codelaw-rules-security-python 0.3.0__py3-none-any.whl

codelaw_rules_security_python/rules/sec-py/no-mass-assignment.cases.md

@@ -0,0 +1,55 @@
+# sec-py/no-mass-assignment — cases
+
+### case: a splat
+
+```py
+def v(request):
+    return Post.objects.create(**request.POST)
+```
+
+```expect
+2:12 sec-py/no-mass-assignment
+```
+
+### case: a constructor
+
+```py
+def v(request):
+    return Post(**request.data)
+```
+
+```expect
+2:12 sec-py/no-mass-assignment
+```
+
+### case: __all__
+
+```py
+class Meta:
+    fields = "__all__"
+```
+
+```expect
+2:5 sec-py/no-mass-assignment
+```
+
+### case: a list
+
+```py
+class Meta:
+    fields = ["title"]
+```
+
+```expect
+(none)
+```
+
+### case: a plain splat
+
+```py
+Post.objects.create(**defaults)
+```
+
+```expect
+(none)
+```

codelaw_rules_security_python/rules/sec-py/no-mass-assignment.md

@@ -0,0 +1,58 @@
+---
+id: sec-py/no-mass-assignment
+title: 'A request is not splatted into a model'
+languages: [python]
+fix: manual
+fix_reason: "which fields a client may set is the author's decision"
+stability: preview
+security: { cwe: [915], owasp: ["A01:2025"], severity: high }
+since: 0.2.0
+---
+
+`Model(**request.POST)`, `Model.objects.create(**request.data)` and `update(**request.json)` are not used, and a `ModelForm` or serializer does not set `fields = "__all__"`.
+
+**Why:** The client chooses which columns are set, so it can set `is_staff`, `owner_id` or a price (CWE-915).
+
+```codelaw
+match:
+  any:
+    - all:
+        - { kind: call }
+        - has:
+            field: function
+            regex: '\.(create|update|get_or_create|update_or_create|bulk_create)$|^[A-Z][A-Za-z0-9_]*$'
+        - has:
+            field: arguments
+            has:
+              kind: dictionary_splat
+              regex: '^\*\*\s*(self\.)?request\.(POST|GET|data|json|form|args|values|query_params)\b'
+    - all:
+        - { kind: assignment }
+        - { has: { field: left, regex: '^fields$' } }
+        - { has: { field: right, regex: '^[''"]__all__[''"]$' } }
+message: 'The client chooses which fields are set; list the fields'
+```
+
+## How to fix
+
+1. List the allowed fields: `fields = ["title", "body"]`.
+2. Build the model from named values: `Post.objects.create(title=data["title"], owner=request.user)`.
+3. Mark server-only fields `read_only_fields`.
+
+## Examples
+
+### Python
+
+#### Don't
+
+```py
+def create(request):
+    return Post.objects.create(**request.POST)
+```
+
+#### Do
+
+```py
+def create(request):
+    return Post.objects.create(title=request.POST["title"], owner=request.user)
+```

codelaw_rules_security_python/rules/sec-py/no-nosql-injection.cases.md

@@ -0,0 +1,34 @@
+# sec-py/no-nosql-injection — cases
+
+### case: a body used whole
+
+```py
+def f(request):
+    return db.users.find(request.json)
+```
+
+```expect
+2:12 sec-py/no-nosql-injection
+```
+
+### case: a built filter
+
+```py
+def f(request):
+    return db.users.find({"name": str(request.json["name"])})
+```
+
+```expect
+(none)
+```
+
+### case: $where
+
+```py
+def f(request):
+    q = {"$where": f"this.a == {request.args['a']}"}
+```
+
+```expect
+2:10 sec-py/no-nosql-injection
+```

codelaw_rules_security_python/rules/sec-py/no-nosql-injection.md

@@ -0,0 +1,56 @@
+---
+id: sec-py/no-nosql-injection
+title: 'A request is not a MongoDB query'
+languages: [python]
+fix: manual
+fix_reason: "which fields the client may filter on, and their types, are the author's decision"
+stability: preview
+security: { cwe: [943], owasp: ["A05:2025"], severity: high }
+since: 0.2.0
+---
+
+A value from the request is not used whole as a `pymongo` filter, and a `$where` expression is not built from a request value.
+
+**Why:** A JSON body such as `{"$ne": null}` or `{"$gt": ""}` in a query field matches every document, and `$where` runs JavaScript (CWE-943). This rule uses `from_source:`, which is not taint analysis: it sees a request value only in the function that reads it, never through a call or a parameter.
+
+```codelaw
+match:
+  any:
+    - all:
+        - { kind: call }
+        - has:
+            field: function
+            regex: '\.(find|find_one|find_one_and_update|find_one_and_delete|find_one_and_replace|update_one|update_many|delete_one|delete_many|count_documents|replace_one)$'
+        - { has: { field: arguments, has: { nthChild: 1, pattern: $Q } } }
+    - all:
+        - { kind: pair }
+        - { has: { field: key, regex: '^[''"]\$where[''"]$' } }
+        - { has: { field: value, pattern: $Q } }
+where: { $Q: { from_source: { tables: [sources/django, sources/flask, sources/fastapi] } } }
+message: '`$Q` comes from the request and is used as a MongoDB query'
+```
+
+## How to fix
+
+1. Build the filter yourself from named fields: `{"name": str(request.json["name"])}`; `str()` stops an operator object from getting through.
+2. Validate the body against a schema (pydantic, marshmallow) before it reaches the query.
+3. Do not use `$where`; express the condition with query operators.
+
+## Examples
+
+### Python
+
+#### Don't
+
+```py
+def find(request):
+    return db.users.find_one(request.json)
+```
+
+#### Do
+
+```py
+def find(request):
+    name = str(request.json["name"])
+    return db.users.find_one({"name": name})
+```

codelaw_rules_security_python/rules/sec-py/no-open-redirect.cases.md

@@ -0,0 +1,35 @@
+# sec-py/no-open-redirect — cases
+
+### case: a bound request value
+
+```py
+def v(request):
+    n = request.args.get("next")
+    return redirect(n)
+```
+
+```expect
+3:12 sec-py/no-open-redirect
+```
+
+### case: Django
+
+```py
+def v(request):
+    return HttpResponseRedirect(request.GET["next"])
+```
+
+```expect
+2:12 sec-py/no-open-redirect
+```
+
+### case: a route
+
+```py
+def v(request):
+    return redirect("/home")
+```
+
+```expect
+(none)
+```

codelaw_rules_security_python/rules/sec-py/no-open-redirect.md

@@ -0,0 +1,51 @@
+---
+id: sec-py/no-open-redirect
+title: 'A request value is not a redirect target'
+languages: [python]
+fix: manual
+fix_reason: "the allowed destinations depend on the application"
+stability: preview
+security: { cwe: [601], owasp: ["A01:2025"], severity: medium }
+since: 0.2.0
+---
+
+A value from the request is not passed to `redirect`, `HttpResponseRedirect` or `RedirectResponse`.
+
+**Why:** A link on another site can send your users to a look-alike page that starts from yours (CWE-601). This rule uses `from_source:`, which is not taint analysis: it sees a request value only in the function that reads it, never through a call or a parameter.
+
+```codelaw
+match:
+  all:
+    - { kind: call }
+    - has:
+        field: function
+        regex: '^(redirect|(.*\.)?(HttpResponseRedirect|HttpResponsePermanentRedirect|RedirectResponse))$'
+    - { has: { field: arguments, has: { nthChild: 1, pattern: $U } } }
+where: { $U: { from_source: { tables: [sources/django, sources/flask, sources/fastapi] } } }
+message: '`$U` comes from the request and is a redirect target'
+```
+
+## How to fix
+
+1. Redirect to a named route (`redirect(url_for("home"))`) and take only an id from the client.
+2. Or check the target: Django `url_has_allowed_host_and_scheme(url, allowed_hosts={request.get_host()})`; elsewhere require a path that starts with a single `/`.
+
+## Examples
+
+### Python
+
+#### Don't
+
+```py
+def login(request):
+    nxt = request.args.get("next")
+    return redirect(nxt)
+```
+
+#### Do
+
+```py
+def login(request):
+    target = SAFE_TARGETS.get(request.args.get("next"), "/")
+    return redirect(target)
+```

codelaw_rules_security_python/rules/sec-py/no-partial-path.cases.md

@@ -0,0 +1,41 @@
+# sec-py/no-partial-path — cases
+
+### case: a bare list
+
+```py
+subprocess.run(["git", "status"])
+```
+
+```expect
+1:1 sec-py/no-partial-path
+```
+
+### case: a bare string
+
+```py
+subprocess.run("git status", shell=True)
+```
+
+```expect
+1:1 sec-py/no-partial-path
+```
+
+### case: a full path
+
+```py
+subprocess.run(["/usr/bin/git", "status"])
+```
+
+```expect
+(none)
+```
+
+### case: a variable
+
+```py
+subprocess.run([GIT, "status"])
+```
+
+```expect
+(none)
+```

codelaw_rules_security_python/rules/sec-py/no-partial-path.md

@@ -0,0 +1,61 @@
+---
+id: sec-py/no-partial-path
+title: 'A program is started by its full path'
+languages: [python]
+severity: warn
+fix: manual
+fix_reason: "the absolute path differs by system, so it has to come from configuration or `shutil.which` at start-up"
+stability: preview
+ported_from: [bandit/B607, ruff/S607]
+security: { cwe: [426], owasp: ["A08:2025"], severity: low }
+since: 0.2.0
+---
+
+A subprocess is not started with a bare program name such as `"git"`.
+
+**Why:** The shell looks the name up in `PATH`, so a program of the same name in an earlier folder runs instead (CWE-426).
+
+```codelaw
+match:
+  kind: call
+  all:
+    - has:
+        field: function
+        regex: '^(os\.system|os\.popen|subprocess\.(run|call|check_call|check_output|Popen))$'
+    - any:
+        - has:
+            field: arguments
+            has: { nthChild: 1, kind: string, regex: '^[rb]?[''\"][^/''\"\s]+(\s[^''\"]*)?[''\"]$' }
+        - has:
+            field: arguments
+            has:
+              nthChild: 1
+              kind: list
+              has: { nthChild: 1, kind: string, regex: '^[rb]?[''\"][^/''\"\s]+(\s[^''\"]*)?[''\"]$' }
+message: 'This starts a program found through `PATH`; use its full path'
+```
+
+## How to fix
+
+1. Resolve it once at start-up: `GIT = shutil.which("git")`, and fail if it is `None`.
+2. Or put the absolute path in configuration.
+
+## Examples
+
+### Python
+
+#### Don't
+
+```py
+import subprocess
+
+subprocess.run(["git", "status"])
+```
+
+#### Do
+
+```py
+import subprocess
+
+subprocess.run(["/usr/bin/git", "status"])
+```

codelaw_rules_security_python/rules/sec-py/no-path-traversal.cases.md

@@ -0,0 +1,46 @@
+# sec-py/no-path-traversal — cases
+
+### case: a request value
+
+```py
+def v(request):
+    return send_file(request.args["f"])
+```
+
+```expect
+2:12 sec-py/no-path-traversal
+```
+
+### case: a bound name
+
+```py
+def v(request):
+    f = request.GET.get("f")
+    return open(f)
+```
+
+```expect
+3:12 sec-py/no-path-traversal
+```
+
+### case: a constant
+
+```py
+def v(request):
+    return send_file("report.pdf")
+```
+
+```expect
+(none)
+```
+
+### case: a parameter is not followed
+
+```py
+def v(name):
+    return open(name)
+```
+
+```expect
+(none)
+```

codelaw_rules_security_python/rules/sec-py/no-path-traversal.md

@@ -0,0 +1,54 @@
+---
+id: sec-py/no-path-traversal
+title: 'A request value is not a file path'
+languages: [python]
+fix: manual
+fix_reason: "the safe form (a lookup by id, a resolved path checked against a base folder) depends on the storage layout"
+stability: preview
+security: { cwe: [22], owasp: ["A01:2025"], severity: high }
+since: 0.2.0
+---
+
+A value from the request is not passed to `open`, `send_file`, `send_from_directory` or `FileResponse` as a path.
+
+**Why:** `../../etc/passwd` in the value reads any file the process can (CWE-22). This rule uses `from_source:`, which is not taint analysis: it sees a request value only in the function that reads it, never through a call or a parameter.
+
+```codelaw
+match:
+  all:
+    - { kind: call }
+    - has:
+        field: function
+        regex: '^(open|(.*\.)?(send_file|send_from_directory|FileResponse|FileSystemStorage|read_text|read_bytes)|Path|pathlib\.Path|os\.path\.join)$'
+    - { has: { field: arguments, has: { nthChild: 1, pattern: $P } } }
+where: { $P: { from_source: { tables: [sources/django, sources/flask, sources/fastapi] } } }
+message: '`$P` comes from the request and is used as a path'
+```
+
+## How to fix
+
+1. Look the file up by an id the program issued, not by a name the client chose.
+2. Or resolve the path and check it stays inside the base folder: `p = (BASE / name).resolve(); p.relative_to(BASE.resolve())`.
+3. Flask: use `send_from_directory(BASE, secure_filename(name))`.
+
+## Examples
+
+### Python
+
+#### Don't
+
+```py
+def download(request):
+    name = request.GET["file"]
+    return open(name, "rb")
+```
+
+#### Do
+
+```py
+def download(request):
+    name = request.GET["file"]
+    path = (BASE / name).resolve()
+    path.relative_to(BASE.resolve())
+    return open(path, "rb")
+```

codelaw_rules_security_python/rules/sec-py/no-prompt-injection.cases.md

@@ -0,0 +1,46 @@
+# sec-py/no-prompt-injection — cases
+
+### case: an anthropic system argument
+
+```py
+def v(request):
+    t = request.GET["t"]
+    return client.messages.create(system=f"About {t}")
+```
+
+```expect
+3:35 sec-py/no-prompt-injection
+```
+
+### case: an openai system message
+
+```py
+def v(request):
+    m = {"role": "system", "content": request.GET["p"]}
+```
+
+```expect
+2:9 sec-py/no-prompt-injection
+```
+
+### case: a constant
+
+```py
+def v(request):
+    m = {"role": "system", "content": PROMPT}
+```
+
+```expect
+(none)
+```
+
+### case: a user message
+
+```py
+def v(request):
+    m = {"role": "user", "content": request.GET["p"]}
+```
+
+```expect
+(none)
+```

codelaw_rules_security_python/rules/sec-py/no-prompt-injection.md

@@ -0,0 +1,65 @@
+---
+id: sec-py/no-prompt-injection
+title: 'A request value is not written into a system prompt'
+languages: [python]
+fix: manual
+fix_reason: "what goes in the system role and what goes in the user role is a design decision"
+stability: preview
+security: { cwe: [1427], owasp: ["A05:2025"], severity: high }
+since: 0.2.0
+---
+
+A value from the request is not part of the system prompt of a language-model call.
+
+**Why:** The model cannot tell your instructions from the user's text, so a user can rewrite the rules the system prompt sets (CWE-1427). This rule uses `from_source:`, which is not taint analysis: it sees a request value only in the function that reads it, never through a call or a parameter.
+
+```codelaw
+match:
+  any:
+    - all:
+        - { kind: dictionary }
+        - has:
+            kind: pair
+            all:
+              - { has: { field: key, regex: '^[''"]role[''"]$' } }
+              - { has: { field: value, regex: '^[''"]system[''"]$' } }
+        - has:
+            kind: pair
+            all:
+              - { has: { field: key, regex: '^[''"]content[''"]$' } }
+              - { has: { field: value, pattern: $V } }
+    - { pattern: 'SystemMessage($V)' }
+    - { pattern: 'SystemMessage(content=$V)' }
+    - all:
+        - { kind: keyword_argument }
+        - { has: { field: name, regex: '^(system|system_prompt|instructions)$' } }
+        - { has: { field: value, pattern: $V } }
+where: { $V: { from_source: { tables: [sources/django, sources/flask, sources/fastapi] } } }
+message: '`$V` comes from the request and is part of the system prompt'
+```
+
+## How to fix
+
+1. Keep the system prompt a constant.
+2. Send the user's text as a separate `user` message, never concatenated into the system one.
+3. Treat the model's answer as untrusted too (see `sec-py/no-llm-output-to-sink`).
+
+## Examples
+
+### Python
+
+#### Don't
+
+```py
+def ask(request):
+    topic = request.GET["topic"]
+    return client.messages.create(system=f"You help with {topic}.", messages=msgs)
+```
+
+#### Do
+
+```py
+def ask(request):
+    msgs = [{"role": "user", "content": request.GET["topic"]}]
+    return client.messages.create(system=SYSTEM_PROMPT, messages=msgs)
+```

codelaw_rules_security_python/rules/sec-py/no-pycrypto.cases.md

@@ -0,0 +1,41 @@
+# sec-py/no-pycrypto — cases
+
+### case: pycrypto
+
+```py
+from Crypto.Cipher import AES
+```
+
+```expect
+1:1 sec-py/no-pycrypto
+```
+
+### case: import
+
+```py
+import Crypto
+```
+
+```expect
+1:1 sec-py/no-pycrypto
+```
+
+### case: Cryptodome
+
+```py
+from Cryptodome.Cipher import AES
+```
+
+```expect
+(none)
+```
+
+### case: cryptography
+
+```py
+from cryptography.fernet import Fernet
+```
+
+```expect
+(none)
+```

codelaw_rules_security_python/rules/sec-py/no-pycrypto.md

@@ -0,0 +1,47 @@
+---
+id: sec-py/no-pycrypto
+title: 'No `pycrypto`'
+languages: [python]
+fix: manual
+fix_reason: "the replacement package changes the import path and some call signatures"
+stability: preview
+ported_from: [bandit/B413, ruff/S413]
+security: { cwe: [1104], owasp: ["A03:2025"], severity: medium }
+since: 0.2.0
+---
+
+`Crypto` is not imported from the unmaintained `pycrypto` package.
+
+**Why:** `pycrypto` has had no release since 2013 and carries known flaws, including a weak random generator and a buffer overflow (CWE-1104).
+
+```codelaw
+match:
+  any:
+    - all: [{ kind: import_statement }, { has: { field: name, regex: '^Crypto(\..*)?$' } }]
+    - all:
+        - { kind: import_from_statement }
+        - { has: { field: module_name, regex: '^Crypto(\..*)?$' } }
+message: '`Crypto` is the unmaintained `pycrypto`; use `cryptography` or `pycryptodomex`'
+```
+
+## How to fix
+
+1. Prefer `cryptography` (`pip install cryptography`).
+2. `pycryptodomex` is a maintained drop-in with the package name `Cryptodome`: change `Crypto` to `Cryptodome`.
+3. `pycryptodome` (not `x`) also installs a package named `Crypto`; if that is what you use, switch to `Cryptodome` so this rule can tell them apart.
+
+## Examples
+
+### Python
+
+#### Don't
+
+```py
+from Crypto.Cipher import AES
+```
+
+#### Do
+
+```py
+from Cryptodome.Cipher import AES
+```