codelaw-rules-security-python 0.3.0__py3-none-any.whl

codelaw_rules_security_python/rules/sec-py/logging-listen.cases.md

@@ -0,0 +1,31 @@
+# sec-py/logging-listen — cases
+
+### case: listen
+
+```py
+logging.config.listen(9999)
+```
+
+```expect
+1:1 sec-py/logging-listen
+```
+
+### case: dictConfig
+
+```py
+logging.config.dictConfig(c)
+```
+
+```expect
+(none)
+```
+
+### case: another listen
+
+```py
+server.listen(5)
+```
+
+```expect
+(none)
+```

codelaw_rules_security_python/rules/sec-py/logging-listen.md

@@ -0,0 +1,47 @@
+---
+id: sec-py/logging-listen
+title: "`logging.config.listen` is not used"
+languages: [python]
+fix: manual
+fix_reason: "reconfiguring a running process needs another route (a signal handler, a config reload) the author has to choose"
+stability: preview
+ported_from: [bandit/B612, ruff/S612]
+security: { cwe: [94], owasp: ["A08:2025"], severity: high }
+since: 0.2.0
+---
+
+`logging.config.listen()` is not called.
+
+**Why:** It opens a socket that accepts a logging configuration, which can name any callable to run, so anyone who can connect runs code (CWE-94).
+
+```codelaw
+match:
+  kind: call
+  all: [{ has: { field: function, regex: '^(logging\.)?config\.listen$' } }]
+message: 'This opens a socket that accepts logging configuration, which can run code'
+```
+
+## How to fix
+
+1. Remove the call; load the configuration from a file at start-up with `logging.config.dictConfig`.
+2. To change levels at run time use a signal handler that re-reads the file.
+
+## Examples
+
+### Python
+
+#### Don't
+
+```py
+import logging.config
+
+t = logging.config.listen(9999)
+```
+
+#### Do
+
+```py
+import logging.config
+
+logging.config.dictConfig(CONFIG)
+```

codelaw_rules_security_python/rules/sec-py/ml-unsafe-load.cases.md

@@ -0,0 +1,61 @@
+# sec-py/ml-unsafe-load — cases
+
+### case: allow_pickle
+
+```py
+np.load(path, allow_pickle=True)
+```
+
+```expect
+1:1 sec-py/ml-unsafe-load
+```
+
+### case: no pickle
+
+```py
+np.load(path)
+```
+
+```expect
+(none)
+```
+
+### case: joblib
+
+```py
+joblib.load(path)
+```
+
+```expect
+1:1 sec-py/ml-unsafe-load
+```
+
+### case: pandas
+
+```py
+pd.read_pickle(path)
+```
+
+```expect
+1:1 sec-py/ml-unsafe-load
+```
+
+### case: keras
+
+```py
+keras.models.load_model(p, safe_mode=False)
+```
+
+```expect
+1:1 sec-py/ml-unsafe-load
+```
+
+### case: keras safe
+
+```py
+keras.models.load_model(p)
+```
+
+```expect
+(none)
+```

codelaw_rules_security_python/rules/sec-py/ml-unsafe-load.md

@@ -0,0 +1,68 @@
+---
+id: sec-py/ml-unsafe-load
+title: 'Model and array files are not unpickled'
+languages: [python]
+fix: manual
+fix_reason: "the replacement format (`safetensors`, `.npy` without pickle, Parquet) means converting the stored files"
+stability: preview
+security: { cwe: [502], owasp: ["A08:2025"], severity: high }
+since: 0.2.0
+---
+
+`numpy.load(allow_pickle=True)`, `joblib.load`, `pandas.read_pickle` and Keras `load_model(safe_mode=False)` are not used.
+
+**Why:** Each one unpickles the file, so a model or dataset from anywhere else runs code on load (CWE-502).
+
+```codelaw
+match:
+  any:
+    - kind: call
+      all:
+        - { has: { field: function, regex: '^(np|numpy)\.load$' } }
+        - has:
+            field: arguments
+            has:
+              kind: keyword_argument
+              all:
+                - { has: { field: name, regex: '^allow_pickle$' } }
+                - { has: { field: value, kind: 'true' } }
+    - kind: call
+      all: [{ has: { field: function, regex: '^joblib\.load$' } }]
+    - kind: call
+      all: [{ has: { field: function, regex: '^(pd|pandas)\.read_pickle$' } }]
+    - kind: call
+      all:
+        - { has: { field: function, regex: '(^|\.)load_model$' } }
+        - has:
+            field: arguments
+            has:
+              kind: keyword_argument
+              all: [{ has: { field: name, regex: '^safe_mode$' } }, { has: { field: value, kind: 'false' } }]
+message: 'This loads a pickle, which can run code; use `safetensors` or a data-only format'
+```
+
+## How to fix
+
+1. Save and load arrays with `np.save` / `np.load` without `allow_pickle`, and tensors with `safetensors`.
+2. Store tables as Parquet or CSV, not pickle.
+3. If the file must be a pickle, load only files your own pipeline wrote and check a signature first.
+
+## Examples
+
+### Python
+
+#### Don't
+
+```py
+import numpy as np
+
+arr = np.load(path, allow_pickle=True)
+```
+
+#### Do
+
+```py
+import numpy as np
+
+arr = np.load(path)
+```

codelaw_rules_security_python/rules/sec-py/no-assert-for-auth.cases.md

@@ -0,0 +1,31 @@
+# sec-py/no-assert-for-auth — cases
+
+### case: a permission
+
+```py
+assert user.has_perm("x")
+```
+
+```expect
+1:1 sec-py/no-assert-for-auth
+```
+
+### case: an invariant
+
+```py
+assert len(items) > 0
+```
+
+```expect
+(none)
+```
+
+### case: current_user
+
+```py
+assert current_user.id == owner_id
+```
+
+```expect
+1:1 sec-py/no-assert-for-auth
+```

codelaw_rules_security_python/rules/sec-py/no-assert-for-auth.md

@@ -0,0 +1,51 @@
+---
+id: sec-py/no-assert-for-auth
+title: "`assert` is not an access check"
+languages: [python]
+exclude: ["**/tests/**", "**/test/**", "**/test_*.py", "**/*_test.py", "**/*_tests.py", "**/tests.py", "**/conftest.py"]
+fix: manual
+fix_reason: "the replacement raises the right exception for the framework, which only the author knows"
+stability: preview
+ported_from: [bandit/B101, ruff/S101]
+security: { cwe: [703], owasp: ["A10:2025"], severity: medium }
+since: 0.2.0
+---
+
+A permission, role or authentication test is not written as an `assert`.
+
+**Why:** `python -O` removes every `assert`, so the check disappears in an optimised run (CWE-703).
+
+```codelaw
+match:
+  all:
+    - { kind: assert_statement }
+    - regex: '(?i)(is_authenticated|is_admin|is_staff|is_superuser|has_perm|has_permission|permission|authorized|authenticated|is_owner|\.role\b|\.roles\b|current_user|user\.id\s*==)'
+message: 'An `assert` is removed by `python -O`; raise an exception for an access check'
+```
+
+## How to fix
+
+1. Replace it with `if not user.is_authenticated: raise PermissionDenied`.
+2. Use your framework's decorator (`@login_required`, `Depends(...)`) where one fits.
+
+## Examples
+
+### Python
+
+#### Don't
+
+```py
+def delete(request, item):
+    assert request.user.is_staff
+```
+
+#### Do
+
+```py
+from django.core.exceptions import PermissionDenied
+
+
+def delete(request, item):
+    if not request.user.is_staff:
+        raise PermissionDenied
+```

codelaw_rules_security_python/rules/sec-py/no-bind-all-interfaces.cases.md

@@ -0,0 +1,41 @@
+# sec-py/no-bind-all-interfaces — cases
+
+### case: uvicorn
+
+```py
+uvicorn.run(app, host="0.0.0.0")
+```
+
+```expect
+1:1 sec-py/no-bind-all-interfaces
+```
+
+### case: socket
+
+```py
+s.bind(("0.0.0.0", 80))
+```
+
+```expect
+1:1 sec-py/no-bind-all-interfaces
+```
+
+### case: loopback
+
+```py
+s.bind(("127.0.0.1", 80))
+```
+
+```expect
+(none)
+```
+
+### case: from the environment
+
+```py
+app.run(host=HOST)
+```
+
+```expect
+(none)
+```

codelaw_rules_security_python/rules/sec-py/no-bind-all-interfaces.md

@@ -0,0 +1,75 @@
+---
+id: sec-py/no-bind-all-interfaces
+title: 'A server does not bind to every interface in code'
+languages: [python]
+severity: warn
+fix: manual
+fix_reason: "the address belongs in configuration, with a loopback default"
+stability: preview
+ported_from: [bandit/B104, ruff/S104]
+security: { cwe: [605], owasp: ["A02:2025"], severity: low }
+since: 0.2.0
+---
+
+A socket or server is not bound to `0.0.0.0` in the source.
+
+**Why:** The service is then reachable from every network the machine is on, including ones that were not meant to reach it (CWE-605).
+
+```codelaw
+match:
+  any:
+    - all:
+        - { kind: call }
+        - { has: { field: function, regex: '\.(bind|connect_ex)$' } }
+        - has:
+            field: arguments
+            has:
+              nthChild: 1
+              kind: tuple
+              has: { nthChild: 1, kind: string, regex: '^[''"](0\.0\.0\.0|::)[''"]$' }
+    - all:
+        - { kind: call }
+        - has:
+            field: arguments
+            has:
+              kind: keyword_argument
+              all:
+                - { has: { field: name, regex: '^host$' } }
+                - { has: { field: value, kind: string, regex: '^[''"](0\.0\.0\.0|::)[''"]$' } }
+    - all:
+        - { kind: call }
+        - has:
+            field: arguments
+            has:
+              kind: keyword_argument
+              all:
+                - { has: { field: name, regex: '^bind$' } }
+                - { has: { field: value, kind: string, regex: '^[''"](0\.0\.0\.0|\[::\]):[0-9]+[''"]$' } }
+message: 'This binds to every network interface; read the address from configuration'
+```
+
+## How to fix
+
+1. Bind to `127.0.0.1` by default and take the address from an environment variable.
+2. A container that must listen on every interface sets it in its deployment settings, not in the code.
+
+## Examples
+
+### Python
+
+#### Don't
+
+```py
+import uvicorn
+
+uvicorn.run(app, host="0.0.0.0")
+```
+
+#### Do
+
+```py
+import os
+import uvicorn
+
+uvicorn.run(app, host=os.environ.get("HOST", "127.0.0.1"))
+```

codelaw_rules_security_python/rules/sec-py/no-cleartext-http.cases.md

@@ -0,0 +1,41 @@
+# sec-py/no-cleartext-http — cases
+
+### case: plain http
+
+```py
+requests.get("http://example.com", timeout=5)
+```
+
+```expect
+1:1 sec-py/no-cleartext-http
+```
+
+### case: https
+
+```py
+requests.get("https://example.com")
+```
+
+```expect
+(none)
+```
+
+### case: localhost
+
+```py
+requests.get("http://localhost:8000/x")
+```
+
+```expect
+(none)
+```
+
+### case: an f-string
+
+```py
+httpx.post(f"http://example.com/{p}/x")
+```
+
+```expect
+1:1 sec-py/no-cleartext-http
+```

codelaw_rules_security_python/rules/sec-py/no-cleartext-http.md

@@ -0,0 +1,56 @@
+---
+id: sec-py/no-cleartext-http
+title: 'Requests go over HTTPS'
+languages: [python]
+fix: manual
+fix_reason: "the server must serve HTTPS first, and the URL change has to follow it"
+stability: preview
+security: { cwe: [319], owasp: ["A04:2025"], severity: medium }
+since: 0.2.0
+---
+
+`requests` and `httpx` are not called with an `http://` URL, except for localhost.
+
+**Why:** The data, and any token in it, crosses the network readable and changeable by anyone on the path (CWE-319).
+
+```codelaw
+match:
+  kind: call
+  all:
+    - has:
+        field: function
+        regex: '^(requests|httpx)\.(get|post|put|patch|delete|head|options|request|stream)$'
+    - has:
+        field: arguments
+        has:
+          nthChild: 1
+          kind: string
+          regex: '^[rbf]?[''\"]http://'
+          not: { regex: '^[rbf]?[''\"]http://(localhost|127\.0\.0\.1|\[::1\]|0\.0\.0\.0)' }
+message: 'This URL is plain HTTP; use `https://`'
+```
+
+## How to fix
+
+1. Change the URL to `https://`.
+2. If the server cannot do HTTPS, put it behind a proxy that can, or reach it over a private tunnel.
+
+## Examples
+
+### Python
+
+#### Don't
+
+```py
+import requests
+
+resp = requests.get("http://api.example.com/data", timeout=5)
+```
+
+#### Do
+
+```py
+import requests
+
+resp = requests.get("https://api.example.com/data", timeout=5)
+```

codelaw_rules_security_python/rules/sec-py/no-csrf-exempt.cases.md

@@ -0,0 +1,49 @@
+# sec-py/no-csrf-exempt — cases
+
+### case: exempt
+
+```py
+@csrf_exempt
+def v(request):
+    pass
+```
+
+```expect
+1:1 sec-py/no-csrf-exempt
+```
+
+### case: qualified
+
+```py
+@csrf.csrf_exempt
+def v(request):
+    pass
+```
+
+```expect
+1:1 sec-py/no-csrf-exempt
+```
+
+### case: another decorator
+
+```py
+@login_required
+def v(request):
+    pass
+```
+
+```expect
+(none)
+```
+
+### case: csrf_protect
+
+```py
+@csrf_protect
+def v(request):
+    pass
+```
+
+```expect
+(none)
+```

codelaw_rules_security_python/rules/sec-py/no-csrf-exempt.md

@@ -0,0 +1,47 @@
+---
+id: sec-py/no-csrf-exempt
+title: 'No `@csrf_exempt`'
+languages: [python]
+fix: manual
+fix_reason: "an endpoint that needs to be exempt (a webhook) needs its own authentication, which only the author can choose"
+stability: preview
+security: { cwe: [352], owasp: ["A01:2025"], severity: high }
+since: 0.2.0
+---
+
+A view is not decorated with `@csrf_exempt`.
+
+**Why:** Without the token check any page the user visits can submit the form as the user (CWE-352).
+
+```codelaw
+match:
+  kind: decorator
+  regex: '^@\s*((django\.views\.decorators\.csrf\.)|(csrf\.))?csrf_exempt\b'
+message: 'This view skips the CSRF check'
+```
+
+## How to fix
+
+1. Remove `@csrf_exempt` and send the token (`{% csrf_token %}`, or the `X-CSRFToken` header).
+2. For a webhook, authenticate the sender (a signed header) and keep the exemption on that one view with a comment saying why.
+
+## Examples
+
+### Python
+
+#### Don't
+
+```py
+from django.views.decorators.csrf import csrf_exempt
+
+@csrf_exempt
+def update(request):
+    ...
+```
+
+#### Do
+
+```py
+def update(request):
+    ...
+```

codelaw_rules_security_python/rules/sec-py/no-dynamic-import.cases.md

@@ -0,0 +1,35 @@
+# sec-py/no-dynamic-import — cases
+
+### case: getattr
+
+```py
+def v(request):
+    n = request.GET["a"]
+    return getattr(handlers, n)()
+```
+
+```expect
+3:12 sec-py/no-dynamic-import
+```
+
+### case: import_module
+
+```py
+def v(request):
+    return importlib.import_module(request.args["m"])
+```
+
+```expect
+2:12 sec-py/no-dynamic-import
+```
+
+### case: a constant
+
+```py
+def v(request):
+    return getattr(handlers, "run")
+```
+
+```expect
+(none)
+```

codelaw_rules_security_python/rules/sec-py/no-dynamic-import.md

@@ -0,0 +1,51 @@
+---
+id: sec-py/no-dynamic-import
+title: 'A request value does not choose a module or attribute'
+languages: [python]
+fix: manual
+fix_reason: "the allow-list of names is the author's"
+stability: preview
+security: { cwe: [470], owasp: ["A05:2025"], severity: high }
+since: 0.2.0
+---
+
+A value from the request is not passed to `__import__`, `importlib.import_module` or `getattr`.
+
+**Why:** The client then picks which module is loaded or which attribute is read or called, including ones that run commands (CWE-470). This rule uses `from_source:`, which is not taint analysis: it sees a request value only in the function that reads it, never through a call or a parameter.
+
+```codelaw
+match:
+  any:
+    - { pattern: '__import__($X)' }
+    - { pattern: 'importlib.import_module($X)' }
+    - { pattern: 'import_module($X)' }
+    - { pattern: 'getattr($O, $X)' }
+    - { pattern: 'getattr($O, $X, $D)' }
+    - { pattern: 'importlib.import_module($X, $P)' }
+where: { $X: { from_source: { tables: [sources/django, sources/flask, sources/fastapi] } } }
+message: '`$X` comes from the request and chooses a module or attribute'
+```
+
+## How to fix
+
+1. Map the client's value to a fixed dict of allowed handlers: `HANDLERS = {"csv": export_csv}`; `HANDLERS[name]`.
+2. Reject a name that is not a key.
+
+## Examples
+
+### Python
+
+#### Don't
+
+```py
+def run(request):
+    action = request.GET["action"]
+    return getattr(handlers, action)()
+```
+
+#### Do
+
+```py
+def run(request):
+    return HANDLERS[request.GET["action"]]()
+```