codelaw-rules-security-python 0.3.0__py3-none-any.whl

codelaw_rules_security_python/rules/sec-py/password-hash-effort.cases.md

@@ -0,0 +1,61 @@
+# sec-py/password-hash-effort — cases
+
+### case: sha256 of a password
+
+```py
+hashlib.sha256(password.encode())
+```
+
+```expect
+1:1 sec-py/password-hash-effort
+```
+
+### case: few iterations
+
+```py
+hashlib.pbkdf2_hmac("sha256", pw, salt, iterations=100000)
+```
+
+```expect
+1:1 sec-py/password-hash-effort
+```
+
+### case: positional few iterations
+
+```py
+hashlib.pbkdf2_hmac("sha256", pw, salt, 1000)
+```
+
+```expect
+1:1 sec-py/password-hash-effort
+```
+
+### case: enough iterations
+
+```py
+hashlib.pbkdf2_hmac("sha256", pw, salt, 600000)
+```
+
+```expect
+(none)
+```
+
+### case: bcrypt rounds
+
+```py
+bcrypt.gensalt(rounds=4)
+```
+
+```expect
+1:1 sec-py/password-hash-effort
+```
+
+### case: sha256 of a file
+
+```py
+hashlib.sha256(data)
+```
+
+```expect
+(none)
+```

codelaw_rules_security_python/rules/sec-py/password-hash-effort.md

@@ -0,0 +1,74 @@
+---
+id: sec-py/password-hash-effort
+title: 'Passwords are hashed with a slow function'
+languages: [python]
+fix: manual
+fix_reason: "moving to Argon2 or bcrypt means rehashing at the next login and changing the stored format"
+stability: preview
+security: { cwe: [916], owasp: ["A04:2025"], severity: high }
+since: 0.2.0
+---
+
+A password is not hashed with a plain `hashlib` digest, `pbkdf2_hmac` runs at least 600 000 iterations, and `bcrypt` uses at least 10 rounds.
+
+**Why:** A fast hash lets an attacker who has the table test billions of guesses per second (CWE-916).
+
+```codelaw
+match:
+  any:
+    - kind: call
+      all:
+        - { has: { field: function, regex: '^hashlib\.(md5|sha1|sha224|sha256|sha384|sha512)$' } }
+        - { has: { field: arguments, has: { nthChild: 1, regex: '(?i)pass(word|wd)?' } } }
+    - kind: call
+      all:
+        - { has: { field: function, regex: '^(hashlib\.)?pbkdf2_hmac$' } }
+        - any:
+            - has:
+                field: arguments
+                has:
+                  kind: keyword_argument
+                  all:
+                    - { has: { field: name, regex: '^iterations$' } }
+                    - { has: { field: value, kind: integer, regex: '^([0-9]{1,5}|[1-5][0-9]{5})$' } }
+            - has:
+                field: arguments
+                has: { nthChild: 4, kind: integer, regex: '^([0-9]{1,5}|[1-5][0-9]{5})$' }
+    - kind: call
+      all:
+        - { has: { field: function, regex: '^(bcrypt\.)?gensalt$' } }
+        - has:
+            field: arguments
+            has:
+              kind: keyword_argument
+              all:
+                - { has: { field: name, regex: '^rounds$' } }
+                - { has: { field: value, kind: integer, regex: '^[0-9]$' } }
+message: 'This password hash is too fast; use Argon2 or bcrypt, or more iterations'
+```
+
+## How to fix
+
+1. Use `argon2-cffi` (`PasswordHasher().hash(password)`) or `bcrypt.hashpw(password, bcrypt.gensalt(rounds=12))`.
+2. If you must use PBKDF2, use SHA-256 with at least 600 000 iterations (OWASP).
+3. Rehash old entries when a user logs in.
+
+## Examples
+
+### Python
+
+#### Don't
+
+```py
+import hashlib
+
+stored = hashlib.sha256(password.encode()).hexdigest()
+```
+
+#### Do
+
+```py
+from argon2 import PasswordHasher
+
+stored = PasswordHasher().hash(password)
+```

codelaw_rules_security_python/rules/sec-py/requests-timeout.cases.md

@@ -0,0 +1,41 @@
+# sec-py/requests-timeout — cases
+
+### case: no timeout
+
+```py
+requests.get(url)
+```
+
+```expect
+1:1 sec-py/requests-timeout
+```
+
+### case: with timeout
+
+```py
+requests.get(url, timeout=3)
+```
+
+```expect
+(none)
+```
+
+### case: a session is not matched
+
+```py
+session.get(url)
+```
+
+```expect
+(none)
+```
+
+### case: post with data
+
+```py
+requests.post(url, json=body)
+```
+
+```expect
+1:1 sec-py/requests-timeout
+```

codelaw_rules_security_python/rules/sec-py/requests-timeout.md

@@ -0,0 +1,63 @@
+---
+id: sec-py/requests-timeout
+title: 'HTTP requests have a timeout'
+languages: [python]
+exclude: ["**/tests/**", "**/test/**", "**/test_*.py", "**/*_test.py", "**/*_tests.py", "**/tests.py", "**/conftest.py"]
+fix: suggest
+fix_reason: "the right timeout depends on the service; the suggested value is a starting point"
+stability: preview
+ported_from: [bandit/B113, ruff/S113]
+security: { cwe: [400], owasp: ["A06:2025"], severity: medium }
+since: 0.2.0
+---
+
+`requests` and `httpx` calls pass `timeout=`.
+
+**Why:** `requests` waits forever by default, so one stuck server holds a worker for good and a flood of slow responses exhausts them (CWE-400).
+
+```codelaw
+match:
+  all:
+    - { pattern: '$F($$$A)' }
+    - { kind: call }
+    - not:
+        has:
+          field: arguments
+          has: { kind: keyword_argument, has: { field: name, regex: '^timeout$' } }
+constraints: { F: { regex: '^requests\.(get|post|put|patch|delete|head|options|request)$' } }
+message: 'This request has no timeout; pass `timeout=`'
+fix: '$F($$$A, timeout=10)'
+```
+
+## How to fix
+
+1. Pass `timeout=` in seconds, or a `(connect, read)` tuple.
+2. Keep the value in one setting if several calls share it.
+
+## Examples
+
+### Python
+
+#### Don't
+
+```py
+import requests
+
+resp = requests.get(url)
+```
+
+#### Do
+
+```py
+import requests
+
+resp = requests.get(url, timeout=10)
+```
+
+#### Fixed
+
+```py
+import requests
+
+resp = requests.get(url, timeout=10)
+```

codelaw_rules_security_python/rules/sec-py/tarfile-filter.cases.md

@@ -0,0 +1,51 @@
+# sec-py/tarfile-filter — cases
+
+### case: no filter
+
+```py
+tar.extractall(dest)
+```
+
+```expect
+1:1 sec-py/tarfile-filter
+```
+
+### case: a filter
+
+```py
+tar.extractall(dest, filter="data")
+```
+
+```expect
+(none)
+```
+
+### case: a zip file
+
+```py
+zf.extract(name)
+```
+
+```expect
+(none)
+```
+
+### case: unpack_archive
+
+```py
+shutil.unpack_archive(path, dest)
+```
+
+```expect
+1:1 sec-py/tarfile-filter
+```
+
+### case: unpack_archive with a filter
+
+```py
+shutil.unpack_archive(path, dest, filter="data")
+```
+
+```expect
+(none)
+```

codelaw_rules_security_python/rules/sec-py/tarfile-filter.md

@@ -0,0 +1,71 @@
+---
+id: sec-py/tarfile-filter
+title: 'Archive extraction uses `filter="data"`'
+languages: [python]
+fix: suggest
+fix_reason: "`filter=\"data\"` refuses members that carry device files or special permissions some archives need"
+stability: preview
+ported_from: [bandit/B202, ruff/S202]
+security: { cwe: [22], owasp: ["A01:2025"], severity: high }
+since: 0.2.0
+---
+
+`TarFile.extractall` and `shutil.unpack_archive` pass `filter="data"`.
+
+**Why:** A member named `../../etc/cron.d/x`, an absolute path or a symlink writes outside the target folder (CWE-22).
+
+```codelaw
+match:
+  any:
+    - all:
+        - { pattern: '$T.extractall($$$A)' }
+        - not:
+            has:
+              field: arguments
+              has: { kind: keyword_argument, has: { field: name, regex: '^filter$' } }
+    - all:
+        - { pattern: 'shutil.unpack_archive($$$B)' }
+        - not:
+            has:
+              field: arguments
+              has: { kind: keyword_argument, has: { field: name, regex: '^filter$' } }
+message: '`extractall` follows member paths out of the folder; pass `filter="data"`'
+fix: '$T.extractall($$$A, filter="data")'
+```
+
+## How to fix
+
+1. Pass `filter="data"` (Python 3.12, and the 3.8–3.11 security releases).
+2. Pass it to `shutil.unpack_archive(…, filter="data")` too.
+3. Extract into a fresh folder, and never run as root.
+
+## Examples
+
+### Python
+
+#### Don't
+
+```py
+import tarfile
+
+with tarfile.open(path) as tar:
+    tar.extractall(dest)
+```
+
+#### Do
+
+```py
+import tarfile
+
+with tarfile.open(path) as tar:
+    tar.extractall(dest, filter="data")
+```
+
+#### Fixed
+
+```py
+import tarfile
+
+with tarfile.open(path) as tar:
+    tar.extractall(dest, filter="data")
+```

codelaw_rules_security_python/rules/sec-py/torch-load-weights-only.cases.md

@@ -0,0 +1,41 @@
+# sec-py/torch-load-weights-only — cases
+
+### case: a bare load
+
+```py
+torch.load(path)
+```
+
+```expect
+1:1 sec-py/torch-load-weights-only
+```
+
+### case: map_location only
+
+```py
+torch.load(path, map_location="cpu")
+```
+
+```expect
+1:1 sec-py/torch-load-weights-only
+```
+
+### case: weights_only=False
+
+```py
+torch.load(path, weights_only=False)
+```
+
+```expect
+1:1 sec-py/torch-load-weights-only
+```
+
+### case: weights_only=True
+
+```py
+torch.load(path, weights_only=True)
+```
+
+```expect
+(none)
+```

codelaw_rules_security_python/rules/sec-py/torch-load-weights-only.md

@@ -0,0 +1,73 @@
+---
+id: sec-py/torch-load-weights-only
+title: "`torch.load` with `weights_only=True`"
+languages: [python]
+fix: suggest
+fix_reason: "`weights_only=True` refuses checkpoints that hold arbitrary objects; those need a conversion to `safetensors`"
+stability: preview
+ported_from: [bandit/B614]
+security: { cwe: [502], owasp: ["A08:2025"], severity: high }
+since: 0.2.0
+---
+
+`torch.load` is called with `weights_only=True`.
+
+**Why:** Without it the file is unpickled, so a model file from anywhere else runs code on load (CWE-502).
+
+```codelaw
+match:
+  any:
+    - all:
+        - { pattern: 'torch.load($$$A)' }
+        - not:
+            has:
+              field: arguments
+              has:
+                kind: keyword_argument
+                all: [{ has: { field: name, regex: '^weights_only$' } }]
+    - kind: call
+      all:
+        - { has: { field: function, regex: '^torch\.load$' } }
+        - has:
+            field: arguments
+            has:
+              kind: keyword_argument
+              all:
+                - { has: { field: name, regex: '^weights_only$' } }
+                - { has: { field: value, kind: 'false' } }
+message: '`torch.load` unpickles the file; pass `weights_only=True`'
+fix: 'torch.load($$$A, weights_only=True)'
+```
+
+## How to fix
+
+1. Add `weights_only=True`.
+2. If the checkpoint holds more than tensors, convert it once with a trusted environment and keep it as `safetensors`.
+
+## Examples
+
+### Python
+
+#### Don't
+
+```py
+import torch
+
+model = torch.load(path)
+```
+
+#### Do
+
+```py
+import torch
+
+model = torch.load(path, weights_only=True)
+```
+
+#### Fixed
+
+```py
+import torch
+
+model = torch.load(path, weights_only=True)
+```

codelaw_rules_security_python/rules/sec-py/upload-secure-filename.cases.md

@@ -0,0 +1,41 @@
+# sec-py/upload-secure-filename — cases
+
+### case: the raw name
+
+```py
+f.save(f.filename)
+```
+
+```expect
+1:1 sec-py/upload-secure-filename
+```
+
+### case: joined
+
+```py
+file.save(os.path.join(UP, file.filename))
+```
+
+```expect
+1:1 sec-py/upload-secure-filename
+```
+
+### case: secured
+
+```py
+f.save(os.path.join(UP, secure_filename(f.filename)))
+```
+
+```expect
+(none)
+```
+
+### case: a generated name
+
+```py
+f.save(uuid4().hex)
+```
+
+```expect
+(none)
+```

codelaw_rules_security_python/rules/sec-py/upload-secure-filename.md

@@ -0,0 +1,65 @@
+---
+id: sec-py/upload-secure-filename
+title: 'Uploaded files are saved under a safe name'
+languages: [python]
+fix: suggest
+fix_reason: "`secure_filename` removes characters a name may legitimately have, and returns an empty string for some names, which needs handling"
+stability: preview
+security: { cwe: [434, 22], owasp: ["A01:2025"], severity: high }
+since: 0.2.0
+---
+
+A file from a request is not saved under the name the client gave it.
+
+**Why:** The name can be `../../app.py` or an absolute path, so the upload overwrites a file outside the upload folder (CWE-434, CWE-22).
+
+```codelaw
+match:
+  all:
+    - { kind: call }
+    - { has: { field: function, regex: '\.save$' } }
+    - has:
+        field: arguments
+        has:
+          any:
+            - { kind: attribute, regex: '\.filename$', pattern: $NAME }
+            - kind: call
+              has: { field: arguments, has: { kind: attribute, regex: '\.filename$', pattern: $NAME } }
+message: 'The upload is saved under the client''s file name; wrap it in `secure_filename`'
+fix:
+  - { replace: { target: $NAME, with: 'secure_filename($NAME)' } }
+```
+
+## How to fix
+
+1. Import `from werkzeug.utils import secure_filename`.
+2. Use `secure_filename(file.filename)`, and refuse an empty result.
+3. Better: store the file under a name you generate (a UUID) and keep the client's name as data.
+
+## Examples
+
+### Python
+
+#### Don't
+
+```py
+from werkzeug.utils import secure_filename
+
+file.save(os.path.join(UPLOADS, file.filename))
+```
+
+#### Do
+
+```py
+from werkzeug.utils import secure_filename
+
+file.save(os.path.join(UPLOADS, secure_filename(file.filename)))
+```
+
+#### Fixed
+
+```py
+from werkzeug.utils import secure_filename
+
+file.save(os.path.join(UPLOADS, secure_filename(file.filename)))
+```

codelaw_rules_security_python/rules/sec-py/urlopen-scheme.cases.md

@@ -0,0 +1,41 @@
+# sec-py/urlopen-scheme — cases
+
+### case: a name
+
+```py
+urlopen(url)
+```
+
+```expect
+1:1 sec-py/urlopen-scheme
+```
+
+### case: an https literal
+
+```py
+urlopen("https://example.com")
+```
+
+```expect
+(none)
+```
+
+### case: qualified
+
+```py
+urllib.request.urlopen(u, timeout=5)
+```
+
+```expect
+1:1 sec-py/urlopen-scheme
+```
+
+### case: an f-string with a fixed prefix
+
+```py
+urlopen(f"https://example.com/{x}")
+```
+
+```expect
+(none)
+```

codelaw_rules_security_python/rules/sec-py/urlopen-scheme.md

@@ -0,0 +1,54 @@
+---
+id: sec-py/urlopen-scheme
+title: "`urlopen` of a value that may be `file://`"
+languages: [python]
+fix: manual
+fix_reason: "the allowed schemes and hosts are policy"
+stability: preview
+ported_from: [bandit/B310, ruff/S310]
+security: { cwe: [22, 918], owasp: ["A01:2025"], severity: medium }
+since: 0.2.0
+---
+
+`urllib.request.urlopen` and `urlretrieve` are not given a value that is not an `http(s)` literal.
+
+**Why:** `urlopen` also opens `file://` and `ftp://` URLs, so a value that is not checked can read local files (CWE-22, CWE-918).
+
+```codelaw
+match:
+  any:
+    - { pattern: 'urlopen($X)' }
+    - { pattern: 'urlopen($X, $$$R)' }
+    - { pattern: 'urllib.request.urlopen($X)' }
+    - { pattern: 'urllib.request.urlopen($X, $$$R)' }
+    - { pattern: 'urllib.request.urlretrieve($X)' }
+    - { pattern: 'urllib.request.urlretrieve($X, $$$R)' }
+    - { pattern: 'urlretrieve($X, $$$R)' }
+constraints: { X: { not: { kind: string, regex: '^[rbf]?[''\"]https?://' } } }
+message: '`$X` may be a `file://` URL; check the scheme first'
+```
+
+## How to fix
+
+1. Parse the URL and check `scheme in ("http", "https")` before opening it.
+2. Or use `requests`, which supports only HTTP(S), with a `timeout`.
+
+## Examples
+
+### Python
+
+#### Don't
+
+```py
+from urllib.request import urlopen
+
+data = urlopen(url).read()
+```
+
+#### Do
+
+```py
+from urllib.request import urlopen
+
+data = urlopen("https://example.com/data").read()
+```