codelaw-rules-security-python 0.3.0__py3-none-any.whl

codelaw_rules_security_python/rules/sec-py/no-ssrf.cases.md

@@ -0,0 +1,34 @@
+# sec-py/no-ssrf — cases
+
+### case: a request URL
+
+```py
+def f(request):
+    return requests.get(request.args["u"], timeout=5)
+```
+
+```expect
+2:12 sec-py/no-ssrf
+```
+
+### case: an f-string
+
+```py
+def f(request):
+    return requests.get(f"https://{request.GET['h']}/x", timeout=5)
+```
+
+```expect
+2:12 sec-py/no-ssrf
+```
+
+### case: a constant
+
+```py
+def f(request):
+    return requests.get("https://api.example.com", timeout=5)
+```
+
+```expect
+(none)
+```

codelaw_rules_security_python/rules/sec-py/no-ssrf.md

@@ -0,0 +1,54 @@
+---
+id: sec-py/no-ssrf
+title: 'A request value is not a URL to fetch'
+languages: [python]
+fix: manual
+fix_reason: "which hosts are allowed is a policy only the author knows"
+stability: preview
+security: { cwe: [918], owasp: ["A01:2025"], severity: high }
+since: 0.2.0
+---
+
+A value from the request is not the URL given to `requests`, `httpx` or `urllib`.
+
+**Why:** The server fetches whatever address the client names, including internal services and cloud metadata (CWE-918). This rule uses `from_source:`, which is not taint analysis: it sees a request value only in the function that reads it, never through a call or a parameter.
+
+```codelaw
+match:
+  all:
+    - { kind: call }
+    - has:
+        field: function
+        regex: '^(requests|httpx)\.(get|post|put|patch|delete|head|options|request|stream)$|^(urllib\.request\.)?urlopen$|^urllib\.request\.urlretrieve$|^(session|client)\.(get|post|put|delete|request)$'
+    - { has: { field: arguments, has: { nthChild: 1, pattern: $U } } }
+where: { $U: { from_source: { tables: [sources/django, sources/flask, sources/fastapi] } } }
+message: '`$U` comes from the request and is fetched by the server'
+```
+
+## How to fix
+
+1. Take an id or a key from the client and map it to a URL you wrote.
+2. Or parse the URL and check the scheme is `https` and the host is on an allow-list, then connect to the address you resolved (not the name again).
+3. Refuse private, loopback and link-local addresses.
+
+## Examples
+
+### Python
+
+#### Don't
+
+```py
+def fetch(request):
+    url = request.args["url"]
+    return requests.get(url, timeout=5)
+```
+
+#### Do
+
+```py
+def fetch(request):
+    host = urlparse(request.args["url"]).hostname
+    if host not in ALLOWED_HOSTS:
+        abort(400)
+    return requests.get(ALLOWED_HOSTS[host], timeout=5)
+```

codelaw_rules_security_python/rules/sec-py/no-stack-trace-response.cases.md

@@ -0,0 +1,48 @@
+# sec-py/no-stack-trace-response — cases
+
+### case: str(e)
+
+```py
+def v():
+    try:
+        run()
+    except Exception as e:
+        return jsonify(error=str(e))
+```
+
+```expect
+5:9 sec-py/no-stack-trace-response
+```
+
+### case: format_exc
+
+```py
+def v():
+    return traceback.format_exc()
+```
+
+```expect
+2:5 sec-py/no-stack-trace-response
+```
+
+### case: generic
+
+```py
+def v():
+    return jsonify(error="internal error")
+```
+
+```expect
+(none)
+```
+
+### case: a number
+
+```py
+def v(e):
+    return len(e)
+```
+
+```expect
+(none)
+```

codelaw_rules_security_python/rules/sec-py/no-stack-trace-response.md

@@ -0,0 +1,67 @@
+---
+id: sec-py/no-stack-trace-response
+title: 'A stack trace is not sent to the client'
+languages: [python]
+exclude: ["**/tests/**", "**/test/**", "**/test_*.py", "**/*_test.py", "**/*_tests.py", "**/tests.py", "**/conftest.py"]
+fix: manual
+fix_reason: "what the client sees instead (a generic message and an error id) is a product decision"
+stability: preview
+security: { cwe: [209], owasp: ["A10:2025"], severity: medium }
+since: 0.2.0
+---
+
+A response does not contain `traceback.format_exc()` or the text of the exception.
+
+**Why:** The text names files, queries, library versions and sometimes values, which tells an attacker where to push (CWE-209).
+
+```codelaw
+match:
+  any:
+    - all:
+        - { kind: return_statement }
+        - has:
+            stopBy: end
+            kind: call
+            regex: '^(str|repr)\((e|exc|err|ex|error|exception)\)$|^traceback\.format_exc\(\)$|^(e|exc|err|ex|error|exception)\.(args|message)$'
+    - all:
+        - { kind: raise_statement }
+        - has:
+            stopBy: end
+            kind: call
+            regex: '^(str|repr)\((e|exc|err|ex|error|exception)\)$|^traceback\.format_exc\(\)$|^(e|exc|err|ex|error|exception)\.(args|message)$'
+        - has:
+            stopBy: end
+            kind: identifier
+            regex: '^(HTTPException|abort|HttpResponseServerError)$'
+message: 'The text of an exception is sent to the client; log it and send a generic message'
+```
+
+## How to fix
+
+1. Log it: `logger.exception("upload failed")`.
+2. Return a generic message and an id the client can quote: `{"error": "internal error", "id": error_id}`.
+
+## Examples
+
+### Python
+
+#### Don't
+
+```py
+def view():
+    try:
+        run()
+    except Exception as e:
+        return jsonify(error=str(e))
+```
+
+#### Do
+
+```py
+def view():
+    try:
+        run()
+    except Exception:
+        logger.exception("run failed")
+        return jsonify(error="internal error")
+```

codelaw_rules_security_python/rules/sec-py/no-tls-bypass.cases.md

@@ -0,0 +1,71 @@
+# sec-py/no-tls-bypass — cases
+
+### case: verify=False
+
+```py
+requests.post(url, data=d, verify=False, timeout=5)
+```
+
+```expect
+1:1 sec-py/no-tls-bypass
+```
+
+### case: verify with a bundle
+
+```py
+requests.get(url, verify="/etc/ca.pem")
+```
+
+```expect
+(none)
+```
+
+### case: unverified context
+
+```py
+ctx = ssl._create_unverified_context()
+```
+
+```expect
+1:7 sec-py/no-tls-bypass
+```
+
+### case: check_hostname
+
+```py
+ctx.check_hostname = False
+```
+
+```expect
+1:1 sec-py/no-tls-bypass
+```
+
+### case: CERT_NONE
+
+```py
+ctx.verify_mode = ssl.CERT_NONE
+```
+
+```expect
+1:1 sec-py/no-tls-bypass
+```
+
+### case: old protocol
+
+```py
+ctx = ssl.SSLContext(ssl.PROTOCOL_TLSv1)
+```
+
+```expect
+1:22 sec-py/no-tls-bypass
+```
+
+### case: default context
+
+```py
+ctx = ssl.create_default_context()
+```
+
+```expect
+(none)
+```

codelaw_rules_security_python/rules/sec-py/no-tls-bypass.md

@@ -0,0 +1,66 @@
+---
+id: sec-py/no-tls-bypass
+title: 'TLS certificate checks stay on'
+languages: [python]
+fix: suggest
+fix_reason: "the server may use a private CA, which needs the CA bundle passed as `verify=` rather than the check removed"
+stability: preview
+ported_from: [bandit/B501, bandit/B502, bandit/B503, bandit/B504, bandit/B323, ruff/S501, ruff/S502, ruff/S503, ruff/S504, ruff/S323]
+security: { cwe: [295], owasp: ["A04:2025"], severity: high }
+since: 0.2.0
+---
+
+Certificate verification is not switched off (`verify=False`, `_create_unverified_context`), and an SSL context is not pinned to an old protocol.
+
+**Why:** Without the check anyone on the network path can pose as the server and read or change the traffic (CWE-295).
+
+```codelaw
+match:
+  any:
+    - kind: call
+      all:
+        - has:
+            field: function
+            regex: '^(requests|httpx|session|client|s|self\.session|self\.client)\.(get|post|put|patch|delete|head|options|request|stream|send)$|^(requests|httpx)\.(Client|AsyncClient|Session)$'
+        - has:
+            field: arguments
+            has:
+              kind: keyword_argument
+              all: [{ has: { field: name, regex: '^verify$' } }, { has: { field: value, kind: 'false' } }]
+              pattern: $KW
+    - kind: call
+      all:
+        - has: { field: function, regex: '^ssl\._create_unverified_context$|^ssl\.wrap_socket$' }
+    - { kind: attribute, regex: '^ssl\.PROTOCOL_(SSLv2|SSLv3|SSLv23|TLSv1|TLSv1_1)$' }
+    - { pattern: '$C.check_hostname = False' }
+    - { pattern: '$C.verify_mode = ssl.CERT_NONE' }
+message: 'TLS verification is off or pinned to an old protocol'
+fix:
+  - { remove: $KW }
+```
+
+## How to fix
+
+1. Delete `verify=False`; if the server uses a private CA, pass its bundle: `verify="/etc/ssl/corp-ca.pem"`.
+2. Use `ssl.create_default_context()` instead of `_create_unverified_context()`.
+3. Never set `check_hostname = False` or `verify_mode = ssl.CERT_NONE`; set `minimum_version = ssl.TLSVersion.TLSv1_2` instead of an old `PROTOCOL_*`.
+
+## Examples
+
+### Python
+
+#### Don't
+
+```py
+import requests
+
+resp = requests.get(url, verify=False, timeout=5)
+```
+
+#### Do
+
+```py
+import requests
+
+resp = requests.get(url, timeout=5)
+```

codelaw_rules_security_python/rules/sec-py/no-trust-remote-code.cases.md

@@ -0,0 +1,31 @@
+# sec-py/no-trust-remote-code — cases
+
+### case: from_pretrained
+
+```py
+AutoModel.from_pretrained(n, trust_remote_code=True)
+```
+
+```expect
+1:1 sec-py/no-trust-remote-code
+```
+
+### case: false
+
+```py
+AutoModel.from_pretrained(n, trust_remote_code=False)
+```
+
+```expect
+(none)
+```
+
+### case: a dataset
+
+```py
+load_dataset("x", trust_remote_code=True)
+```
+
+```expect
+1:1 sec-py/no-trust-remote-code
+```

codelaw_rules_security_python/rules/sec-py/no-trust-remote-code.md

@@ -0,0 +1,50 @@
+---
+id: sec-py/no-trust-remote-code
+title: 'No `trust_remote_code=True`'
+languages: [python]
+fix: manual
+fix_reason: "using a model that needs custom code means reviewing and vendoring that code, which is the author's call"
+stability: preview
+security: { cwe: [94], owasp: ["A03:2025"], severity: high }
+since: 0.2.0
+---
+
+`from_pretrained`, `load_dataset` and `pipeline` are not called with `trust_remote_code=True`.
+
+**Why:** The repository's Python files are downloaded and run on your machine, so whoever can push to it runs code in your process (CWE-94).
+
+```codelaw
+match:
+  all:
+    - { kind: call }
+    - has:
+        field: arguments
+        has:
+          kind: keyword_argument
+          all:
+            - { has: { field: name, regex: '^trust_remote_code$' } }
+            - { has: { field: value, kind: 'true' } }
+message: 'This runs code from the model repository; review it and vendor it, or use a model without custom code'
+```
+
+## How to fix
+
+1. Remove `trust_remote_code=True`; use a model whose architecture is built into the library.
+2. If you need the code, read it, copy it into your repository at a pinned commit, and load that instead.
+3. At least pin `revision=` to a commit you reviewed.
+
+## Examples
+
+### Python
+
+#### Don't
+
+```py
+model = AutoModel.from_pretrained(name, trust_remote_code=True)
+```
+
+#### Do
+
+```py
+model = AutoModel.from_pretrained(name, revision=REVISION)
+```

codelaw_rules_security_python/rules/sec-py/no-unsafe-deserialize.cases.md

@@ -0,0 +1,63 @@
+# sec-py/no-unsafe-deserialize — cases
+
+### case: pickle.load
+
+```py
+import pickle
+
+pickle.load(f)
+```
+
+```expect
+3:1 sec-py/no-unsafe-deserialize
+```
+
+### case: dill
+
+```py
+dill.loads(b)
+```
+
+```expect
+1:1 sec-py/no-unsafe-deserialize
+```
+
+### case: marshal
+
+```py
+marshal.loads(b)
+```
+
+```expect
+1:1 sec-py/no-unsafe-deserialize
+```
+
+### case: shelve.open
+
+```py
+shelve.open(path)
+```
+
+```expect
+1:1 sec-py/no-unsafe-deserialize
+```
+
+### case: pickle.dumps is fine
+
+```py
+pickle.dumps(obj)
+```
+
+```expect
+(none)
+```
+
+### case: json is fine
+
+```py
+json.load(f)
+```
+
+```expect
+(none)
+```

codelaw_rules_security_python/rules/sec-py/no-unsafe-deserialize.md

@@ -0,0 +1,51 @@
+---
+id: sec-py/no-unsafe-deserialize
+title: 'Deserialising with `pickle` and its relatives'
+languages: [python]
+fix: manual
+fix_reason: "the replacement format (JSON, a schema, a signed payload) is a design choice"
+stability: preview
+ported_from: [bandit/B301, bandit/B302, bandit/B403]
+security: { cwe: [502], owasp: ["A08:2025"], severity: high }
+since: 0.2.0
+---
+
+Data is not loaded with `pickle`, `cPickle`, `dill`, `marshal`, `shelve` or `jsonpickle`.
+
+**Why:** Loading runs code chosen by whoever wrote the bytes, so untrusted input is remote code execution (CWE-502).
+
+```codelaw
+match:
+  kind: call
+  all:
+    - has:
+        field: function
+        regex: '^((c|_)?[Pp]ickle|dill|cloudpickle)\.(loads?|Unpickler)$|^marshal\.loads?$|^shelve\.open$|^jsonpickle\.(decode|loads)$'
+message: 'This loads data with a format that runs code on load'
+```
+
+## How to fix
+
+1. Use JSON (`json.loads`) or another data-only format, and validate the result against a schema.
+2. If the bytes must be a pickle, sign them (`hmac`) and verify the signature before loading, or load only files the program itself wrote.
+3. For model weights use `safetensors`.
+
+## Examples
+
+### Python
+
+#### Don't
+
+```py
+import pickle
+
+obj = pickle.loads(payload)
+```
+
+#### Do
+
+```py
+import json
+
+obj = json.loads(payload)
+```

codelaw_rules_security_python/rules/sec-py/no-weak-cipher.cases.md

@@ -0,0 +1,51 @@
+# sec-py/no-weak-cipher — cases
+
+### case: ECB
+
+```py
+cipher = AES.new(key, AES.MODE_ECB)
+```
+
+```expect
+1:23 sec-py/no-weak-cipher
+```
+
+### case: DES
+
+```py
+DES.new(key, DES.MODE_CBC, iv)
+```
+
+```expect
+1:1 sec-py/no-weak-cipher
+```
+
+### case: modes.ECB
+
+```py
+modes.ECB()
+```
+
+```expect
+1:1 sec-py/no-weak-cipher
+```
+
+### case: GCM
+
+```py
+AES.new(key, AES.MODE_GCM)
+```
+
+```expect
+(none)
+```
+
+### case: TripleDES
+
+```py
+algorithms.TripleDES(key)
+```
+
+```expect
+1:1 sec-py/no-weak-cipher
+```

codelaw_rules_security_python/rules/sec-py/no-weak-cipher.md

@@ -0,0 +1,60 @@
+---
+id: sec-py/no-weak-cipher
+title: 'No DES, RC4, Blowfish or ECB'
+languages: [python]
+fix: manual
+fix_reason: "the new cipher changes key size, nonce handling and the stored format"
+stability: preview
+ported_from: [bandit/B304, bandit/B305, ruff/S304, ruff/S305]
+security: { cwe: [327], owasp: ["A04:2025"], severity: high }
+since: 0.2.0
+---
+
+A weak cipher (DES, 3DES, ARC2, ARC4, Blowfish, CAST5, IDEA) or ECB mode is not used.
+
+**Why:** The ciphers have small blocks or known attacks, and ECB encrypts equal blocks to equal output, so the data's structure shows through (CWE-327).
+
+```codelaw
+match:
+  any:
+    - kind: call
+      all:
+        - has:
+            field: function
+            regex: '^((Crypto|Cryptodome)\.Cipher\.)?(DES|DES3|ARC2|ARC4|Blowfish|CAST|XOR)\.new$'
+    - kind: call
+      all:
+        - has:
+            field: function
+            regex: '^(algorithms\.)(TripleDES|ARC4|ARC2|Blowfish|CAST5|IDEA|SEED)$'
+    - kind: call
+      all: [{ has: { field: function, regex: '^(modes\.)?ECB$' } }]
+    - { kind: attribute, regex: '\.MODE_ECB$' }
+message: 'This cipher or mode is weak; use AES-GCM or ChaCha20-Poly1305'
+```
+
+## How to fix
+
+1. Use `cryptography`'s `AESGCM` or `ChaCha20Poly1305`: they encrypt and authenticate.
+2. A new random nonce for every message; never reuse one with the same key.
+3. Re-encrypt stored data under the new scheme.
+
+## Examples
+
+### Python
+
+#### Don't
+
+```py
+from Crypto.Cipher import AES
+
+cipher = AES.new(key, AES.MODE_ECB)
+```
+
+#### Do
+
+```py
+from cryptography.hazmat.primitives.ciphers.aead import AESGCM
+
+cipher = AESGCM(key)
+```

codelaw_rules_security_python/rules/sec-py/no-weak-hash.cases.md

@@ -0,0 +1,41 @@
+# sec-py/no-weak-hash — cases
+
+### case: md5
+
+```py
+hashlib.md5(data)
+```
+
+```expect
+1:1 sec-py/no-weak-hash
+```
+
+### case: sha1
+
+```py
+hashlib.sha1(data)
+```
+
+```expect
+1:1 sec-py/no-weak-hash
+```
+
+### case: not for security
+
+```py
+hashlib.md5(data, usedforsecurity=False)
+```
+
+```expect
+(none)
+```
+
+### case: sha256
+
+```py
+hashlib.sha256(data)
+```
+
+```expect
+(none)
+```