@neralabs/rerail-pack-python 0.1.1

package/rules/bandit-b316-xml-bad-expatbuilder.json

@@ -0,0 +1,48 @@
+{
+  "format": "rerail.policy/v1",
+  "id": "bandit-b316-xml-bad-expatbuilder",
+  "revision": 1,
+  "mode": "steer",
+  "description": "Detect vulnerable xml.dom.expatbuilder parsing calls",
+  "scope": {
+    "include": [
+      "**/*.py"
+    ],
+    "exclude": []
+  },
+  "clauses": [
+    {
+      "id": "bandit:B316",
+      "forbid": {
+        "ast": {
+          "language": "python",
+          "rule": {
+            "pattern": "$F($$$ARGS)"
+          },
+          "constraints": {
+            "F": {
+              "resolves": {
+                "import": [
+                  "xml.dom.expatbuilder.parse",
+                  "xml.dom.expatbuilder.parseString"
+                ]
+              }
+            }
+          }
+        }
+      },
+      "violation": {
+        "code": "B316",
+        "anchor": "witness.span",
+        "message": "Using xml.dom.expatbuilder to parse untrusted XML may permit XML attacks; use defusedxml.",
+        "suppress": {
+          "nosec": {
+            "codes": [
+              "B316"
+            ]
+          }
+        }
+      }
+    }
+  ]
+}

package/rules/bandit-b317-xml-bad-sax.json

@@ -0,0 +1,58 @@
+{
+  "format": "rerail.policy/v1",
+  "id": "bandit-b317-xml-bad-sax",
+  "revision": 1,
+  "mode": "steer",
+  "description": "Detect vulnerable xml.sax parsing calls",
+  "scope": {
+    "include": [
+      "**/*.py"
+    ],
+    "exclude": []
+  },
+  "clauses": [
+    {
+      "id": "bandit:B317",
+      "forbid": {
+        "ast": {
+          "language": "python",
+          "rule": {
+            "all": [
+              {
+                "kind": "expression_statement"
+              },
+              {
+                "has": {
+                  "pattern": "$F($$$ARGS)"
+                }
+              }
+            ]
+          },
+          "constraints": {
+            "F": {
+              "resolves": {
+                "import": [
+                  "xml.sax.parse",
+                  "xml.sax.parseString",
+                  "xml.sax.make_parser"
+                ]
+              }
+            }
+          }
+        }
+      },
+      "violation": {
+        "code": "B317",
+        "anchor": "witness.span",
+        "message": "Using xml.sax to parse untrusted XML may permit XML attacks; use defusedxml.",
+        "suppress": {
+          "nosec": {
+            "codes": [
+              "B317"
+            ]
+          }
+        }
+      }
+    }
+  ]
+}

package/rules/bandit-b318-xml-bad-minidom.json

@@ -0,0 +1,48 @@
+{
+  "format": "rerail.policy/v1",
+  "id": "bandit-b318-xml-bad-minidom",
+  "revision": 1,
+  "mode": "steer",
+  "description": "Detect unsafe xml.dom.minidom parsing calls",
+  "scope": {
+    "include": [
+      "**/*.py"
+    ],
+    "exclude": []
+  },
+  "clauses": [
+    {
+      "id": "B318",
+      "forbid": {
+        "ast": {
+          "language": "python",
+          "rule": {
+            "pattern": "$F($$$ARGS)"
+          },
+          "constraints": {
+            "F": {
+              "resolves": {
+                "import": [
+                  "xml.dom.minidom.parse",
+                  "xml.dom.minidom.parseString"
+                ]
+              }
+            }
+          }
+        }
+      },
+      "violation": {
+        "code": "B318",
+        "anchor": "witness.span",
+        "message": "Using xml.dom.minidom to parse untrusted XML is vulnerable to XML attacks; use the defusedxml equivalent.",
+        "suppress": {
+          "nosec": {
+            "codes": [
+              "B318"
+            ]
+          }
+        }
+      }
+    }
+  ]
+}

package/rules/bandit-b319-xml-bad-pulldom.json

@@ -0,0 +1,48 @@
+{
+  "format": "rerail.policy/v1",
+  "id": "bandit-b319-xml-bad-pulldom",
+  "revision": 1,
+  "mode": "steer",
+  "description": "Detect unsafe xml.dom.pulldom parsing calls",
+  "scope": {
+    "include": [
+      "**/*.py"
+    ],
+    "exclude": []
+  },
+  "clauses": [
+    {
+      "id": "B319",
+      "forbid": {
+        "ast": {
+          "language": "python",
+          "rule": {
+            "pattern": "$F($$$ARGS)"
+          },
+          "constraints": {
+            "F": {
+              "resolves": {
+                "import": [
+                  "xml.dom.pulldom.parse",
+                  "xml.dom.pulldom.parseString"
+                ]
+              }
+            }
+          }
+        }
+      },
+      "violation": {
+        "code": "B319",
+        "anchor": "witness.span",
+        "message": "Using xml.dom.pulldom to parse untrusted XML is vulnerable to XML attacks; use the defusedxml equivalent.",
+        "suppress": {
+          "nosec": {
+            "codes": [
+              "B319"
+            ]
+          }
+        }
+      }
+    }
+  ]
+}

package/rules/bandit-b321-ftplib.json

@@ -0,0 +1,47 @@
+{
+  "format": "rerail.policy/v1",
+  "id": "bandit-b321-ftplib",
+  "revision": 1,
+  "mode": "steer",
+  "description": "Detect insecure ftplib.FTP construction",
+  "scope": {
+    "include": [
+      "**/*.py"
+    ],
+    "exclude": []
+  },
+  "clauses": [
+    {
+      "id": "B321",
+      "forbid": {
+        "ast": {
+          "language": "python",
+          "rule": {
+            "pattern": "$F($$$ARGS)"
+          },
+          "constraints": {
+            "F": {
+              "resolves": {
+                "import": [
+                  "ftplib.FTP"
+                ]
+              }
+            }
+          }
+        }
+      },
+      "violation": {
+        "code": "B321",
+        "anchor": "witness.span",
+        "message": "FTP is unencrypted and insecure; use SSH, SFTP, SCP, or another encrypted protocol.",
+        "suppress": {
+          "nosec": {
+            "codes": [
+              "B321"
+            ]
+          }
+        }
+      }
+    }
+  ]
+}

package/rules/bandit-b323-unverified-context.json

@@ -0,0 +1,47 @@
+{
+  "format": "rerail.policy/v1",
+  "id": "bandit-b323-unverified-context",
+  "revision": 1,
+  "mode": "steer",
+  "description": "Detect creation of unverified SSL contexts",
+  "scope": {
+    "include": [
+      "**/*.py"
+    ],
+    "exclude": []
+  },
+  "clauses": [
+    {
+      "id": "B323",
+      "forbid": {
+        "ast": {
+          "language": "python",
+          "rule": {
+            "pattern": "$F($$$ARGS)"
+          },
+          "constraints": {
+            "F": {
+              "resolves": {
+                "import": [
+                  "ssl._create_unverified_context"
+                ]
+              }
+            }
+          }
+        }
+      },
+      "violation": {
+        "code": "B323",
+        "anchor": "witness.span",
+        "message": "Creating an unverified SSL context disables certificate validation and hostname checks.",
+        "suppress": {
+          "nosec": {
+            "codes": [
+              "B323"
+            ]
+          }
+        }
+      }
+    }
+  ]
+}

package/rules/bandit-b401-import-telnetlib.json

@@ -0,0 +1,48 @@
+{
+  "format": "rerail.policy/v1",
+  "id": "bandit-b401-import-telnetlib",
+  "revision": 1,
+  "mode": "steer",
+  "description": "Detect direct imports of the insecure telnetlib module.",
+  "scope": {
+    "include": [
+      "**/*.py"
+    ],
+    "exclude": []
+  },
+  "clauses": [
+    {
+      "id": "B401",
+      "forbid": {
+        "ast": {
+          "language": "python",
+          "rule": {
+            "any": [
+              {
+                "pattern": "import telnetlib"
+              },
+              {
+                "pattern": "import telnetlib as $ALIAS"
+              },
+              {
+                "pattern": "from telnetlib import $$$NAMES"
+              }
+            ]
+          }
+        }
+      },
+      "violation": {
+        "code": "B401",
+        "anchor": "witness.span",
+        "message": "A telnet-related module is being imported. Telnet is insecure; use SSH or another encrypted protocol.",
+        "suppress": {
+          "nosec": {
+            "codes": [
+              "B401"
+            ]
+          }
+        }
+      }
+    }
+  ]
+}

package/rules/bandit-b402-import-ftplib.json

@@ -0,0 +1,48 @@
+{
+  "format": "rerail.policy/v1",
+  "id": "bandit-b402-import-ftplib",
+  "revision": 1,
+  "mode": "steer",
+  "description": "Detect direct imports of the insecure ftplib module.",
+  "scope": {
+    "include": [
+      "**/*.py"
+    ],
+    "exclude": []
+  },
+  "clauses": [
+    {
+      "id": "B402",
+      "forbid": {
+        "ast": {
+          "language": "python",
+          "rule": {
+            "any": [
+              {
+                "pattern": "import ftplib"
+              },
+              {
+                "pattern": "import ftplib as $ALIAS"
+              },
+              {
+                "pattern": "from ftplib import $$$NAMES"
+              }
+            ]
+          }
+        }
+      },
+      "violation": {
+        "code": "B402",
+        "anchor": "witness.span",
+        "message": "An FTP-related module is being imported. FTP is insecure; use SSH, SFTP, SCP, or another encrypted protocol.",
+        "suppress": {
+          "nosec": {
+            "codes": [
+              "B402"
+            ]
+          }
+        }
+      }
+    }
+  ]
+}

package/rules/bandit-b405-import-xml-etree.json

@@ -0,0 +1,69 @@
+{
+  "format": "rerail.policy/v1",
+  "id": "bandit-b405-import-xml-etree",
+  "revision": 1,
+  "mode": "steer",
+  "description": "Detect direct imports of xml.etree.cElementTree and xml.etree.ElementTree.",
+  "scope": {
+    "include": [
+      "**/*.py"
+    ],
+    "exclude": []
+  },
+  "clauses": [
+    {
+      "id": "B405",
+      "forbid": {
+        "ast": {
+          "language": "python",
+          "rule": {
+            "any": [
+              {
+                "pattern": "import xml.etree.cElementTree"
+              },
+              {
+                "pattern": "import xml.etree.cElementTree as $ALIAS"
+              },
+              {
+                "pattern": "from xml.etree.cElementTree import $$$NAMES"
+              },
+              {
+                "pattern": "from xml.etree import cElementTree"
+              },
+              {
+                "pattern": "from xml.etree import cElementTree as $ALIAS"
+              },
+              {
+                "pattern": "import xml.etree.ElementTree"
+              },
+              {
+                "pattern": "import xml.etree.ElementTree as $ALIAS"
+              },
+              {
+                "pattern": "from xml.etree.ElementTree import $$$NAMES"
+              },
+              {
+                "pattern": "from xml.etree import ElementTree"
+              },
+              {
+                "pattern": "from xml.etree import ElementTree as $ALIAS"
+              }
+            ]
+          }
+        }
+      },
+      "violation": {
+        "code": "B405",
+        "anchor": "witness.span",
+        "message": "ElementTree XML parsing may be vulnerable to XML attacks; use defusedxml or defuse the standard library.",
+        "suppress": {
+          "nosec": {
+            "codes": [
+              "B405"
+            ]
+          }
+        }
+      }
+    }
+  ]
+}

package/rules/bandit-b406-import-xml-sax.json

@@ -0,0 +1,73 @@
+{
+  "format": "rerail.policy/v1",
+  "id": "bandit-b406-import-xml-sax",
+  "revision": 2,
+  "mode": "steer",
+  "description": "Detect direct imports of xml.sax. Port of Bandit 1.9.4's B406 import_xml_sax. Divergence: an import of only xml.sax.saxutils (`from xml.sax.saxutils import ...`, `from xml.sax import saxutils`, aliased or parenthesised) is not reported. saxutils holds XML writing and escaping helpers (escape, quoteattr, unescape, XMLGenerator) and no parser, so defusedxml, which the steer points to, has nothing to replace it with. `import xml.sax.saxutils` is still reported, since it also binds xml.sax and its parse functions (NER-1827).",
+  "scope": {
+    "include": [
+      "**/*.py"
+    ],
+    "exclude": []
+  },
+  "clauses": [
+    {
+      "id": "B406",
+      "forbid": {
+        "ast": {
+          "language": "python",
+          "rule": {
+            "any": [
+              {
+                "pattern": "import xml.sax"
+              },
+              {
+                "pattern": "import xml.sax as $ALIAS"
+              },
+              {
+                "pattern": "from xml.sax import $$$NAMES"
+              },
+              {
+                "pattern": "from xml import sax"
+              },
+              {
+                "pattern": "from xml import sax as $ALIAS"
+              }
+            ],
+            "not": {
+              "any": [
+                {
+                  "pattern": "from xml.sax.saxutils import $$$NAMES"
+                },
+                {
+                  "pattern": "from xml.sax import saxutils"
+                },
+                {
+                  "pattern": "from xml.sax import saxutils as $ALIAS"
+                },
+                {
+                  "pattern": "from xml.sax import (saxutils)"
+                },
+                {
+                  "pattern": "from xml.sax import (saxutils as $ALIAS)"
+                }
+              ]
+            }
+          }
+        }
+      },
+      "violation": {
+        "code": "B406",
+        "anchor": "witness.span",
+        "message": "xml.sax parsing may be vulnerable to XML attacks; use defusedxml or defuse the standard library.",
+        "suppress": {
+          "nosec": {
+            "codes": [
+              "B406"
+            ]
+          }
+        }
+      }
+    }
+  ]
+}

package/rules/bandit-b407-import-xml-expat.json

@@ -0,0 +1,54 @@
+{
+  "format": "rerail.policy/v1",
+  "id": "bandit-b407-import-xml-expat",
+  "revision": 1,
+  "mode": "steer",
+  "description": "Detect direct imports of xml.dom.expatbuilder.",
+  "scope": {
+    "include": [
+      "**/*.py"
+    ],
+    "exclude": []
+  },
+  "clauses": [
+    {
+      "id": "B407",
+      "forbid": {
+        "ast": {
+          "language": "python",
+          "rule": {
+            "any": [
+              {
+                "pattern": "import xml.dom.expatbuilder"
+              },
+              {
+                "pattern": "import xml.dom.expatbuilder as $ALIAS"
+              },
+              {
+                "pattern": "from xml.dom.expatbuilder import $$$NAMES"
+              },
+              {
+                "pattern": "from xml.dom import expatbuilder"
+              },
+              {
+                "pattern": "from xml.dom import expatbuilder as $ALIAS"
+              }
+            ]
+          }
+        }
+      },
+      "violation": {
+        "code": "B407",
+        "anchor": "witness.span",
+        "message": "xml.dom.expatbuilder parsing may be vulnerable to XML attacks; use defusedxml or defuse the standard library.",
+        "suppress": {
+          "nosec": {
+            "codes": [
+              "B407"
+            ]
+          }
+        }
+      }
+    }
+  ]
+}

package/rules/bandit-b408-import-xml-minidom.json

@@ -0,0 +1,54 @@
+{
+  "format": "rerail.policy/v1",
+  "id": "bandit-b408-import-xml-minidom",
+  "revision": 1,
+  "mode": "steer",
+  "description": "Detect direct imports of xml.dom.minidom.",
+  "scope": {
+    "include": [
+      "**/*.py"
+    ],
+    "exclude": []
+  },
+  "clauses": [
+    {
+      "id": "B408",
+      "forbid": {
+        "ast": {
+          "language": "python",
+          "rule": {
+            "any": [
+              {
+                "pattern": "import xml.dom.minidom"
+              },
+              {
+                "pattern": "import xml.dom.minidom as $ALIAS"
+              },
+              {
+                "pattern": "from xml.dom.minidom import $$$NAMES"
+              },
+              {
+                "pattern": "from xml.dom import minidom"
+              },
+              {
+                "pattern": "from xml.dom import minidom as $ALIAS"
+              }
+            ]
+          }
+        }
+      },
+      "violation": {
+        "code": "B408",
+        "anchor": "witness.span",
+        "message": "xml.dom.minidom parsing may be vulnerable to XML attacks; use defusedxml or defuse the standard library.",
+        "suppress": {
+          "nosec": {
+            "codes": [
+              "B408"
+            ]
+          }
+        }
+      }
+    }
+  ]
+}