@neralabs/rerail-pack-python 0.1.1

package/rules/bandit-b409-import-xml-pulldom.json

@@ -0,0 +1,54 @@
+{
+  "format": "rerail.policy/v1",
+  "id": "bandit-b409-import-xml-pulldom",
+  "revision": 1,
+  "mode": "steer",
+  "description": "Detect direct imports of xml.dom.pulldom.",
+  "scope": {
+    "include": [
+      "**/*.py"
+    ],
+    "exclude": []
+  },
+  "clauses": [
+    {
+      "id": "B409",
+      "forbid": {
+        "ast": {
+          "language": "python",
+          "rule": {
+            "any": [
+              {
+                "pattern": "import xml.dom.pulldom"
+              },
+              {
+                "pattern": "import xml.dom.pulldom as $ALIAS"
+              },
+              {
+                "pattern": "from xml.dom.pulldom import $$$NAMES"
+              },
+              {
+                "pattern": "from xml.dom import pulldom"
+              },
+              {
+                "pattern": "from xml.dom import pulldom as $ALIAS"
+              }
+            ]
+          }
+        }
+      },
+      "violation": {
+        "code": "B409",
+        "anchor": "witness.span",
+        "message": "xml.dom.pulldom parsing may be vulnerable to XML attacks; use defusedxml or defuse the standard library.",
+        "suppress": {
+          "nosec": {
+            "codes": [
+              "B409"
+            ]
+          }
+        }
+      }
+    }
+  ]
+}

package/rules/bandit-b411-import-xmlrpclib.json

@@ -0,0 +1,48 @@
+{
+  "format": "rerail.policy/v1",
+  "id": "bandit-b411-import-xmlrpclib",
+  "revision": 1,
+  "mode": "steer",
+  "description": "Detect direct imports of xmlrpc.",
+  "scope": {
+    "include": [
+      "**/*.py"
+    ],
+    "exclude": []
+  },
+  "clauses": [
+    {
+      "id": "B411",
+      "forbid": {
+        "ast": {
+          "language": "python",
+          "rule": {
+            "any": [
+              {
+                "pattern": "import xmlrpc"
+              },
+              {
+                "pattern": "import xmlrpc as $ALIAS"
+              },
+              {
+                "pattern": "from xmlrpc import $$$NAMES"
+              }
+            ]
+          }
+        }
+      },
+      "violation": {
+        "code": "B411",
+        "anchor": "witness.span",
+        "message": "xmlrpc parsing may be vulnerable to XML attacks; use defusedxml.xmlrpc.monkey_patch() to mitigate XML vulnerabilities.",
+        "suppress": {
+          "nosec": {
+            "codes": [
+              "B411"
+            ]
+          }
+        }
+      }
+    }
+  ]
+}

package/rules/bandit-b413-import-pycrypto.json

@@ -0,0 +1,159 @@
+{
+  "format": "rerail.policy/v1",
+  "id": "bandit-b413-import-pycrypto",
+  "revision": 1,
+  "mode": "steer",
+  "description": "Detect direct imports of deprecated pyCrypto namespaces.",
+  "scope": {
+    "include": [
+      "**/*.py"
+    ],
+    "exclude": []
+  },
+  "clauses": [
+    {
+      "id": "B413",
+      "forbid": {
+        "ast": {
+          "language": "python",
+          "rule": {
+            "any": [
+              {
+                "pattern": "import Crypto.Cipher"
+              },
+              {
+                "pattern": "import Crypto.Cipher as $ALIAS"
+              },
+              {
+                "pattern": "from Crypto.Cipher import $$$NAMES"
+              },
+              {
+                "pattern": "from Crypto import Cipher"
+              },
+              {
+                "pattern": "from Crypto import Cipher as $ALIAS"
+              },
+              {
+                "pattern": "import Crypto.Hash"
+              },
+              {
+                "pattern": "import Crypto.Hash as $ALIAS"
+              },
+              {
+                "pattern": "from Crypto.Hash import $$$NAMES"
+              },
+              {
+                "pattern": "from Crypto import Hash"
+              },
+              {
+                "pattern": "from Crypto import Hash as $ALIAS"
+              },
+              {
+                "pattern": "import Crypto.IO"
+              },
+              {
+                "pattern": "import Crypto.IO as $ALIAS"
+              },
+              {
+                "pattern": "from Crypto.IO import $$$NAMES"
+              },
+              {
+                "pattern": "from Crypto import IO"
+              },
+              {
+                "pattern": "from Crypto import IO as $ALIAS"
+              },
+              {
+                "pattern": "import Crypto.Protocol"
+              },
+              {
+                "pattern": "import Crypto.Protocol as $ALIAS"
+              },
+              {
+                "pattern": "from Crypto.Protocol import $$$NAMES"
+              },
+              {
+                "pattern": "from Crypto import Protocol"
+              },
+              {
+                "pattern": "from Crypto import Protocol as $ALIAS"
+              },
+              {
+                "pattern": "import Crypto.PublicKey"
+              },
+              {
+                "pattern": "import Crypto.PublicKey as $ALIAS"
+              },
+              {
+                "pattern": "from Crypto.PublicKey import $$$NAMES"
+              },
+              {
+                "pattern": "from Crypto import PublicKey"
+              },
+              {
+                "pattern": "from Crypto import PublicKey as $ALIAS"
+              },
+              {
+                "pattern": "import Crypto.Random"
+              },
+              {
+                "pattern": "import Crypto.Random as $ALIAS"
+              },
+              {
+                "pattern": "from Crypto.Random import $$$NAMES"
+              },
+              {
+                "pattern": "from Crypto import Random"
+              },
+              {
+                "pattern": "from Crypto import Random as $ALIAS"
+              },
+              {
+                "pattern": "import Crypto.Signature"
+              },
+              {
+                "pattern": "import Crypto.Signature as $ALIAS"
+              },
+              {
+                "pattern": "from Crypto.Signature import $$$NAMES"
+              },
+              {
+                "pattern": "from Crypto import Signature"
+              },
+              {
+                "pattern": "from Crypto import Signature as $ALIAS"
+              },
+              {
+                "pattern": "import Crypto.Util"
+              },
+              {
+                "pattern": "import Crypto.Util as $ALIAS"
+              },
+              {
+                "pattern": "from Crypto.Util import $$$NAMES"
+              },
+              {
+                "pattern": "from Crypto import Util"
+              },
+              {
+                "pattern": "from Crypto import Util as $ALIAS"
+              }
+            ]
+          }
+        }
+      },
+      "violation": {
+        "code": "B413",
+        "anchor": "witness.span",
+        "message": "The pyCrypto library is deprecated and unmaintained; consider using pyca/cryptography.",
+        "suppress": {
+          "nosec": {
+            "codes": [
+              "B413"
+            ]
+          }
+        }
+      }
+    }
+  ]
+}

package/rules/bandit-b415-import-pyghmi.json

@@ -0,0 +1,48 @@
+{
+  "format": "rerail.policy/v1",
+  "id": "bandit-b415-import-pyghmi",
+  "revision": 1,
+  "mode": "steer",
+  "description": "Detect direct imports of the insecure pyghmi package.",
+  "scope": {
+    "include": [
+      "**/*.py"
+    ],
+    "exclude": []
+  },
+  "clauses": [
+    {
+      "id": "B415",
+      "forbid": {
+        "ast": {
+          "language": "python",
+          "rule": {
+            "any": [
+              {
+                "pattern": "import pyghmi"
+              },
+              {
+                "pattern": "import pyghmi as $ALIAS"
+              },
+              {
+                "pattern": "from pyghmi import $$$NAMES"
+              }
+            ]
+          }
+        }
+      },
+      "violation": {
+        "code": "B415",
+        "anchor": "witness.span",
+        "message": "An IPMI-related module is being imported. IPMI is insecure; use an encrypted protocol.",
+        "suppress": {
+          "nosec": {
+            "codes": [
+              "B415"
+            ]
+          }
+        }
+      }
+    }
+  ]
+}

package/rules/bandit-b502-ssl-with-bad-version.json

@@ -0,0 +1,90 @@
+{
+  "format": "rerail.policy/v1",
+  "id": "bandit-b502-ssl-with-bad-version",
+  "revision": 1,
+  "mode": "steer",
+  "description": "Detect calls whose method or ssl_version argument selects an insecure SSL/TLS protocol.",
+  "scope": {
+    "include": [
+      "**/*.py"
+    ],
+    "exclude": []
+  },
+  "clauses": [
+    {
+      "id": "B502",
+      "forbid": {
+        "ast": {
+          "language": "python",
+          "rule": {
+            "all": [
+              {
+                "pattern": "$F($$$ARGS)"
+              },
+              {
+                "any": [
+                  {
+                    "arguments": {
+                      "signature": [
+                        "*",
+                        "method"
+                      ],
+                      "bind": {
+                        "PROTOCOL": "method"
+                      }
+                    }
+                  },
+                  {
+                    "arguments": {
+                      "signature": [
+                        "*",
+                        "ssl_version"
+                      ],
+                      "bind": {
+                        "PROTOCOL": "ssl_version"
+                      }
+                    }
+                  }
+                ]
+              }
+            ]
+          },
+          "constraints": {
+            "PROTOCOL": {
+              "resolves": {
+                "import": [
+                  "ssl.PROTOCOL_SSLv2",
+                  "ssl.PROTOCOL_SSLv3",
+                  "ssl.PROTOCOL_TLSv1",
+                  "ssl.PROTOCOL_TLSv1_1",
+                  "OpenSSL.SSL.SSLv2_METHOD",
+                  "OpenSSL.SSL.SSLv23_METHOD",
+                  "OpenSSL.SSL.SSLv3_METHOD",
+                  "OpenSSL.SSL.TLSv1_METHOD",
+                  "OpenSSL.SSL.TLSv1_1_METHOD",
+                  "pyOpenSSL.SSL.SSLv2_METHOD",
+                  "pyOpenSSL.SSL.SSLv23_METHOD",
+                  "pyOpenSSL.SSL.SSLv3_METHOD",
+                  "pyOpenSSL.SSL.TLSv1_METHOD",
+                  "pyOpenSSL.SSL.TLSv1_1_METHOD"
+                ]
+              }
+            }
+          }
+        }
+      },
+      "violation": {
+        "code": "B502",
+        "anchor": "witness.span",
+        "message": "An SSL context is configured with an insecure protocol version.",
+        "suppress": {
+          "nosec": {
+            "codes": [
+              "B502"
+            ]
+          }
+        }
+      }
+    }
+  ]
+}

package/rules/bandit-b505-weak-cryptographic-key.json

@@ -0,0 +1,166 @@
+{
+  "format": "rerail.policy/v1",
+  "id": "bandit-b505-weak-cryptographic-key",
+  "revision": 1,
+  "mode": "steer",
+  "description": "Port of Bandit 1.9.4's B505 weak_cryptographic_key: a DSA or RSA key below 2048 bits or an EC curve below 224 bits, by keyword or position (Bandit's medium thresholds). Port of the kernel test b505_weak_key_sizes_by_keyword_or_position. Bandit's `# nosec` is honoured (`suppress.nosec`), as its recordings honour it.",
+  "scope": {
+    "include": [
+      "**/*"
+    ],
+    "exclude": []
+  },
+  "clauses": [
+    {
+      "id": "weak-cryptographic-key",
+      "forbid": {
+        "ast": {
+          "language": "python",
+          "rule": {
+            "kind": "call",
+            "any": [
+              {
+                "has": {
+                  "any": [
+                    {
+                      "kind": "identifier"
+                    },
+                    {
+                      "kind": "attribute"
+                    }
+                  ],
+                  "resolves": {
+                    "import": [
+                      "cryptography.hazmat.primitives.asymmetric.dsa.generate_private_key"
+                    ]
+                  }
+                },
+                "arguments": {
+                  "signature": [
+                    "key_size",
+                    "backend"
+                  ],
+                  "bind": {
+                    "K": "key_size"
+                  }
+                }
+              },
+              {
+                "has": {
+                  "any": [
+                    {
+                      "kind": "identifier"
+                    },
+                    {
+                      "kind": "attribute"
+                    }
+                  ],
+                  "resolves": {
+                    "import": [
+                      "cryptography.hazmat.primitives.asymmetric.rsa.generate_private_key"
+                    ]
+                  }
+                },
+                "arguments": {
+                  "signature": [
+                    "public_exponent",
+                    "key_size",
+                    "backend"
+                  ],
+                  "bind": {
+                    "K": "key_size"
+                  }
+                }
+              },
+              {
+                "has": {
+                  "any": [
+                    {
+                      "kind": "identifier"
+                    },
+                    {
+                      "kind": "attribute"
+                    }
+                  ],
+                  "resolves": {
+                    "import": [
+                      "cryptography.hazmat.primitives.asymmetric.ec.generate_private_key"
+                    ]
+                  }
+                },
+                "arguments": {
+                  "signature": [
+                    "curve",
+                    "backend"
+                  ],
+                  "bind": {
+                    "C": "curve"
+                  }
+                }
+              },
+              {
+                "has": {
+                  "any": [
+                    {
+                      "kind": "identifier"
+                    },
+                    {
+                      "kind": "attribute"
+                    }
+                  ],
+                  "resolves": {
+                    "import": [
+                      "Crypto.PublicKey.DSA.generate",
+                      "Crypto.PublicKey.RSA.generate",
+                      "Cryptodome.PublicKey.DSA.generate",
+                      "Cryptodome.PublicKey.RSA.generate"
+                    ]
+                  }
+                },
+                "arguments": {
+                  "signature": [
+                    "bits"
+                  ],
+                  "bind": {
+                    "K": "bits"
+                  }
+                }
+              }
+            ]
+          },
+          "constraints": {
+            "K": {
+              "value": {
+                "lt": 2048
+              }
+            },
+            "C": {
+              "any": [
+                {
+                  "kind": "attribute",
+                  "regex": "\\.(SECP192R1|SECT163K1|SECT163R2)$"
+                },
+                {
+                  "kind": "identifier",
+                  "regex": "^(SECP192R1|SECT163K1|SECT163R2)$"
+                }
+              ]
+            }
+          }
+        }
+      },
+      "violation": {
+        "anchor": "witness.span",
+        "code": "B505",
+        "message": "Bandit B505 (weak-cryptographic-key)",
+        "suppress": {
+          "nosec": {
+            "codes": [
+              "B505"
+            ]
+          }
+        }
+      }
+    }
+  ]
+}