@neralabs/rerail-pack-python 0.1.1

package/rules/bandit-b507-ssh-no-host-key-verification.json

@@ -0,0 +1,210 @@
+{
+  "format": "rerail.policy/v1",
+  "id": "bandit-b507-ssh-no-host-key-verification",
+  "revision": 4,
+  "mode": "steer",
+  "description": "Once an import whose name contains paramiko has been walked (Bandit's substring test, in Bandit's source-order walk), flag a call whose function name is set_missing_host_key_policy (the attribute name, a bare name, or a name aliased by an earlier import to one ending in set_missing_host_key_policy) and whose first positional argument is a name, attribute, or call naming AutoAddPolicy or WarningPolicy.",
+  "scope": {
+    "include": [
+      "**/*.py"
+    ],
+    "exclude": []
+  },
+  "clauses": [
+    {
+      "id": "b507",
+      "forbid": {
+        "ast": {
+          "language": "python",
+          "utils": {
+            "paramiko-import": {
+              "any": [
+                {
+                  "kind": "import_statement"
+                },
+                {
+                  "kind": "import_from_statement"
+                },
+                {
+                  "kind": "future_import_statement"
+                }
+              ],
+              "has": {
+                "stopBy": "end",
+                "kind": "dotted_name",
+                "regex": "paramiko"
+              }
+            },
+            "after-paramiko-import": {
+              "inside": {
+                "stopBy": "end",
+                "follows": {
+                  "stopBy": "end",
+                  "any": [
+                    {
+                      "matches": "paramiko-import"
+                    },
+                    {
+                      "has": {
+                        "stopBy": "end",
+                        "matches": "paramiko-import"
+                      }
+                    }
+                  ]
+                }
+              }
+            },
+            "alias-to-target": {
+              "kind": "aliased_import",
+              "all": [
+                {
+                  "has": {
+                    "field": "alias",
+                    "pattern": "$ALIAS"
+                  }
+                },
+                {
+                  "has": {
+                    "field": "name",
+                    "regex": "(?:^|\\.)\\s*set_missing_host_key_policy$"
+                  }
+                }
+              ]
+            },
+            "after-alias-to-target": {
+              "inside": {
+                "stopBy": "end",
+                "follows": {
+                  "stopBy": "end",
+                  "has": {
+                    "stopBy": "end",
+                    "matches": "alias-to-target"
+                  }
+                }
+              }
+            },
+            "target-callee": {
+              "any": [
+                {
+                  "kind": "attribute",
+                  "has": {
+                    "field": "attribute",
+                    "regex": "^set_missing_host_key_policy$"
+                  }
+                },
+                {
+                  "kind": "identifier",
+                  "regex": "^set_missing_host_key_policy$"
+                },
+                {
+                  "kind": "identifier",
+                  "pattern": "$ALIAS",
+                  "matches": "after-alias-to-target"
+                },
+                {
+                  "kind": "parenthesized_expression",
+                  "has": {
+                    "stopBy": "neighbor",
+                    "matches": "target-callee"
+                  }
+                }
+              ]
+            },
+            "policy-name": {
+              "any": [
+                {
+                  "kind": "attribute",
+                  "has": {
+                    "field": "attribute",
+                    "regex": "^(?:AutoAddPolicy|WarningPolicy)$"
+                  }
+                },
+                {
+                  "kind": "identifier",
+                  "regex": "^(?:AutoAddPolicy|WarningPolicy)$"
+                },
+                {
+                  "kind": "parenthesized_expression",
+                  "has": {
+                    "stopBy": "neighbor",
+                    "matches": "policy-name"
+                  }
+                }
+              ]
+            },
+            "trusting-policy": {
+              "any": [
+                {
+                  "matches": "policy-name"
+                },
+                {
+                  "kind": "call",
+                  "has": {
+                    "field": "function",
+                    "matches": "policy-name"
+                  }
+                },
+                {
+                  "kind": "parenthesized_expression",
+                  "has": {
+                    "stopBy": "neighbor",
+                    "matches": "trusting-policy"
+                  }
+                }
+              ]
+            }
+          },
+          "rule": {
+            "kind": "call",
+            "arguments": {
+              "signature": [
+                "policy",
+                "/"
+              ],
+              "bind": {
+                "POLICY": "policy"
+              },
+              "mode": "syntactic"
+            },
+            "all": [
+              {
+                "has": {
+                  "field": "arguments",
+                  "has": {
+                    "matches": "trusting-policy"
+                  }
+                }
+              },
+              {
+                "has": {
+                  "field": "function",
+                  "matches": "target-callee"
+                }
+              },
+              {
+                "matches": "after-paramiko-import"
+              }
+            ]
+          },
+          "constraints": {
+            "POLICY": {
+              "matches": "trusting-policy"
+            }
+          }
+        }
+      },
+      "violation": {
+        "code": "B507",
+        "anchor": "witness.span",
+        "message": "Paramiko call with policy set to automatically trust the unknown host key.",
+        "suppress": {
+          "nosec": {
+            "codes": [
+              "B507"
+            ]
+          }
+        }
+      }
+    }
+  ]
+}

package/rules/bandit-b606-start-process-with-no-shell.json

@@ -0,0 +1,63 @@
+{
+  "format": "rerail.policy/v1",
+  "id": "bandit-b606-start-process-with-no-shell",
+  "revision": 1,
+  "mode": "steer",
+  "description": "Detect configured process APIs that execute without a command shell",
+  "scope": {
+    "include": [
+      "**/*.py"
+    ],
+    "exclude": []
+  },
+  "clauses": [
+    {
+      "id": "bandit-b606",
+      "forbid": {
+        "ast": {
+          "language": "python",
+          "rule": {
+            "pattern": "$F($$$ARGS)"
+          },
+          "constraints": {
+            "F": {
+              "resolves": {
+                "import": [
+                  "os.execl",
+                  "os.execle",
+                  "os.execlp",
+                  "os.execlpe",
+                  "os.execv",
+                  "os.execve",
+                  "os.execvp",
+                  "os.execvpe",
+                  "os.spawnl",
+                  "os.spawnle",
+                  "os.spawnlp",
+                  "os.spawnlpe",
+                  "os.spawnv",
+                  "os.spawnve",
+                  "os.spawnvp",
+                  "os.spawnvpe",
+                  "os.startfile"
+                ]
+              }
+            }
+          }
+        }
+      },
+      "violation": {
+        "code": "B606",
+        "anchor": "witness.span",
+        "message": "Review input passed to a no-shell process API",
+        "suppress": {
+          "nosec": {
+            "codes": [
+              "B606"
+            ]
+          }
+        }
+      }
+    }
+  ]
+}

package/rules/bandit-b610-django-extra-used.json

@@ -0,0 +1,268 @@
+{
+  "format": "rerail.policy/v1",
+  "id": "bandit-b610-django-extra-used",
+  "revision": 2,
+  "mode": "steer",
+  "description": "Port of Bandit 1.9.4's B610 django_extra_used: a call of `extra` whose `where` or `tables` is not a list of plain strings, or whose `select` is not a dict of plain strings, bound to QuerySet.extra's six positional slots. Port of the kernel test b610_extra_with_a_non_literal_where_tables_or_select. Bandit's `# nosec` is honoured (`suppress.nosec`), as its recordings honour it. Divergence: Bandit reports a call of any function or method named `extra`; the port reports only a method call whose receiver looks like a Django QuerySet or Manager: a name or attribute named `objects`, `qs`, `QS`, `queryset`, `querysets`, `manager` or `managers`, alone or after an underscore-joined prefix (`User.objects`, `self.queryset`, `base_qs`, `_default_manager`); a call of `get_queryset`; a method call on such a receiver (`User.objects.filter(...)`); or `self` or `super()` inside a class with a base whose name ends in `QuerySet` (`QuerySet`, `SoftDeleteQuerySet`, `TreeQuerySet`) or is `Manager`, `BaseManager` or `BaseUserManager`, optionally dotted (`models.QuerySet`); a base that only ends in `Manager` (`AbstractContextManager`, `PluginManager`, `TreeManager`) does not count. A bare `extra(...)` call and `extra` on any other receiver (`parser.extra(...)`, `self.extra(...)` in an unrelated class) are not reported (NER-1827).",
+  "scope": {
+    "include": [
+      "**/*"
+    ],
+    "exclude": []
+  },
+  "clauses": [
+    {
+      "id": "django-extra-used",
+      "forbid": {
+        "ast": {
+          "language": "python",
+          "rule": {
+            "any": [
+              {
+                "pattern": "$R.extra($$$)"
+              }
+            ],
+            "all": [
+              {
+                "has": {
+                  "field": "function",
+                  "has": {
+                    "field": "object",
+                    "matches": "queryset-receiver"
+                  }
+                }
+              },
+              {
+                "any": [
+                  {
+                    "arguments": {
+                      "signature": [
+                        "select",
+                        "where",
+                        "params",
+                        "tables",
+                        "order_by",
+                        "select_params"
+                      ],
+                      "bind": {
+                        "W": "where"
+                      }
+                    },
+                    "has": {
+                      "stopBy": "end",
+                      "pattern": "$W",
+                      "not": {
+                        "matches": "strings"
+                      }
+                    }
+                  },
+                  {
+                    "arguments": {
+                      "signature": [
+                        "select",
+                        "where",
+                        "params",
+                        "tables",
+                        "order_by",
+                        "select_params"
+                      ],
+                      "bind": {
+                        "T": "tables"
+                      }
+                    },
+                    "has": {
+                      "stopBy": "end",
+                      "pattern": "$T",
+                      "not": {
+                        "matches": "strings"
+                      }
+                    }
+                  },
+                  {
+                    "arguments": {
+                      "signature": [
+                        "select",
+                        "where",
+                        "params",
+                        "tables",
+                        "order_by",
+                        "select_params"
+                      ],
+                      "bind": {
+                        "S": "select"
+                      }
+                    },
+                    "has": {
+                      "stopBy": "end",
+                      "pattern": "$S",
+                      "not": {
+                        "matches": "string-pairs"
+                      }
+                    }
+                  }
+                ]
+              }
+            ]
+          },
+          "utils": {
+            "queryset-receiver": {
+              "any": [
+                {
+                  "kind": "identifier",
+                  "regex": "^(?:[A-Za-z0-9_]*_)?(?:qs|QS|querysets?|objects|managers?)$"
+                },
+                {
+                  "kind": "attribute",
+                  "has": {
+                    "field": "attribute",
+                    "regex": "^(?:[A-Za-z0-9_]*_)?(?:qs|QS|querysets?|objects|managers?)$"
+                  }
+                },
+                {
+                  "kind": "call",
+                  "has": {
+                    "field": "function",
+                    "kind": "attribute",
+                    "has": {
+                      "field": "object",
+                      "matches": "queryset-receiver"
+                    }
+                  }
+                },
+                {
+                  "kind": "call",
+                  "has": {
+                    "field": "function",
+                    "any": [
+                      {
+                        "kind": "identifier",
+                        "regex": "^get_queryset$"
+                      },
+                      {
+                        "kind": "attribute",
+                        "has": {
+                          "field": "attribute",
+                          "regex": "^get_queryset$"
+                        }
+                      }
+                    ]
+                  }
+                },
+                {
+                  "any": [
+                    {
+                      "kind": "identifier",
+                      "regex": "^self$"
+                    },
+                    {
+                      "pattern": "super()"
+                    }
+                  ],
+                  "inside": {
+                    "stopBy": "end",
+                    "kind": "class_definition",
+                    "has": {
+                      "field": "superclasses",
+                      "regex": "(?:^|[(,\\s])(?:[A-Za-z_][A-Za-z0-9_]*\\.)*(?:[A-Za-z0-9_]*QuerySet|Manager|BaseManager|BaseUserManager)\\b"
+                    }
+                  }
+                }
+              ]
+            },
+            "string": {
+              "any": [
+                {
+                  "kind": "string",
+                  "not": {
+                    "regex": "^[A-Za-z]*[fFbBtT]"
+                  }
+                },
+                {
+                  "kind": "concatenated_string",
+                  "not": {
+                    "has": {
+                      "kind": "string",
+                      "regex": "^[A-Za-z]*[fFbBtT]"
+                    }
+                  }
+                }
+              ]
+            },
+            "strings": {
+              "kind": "list",
+              "not": {
+                "has": {
+                  "stopBy": "neighbor",
+                  "not": {
+                    "any": [
+                      {
+                        "matches": "string"
+                      },
+                      {
+                        "regex": "^[\\[\\],]$"
+                      },
+                      {
+                        "kind": "comment"
+                      }
+                    ]
+                  }
+                }
+              }
+            },
+            "string-pairs": {
+              "kind": "dictionary",
+              "not": {
+                "has": {
+                  "stopBy": "neighbor",
+                  "not": {
+                    "any": [
+                      {
+                        "kind": "pair",
+                        "not": {
+                          "has": {
+                            "stopBy": "neighbor",
+                            "not": {
+                              "any": [
+                                {
+                                  "matches": "string"
+                                },
+                                {
+                                  "regex": "^:$"
+                                },
+                                {
+                                  "kind": "comment"
+                                }
+                              ]
+                            }
+                          }
+                        }
+                      },
+                      {
+                        "regex": "^[{},]$"
+                      },
+                      {
+                        "kind": "comment"
+                      }
+                    ]
+                  }
+                }
+              }
+            }
+          }
+        }
+      },
+      "violation": {
+        "anchor": "witness.span",
+        "code": "B610",
+        "message": "Bandit B610 (django-extra-used)",
+        "suppress": {
+          "nosec": {
+            "codes": [
+              "B610"
+            ]
+          }
+        }
+      }
+    }
+  ]
+}