.moves.urllib.request.urlretrieve",
+                  "six.moves.urllib.request.URLopener",
+                  "six.moves.urllib.request.FancyURLopener"
+                ]
+              }
+            }
+          }
+        }
+      },
+      "violation": {
+        "code": "B310",
+        "anchor": "witness.span",
+        "message": "Audit URL opening for permitted schemes; file or custom schemes may be unexpected.",
+        "suppress": {
+          "nosec": {
+            "codes": [
+              "B310"
+            ]
+          }
+        }
+      }
+    }
+  ]
+}

package/rules/bandit-b311-random.json

@@ -0,0 +1,57 @@
+{
+  "format": "rerail.policy/v1",
+  "id": "bandit-b311-random",
+  "revision": 1,
+  "mode": "steer",
+  "description": "Detect insecure uses of Python pseudo-random generators",
+  "scope": {
+    "include": [
+      "**/*.py"
+    ],
+    "exclude": []
+  },
+  "clauses": [
+    {
+      "id": "bandit:B311",
+      "forbid": {
+        "ast": {
+          "language": "python",
+          "rule": {
+            "pattern": "$F($$$ARGS)"
+          },
+          "constraints": {
+            "F": {
+              "resolves": {
+                "import": [
+                  "random.Random",
+                  "random.random",
+                  "random.randrange",
+                  "random.randint",
+                  "random.choice",
+                  "random.choices",
+                  "random.uniform",
+                  "random.triangular",
+                  "random.randbytes",
+                  "random.sample",
+                  "random.getrandbits"
+                ]
+              }
+            }
+          }
+        }
+      },
+      "violation": {
+        "code": "B311",
+        "anchor": "witness.span",
+        "message": "Standard pseudo-random generators are not suitable for security or cryptographic purposes.",
+        "suppress": {
+          "nosec": {
+            "codes": [
+              "B311"
+            ]
+          }
+        }
+      }
+    }
+  ]
+}

package/rules/bandit-b312-telnetlib.json

@@ -0,0 +1,47 @@
+{
+  "format": "rerail.policy/v1",
+  "id": "bandit-b312-telnetlib",
+  "revision": 1,
+  "mode": "steer",
+  "description": "Detect insecure telnetlib.Telnet calls",
+  "scope": {
+    "include": [
+      "**/*.py"
+    ],
+    "exclude": []
+  },
+  "clauses": [
+    {
+      "id": "bandit:B312",
+      "forbid": {
+        "ast": {
+          "language": "python",
+          "rule": {
+            "pattern": "$F($$$ARGS)"
+          },
+          "constraints": {
+            "F": {
+              "resolves": {
+                "import": [
+                  "telnetlib.Telnet"
+                ]
+              }
+            }
+          }
+        }
+      },
+      "violation": {
+        "code": "B312",
+        "anchor": "witness.span",
+        "message": "Telnet is insecure; use SSH or another encrypted protocol.",
+        "suppress": {
+          "nosec": {
+            "codes": [
+              "B312"
+            ]
+          }
+        }
+      }
+    }
+  ]
+}

package/rules/bandit-b313-xml-bad-celementtree.json

@@ -0,0 +1,50 @@
+{
+  "format": "rerail.policy/v1",
+  "id": "bandit-b313-xml-bad-celementtree",
+  "revision": 1,
+  "mode": "steer",
+  "description": "Detect vulnerable xml.etree.cElementTree parsing calls",
+  "scope": {
+    "include": [
+      "**/*.py"
+    ],
+    "exclude": []
+  },
+  "clauses": [
+    {
+      "id": "bandit:B313",
+      "forbid": {
+        "ast": {
+          "language": "python",
+          "rule": {
+            "pattern": "$F($$$ARGS)"
+          },
+          "constraints": {
+            "F": {
+              "resolves": {
+                "import": [
+                  "xml.etree.cElementTree.parse",
+                  "xml.etree.cElementTree.iterparse",
+                  "xml.etree.cElementTree.fromstring",
+                  "xml.etree.cElementTree.XMLParser"
+                ]
+              }
+            }
+          }
+        }
+      },
+      "violation": {
+        "code": "B313",
+        "anchor": "witness.span",
+        "message": "Using xml.etree.cElementTree to parse untrusted XML may permit XML attacks; use defusedxml.",
+        "suppress": {
+          "nosec": {
+            "codes": [
+              "B313"
+            ]
+          }
+        }
+      }
+    }
+  ]
+}

package/rules/bandit-b314-xml-bad-elementtree.json

@@ -0,0 +1,50 @@
+{
+  "format": "rerail.policy/v1",
+  "id": "bandit-b314-xml-bad-elementtree",
+  "revision": 1,
+  "mode": "steer",
+  "description": "Detect vulnerable xml.etree.ElementTree parsing calls",
+  "scope": {
+    "include": [
+      "**/*.py"
+    ],
+    "exclude": []
+  },
+  "clauses": [
+    {
+      "id": "bandit:B314",
+      "forbid": {
+        "ast": {
+          "language": "python",
+          "rule": {
+            "pattern": "$F($$$ARGS)"
+          },
+          "constraints": {
+            "F": {
+              "resolves": {
+                "import": [
+                  "xml.etree.ElementTree.parse",
+                  "xml.etree.ElementTree.iterparse",
+                  "xml.etree.ElementTree.fromstring",
+                  "xml.etree.ElementTree.XMLParser"
+                ]
+              }
+            }
+          }
+        }
+      },
+      "violation": {
+        "code": "B314",
+        "anchor": "witness.span",
+        "message": "Using xml.etree.ElementTree to parse untrusted XML may permit XML attacks; use defusedxml.",
+        "suppress": {
+          "nosec": {
+            "codes": [
+              "B314"
+            ]
+          }
+        }
+      }
+    }
+  ]
+}

package/rules/bandit-b315-xml-bad-expatreader.json

@@ -0,0 +1,47 @@
+{
+  "format": "rerail.policy/v1",
+  "id": "bandit-b315-xml-bad-expatreader",
+  "revision": 1,
+  "mode": "steer",
+  "description": "Detect vulnerable xml.sax.expatreader parser creation",
+  "scope": {
+    "include": [
+      "**/*.py"
+    ],
+    "exclude": []
+  },
+  "clauses": [
+    {
+      "id": "bandit:B315",
+      "forbid": {
+        "ast": {
+          "language": "python",
+          "rule": {
+            "pattern": "$F($$$ARGS)"
+          },
+          "constraints": {
+            "F": {
+              "resolves": {
+                "import": [
+                  "xml.sax.expatreader.create_parser"
+                ]
+              }
+            }
+          }
+        }
+      },
+      "violation": {
+        "code": "B315",
+        "anchor": "witness.span",
+        "message": "Using xml.sax.expatreader to parse untrusted XML may permit XML attacks; use defusedxml.",
+        "suppress": {
+          "nosec": {
+            "codes": [
+              "B315"
+            ]
+          }
+        }
+      }
+    }
+  ]
+}