codelaw-rules-security-python 0.3.0__py3-none-any.whl

codelaw_rules_security_python/rules/sec-py/no-exec-eval.cases.md

@@ -0,0 +1,51 @@
+# sec-py/no-exec-eval — cases
+
+### case: a literal string
+
+```py
+eval("1 + 1")
+```
+
+```expect
+(none)
+```
+
+### case: an f-string
+
+```py
+exec(f"import {name}")
+```
+
+```expect
+1:1 sec-py/no-exec-eval
+```
+
+### case: exec with a namespace
+
+```py
+exec(code, {})
+```
+
+```expect
+1:1 sec-py/no-exec-eval
+```
+
+### case: a method named eval
+
+```py
+model.eval()
+```
+
+```expect
+(none)
+```
+
+### case: a name
+
+```py
+compile(source, 'f.py', 'exec')
+```
+
+```expect
+1:1 sec-py/no-exec-eval
+```

codelaw_rules_security_python/rules/sec-py/no-exec-eval.md

@@ -0,0 +1,56 @@
+---
+id: sec-py/no-exec-eval
+title: "`exec`, `eval` and `compile` of a non-literal"
+languages: [python]
+fix: manual
+fix_reason: "the safe replacement (`ast.literal_eval`, a lookup table, a parser) depends on what the string is for"
+stability: preview
+ported_from: [bandit/B102, bandit/B307]
+security: { cwe: [94], owasp: ["A05:2025"], severity: high }
+since: 0.2.0
+---
+
+`exec`, `eval` and `compile` are not given a value that is not a string literal.
+
+**Why:** The string is run as code, so whoever controls it controls the program (CWE-94).
+
+```codelaw
+match:
+  any:
+    - { pattern: 'exec($X)' }
+    - { pattern: 'exec($X, $$$R)' }
+    - { pattern: 'eval($X)' }
+    - { pattern: 'eval($X, $$$R)' }
+    - all:
+        - { pattern: 'compile($X, $$$R)' }
+        - not:
+            inside:
+              kind: argument_list
+              inside: { kind: call, has: { field: function, regex: '^(exec|eval)$' } }
+constraints: { X: { not: { kind: string, not: { has: { kind: interpolation } } } } }
+message: '`$X` is run as code; use `ast.literal_eval` or a lookup table'
+```
+
+## How to fix
+
+1. For a literal (a number, a list, a dict), call `ast.literal_eval`.
+2. For a choice among behaviours, map the input to a function through a dict.
+3. For arithmetic or expressions, use a parser built for it, not the interpreter.
+
+## Examples
+
+### Python
+
+#### Don't
+
+```py
+result = eval(user_text)
+```
+
+#### Do
+
+```py
+import ast
+
+result = ast.literal_eval(user_text)
+```

codelaw_rules_security_python/rules/sec-py/no-format-string-injection.cases.md

@@ -0,0 +1,35 @@
+# sec-py/no-format-string-injection — cases
+
+### case: a request template
+
+```py
+def g(request):
+    return request.GET["t"].format(user)
+```
+
+```expect
+2:12 sec-py/no-format-string-injection
+```
+
+### case: a literal template
+
+```py
+def g(request):
+    return "Hello {}".format(request.GET["n"])
+```
+
+```expect
+(none)
+```
+
+### case: format_map
+
+```py
+def g(request):
+    t = request.args["t"]
+    return t.format_map(d)
+```
+
+```expect
+3:12 sec-py/no-format-string-injection
+```

codelaw_rules_security_python/rules/sec-py/no-format-string-injection.md

@@ -0,0 +1,44 @@
+---
+id: sec-py/no-format-string-injection
+title: 'A request value is not a format string'
+languages: [python]
+fix: manual
+fix_reason: "the template has to be a literal, which needs the format string moved out of the request"
+stability: preview
+security: { cwe: [134], owasp: ["A05:2025"], severity: high }
+since: 0.2.0
+---
+
+A value from the request is not the receiver of `.format`.
+
+**Why:** A field such as `{obj.__class__.__init__.__globals__[SECRET]}` reads attributes of the arguments, so the client reads secrets (CWE-134). This rule uses `from_source:`, which is not taint analysis: it sees a request value only in the function that reads it, never through a call or a parameter.
+
+```codelaw
+match:
+  any: [{ pattern: '$V.format($$$A)' }, { pattern: '$V.format_map($$$A)' }]
+where: { $V: { from_source: { tables: [sources/django, sources/flask, sources/fastapi] } } }
+message: '`$V` comes from the request and is used as a format string'
+```
+
+## How to fix
+
+1. Make the template a literal and pass the request value as an argument: `"Hello {}".format(name)`.
+2. For client-written templates use `string.Template(...).safe_substitute(...)`, which has no attribute access.
+
+## Examples
+
+### Python
+
+#### Don't
+
+```py
+def greet(request):
+    return request.GET["tpl"].format(user)
+```
+
+#### Do
+
+```py
+def greet(request):
+    return "Hello {}".format(request.GET["name"])
+```

codelaw_rules_security_python/rules/sec-py/no-hardcoded-crypto-key.cases.md

@@ -0,0 +1,51 @@
+# sec-py/no-hardcoded-crypto-key — cases
+
+### case: Fernet
+
+```py
+Fernet(b"abc")
+```
+
+```expect
+1:1 sec-py/no-hardcoded-crypto-key
+```
+
+### case: AES
+
+```py
+AES.new(b"0123456789abcdef", AES.MODE_GCM)
+```
+
+```expect
+1:1 sec-py/no-hardcoded-crypto-key
+```
+
+### case: a key from the environment
+
+```py
+Fernet(os.environ["K"])
+```
+
+```expect
+(none)
+```
+
+### case: a fixed IV
+
+```py
+Cipher(alg, modes.CBC(b"0000000000000000"))
+```
+
+```expect
+1:13 sec-py/no-hardcoded-crypto-key
+```
+
+### case: a keyword key
+
+```py
+sign(key="secret-key")
+```
+
+```expect
+1:1 sec-py/no-hardcoded-crypto-key
+```

codelaw_rules_security_python/rules/sec-py/no-hardcoded-crypto-key.md

@@ -0,0 +1,91 @@
+---
+id: sec-py/no-hardcoded-crypto-key
+title: 'No keys or IVs in the source'
+languages: [python]
+exclude: ["**/tests/**", "**/test/**", "**/test_*.py", "**/*_test.py", "**/*_tests.py", "**/tests.py", "**/conftest.py"]
+fix: manual
+fix_reason: "where the key comes from (a key store, an environment variable) is a deployment decision"
+stability: preview
+security: { cwe: [321, 329], owasp: ["A04:2025"], severity: high }
+since: 0.2.0
+---
+
+A cipher key, HMAC key, IV or nonce is not a literal.
+
+**Why:** A key in the source is known to everyone who can read the source, and a fixed IV or nonce breaks the cipher's guarantees (CWE-321, CWE-329).
+
+```codelaw
+match:
+  any:
+    - kind: call
+      all:
+        - has:
+            field: function
+            regex: '^((Crypto|Cryptodome)\.Cipher\.)?(AES|DES|DES3|ChaCha20|Blowfish|ARC4|Salsa20)\.new$|^(Fernet|hmac\.new|ChaCha20Poly1305|AESGCM|AESCCM)$'
+        - has:
+            field: arguments
+            has: { nthChild: 1, kind: string, not: { has: { kind: interpolation } } }
+    - kind: call
+      all:
+        - { has: { field: function, regex: '^(modes\.)?(CBC|CTR|GCM|CFB|OFB|CCM)$' } }
+        - has:
+            field: arguments
+            has: { nthChild: 1, kind: string, not: { has: { kind: interpolation } } }
+    - all:
+        - { kind: call }
+        - has:
+            field: arguments
+            has:
+              kind: keyword_argument
+              all:
+                - { has: { field: name, regex: '^iv$' } }
+                - { has: { field: value, kind: string, not: { has: { kind: interpolation } } } }
+    - all:
+        - { kind: call }
+        - has:
+            field: arguments
+            has:
+              kind: keyword_argument
+              all:
+                - { has: { field: name, regex: '^nonce$' } }
+                - { has: { field: value, kind: string, not: { has: { kind: interpolation } } } }
+    - all:
+        - { kind: call }
+        - has:
+            field: function
+            regex: '(?i)(cipher|crypt|aes|fernet|hmac|jwt|sign|cmac|pbkdf|scrypt)'
+        - has:
+            field: arguments
+            has:
+              kind: keyword_argument
+              all:
+                - { has: { field: name, regex: '^key$' } }
+                - { has: { field: value, kind: string, not: { has: { kind: interpolation } } } }
+message: 'A key, IV or nonce is a literal; load the key from a key store and make the IV random'
+```
+
+## How to fix
+
+1. Generate keys with `os.urandom` or the library (`Fernet.generate_key()`) once, and store them in a secret manager or an environment variable.
+2. Make a fresh random IV or nonce for every message (`os.urandom(12)`) and store it beside the ciphertext.
+
+## Examples
+
+### Python
+
+#### Don't
+
+```py
+from cryptography.fernet import Fernet
+
+f = Fernet(b"ZmFrZWtleWZha2VrZXlmYWtla2V5ZmFrZWtleTA9")
+```
+
+#### Do
+
+```py
+import os
+from cryptography.fernet import Fernet
+
+f = Fernet(os.environ["FERNET_KEY"])
+```

codelaw_rules_security_python/rules/sec-py/no-hardcoded-secret.cases.md

@@ -0,0 +1,61 @@
+# sec-py/no-hardcoded-secret — cases
+
+### case: a password assignment
+
+```py
+password = "s3cr3tvalue"
+```
+
+```expect
+1:1 sec-py/no-hardcoded-secret
+```
+
+### case: a keyword argument
+
+```py
+connect(host, password="s3cr3tvalue")
+```
+
+```expect
+1:15 sec-py/no-hardcoded-secret
+```
+
+### case: a placeholder is short
+
+```py
+password = ""
+```
+
+```expect
+(none)
+```
+
+### case: an environment read
+
+```py
+password = os.environ["PASSWORD"]
+```
+
+```expect
+(none)
+```
+
+### case: an AWS key
+
+```py
+key = "AKIAIOSFODNN7EXAMPLE"
+```
+
+```expect
+1:7 sec-py/no-hardcoded-secret
+```
+
+### case: a name that is not a secret
+
+```py
+title = "A long title string"
+```
+
+```expect
+(none)
+```

codelaw_rules_security_python/rules/sec-py/no-hardcoded-secret.md

@@ -0,0 +1,82 @@
+---
+id: sec-py/no-hardcoded-secret
+title: 'No secrets in the source'
+languages: [python]
+exclude: ["**/tests/**", "**/test/**", "**/test_*.py", "**/*_test.py", "**/*_tests.py", "**/tests.py", "**/conftest.py"]
+fix: manual
+fix_reason: "where the secret lives instead (environment, secret manager) is a decision, and the leaked one must be rotated"
+stability: preview
+ported_from: [bandit/B105, bandit/B106, bandit/B107, ruff/S105, ruff/S106, ruff/S107]
+security: { cwe: [798], owasp: ["A07:2025"], severity: high }
+since: 0.2.0
+---
+
+A password, key or token is not a string literal in the code, and a cloud access key is not pasted into it.
+
+**Why:** The source goes to every clone, build log and backup, so the secret does too, and revoking it means a release (CWE-798).
+
+```codelaw
+match:
+  any:
+    - all:
+        - { kind: assignment }
+        - has:
+            field: left
+            regex: '(?i)^_*[a-z0-9_]*(pass(word|wd)?|secret|api_?key|private_?key|token|credentials?|auth_?key|access_?key)[a-z0-9_]*$'
+            not:
+              regex: '(?i)(_type|_url|_uri|_path|_file|_header|_name|_field|_class|_backend|_func|_label|_prefix)$'
+        - has:
+            field: right
+            kind: string
+            regex: '^[rb]?("[^"]{4,}"|''[^'']{4,}'')$'
+            not:
+              any:
+                - { has: { kind: interpolation } }
+                - { regex: '^[rb]?[''"][*x#.\-]+[''"]$' }
+                - { regex: '^[rb]?[''"][A-Za-z_][A-Za-z0-9_]*(\.[A-Za-z_][A-Za-z0-9_]*)+[''"]$' }
+    - all:
+        - { kind: keyword_argument }
+        - has:
+            field: name
+            regex: '(?i)^_*[a-z0-9_]*(pass(word|wd)?|secret|api_?key|private_?key|token|credentials?|auth_?key|access_?key)[a-z0-9_]*$'
+            not:
+              regex: '(?i)(_type|_url|_uri|_path|_file|_header|_name|_field|_class|_backend|_func|_label|_prefix)$'
+        - has:
+            field: value
+            kind: string
+            regex: '^[rb]?("[^"]{4,}"|''[^'']{4,}'')$'
+            not:
+              any:
+                - { has: { kind: interpolation } }
+                - { regex: '^[rb]?[''"][*x#.\-]+[''"]$' }
+                - { regex: '^[rb]?[''"][A-Za-z_][A-Za-z0-9_]*(\.[A-Za-z_][A-Za-z0-9_]*)+[''"]$' }
+    - { kind: string, regex: '^[''"](AKIA|ASIA)[0-9A-Z]{16}[''"]$' }
+    - { kind: string, regex: '^[''"](ghp|gho|ghs|ghu)_[A-Za-z0-9]{36,}[''"]$' }
+    - { kind: string, regex: '^[''"]xox[abprs]-[A-Za-z0-9-]{10,}[''"]$' }
+    - { kind: string, regex: '^[''"]sk_live_[A-Za-z0-9]{16,}[''"]$' }
+message: 'A secret is written in the source; read it from the environment or a secret manager'
+```
+
+## How to fix
+
+1. Rotate the secret: it is in version control now.
+2. Read it at start-up: `os.environ["DB_PASSWORD"]`, or from your secret manager.
+3. Keep local values in an untracked `.env` file.
+
+## Examples
+
+### Python
+
+#### Don't
+
+```py
+DB_PASSWORD = "hunter2-prod"
+```
+
+#### Do
+
+```py
+import os
+
+DB_PASSWORD = os.environ["DB_PASSWORD"]
+```

codelaw_rules_security_python/rules/sec-py/no-header-injection.cases.md

@@ -0,0 +1,45 @@
+# sec-py/no-header-injection — cases
+
+### case: a request value
+
+```py
+def v(request):
+    resp.headers["X-A"] = request.args["a"]
+```
+
+```expect
+2:5 sec-py/no-header-injection
+```
+
+### case: a constant
+
+```py
+def v(request):
+    resp.headers["X-A"] = "1"
+```
+
+```expect
+(none)
+```
+
+### case: Django
+
+```py
+def v(request):
+    response["X-A"] = request.GET["a"]
+```
+
+```expect
+2:5 sec-py/no-header-injection
+```
+
+### case: a dict is not matched
+
+```py
+def v(request):
+    d["x"] = request.GET["a"]
+```
+
+```expect
+(none)
+```

codelaw_rules_security_python/rules/sec-py/no-header-injection.md

@@ -0,0 +1,55 @@
+---
+id: sec-py/no-header-injection
+title: 'A request value is not a response header'
+languages: [python]
+fix: manual
+fix_reason: "whether to reject, strip or encode the value depends on what the header is for"
+stability: preview
+security: { cwe: [113], owasp: ["A05:2025"], severity: medium }
+since: 0.2.0
+---
+
+A value from the request is not written into a response header or a cookie value without its line breaks removed.
+
+**Why:** A CR or LF in the value ends the header and starts a new one, so an attacker can add headers or a second response (CWE-113). This rule uses `from_source:`, which is not taint analysis: it sees a request value only in the function that reads it, never through a call or a parameter.
+
+```codelaw
+match:
+  any:
+    - { pattern: '$R.headers[$K] = $V' }
+    - { pattern: '$R.headers.add($K, $V)' }
+    - { pattern: '$R.headers.set($K, $V)' }
+    - { pattern: '$R[$K] = $V' }
+    - { pattern: '$R.set_cookie($K, $V)' }
+constraints: { R: { regex: '^(resp|response|res|r|rv|rsp|self\.response|make_response\(.*\))$' } }
+where: { $V: { from_source: { tables: [sources/django, sources/flask, sources/fastapi] } } }
+message: '`$V` comes from the request and is written into a header'
+```
+
+## How to fix
+
+1. Reject a value that contains `\r` or `\n`: `if "\n" in value or "\r" in value: abort(400)`.
+2. Or percent-encode it: `urllib.parse.quote(value)`.
+3. Modern servers and frameworks refuse newlines in headers; do not rely on that.
+
+## Examples
+
+### Python
+
+#### Don't
+
+```py
+def view(request):
+    resp = make_response("ok")
+    resp.headers["X-Name"] = request.args["name"]
+    return resp
+```
+
+#### Do
+
+```py
+def view(request):
+    resp = make_response("ok")
+    resp.headers["X-Name"] = quote(request.args["name"])
+    return resp
+```

codelaw_rules_security_python/rules/sec-py/no-insecure-protocol.cases.md

@@ -0,0 +1,41 @@
+# sec-py/no-insecure-protocol — cases
+
+### case: an import
+
+```py
+import telnetlib
+```
+
+```expect
+1:1 sec-py/no-insecure-protocol
+```
+
+### case: a from import
+
+```py
+from ftplib import FTP
+```
+
+```expect
+1:1 sec-py/no-insecure-protocol
+```
+
+### case: SNMP
+
+```py
+CommunityData("public")
+```
+
+```expect
+1:1 sec-py/no-insecure-protocol
+```
+
+### case: ssh
+
+```py
+import paramiko
+```
+
+```expect
+(none)
+```

codelaw_rules_security_python/rules/sec-py/no-insecure-protocol.md

@@ -0,0 +1,52 @@
+---
+id: sec-py/no-insecure-protocol
+title: 'No Telnet, FTP or SNMP v1/v2'
+languages: [python]
+fix: manual
+fix_reason: "the replacement (SSH or SFTP, FTPS, SNMPv3) needs the server to support it"
+stability: preview
+ported_from: [bandit/B312, bandit/B321, bandit/B401, bandit/B402, bandit/B508, bandit/B509, ruff/S401, ruff/S402, ruff/S312, ruff/S321, ruff/S508, ruff/S509]
+security: { cwe: [319], owasp: ["A04:2025"], severity: high }
+since: 0.2.0
+---
+
+`telnetlib`, `ftplib` and SNMP community strings (v1/v2c) are not used.
+
+**Why:** These send credentials and data in clear text, so anyone on the path reads and changes them (CWE-319).
+
+```codelaw
+match:
+  any:
+    - all: [{ kind: import_statement }, { has: { field: name, regex: '^(telnetlib|ftplib)$' } }]
+    - all:
+        - { kind: import_from_statement }
+        - { has: { field: module_name, regex: '^(telnetlib|ftplib)$' } }
+    - kind: call
+      all: [{ has: { field: function, regex: '^(pysnmp\.hlapi\.)?CommunityData$' } }]
+message: 'This protocol sends credentials in clear text'
+```
+
+## How to fix
+
+1. Use SSH or SFTP (`paramiko`, `asyncssh`) instead of Telnet and FTP, or `ftplib.FTP_TLS` for FTPS.
+2. Use SNMPv3 (`UsmUserData` with authentication and privacy) instead of a community string.
+
+## Examples
+
+### Python
+
+#### Don't
+
+```py
+import ftplib
+
+ftp = ftplib.FTP(host)
+```
+
+#### Do
+
+```py
+import paramiko
+
+client = paramiko.SSHClient()
+```