codelaw-rules-security-python 0.3.0__py3-none-any.whl

codelaw_rules_security_python/rules/sec-py/django-settings.cases.md

@@ -0,0 +1,61 @@
+# sec-py/django-settings — cases
+
+### case: DEBUG
+
+```py path=settings.py
+DEBUG = True
+```
+
+```expect
+1:1 sec-py/django-settings
+```
+
+### case: wildcard hosts
+
+```py path=settings.py
+ALLOWED_HOSTS = ["*"]
+```
+
+```expect
+1:1 sec-py/django-settings
+```
+
+### case: a literal key
+
+```py path=settings.py
+SECRET_KEY = "django-insecure-abc123"
+```
+
+```expect
+1:1 sec-py/django-settings
+```
+
+### case: a key from the environment
+
+```py path=settings.py
+SECRET_KEY = os.environ["KEY"]
+```
+
+```expect
+(none)
+```
+
+### case: an insecure cookie
+
+```py path=settings.py
+SESSION_COOKIE_SECURE = False
+```
+
+```expect
+1:1 sec-py/django-settings
+```
+
+### case: a secure cookie
+
+```py path=settings.py
+CSRF_COOKIE_SECURE = True
+```
+
+```expect
+(none)
+```

codelaw_rules_security_python/rules/sec-py/django-settings.md

@@ -0,0 +1,68 @@
+---
+id: sec-py/django-settings
+title: 'Django settings are safe'
+languages: [python]
+files: ["**/settings.py", "**/settings/**/*.py", "**/*_settings.py", "**/settings_*.py"]
+exclude: ["**/*dev*.py", "**/*local*.py", "**/*test*.py"]
+fix: manual
+fix_reason: "the production value comes from the deployment (environment variables, a secret manager)"
+stability: preview
+ported_from: [ruff/S105]
+security: { cwe: [489, 798, 614], owasp: ["A02:2025"], severity: high }
+since: 0.2.0
+---
+
+In a settings module, `DEBUG`, `ALLOWED_HOSTS`, `SECRET_KEY` and the cookie flags are not left in their development values.
+
+**Why:** Debug pages show settings and source (CWE-489); `ALLOWED_HOSTS = ["*"]` accepts forged Host headers; a literal `SECRET_KEY` is in the repository (CWE-798); cookies without `Secure` travel over plain HTTP (CWE-614).
+
+```codelaw
+match:
+  all:
+    - { kind: assignment }
+    - any:
+        - all: [{ has: { field: left, regex: '^DEBUG$' } }, { has: { field: right, kind: 'true' } }]
+        - all:
+            - { has: { field: left, regex: '^ALLOWED_HOSTS$' } }
+            - { has: { field: right, regex: '^\[\s*[''"]\*[''"]\s*\]$' } }
+        - all:
+            - { has: { field: left, regex: '^SECRET_KEY$' } }
+            - has:
+                field: right
+                kind: string
+                regex: '^[rb]?("[^"]{4,}"|''[^'']{4,}'')$'
+                not: { has: { kind: interpolation } }
+        - all:
+            - has:
+                field: left
+                regex: '^(SESSION_COOKIE_SECURE|CSRF_COOKIE_SECURE|SECURE_SSL_REDIRECT|SESSION_COOKIE_HTTPONLY)$'
+            - { has: { field: right, kind: 'false' } }
+message: 'This Django setting is unsafe outside development'
+```
+
+## How to fix
+
+1. `DEBUG = os.environ.get("DJANGO_DEBUG") == "1"`.
+2. `ALLOWED_HOSTS = ["app.example.com"]`: list the host names you serve.
+3. `SECRET_KEY = os.environ["DJANGO_SECRET_KEY"]`, and rotate the one that was committed.
+4. Set `SESSION_COOKIE_SECURE`, `CSRF_COOKIE_SECURE` and `SECURE_SSL_REDIRECT` to `True`; run `python manage.py check --deploy`.
+
+## Examples
+
+### Python
+
+#### Don't
+
+```py path=settings.py
+DEBUG = True
+ALLOWED_HOSTS = ["*"]
+```
+
+#### Do
+
+```py path=settings.py
+import os
+
+DEBUG = os.environ.get("DJANGO_DEBUG") == "1"
+ALLOWED_HOSTS = ["app.example.com"]
+```

codelaw_rules_security_python/rules/sec-py/fastapi-cors.cases.md

@@ -0,0 +1,31 @@
+# sec-py/fastapi-cors — cases
+
+### case: wildcard with credentials
+
+```py
+app.add_middleware(CORSMiddleware, allow_origins=["*"], allow_credentials=True)
+```
+
+```expect
+1:1 sec-py/fastapi-cors
+```
+
+### case: wildcard without credentials
+
+```py
+app.add_middleware(CORSMiddleware, allow_origins=["*"])
+```
+
+```expect
+(none)
+```
+
+### case: listed origins
+
+```py
+app.add_middleware(CORSMiddleware, allow_origins=["https://a.example"], allow_credentials=True)
+```
+
+```expect
+(none)
+```

codelaw_rules_security_python/rules/sec-py/fastapi-cors.md

@@ -0,0 +1,46 @@
+---
+id: sec-py/fastapi-cors
+title: 'CORS does not allow every origin with credentials'
+languages: [python]
+fix: manual
+fix_reason: "the list of trusted origins is the application's own"
+stability: preview
+security: { cwe: [942], owasp: ["A02:2025"], severity: high }
+since: 0.2.0
+---
+
+`CORSMiddleware` is not given `allow_origins=["*"]` together with `allow_credentials=True`.
+
+**Why:** Any site can then make authenticated requests as the user and read the answers (CWE-942).
+
+```codelaw
+match:
+  any:
+    - all:
+        - { kind: call }
+        - { has: { field: function, regex: '^(CORSMiddleware|.*\.add_middleware)$' } }
+        - { has: { field: arguments, regex: 'allow_origins\s*=\s*\[\s*[''"]\*[''"]\s*\]' } }
+        - { has: { field: arguments, regex: 'allow_credentials\s*=\s*True' } }
+message: 'Every origin is allowed with credentials; list the trusted origins'
+```
+
+## How to fix
+
+1. List the origins: `allow_origins=["https://app.example.com"]`.
+2. If the API needs no cookies, set `allow_credentials=False` and keep `*`.
+
+## Examples
+
+### Python
+
+#### Don't
+
+```py
+app.add_middleware(CORSMiddleware, allow_origins=["*"], allow_credentials=True)
+```
+
+#### Do
+
+```py
+app.add_middleware(CORSMiddleware, allow_origins=["https://app.example.com"], allow_credentials=True)
+```

codelaw_rules_security_python/rules/sec-py/flask-debug.cases.md

@@ -0,0 +1,31 @@
+# sec-py/flask-debug — cases
+
+### case: debug=True
+
+```py
+app.run(host="127.0.0.1", debug=True)
+```
+
+```expect
+1:1 sec-py/flask-debug
+```
+
+### case: debug=False
+
+```py
+app.run(debug=False)
+```
+
+```expect
+(none)
+```
+
+### case: no debug
+
+```py
+app.run()
+```
+
+```expect
+(none)
+```

codelaw_rules_security_python/rules/sec-py/flask-debug.md

@@ -0,0 +1,59 @@
+---
+id: sec-py/flask-debug
+title: 'Flask''s debugger is off'
+languages: [python]
+exclude: ["**/tests/**", "**/test/**", "**/test_*.py", "**/*_test.py", "**/*_tests.py", "**/tests.py", "**/conftest.py"]
+fix: suggest
+fix_reason: "the setting belongs to the environment, so the debug flag has to come from configuration"
+stability: preview
+ported_from: [bandit/B201, ruff/S201]
+security: { cwe: [489], owasp: ["A02:2025"], severity: high }
+since: 0.2.0
+---
+
+`app.run(debug=True)` is not written in code.
+
+**Why:** The debugger serves an interactive console that runs code on the server, and a stack trace shows source and settings (CWE-489).
+
+```codelaw
+match:
+  kind: call
+  all:
+    - { has: { field: function, regex: '^(app|application|flask_app|self\.app)\.run$' } }
+    - has:
+        field: arguments
+        has:
+          kind: keyword_argument
+          all: [{ has: { field: name, regex: '^debug$' } }, { has: { field: value, kind: 'true' } }]
+          pattern: $KW
+message: 'Flask runs with the debugger on; take `debug` from the environment'
+fix:
+  - { remove: $KW }
+```
+
+## How to fix
+
+1. Remove `debug=True`; turn the debugger on with `flask --debug run` while developing.
+2. In production run a WSGI server (`gunicorn app:app`), not `app.run`.
+
+## Examples
+
+### Python
+
+#### Don't
+
+```py
+from flask import Flask
+
+app = Flask(__name__)
+app.run(debug=True)
+```
+
+#### Do
+
+```py
+from flask import Flask
+
+app = Flask(__name__)
+app.run()
+```

codelaw_rules_security_python/rules/sec-py/flask-settings.cases.md

@@ -0,0 +1,51 @@
+# sec-py/flask-settings — cases
+
+### case: a literal key
+
+```py
+app.config["SECRET_KEY"] = "dev-secret-key"
+```
+
+```expect
+1:1 sec-py/flask-settings
+```
+
+### case: csrf off
+
+```py
+app.config["WTF_CSRF_ENABLED"] = False
+```
+
+```expect
+1:1 sec-py/flask-settings
+```
+
+### case: update
+
+```py
+app.config.update(SECRET_KEY="abcdef")
+```
+
+```expect
+1:1 sec-py/flask-settings
+```
+
+### case: an environment key
+
+```py
+app.config["SECRET_KEY"] = os.environ["K"]
+```
+
+```expect
+(none)
+```
+
+### case: a secure cookie
+
+```py
+app.config["SESSION_COOKIE_SECURE"] = True
+```
+
+```expect
+(none)
+```

codelaw_rules_security_python/rules/sec-py/flask-settings.md

@@ -0,0 +1,84 @@
+---
+id: sec-py/flask-settings
+title: 'Flask configuration is safe'
+languages: [python]
+exclude: ["**/tests/**", "**/test/**", "**/test_*.py", "**/*_test.py", "**/*_tests.py", "**/tests.py", "**/conftest.py"]
+fix: manual
+fix_reason: "the production values come from the deployment (environment variables, a secret manager)"
+stability: preview
+security: { cwe: [798, 352, 614], owasp: ["A02:2025"], severity: high }
+since: 0.2.0
+---
+
+`SECRET_KEY` is not a literal, and `WTF_CSRF_ENABLED` and `SESSION_COOKIE_SECURE` are not switched off in the app configuration.
+
+**Why:** A literal key is in the repository (CWE-798), turning off CSRF protection lets other sites submit forms as the user (CWE-352), and a cookie without `Secure` travels over plain HTTP (CWE-614).
+
+```codelaw
+match:
+  any:
+    - all:
+        - { kind: assignment }
+        - { has: { field: left, regex: 'config\[\s*[''"]SECRET_KEY[''"]\s*\]$' } }
+        - has:
+            field: right
+            kind: string
+            regex: '^[rb]?("[^"]{4,}"|''[^'']{4,}'')$'
+            not: { has: { kind: interpolation } }
+    - all:
+        - { kind: assignment }
+        - has:
+            field: left
+            regex: 'config\[\s*[''"](WTF_CSRF_ENABLED|WTF_CSRF_CHECK_DEFAULT|SESSION_COOKIE_SECURE|SESSION_COOKIE_HTTPONLY)[''"]\s*\]$'
+        - { has: { field: right, kind: 'false' } }
+    - kind: call
+      all:
+        - { has: { field: function, regex: '\.config\.(update|from_mapping)$' } }
+        - any:
+            - has:
+                field: arguments
+                has:
+                  kind: keyword_argument
+                  all:
+                    - { has: { field: name, regex: '^SECRET_KEY$' } }
+                    - { has: { field: value, kind: string, not: { has: { kind: interpolation } } } }
+            - has:
+                field: arguments
+                has:
+                  kind: keyword_argument
+                  all:
+                    - { has: { field: name, regex: '^WTF_CSRF_ENABLED$' } }
+                    - { has: { field: value, kind: 'false' } }
+            - has:
+                field: arguments
+                has:
+                  kind: keyword_argument
+                  all:
+                    - { has: { field: name, regex: '^SESSION_COOKIE_SECURE$' } }
+                    - { has: { field: value, kind: 'false' } }
+message: 'This Flask setting is unsafe outside development'
+```
+
+## How to fix
+
+1. `app.config["SECRET_KEY"] = os.environ["FLASK_SECRET_KEY"]`, and rotate the key that was committed.
+2. Leave `WTF_CSRF_ENABLED` on; send the token with `{{ csrf_token() }}`.
+3. Set `SESSION_COOKIE_SECURE`, `SESSION_COOKIE_HTTPONLY` and `SESSION_COOKIE_SAMESITE` to safe values.
+
+## Examples
+
+### Python
+
+#### Don't
+
+```py
+app.config["SECRET_KEY"] = "dev-secret-key"
+```
+
+#### Do
+
+```py
+import os
+
+app.config["SECRET_KEY"] = os.environ["FLASK_SECRET_KEY"]
+```

codelaw_rules_security_python/rules/sec-py/hf-pin-revision.cases.md

@@ -0,0 +1,51 @@
+# sec-py/hf-pin-revision — cases
+
+### case: pinned
+
+```py
+model = AutoModel.from_pretrained(name, revision=rev)
+```
+
+```expect
+(none)
+```
+
+### case: unpinned
+
+```py
+tok = AutoTokenizer.from_pretrained(name)
+```
+
+```expect
+1:7 sec-py/hf-pin-revision
+```
+
+### case: hub download
+
+```py
+hf_hub_download(repo_id, filename)
+```
+
+```expect
+1:1 sec-py/hf-pin-revision
+```
+
+### case: dataset
+
+```py
+load_dataset("org/data")
+```
+
+```expect
+1:1 sec-py/hf-pin-revision
+```
+
+### case: a local path is still flagged
+
+```py
+AutoModel.from_pretrained("./model")
+```
+
+```expect
+1:1 sec-py/hf-pin-revision
+```

codelaw_rules_security_python/rules/sec-py/hf-pin-revision.md

@@ -0,0 +1,58 @@
+---
+id: sec-py/hf-pin-revision
+title: 'Hugging Face downloads pin a revision'
+languages: [python]
+fix: manual
+fix_reason: "the commit hash to pin is a choice the author makes after reviewing the model"
+stability: preview
+ported_from: [bandit/B615]
+security: { cwe: [494], owasp: ["A03:2025"], severity: medium }
+since: 0.2.0
+---
+
+`from_pretrained`, `hf_hub_download`, `snapshot_download` and `load_dataset` are called with `revision=`.
+
+**Why:** Without a revision the code runs whatever the repository's `main` branch holds today, so a change there reaches production unreviewed (CWE-494).
+
+```codelaw
+match:
+  kind: call
+  all:
+    - has:
+        field: function
+        regex: '^((.*\.)?(from_pretrained|hf_hub_download|snapshot_download)|(datasets\.)?load_dataset)$'
+    - not:
+        has:
+          field: arguments
+          has:
+            kind: keyword_argument
+            all: [{ has: { field: name, regex: '^revision$' } }]
+message: 'This download follows `main`; pin `revision=` to a commit hash'
+```
+
+## How to fix
+
+1. Find the commit hash of the revision you reviewed on the model's page.
+2. Pass it: `from_pretrained(name, revision="<hash>")`.
+3. Keep the hash in one constant or setting so an upgrade is one reviewed change.
+
+## Examples
+
+### Python
+
+#### Don't
+
+```py
+from transformers import AutoModel
+
+model = AutoModel.from_pretrained("org/model")
+```
+
+#### Do
+
+```py
+from transformers import AutoModel
+
+MODEL_REVISION = "5c9e4d1"
+model = AutoModel.from_pretrained("org/model", revision=MODEL_REVISION)
+```

codelaw_rules_security_python/rules/sec-py/jinja-autoescape.cases.md

@@ -0,0 +1,62 @@
+# sec-py/jinja-autoescape — cases
+
+### case: autoescape=False
+
+```py
+env = Environment(autoescape=False)
+```
+
+```expect
+1:7 sec-py/jinja-autoescape
+```
+
+### case: no autoescape given
+
+```py
+env = Environment(loader=loader)
+```
+
+```expect
+1:7 sec-py/jinja-autoescape
+```
+
+### case: select_autoescape
+
+```py
+env = Environment(autoescape=select_autoescape())
+```
+
+```expect
+(none)
+```
+
+### case: SSTI
+
+```py
+def v(request):
+    return render_template_string(request.args["t"])
+```
+
+```expect
+2:12 sec-py/jinja-autoescape
+```
+
+### case: from_string
+
+```py
+env.from_string(text)
+```
+
+```expect
+1:1 sec-py/jinja-autoescape
+```
+
+### case: a literal template
+
+```py
+render_template_string("<p>{{ x }}</p>", x=x)
+```
+
+```expect
+(none)
+```

codelaw_rules_security_python/rules/sec-py/jinja-autoescape.md

@@ -0,0 +1,80 @@
+---
+id: sec-py/jinja-autoescape
+title: 'Jinja2 keeps autoescape on'
+languages: [python]
+fix: suggest
+fix_reason: "turning autoescape on changes the output of templates that write HTML on purpose; those need `|safe` or `Markup`"
+stability: preview
+ported_from: [bandit/B701, ruff/S701]
+security: { cwe: [79, 1336], owasp: ["A05:2025"], severity: high }
+since: 0.2.0
+---
+
+`Environment` is not created with `autoescape=False` or without `autoescape`, and `render_template_string` / `Template` / `from_string` are not given a template that is not a literal.
+
+**Why:** Without autoescape a value written into a page can carry a script (CWE-79); a template built from a non-literal runs template code on the server (CWE-1336).
+
+```codelaw
+match:
+  any:
+    - kind: call
+      all:
+        - { has: { field: function, regex: '^(jinja2\.)?Environment$' } }
+        - has:
+            field: arguments
+            has:
+              kind: keyword_argument
+              all:
+                - { has: { field: name, regex: '^autoescape$' } }
+                - { has: { field: value, kind: 'false' } }
+              pattern: $KW
+    - all:
+        - { kind: call }
+        - { has: { field: function, regex: '^(jinja2\.)?Environment$' } }
+        - not:
+            has:
+              field: arguments
+              has: { kind: keyword_argument, has: { field: name, regex: '^(autoescape)$' } }
+    - { pattern: 'render_template_string($T)' }
+    - { pattern: 'jinja2.Template($T)' }
+    - { pattern: '$E.from_string($T)' }
+constraints:
+  T: { not: { kind: string, not: { has: { kind: interpolation } } } }
+  E: { regex: '^(env|environment|jinja_env|jinja2\.Environment\(.*\))$' }
+message: 'Jinja2 is not escaping, or the template comes from the request'
+fix:
+  - { replace: { target: $KW, with: 'autoescape=True' } }
+```
+
+## How to fix
+
+1. Create the environment with `autoescape=True`, or `select_autoescape()`.
+2. Never use request data as the template: pass it as a value to a template file instead.
+
+## Examples
+
+### Python
+
+#### Don't
+
+```py
+from jinja2 import Environment
+
+env = Environment(autoescape=False)
+```
+
+#### Do
+
+```py
+from jinja2 import Environment
+
+env = Environment(autoescape=True)
+```
+
+#### Fixed
+
+```py
+from jinja2 import Environment
+
+env = Environment(autoescape=True)
+```