codelaw-rules-security-python 0.3.0__py3-none-any.whl

codelaw_rules_security_python/rules/sec-py/no-reflected-xss.cases.md

@@ -0,0 +1,45 @@
+# sec-py/no-reflected-xss — cases
+
+### case: a direct value
+
+```py
+def v(request):
+    return HttpResponse(request.GET["n"])
+```
+
+```expect
+2:12 sec-py/no-reflected-xss
+```
+
+### case: a returned string
+
+```py
+def v():
+    return "<p>" + request.args["n"] + "</p>"
+```
+
+```expect
+2:5 sec-py/no-reflected-xss
+```
+
+### case: escaped
+
+```py
+def v(request):
+    return HttpResponse(escape(request.GET["n"]))
+```
+
+```expect
+(none)
+```
+
+### case: a constant
+
+```py
+def v(request):
+    return HttpResponse("ok")
+```
+
+```expect
+(none)
+```

codelaw_rules_security_python/rules/sec-py/no-reflected-xss.md

@@ -0,0 +1,56 @@
+---
+id: sec-py/no-reflected-xss
+title: 'A request value is not written into the response as it is'
+languages: [python]
+exclude: ["**/tests/**", "**/test/**", "**/test_*.py", "**/*_test.py", "**/*_tests.py", "**/tests.py", "**/conftest.py"]
+fix: manual
+fix_reason: "escaping the value or rendering a template are both fixes; which fits depends on the response"
+stability: preview
+security: { cwe: [79], owasp: ["A05:2025"], severity: high }
+since: 0.2.0
+---
+
+A value from the request is not passed to `HttpResponse`, `make_response` or `HTMLResponse`, or built into a returned string, without escaping.
+
+**Why:** The page then contains whatever the client sent, including a script (CWE-79). This rule uses `from_source:`, which is not taint analysis: it sees a request value only in the function that reads it, never through a call or a parameter.
+
+```codelaw
+match:
+  any:
+    - { pattern: 'HttpResponse($V)' }
+    - { pattern: 'make_response($V)' }
+    - { pattern: 'HTMLResponse($V)' }
+    - all:
+        - { pattern: 'return $V' }
+        - has:
+            any:
+              - { kind: string, has: { kind: interpolation } }
+              - { kind: binary_operator, has: { field: operator, regex: '^(%|\+)$' } }
+              - { kind: call, has: { field: function, regex: '\.format$' } }
+where: { $V: { from_source: { tables: [sources/django, sources/flask, sources/fastapi] } } }
+message: '`$V` comes from the request and is written into the page without escaping'
+```
+
+## How to fix
+
+1. Escape it: `markupsafe.escape(value)` or Django's `django.utils.html.escape`.
+2. Or render a template with autoescape on and pass the value in.
+3. If the response is not HTML, set `Content-Type: text/plain` or `application/json`.
+
+## Examples
+
+### Python
+
+#### Don't
+
+```py
+def hello(request):
+    return HttpResponse(request.GET["name"])
+```
+
+#### Do
+
+```py
+def hello(request):
+    return HttpResponse(escape(request.GET["name"]))
+```

codelaw_rules_security_python/rules/sec-py/no-regex-injection.cases.md

@@ -0,0 +1,33 @@
+# sec-py/no-regex-injection — cases
+
+### case: a request pattern
+
+```py
+def f(request, t):
+    return re.search(request.GET["q"], t)
+```
+
+```expect
+2:12 sec-py/no-regex-injection
+```
+
+### case: escaped
+
+```py
+def f(request, t):
+    return re.search(re.escape(request.GET["q"]), t)
+```
+
+```expect
+(none)
+```
+
+### case: a literal
+
+```py
+re.compile("a+")
+```
+
+```expect
+(none)
+```

codelaw_rules_security_python/rules/sec-py/no-regex-injection.md

@@ -0,0 +1,49 @@
+---
+id: sec-py/no-regex-injection
+title: 'A request value is not a regular expression'
+languages: [python]
+fix: suggest
+fix_reason: "`re.escape` turns the value into a literal search; a client that is meant to send a pattern needs a length limit and a timeout instead"
+stability: preview
+security: { cwe: [730, 1333], owasp: ["A06:2025"], severity: medium }
+since: 0.2.0
+---
+
+A value from the request is not used as the pattern of `re.compile`, `re.search`, `re.match` or the other `re` functions.
+
+**Why:** The client can write a pattern that takes exponential time (a ReDoS) or changes what the search matches (CWE-730, CWE-1333). This rule uses `from_source:`, which is not taint analysis: it sees a request value only in the function that reads it, never through a call or a parameter.
+
+```codelaw
+match: { any: [{ pattern: '$F($P, $$$R)' }, { pattern: '$F($P)' }] }
+constraints: { F: { regex: '^re\.(compile|search|match|fullmatch|findall|finditer|sub|subn|split)$' } }
+where: { $P: { from_source: { tables: [sources/django, sources/flask, sources/fastapi] } } }
+message: '`$P` comes from the request and is used as a regular expression; escape it'
+fix: '$F(re.escape($P), $$$R)'
+```
+
+## How to fix
+
+1. If the value is text to look for, wrap it in `re.escape(value)`.
+2. If the client must send a pattern, limit its length and run it with a timeout (the `regex` package's `timeout=`).
+
+## Examples
+
+### Python
+
+#### Don't
+
+```py
+import re
+
+def find(request, text):
+    return re.search(request.GET["q"], text)
+```
+
+#### Do
+
+```py
+import re
+
+def find(request, text):
+    return re.search(re.escape(request.GET["q"]), text)
+```

codelaw_rules_security_python/rules/sec-py/no-secret-in-log.cases.md

@@ -0,0 +1,41 @@
+# sec-py/no-secret-in-log — cases
+
+### case: a password
+
+```py
+logger.info("pw=%s", password)
+```
+
+```expect
+1:1 sec-py/no-secret-in-log
+```
+
+### case: an f-string
+
+```py
+log.debug(f"token {token}")
+```
+
+```expect
+1:1 sec-py/no-secret-in-log
+```
+
+### case: a user name
+
+```py
+logger.info("user %s", username)
+```
+
+```expect
+(none)
+```
+
+### case: print
+
+```py
+print(api_key)
+```
+
+```expect
+1:1 sec-py/no-secret-in-log
+```

codelaw_rules_security_python/rules/sec-py/no-secret-in-log.md

@@ -0,0 +1,55 @@
+---
+id: sec-py/no-secret-in-log
+title: 'Secrets are not logged'
+languages: [python]
+fix: manual
+fix_reason: "whether to drop the value or mask it depends on what the log is for"
+stability: preview
+security: { cwe: [532], owasp: ["A09:2025"], severity: medium }
+since: 0.2.0
+---
+
+A value named `password`, `token` or `secret` is not written to a log.
+
+**Why:** Logs are kept longer and read by more people than the secret was meant for (CWE-532).
+
+```codelaw
+match:
+  all:
+    - { kind: call }
+    - has:
+        field: function
+        regex: '^((logger|logging|log|self\.logger|self\.log|app\.logger)\.(debug|info|warning|warn|error|exception|critical|log)|print)$'
+    - has:
+        field: arguments
+        has:
+          regex: '(?i)(pass(word|wd)?|secret|token|api_?key|auth|otp|nonce|salt|session_?id|csrf|reset_?code|verification_?code)'
+          any:
+            - { kind: identifier }
+            - { kind: attribute }
+            - { kind: subscript }
+            - { kind: string, has: { kind: interpolation } }
+            - { kind: keyword_argument }
+message: 'A secret may be written to the log; log that it was set, not its value'
+```
+
+## How to fix
+
+1. Remove the value from the message.
+2. Log an id or `"set"/"missing"`, or a masked form such as the last four characters.
+
+## Examples
+
+### Python
+
+#### Don't
+
+```py
+logger.info("login with password %s", password)
+```
+
+#### Do
+
+```py
+logger.info("login for user %s", username)
+```

codelaw_rules_security_python/rules/sec-py/no-shell.cases.md

@@ -0,0 +1,55 @@
+# sec-py/no-shell — cases
+
+### case: shell=True with a string
+
+```py
+import subprocess
+
+subprocess.check_output(cmd, shell=True)
+```
+
+```expect
+3:1 sec-py/no-shell
+```
+
+### case: shell=False
+
+```py
+import subprocess
+
+subprocess.run(["ls"], shell=False)
+```
+
+```expect
+(none)
+```
+
+### case: os.system of a literal
+
+```py
+os.system("clear")
+```
+
+```expect
+(none)
+```
+
+### case: os.system of an f-string
+
+```py
+os.system(f"rm {path}")
+```
+
+```expect
+1:1 sec-py/no-shell
+```
+
+### case: os.popen of a name
+
+```py
+os.popen(cmd)
+```
+
+```expect
+1:1 sec-py/no-shell
+```

codelaw_rules_security_python/rules/sec-py/no-shell.md

@@ -0,0 +1,63 @@
+---
+id: sec-py/no-shell
+title: 'A shell command built from data'
+languages: [python]
+fix: suggest
+fix_reason: "dropping `shell=True` only works when the command is already a list of arguments; a string command must be split"
+stability: preview
+ported_from: [bandit/B602, bandit/B603, bandit/B604, bandit/B605, bandit/B609]
+security: { cwe: [78], owasp: ["A05:2025"], severity: high }
+since: 0.2.0
+---
+
+A subprocess is not started with `shell=True`, and `os.system` / `os.popen` are not given a value that is not a literal.
+
+**Why:** The command line goes through the shell, so a quote, `;` or `$(…)` in any part of it runs another command (CWE-78).
+
+```codelaw
+match:
+  any:
+    - kind: call
+      all:
+        - has:
+            field: function
+            regex: '^subprocess\.(run|call|check_call|check_output|Popen|getoutput|getstatusoutput)$'
+        - has:
+            field: arguments
+            has:
+              kind: keyword_argument
+              all: [{ has: { field: name, regex: '^shell$' } }, { has: { field: value, kind: 'true' } }]
+              pattern: $KW
+    - { pattern: 'os.system($X)' }
+    - { pattern: 'os.popen($X)' }
+constraints: { X: { not: { kind: string, not: { has: { kind: interpolation } } } } }
+message: 'This command runs through a shell; pass a list of arguments and leave `shell` off'
+fix:
+  - { remove: $KW }
+```
+
+## How to fix
+
+1. Pass the command as a list: `subprocess.run(["ls", "-l", path])`.
+2. Remove `shell=True`.
+3. Replace `os.system(cmd)` with `subprocess.run([...], check=True)`; use `shlex.split` only for a trusted fixed string.
+
+## Examples
+
+### Python
+
+#### Don't
+
+```py
+import subprocess
+
+subprocess.run(["ls", path], shell=True)
+```
+
+#### Do
+
+```py
+import subprocess
+
+subprocess.run(["ls", path])
+```

codelaw_rules_security_python/rules/sec-py/no-silent-except.cases.md

@@ -0,0 +1,53 @@
+# sec-py/no-silent-except — cases
+
+### case: bare except
+
+```py
+try:
+    f()
+except:
+    pass
+```
+
+```expect
+3:1 sec-py/no-silent-except
+```
+
+### case: Exception
+
+```py
+try:
+    f()
+except Exception:
+    pass
+```
+
+```expect
+3:1 sec-py/no-silent-except
+```
+
+### case: a specific exception
+
+```py
+try:
+    f()
+except KeyError:
+    pass
+```
+
+```expect
+(none)
+```
+
+### case: logged
+
+```py
+try:
+    f()
+except Exception:
+    log.exception("x")
+```
+
+```expect
+(none)
+```

codelaw_rules_security_python/rules/sec-py/no-silent-except.md

@@ -0,0 +1,54 @@
+---
+id: sec-py/no-silent-except
+title: 'Errors are not swallowed'
+languages: [python]
+exclude: ["**/tests/**", "**/test/**", "**/test_*.py", "**/*_test.py", "**/*_tests.py", "**/tests.py", "**/conftest.py"]
+fix: manual
+fix_reason: "what to do with the error (log, retry, stop) is a decision"
+stability: preview
+ported_from: [bandit/B110, bandit/B112, ruff/S110, ruff/S112]
+security: { cwe: [703], owasp: ["A10:2025"], severity: low }
+since: 0.2.0
+---
+
+An `except` that catches everything (bare, `Exception` or `BaseException`) does not just `pass` or `continue`.
+
+**Why:** A failure that is dropped hides a broken check or a failed login step, and the code goes on as though it had worked (CWE-703).
+
+```codelaw
+match:
+  all:
+    - { kind: except_clause }
+    - any:
+        - { regex: '^except\s*:' }
+        - { has: { kind: identifier, regex: '^(Exception|BaseException)$' } }
+    - { has: { kind: block, regex: '^(pass|continue)$' } }
+message: 'This `except` drops the error; handle it or log it'
+```
+
+## How to fix
+
+1. Catch the specific exceptions you expect.
+2. Log the others with `logger.exception("…")` and let them go on or re-raise.
+
+## Examples
+
+### Python
+
+#### Don't
+
+```py
+try:
+    check(token)
+except Exception:
+    pass
+```
+
+#### Do
+
+```py
+try:
+    check(token)
+except InvalidToken:
+    logger.warning("bad token")
+```

codelaw_rules_security_python/rules/sec-py/no-sql-string.cases.md

@@ -0,0 +1,91 @@
+# sec-py/no-sql-string — cases
+
+### case: a literal statement
+
+```py
+cursor.execute("SELECT 1")
+```
+
+```expect
+(none)
+```
+
+### case: a statement with parameters
+
+```py
+cursor.execute("SELECT * FROM t WHERE a = %s", (a,))
+```
+
+```expect
+(none)
+```
+
+### case: percent formatting
+
+```py
+cursor.execute("SELECT * FROM t WHERE a = %s" % a)
+```
+
+```expect
+1:1 sec-py/no-sql-string
+```
+
+### case: concatenation
+
+```py
+cursor.execute("SELECT * FROM t WHERE a = " + a)
+```
+
+```expect
+1:1 sec-py/no-sql-string
+```
+
+### case: format
+
+```py
+db.execute("SELECT {}".format(col))
+```
+
+```expect
+1:1 sec-py/no-sql-string
+```
+
+### case: Django raw with an f-string
+
+```py
+User.objects.raw(f"SELECT * FROM auth_user WHERE id = {uid}")
+```
+
+```expect
+1:1 sec-py/no-sql-string
+```
+
+### case: a name
+
+```py
+cursor.execute(sql)
+```
+
+```expect
+(none)
+```
+
+### case: extra with an interpolated where
+
+```py
+Entry.objects.extra(where=[f"id = {i}"])
+```
+
+```expect
+1:1 sec-py/no-sql-string
+```
+
+### case: extra with parameters
+
+```py
+Entry.objects.extra(where=["id = %s"], params=[i])
+```
+
+```expect
+(none)
+```

codelaw_rules_security_python/rules/sec-py/no-sql-string.md

@@ -0,0 +1,78 @@
+---
+id: sec-py/no-sql-string
+title: 'SQL built from a string'
+languages: [python]
+fix: manual
+fix_reason: "which placeholder style the driver takes, and where each value goes, depends on the driver"
+stability: preview
+ported_from: [bandit/B608, bandit/B610, bandit/B611]
+security: { cwe: [89], owasp: ["A05:2025"], severity: high }
+since: 0.2.0
+---
+
+A SQL statement is not built with an f-string, `%`, `+` or `.format`; the values go in as parameters.
+
+**Why:** A value that is part of the statement text can change the statement (CWE-89).
+
+```codelaw
+match:
+  any:
+    - kind: call
+      all:
+        - has:
+            field: function
+            regex: '^((.*\.)?(execute|executemany|executescript|raw|read_sql|read_sql_query)|RawSQL|text|sa\.text|sqlalchemy\.text)$'
+        - has:
+            field: arguments
+            has:
+              nthChild: 1
+              any:
+                - { kind: string, has: { kind: interpolation } }
+                - { kind: binary_operator, has: { field: operator, regex: '^(%|\+)$' } }
+                - { kind: call, has: { field: function, regex: '\.format$' } }
+    - kind: call
+      all:
+        - { has: { field: function, regex: '\.extra$' } }
+        - has:
+            field: arguments
+            has:
+              kind: keyword_argument
+              has:
+                field: value
+                any:
+                  - { kind: string, has: { kind: interpolation } }
+                  - { kind: binary_operator, has: { field: operator, regex: '^(%|\+)$' } }
+                  - { kind: call, has: { field: function, regex: '\.format$' } }
+                  - kind: list
+                    has:
+                      any:
+                        - { kind: string, has: { kind: interpolation } }
+                        - { kind: binary_operator, has: { field: operator, regex: '^(%|\+)$' } }
+                        - { kind: call, has: { field: function, regex: '\.format$' } }
+message: 'This SQL is built from a string; pass the values as parameters'
+```
+
+## How to fix
+
+1. Write the statement with placeholders: `cursor.execute("SELECT * FROM t WHERE id = %s", (item_id,))`.
+2. Pass the values as the second argument; the driver quotes them.
+3. A table or column name cannot be a parameter: choose it from a fixed allow-list.
+4. In Django use the ORM, `.raw(sql, params)` or `RawSQL(sql, params)`; give `.extra` parameters through `params=`.
+
+## Examples
+
+### Python
+
+#### Don't
+
+```py
+def find(cursor, name):
+    cursor.execute(f"SELECT * FROM users WHERE name = '{name}'")
+```
+
+#### Do
+
+```py
+def find(cursor, name):
+    cursor.execute("SELECT * FROM users WHERE name = %s", (name,))
+```