codelaw-rules-security-python 0.3.0__py3-none-any.whl

codelaw_rules_security_python/rules/sec-py/no-insecure-random.cases.md

@@ -0,0 +1,41 @@
+# sec-py/no-insecure-random — cases
+
+### case: a token
+
+```py
+session_token = random.randint(0, 10**9)
+```
+
+```expect
+1:1 sec-py/no-insecure-random
+```
+
+### case: a password
+
+```py
+password = random.choice(chars)
+```
+
+```expect
+1:1 sec-py/no-insecure-random
+```
+
+### case: a dice roll
+
+```py
+roll = random.randint(1, 6)
+```
+
+```expect
+(none)
+```
+
+### case: secrets
+
+```py
+token = secrets.token_hex(16)
+```
+
+```expect
+(none)
+```

codelaw_rules_security_python/rules/sec-py/no-insecure-random.md

@@ -0,0 +1,67 @@
+---
+id: sec-py/no-insecure-random
+title: "`secrets` for tokens, not `random`"
+languages: [python]
+fix: suggest
+fix_reason: "`secrets` has different functions (`token_hex`, `choice`, `randbelow`), so the call has to be chosen, not renamed"
+stability: preview
+ported_from: [bandit/B311, ruff/S311]
+security: { cwe: [338], owasp: ["A04:2025"], severity: high }
+since: 0.2.0
+---
+
+A password, token, key, nonce or code is not made with the `random` module.
+
+**Why:** `random` is a predictable generator, so a few outputs reveal the rest (CWE-338).
+
+```codelaw
+match:
+  all:
+    - { kind: assignment }
+    - has:
+        field: left
+        regex: '(?i)(pass(word|wd)?|secret|token|api_?key|auth|otp|nonce|salt|session_?id|csrf|reset_?code|verification_?code)'
+    - has:
+        field: right
+        kind: call
+        pattern: $R
+        has:
+          field: function
+          regex: '^(random\.)?(random|randint|randrange|choice|choices|getrandbits|sample|randbytes|uniform)$'
+message: 'This secret comes from `random`; use `secrets`'
+fix:
+  - { replace: { target: $R, with: 'secrets.token_hex(16)' } }
+```
+
+## How to fix
+
+1. Use `secrets.token_urlsafe(32)` or `secrets.token_hex(16)` for a token.
+2. Use `secrets.choice` for a character picked from an alphabet, `secrets.randbelow(n)` for a number.
+
+## Examples
+
+### Python
+
+#### Don't
+
+```py
+import random
+
+reset_token = random.getrandbits(64)
+```
+
+#### Do
+
+```py
+import secrets
+
+reset_token = secrets.token_hex(16)
+```
+
+#### Fixed
+
+```py
+import random
+
+reset_token = secrets.token_hex(16)
+```

codelaw_rules_security_python/rules/sec-py/no-insecure-tempfile.cases.md

@@ -0,0 +1,41 @@
+# sec-py/no-insecure-tempfile — cases
+
+### case: mktemp
+
+```py
+tempfile.mktemp(suffix=".txt")
+```
+
+```expect
+1:1 sec-py/no-insecure-tempfile
+```
+
+### case: a fixed /tmp path
+
+```py
+open("/tmp/report.txt", "w")
+```
+
+```expect
+1:6 sec-py/no-insecure-tempfile
+```
+
+### case: mkstemp
+
+```py
+tempfile.mkstemp()
+```
+
+```expect
+(none)
+```
+
+### case: a path outside /tmp
+
+```py
+open("/var/data/report.txt", "w")
+```
+
+```expect
+(none)
+```

codelaw_rules_security_python/rules/sec-py/no-insecure-tempfile.md

@@ -0,0 +1,62 @@
+---
+id: sec-py/no-insecure-tempfile
+title: "`mkstemp` instead of `mktemp`"
+languages: [python]
+fix: suggest
+fix_reason: "`mkstemp` returns an open file descriptor and a path, not just a name, so the surrounding code changes"
+stability: preview
+ported_from: [bandit/B306, bandit/B108, bandit/B325, ruff/S306, ruff/S108]
+security: { cwe: [377], owasp: ["A01:2025"], severity: medium }
+since: 0.2.0
+---
+
+Temporary files are made with `tempfile.mkstemp`, `NamedTemporaryFile` or `TemporaryDirectory`, not `mktemp`, and not at a fixed path under `/tmp`.
+
+**Why:** `mktemp` returns a name without creating the file, so another user can create it first and the program then writes into a file they control (CWE-377).
+
+```codelaw
+match:
+  any:
+    - { pattern: 'tempfile.mktemp($$$A)' }
+    - { pattern: 'os.tempnam($$$A)' }
+    - { pattern: 'os.tmpnam()' }
+    - kind: string
+      regex: '^[''"]/(var/)?tmp/[^''"{}]*[''"]$'
+      inside: { kind: call, stopBy: end }
+message: 'A predictable temporary file name; use `tempfile.mkstemp` or `NamedTemporaryFile`'
+fix: 'tempfile.mkstemp($$$A)[1]'
+```
+
+## How to fix
+
+1. Use `with tempfile.NamedTemporaryFile(delete=False) as f:` and write through `f`.
+2. Use `tempfile.mkdtemp()` or `TemporaryDirectory()` for a directory.
+3. Never build a path under `/tmp` by hand.
+
+## Examples
+
+### Python
+
+#### Don't
+
+```py
+import tempfile
+
+path = tempfile.mktemp()
+```
+
+#### Do
+
+```py
+import tempfile
+
+path = tempfile.mkstemp()[1]
+```
+
+#### Fixed
+
+```py
+import tempfile
+
+path = tempfile.mkstemp()[1]
+```

codelaw_rules_security_python/rules/sec-py/no-ldap-injection.cases.md

@@ -0,0 +1,41 @@
+# sec-py/no-ldap-injection — cases
+
+### case: an f-string filter
+
+```py
+conn.search_s(base, 2, f"(uid={name})")
+```
+
+```expect
+1:1 sec-py/no-ldap-injection
+```
+
+### case: ldap3
+
+```py
+conn.search(base, "(cn=" + name + ")")
+```
+
+```expect
+1:1 sec-py/no-ldap-injection
+```
+
+### case: a fixed filter
+
+```py
+conn.search(base, "(objectClass=*)")
+```
+
+```expect
+(none)
+```
+
+### case: a re.search is not matched
+
+```py
+re.search("a", text)
+```
+
+```expect
+(none)
+```

codelaw_rules_security_python/rules/sec-py/no-ldap-injection.md

@@ -0,0 +1,51 @@
+---
+id: sec-py/no-ldap-injection
+title: 'LDAP filters are not built from strings'
+languages: [python]
+fix: manual
+fix_reason: "the escaping function belongs to the LDAP library in use"
+stability: preview
+security: { cwe: [90], owasp: ["A05:2025"], severity: high }
+since: 0.2.0
+---
+
+An LDAP search filter is not made with an f-string, `%`, `+` or `.format`.
+
+**Why:** A value with `*`, `)` or `(` in it changes which entries the filter matches, which can turn a login check into a match-all (CWE-90).
+
+```codelaw
+match:
+  kind: call
+  all:
+    - has: { field: function, regex: '\.(search|search_s|search_st|search_ext|search_ext_s)$' }
+    - has:
+        field: arguments
+        has:
+          regex: '\(.*='
+          any:
+            - { kind: string, has: { kind: interpolation } }
+            - { kind: binary_operator, has: { field: operator, regex: '^(%|\+)$' } }
+            - { kind: call, has: { field: function, regex: '\.format$' } }
+message: 'This LDAP filter is built from a string; escape the values'
+```
+
+## How to fix
+
+1. Escape each value: `ldap3.utils.conv.escape_filter_chars(value)` or `ldap.filter.escape_filter_chars(value)`.
+2. Or build the filter with `ldap.filter.filter_format("(uid=%s)", [value])`.
+
+## Examples
+
+### Python
+
+#### Don't
+
+```py
+conn.search_s(base, ldap.SCOPE_SUBTREE, f"(uid={name})")
+```
+
+#### Do
+
+```py
+conn.search_s(base, ldap.SCOPE_SUBTREE, filter_format("(uid=%s)", [name]))
+```

codelaw_rules_security_python/rules/sec-py/no-llm-output-to-sink.cases.md

@@ -0,0 +1,31 @@
+# sec-py/no-llm-output-to-sink — cases
+
+### case: exec of a completion
+
+```py
+exec(completion.choices[0].message.content)
+```
+
+```expect
+1:1 sec-py/no-llm-output-to-sink
+```
+
+### case: a subprocess
+
+```py
+subprocess.run(llm_output, shell=True)
+```
+
+```expect
+1:1 sec-py/no-llm-output-to-sink
+```
+
+### case: a lookup
+
+```py
+ACTIONS[reply]()
+```
+
+```expect
+(none)
+```

codelaw_rules_security_python/rules/sec-py/no-llm-output-to-sink.md

@@ -0,0 +1,55 @@
+---
+id: sec-py/no-llm-output-to-sink
+title: 'Model output is not run or rendered'
+languages: [python]
+severity: warn
+fix: manual
+fix_reason: "what to do with the output instead (parse it against a schema, pick from a fixed list of actions) is a design choice"
+stability: preview
+security: { cwe: [94], owasp: ["A05:2025"], severity: high }
+since: 0.2.0
+---
+
+The reply of an OpenAI, Anthropic or LangChain call does not reach `exec`, `eval`, a subprocess, SQL or `mark_safe`.
+
+**Why:** A model's output is shaped by its input, so a prompt written by an attacker becomes code, a command, a query or a script (CWE-94).
+
+```codelaw
+match:
+  all:
+    - { kind: call }
+    - has:
+        field: function
+        regex: '^(exec|eval|os\.system|os\.popen|subprocess\.(run|call|check_call|check_output|Popen)|mark_safe|Markup|(.*\.)?(execute|executescript))$'
+    - has:
+        field: arguments
+        has:
+          regex: '(?i)(\.choices\[0\]\.message\.content|\.content\[0\]\.text|\.content\b|\.text\b|llm_output|completion|model_output|llm_response|ai_response)'
+message: 'The output of a language model reaches a code, command, query or HTML sink'
+```
+
+## How to fix
+
+1. Ask the model for structured output and validate it against a schema.
+2. Map the answer to a fixed list of actions the program already has; never pass it to a sink as text.
+3. Escape it before it goes into HTML; use parameters for SQL.
+
+## Examples
+
+### Python
+
+#### Don't
+
+```py
+reply = client.chat.completions.create(model=m, messages=msgs)
+exec(reply.choices[0].message.content)
+```
+
+#### Do
+
+```py
+reply = client.chat.completions.create(model=m, messages=msgs)
+action = reply.choices[0].message.content.strip()
+if action in ACTIONS:
+    ACTIONS[action]()
+```

codelaw_rules_security_python/rules/sec-py/no-log-injection.cases.md

@@ -0,0 +1,45 @@
+# sec-py/no-log-injection — cases
+
+### case: a request value
+
+```py
+def v(request):
+    logger.info("login %s", request.POST["u"])
+```
+
+```expect
+2:5 sec-py/no-log-injection
+```
+
+### case: a message only
+
+```py
+def v(request):
+    logger.warning(request.GET["u"])
+```
+
+```expect
+2:5 sec-py/no-log-injection
+```
+
+### case: a constant
+
+```py
+def v(request):
+    logger.info("login %s", "x")
+```
+
+```expect
+(none)
+```
+
+### case: not a logger
+
+```py
+def v(request):
+    other.info("login %s", request.POST["u"])
+```
+
+```expect
+(none)
+```

codelaw_rules_security_python/rules/sec-py/no-log-injection.md

@@ -0,0 +1,52 @@
+---
+id: sec-py/no-log-injection
+title: 'A request value is not logged raw'
+languages: [python]
+severity: warn
+fix: manual
+fix_reason: "whether to strip, escape or reject the value depends on how the log is read"
+stability: preview
+security: { cwe: [117], owasp: ["A09:2025"], severity: low }
+since: 0.2.0
+---
+
+A value from the request is not passed to a logger without its line breaks removed.
+
+**Why:** A CR or LF in the value writes a line that looks like another log entry, so an attacker can forge audit records (CWE-117). This rule uses `from_source:`, which is not taint analysis: it sees a request value only in the function that reads it, never through a call or a parameter.
+
+```codelaw
+match: { any: [{ pattern: '$L($V)' }, { pattern: '$L($A, $V)' }] }
+constraints:
+  L:
+    regex: '^(logger|logging|log|self\.logger|self\.log|app\.logger|_logger|_log)\.(debug|info|warning|warn|error|exception|critical|log)$'
+  A: { regex: '^[rbf]?[''\"]' }
+where: { $V: { from_source: { tables: [sources/django, sources/flask, sources/fastapi] } } }
+message: '`$V` comes from the request and is logged as it is'
+```
+
+## How to fix
+
+1. Pass the value through a helper that strips the line breaks, such as `clean(value)` with `text.replace("\r", "").replace("\n", " ")`; a method called on the request value itself is still seen as the request value.
+2. Or log it as structured data (`extra={"name": value}`) and use a JSON formatter that escapes it.
+
+## Examples
+
+### Python
+
+#### Don't
+
+```py
+def view(request):
+    logger.info("login %s", request.POST["user"])
+```
+
+#### Do
+
+```py
+def clean(text):
+    return text.replace("\r", "").replace("\n", " ")
+
+
+def view(request):
+    logger.info("login %s", clean(request.POST["user"]))
+```

codelaw_rules_security_python/rules/sec-py/no-mako.cases.md

@@ -0,0 +1,37 @@
+# sec-py/no-mako — cases
+
+### case: Template
+
+```py
+from mako.template import Template
+
+Template(src)
+```
+
+```expect
+3:1 sec-py/no-mako
+```
+
+### case: qualified
+
+```py
+import mako.template
+
+mako.template.Template(src)
+```
+
+```expect
+3:1 sec-py/no-mako
+```
+
+### case: jinja Template
+
+```py
+from jinja2 import Template
+
+Template(src)
+```
+
+```expect
+(none)
+```

codelaw_rules_security_python/rules/sec-py/no-mako.md

@@ -0,0 +1,52 @@
+---
+id: sec-py/no-mako
+title: 'No Mako templates'
+languages: [python]
+fix: manual
+fix_reason: "moving to another engine (or turning on `default_filters`) changes every template"
+stability: preview
+ported_from: [bandit/B702, ruff/S702]
+security: { cwe: [79], owasp: ["A05:2025"], severity: medium }
+since: 0.2.0
+---
+
+`mako.template.Template` is not used.
+
+**Why:** Mako does not escape output unless told to, so every `${value}` is a script waiting for a hostile value (CWE-79).
+
+```codelaw
+match: { any: [{ pattern: '$T($$$A)' }] }
+constraints: { T: { regex: '^(Template|[A-Za-z_]+\.Template|mako\.template\.Template)$' } }
+where:
+  $T:
+    any:
+      - { imported-from: { module: mako.template, name: Template } }
+      - { imported-from: mako.template }
+      - { imported-from: { module: mako, name: template } }
+message: 'Mako does not escape by default; use Jinja2 with autoescape, or set `default_filters=[''h'']`'
+```
+
+## How to fix
+
+1. Use Jinja2 with `autoescape=True`.
+2. If you keep Mako, pass `default_filters=["h"]` to `Template` / `TemplateLookup`, and review each `|n`.
+
+## Examples
+
+### Python
+
+#### Don't
+
+```py
+from mako.template import Template
+
+t = Template(source)
+```
+
+#### Do
+
+```py
+from jinja2 import Environment
+
+env = Environment(autoescape=True)
+```

codelaw_rules_security_python/rules/sec-py/no-mark-safe.cases.md

@@ -0,0 +1,51 @@
+# sec-py/no-mark-safe — cases
+
+### case: a concatenation
+
+```py
+mark_safe("<b>" + name + "</b>")
+```
+
+```expect
+1:1 sec-py/no-mark-safe
+```
+
+### case: an f-string
+
+```py
+mark_safe(f"<b>{name}</b>")
+```
+
+```expect
+1:1 sec-py/no-mark-safe
+```
+
+### case: a literal
+
+```py
+mark_safe("<br>")
+```
+
+```expect
+(none)
+```
+
+### case: Markup
+
+```py
+Markup(user_text)
+```
+
+```expect
+1:1 sec-py/no-mark-safe
+```
+
+### case: format_html
+
+```py
+format_html("<b>{}</b>", name)
+```
+
+```expect
+(none)
+```

codelaw_rules_security_python/rules/sec-py/no-mark-safe.md

@@ -0,0 +1,54 @@
+---
+id: sec-py/no-mark-safe
+title: 'No `mark_safe` of dynamic text'
+languages: [python]
+fix: manual
+fix_reason: "the right fix is escaping the parts (`format_html`, `escape`) or rendering through a template, not removing the call"
+stability: preview
+ported_from: [bandit/B308, bandit/B703, bandit/B704, ruff/S308, ruff/S703, ruff/S704]
+security: { cwe: [79], owasp: ["A05:2025"], severity: high }
+since: 0.2.0
+---
+
+`mark_safe`, `SafeString`, `Markup` and `format_html` are not given a value that is not a literal.
+
+**Why:** They switch HTML escaping off for that value, so any part of it that came from a user is a script (CWE-79).
+
+```codelaw
+match:
+  all:
+    - { kind: call }
+    - has:
+        field: function
+        regex: '^((.*\.)?(mark_safe|SafeString|SafeText|SafeData)|(markupsafe\.)?Markup)$'
+    - has:
+        field: arguments
+        has: { nthChild: 1, not: { kind: string, not: { has: { kind: interpolation } } }, pattern: $X }
+message: '`$X` is marked safe, so it is not escaped; escape the parts with `format_html` or `escape`'
+```
+
+## How to fix
+
+1. Build HTML with `format_html("<b>{}</b>", value)`: it escapes `value` and trusts only the literal.
+2. Or render a template with autoescape on.
+3. Use `mark_safe` only on a literal, or on text you produced by escaping.
+
+## Examples
+
+### Python
+
+#### Don't
+
+```py
+from django.utils.safestring import mark_safe
+
+html = mark_safe("<b>" + name + "</b>")
+```
+
+#### Do
+
+```py
+from django.utils.html import format_html
+
+html = format_html("<b>{}</b>", name)
+```