codelaw-rules-security-python 0.3.0__py3-none-any.whl

codelaw_rules_security_python/rules/sec-py/no-weak-hash.md

@@ -0,0 +1,54 @@
+---
+id: sec-py/no-weak-hash
+title: 'No MD5 or SHA-1 for security'
+languages: [python]
+fix: suggest
+fix_reason: "whether the digest is used for security (use SHA-256) or only as a checksum (say so) is the author's call"
+stability: preview
+ported_from: [bandit/B303, bandit/B324, ruff/S324]
+security: { cwe: [327], owasp: ["A04:2025"], severity: medium }
+since: 0.2.0
+---
+
+`hashlib.md5` and `hashlib.sha1` pass `usedforsecurity=False`, or are replaced by SHA-256.
+
+**Why:** Both can be forged by collision, so they prove nothing about who wrote the data (CWE-327).
+
+```codelaw
+match:
+  all:
+    - { pattern: 'hashlib.$H($$$A)' }
+    - not:
+        has:
+          field: arguments
+          has: { kind: keyword_argument, has: { field: name, regex: '^usedforsecurity$' } }
+constraints: { H: { regex: '^(md5|sha1)$' } }
+message: '`hashlib.$H` is not collision resistant; use SHA-256, or pass `usedforsecurity=False` for a checksum'
+fix: 'hashlib.sha256($$$A)'
+```
+
+## How to fix
+
+1. If the digest guards integrity or identity, use `hashlib.sha256` or `hashlib.blake2b`.
+2. If it is only a cache key or checksum, pass `usedforsecurity=False` and say so in a comment.
+3. For passwords see `sec-py/password-hash-effort`.
+
+## Examples
+
+### Python
+
+#### Don't
+
+```py
+import hashlib
+
+digest = hashlib.md5(data).hexdigest()
+```
+
+#### Do
+
+```py
+import hashlib
+
+digest = hashlib.sha256(data).hexdigest()
+```

codelaw_rules_security_python/rules/sec-py/no-wildcard-injection.cases.md

@@ -0,0 +1,41 @@
+# sec-py/no-wildcard-injection — cases
+
+### case: tar *
+
+```py
+os.system("tar cf a.tar *")
+```
+
+```expect
+1:1 sec-py/no-wildcard-injection
+```
+
+### case: chmod *
+
+```py
+subprocess.run("chmod 600 *", shell=True)
+```
+
+```expect
+1:1 sec-py/no-wildcard-injection
+```
+
+### case: ls *
+
+```py
+os.system("ls *")
+```
+
+```expect
+(none)
+```
+
+### case: a list
+
+```py
+subprocess.run(["tar", "cf", "a"])
+```
+
+```expect
+(none)
+```

codelaw_rules_security_python/rules/sec-py/no-wildcard-injection.md

@@ -0,0 +1,53 @@
+---
+id: sec-py/no-wildcard-injection
+title: 'A shell wildcard after `tar`, `chown`, `chmod` or `rsync`'
+languages: [python]
+fix: manual
+fix_reason: "the files have to be listed (`glob`) and passed after `--`, which changes the call"
+stability: preview
+ported_from: [bandit/B609, ruff/S609]
+security: { cwe: [155], owasp: ["A05:2025"], severity: medium }
+since: 0.2.0
+---
+
+A command that runs `tar`, `chown`, `chmod` or `rsync` on `*` is not started through a shell.
+
+**Why:** A file named `--checkpoint-action=exec=sh x.sh` in the folder is expanded by the shell into an option, so whoever can create files there runs commands (CWE-155).
+
+```codelaw
+match:
+  kind: call
+  all:
+    - has:
+        field: function
+        regex: '^(os\.system|os\.popen|subprocess\.(run|call|check_call|check_output|Popen))$'
+    - has:
+        field: arguments
+        has: { nthChild: 1, kind: string, regex: '\b(tar|chown|chmod|rsync)\b[^''\"]*\*' }
+message: '`*` is expanded by the shell, so a file named like an option changes the command'
+```
+
+## How to fix
+
+1. List the files in Python: `files = sorted(glob.glob("*.txt"))`.
+2. Pass them as a list after `--`: `subprocess.run(["tar", "cf", out, "--", *files])`.
+
+## Examples
+
+### Python
+
+#### Don't
+
+```py
+import os
+
+os.system("tar cf backup.tar *")
+```
+
+#### Do
+
+```py
+import subprocess
+
+subprocess.run(["tar", "cf", "backup.tar", "--", *files], check=True)
+```

codelaw_rules_security_python/rules/sec-py/no-world-writable.cases.md

@@ -0,0 +1,51 @@
+# sec-py/no-world-writable — cases
+
+### case: 777
+
+```py
+os.chmod(path, 0o777)
+```
+
+```expect
+1:1 sec-py/no-world-writable
+```
+
+### case: 666
+
+```py
+os.chmod(path, 0o666)
+```
+
+```expect
+1:1 sec-py/no-world-writable
+```
+
+### case: 600
+
+```py
+os.chmod(path, 0o600)
+```
+
+```expect
+(none)
+```
+
+### case: 755
+
+```py
+os.chmod(path, 0o755)
+```
+
+```expect
+(none)
+```
+
+### case: S_IWOTH
+
+```py
+os.chmod(path, stat.S_IWOTH)
+```
+
+```expect
+1:1 sec-py/no-world-writable
+```

codelaw_rules_security_python/rules/sec-py/no-world-writable.md

@@ -0,0 +1,57 @@
+---
+id: sec-py/no-world-writable
+title: 'No world-writable files'
+languages: [python]
+fix: suggest
+fix_reason: "the right mode depends on who has to write the file"
+stability: preview
+ported_from: [bandit/B103, ruff/S103]
+security: { cwe: [732], owasp: ["A01:2025"], severity: medium }
+since: 0.2.0
+---
+
+`os.chmod` and `os.umask` do not give write access to everyone.
+
+**Why:** Any local user can then change the file, which for a script, config or socket means running code as its owner (CWE-732).
+
+```codelaw
+match: { all: [{ pattern: 'os.chmod($P, $M)' }] }
+constraints:
+  M:
+    regex: '^(0o?[0-7]*[2367]|0o?[0-7]*7[0-7]?[2367]|stat\.S_IWOTH|stat\.S_IRWXO|0o?[0-7]{0,2}77[0-7]|0o?[0-7]*[2367])$'
+message: '`$M` makes the file writable by everyone'
+fix: 'os.chmod($P, 0o600)'
+```
+
+## How to fix
+
+1. Use `0o600` for a private file, `0o644` for one others read, `0o755` for a program.
+2. Never set the others' write bit.
+
+## Examples
+
+### Python
+
+#### Don't
+
+```py
+import os
+
+os.chmod(path, 0o777)
+```
+
+#### Do
+
+```py
+import os
+
+os.chmod(path, 0o600)
+```
+
+#### Fixed
+
+```py
+import os
+
+os.chmod(path, 0o600)
+```

codelaw_rules_security_python/rules/sec-py/no-xml-unsafe-parser.cases.md

@@ -0,0 +1,83 @@
+# sec-py/no-xml-unsafe-parser — cases
+
+### case: ElementTree through an alias
+
+```py
+import xml.etree.ElementTree as ET
+
+ET.fromstring(text)
+```
+
+```expect
+3:1 sec-py/no-xml-unsafe-parser
+```
+
+### case: ElementTree imported from xml.etree
+
+```py
+from xml.etree import ElementTree
+
+ElementTree.parse(p)
+```
+
+```expect
+3:1 sec-py/no-xml-unsafe-parser
+```
+
+### case: defusedxml
+
+```py
+import defusedxml.ElementTree as ET
+
+ET.parse(p)
+```
+
+```expect
+(none)
+```
+
+### case: minidom
+
+```py
+from xml.dom import minidom
+
+minidom.parseString(text)
+```
+
+```expect
+3:1 sec-py/no-xml-unsafe-parser
+```
+
+### case: lxml
+
+```py
+from lxml import etree
+
+etree.fromstring(text)
+```
+
+```expect
+3:1 sec-py/no-xml-unsafe-parser
+```
+
+### case: an unrelated etree
+
+```py
+from mylib import etree
+
+etree.parse(text)
+```
+
+```expect
+(none)
+```
+
+### case: an unrelated parse
+
+```py
+parser.parse(text)
+```
+
+```expect
+(none)
+```

codelaw_rules_security_python/rules/sec-py/no-xml-unsafe-parser.md

@@ -0,0 +1,86 @@
+---
+id: sec-py/no-xml-unsafe-parser
+title: 'XML is parsed with `defusedxml`'
+languages: [python]
+fix: suggest
+fix_reason: "`defusedxml` has to be installed and imported, and it refuses documents the standard parser accepts"
+stability: preview
+ported_from: [bandit/B313, bandit/B314, bandit/B315, bandit/B316, bandit/B317, bandit/B318, bandit/B319, bandit/B320, bandit/B405, bandit/B406, bandit/B407, bandit/B408, bandit/B409, bandit/B410]
+security: { cwe: [611], owasp: ["A05:2025"], severity: high }
+since: 0.2.0
+---
+
+XML from outside the program is parsed with `defusedxml`, not with `xml.etree`, `minidom`, `sax` or `lxml`.
+
+**Why:** The standard parsers expand entities, so a crafted document can read local files, reach the network or exhaust memory (CWE-611).
+
+```codelaw
+match:
+  any:
+    - all:
+        - { pattern: '$M.$F($$$A)' }
+        - has:
+            field: function
+            has:
+              field: object
+              regex: '^(ET|ElementTree|cElementTree|xml\.etree\.(c)?ElementTree)$'
+              pattern: $ET
+    - { pattern: '$M.$F($$$A)' }
+constraints:
+  F:
+    regex: '^(parse|parseString|iterparse|fromstring|fromstringlist|XML|XMLParser|make_parser)$'
+where:
+  $M:
+    any:
+      - imported-from:
+          - xml.etree.ElementTree
+          - xml.etree.cElementTree
+          - xml.dom.minidom
+          - xml.dom.pulldom
+          - xml.sax
+          - xml.dom.expatbuilder
+          - lxml.etree
+      - { imported-from: { module: xml.etree, name: ElementTree } }
+      - { imported-from: { module: xml.etree, name: cElementTree } }
+      - { imported-from: { module: xml.dom, name: minidom } }
+      - { imported-from: { module: xml.dom, name: pulldom } }
+      - { imported-from: { module: xml, name: sax } }
+      - { imported-from: { module: lxml, name: etree } }
+message: 'This parser expands XML entities; use `defusedxml`'
+fix:
+  - { replace: { target: $ET, with: defusedxml.ElementTree } }
+```
+
+## How to fix
+
+1. Install `defusedxml` and import it: `import defusedxml.ElementTree as ET`.
+2. Call the same function on it: `ET.fromstring(text)`.
+3. For `minidom`, `sax` or `pulldom`, import the module of the same name from `defusedxml`; for `lxml`, build the parser with `resolve_entities=False, no_network=True`.
+
+## Examples
+
+### Python
+
+#### Don't
+
+```py
+import xml.etree.ElementTree as ET
+
+tree = ET.parse(path)
+```
+
+#### Do
+
+```py
+import defusedxml.ElementTree as ET
+
+tree = ET.parse(path)
+```
+
+#### Fixed
+
+```py
+import xml.etree.ElementTree as ET
+
+tree = defusedxml.ElementTree.parse(path)
+```

codelaw_rules_security_python/rules/sec-py/no-xmlrpc.cases.md

@@ -0,0 +1,31 @@
+# sec-py/no-xmlrpc — cases
+
+### case: ServerProxy
+
+```py
+xmlrpc.client.ServerProxy(url)
+```
+
+```expect
+1:1 sec-py/no-xmlrpc
+```
+
+### case: a server
+
+```py
+SimpleXMLRPCServer(("localhost", 8000))
+```
+
+```expect
+1:1 sec-py/no-xmlrpc
+```
+
+### case: requests
+
+```py
+requests.post(url)
+```
+
+```expect
+(none)
+```

codelaw_rules_security_python/rules/sec-py/no-xmlrpc.md

@@ -0,0 +1,50 @@
+---
+id: sec-py/no-xmlrpc
+title: 'No `xmlrpc` without `defusedxml`'
+languages: [python]
+fix: manual
+fix_reason: "the patch has to run once before any xmlrpc object exists, and where that is depends on the program's start-up"
+stability: preview
+ported_from: [bandit/B411, ruff/S411]
+security: { cwe: [776], owasp: ["A05:2025"], severity: medium }
+since: 0.2.0
+---
+
+An `xmlrpc` client or server is not created without `defusedxml.xmlrpc.monkey_patch()` in the program.
+
+**Why:** `xmlrpc` parses XML with the standard parser, so a crafted request or response carries an entity expansion bomb or reads files (CWE-776).
+
+```codelaw
+match:
+  kind: call
+  all:
+    - has:
+        field: function
+        regex: '^(xmlrpc\.(client|server)\.)?(ServerProxy|Server|SimpleXMLRPCServer|SimpleXMLRPCRequestHandler|MultiCall|DocXMLRPCServer|CGIXMLRPCRequestHandler)$'
+message: '`xmlrpc` parses XML unsafely; call `defusedxml.xmlrpc.monkey_patch()` at start-up, or use JSON'
+```
+
+## How to fix
+
+1. Add `import defusedxml.xmlrpc` and call `defusedxml.xmlrpc.monkey_patch()` once, before any `xmlrpc` object is made.
+2. Or move the API to JSON over HTTP.
+
+## Examples
+
+### Python
+
+#### Don't
+
+```py
+from xmlrpc.client import ServerProxy
+
+proxy = ServerProxy(url)
+```
+
+#### Do
+
+```py
+import requests
+
+resp = requests.post(url, json=payload, timeout=10)
+```

codelaw_rules_security_python/rules/sec-py/no-xpath-injection.cases.md

@@ -0,0 +1,41 @@
+# sec-py/no-xpath-injection — cases
+
+### case: an f-string
+
+```py
+tree.xpath(f"//user[@name='{name}']")
+```
+
+```expect
+1:1 sec-py/no-xpath-injection
+```
+
+### case: variables
+
+```py
+tree.xpath("//user[@name=$n]", n=name)
+```
+
+```expect
+(none)
+```
+
+### case: a concatenation
+
+```py
+root.findall("./user[@id='" + uid + "']")
+```
+
+```expect
+1:1 sec-py/no-xpath-injection
+```
+
+### case: a plain path
+
+```py
+root.findall("./user")
+```
+
+```expect
+(none)
+```

codelaw_rules_security_python/rules/sec-py/no-xpath-injection.md

@@ -0,0 +1,52 @@
+---
+id: sec-py/no-xpath-injection
+title: 'XPath expressions are not built from strings'
+languages: [python]
+fix: manual
+fix_reason: "the expression has to be rewritten around `$name` variables, and which parts are values is the author's call"
+stability: preview
+security: { cwe: [643], owasp: ["A05:2025"], severity: high }
+since: 0.2.0
+---
+
+An XPath expression is not made with an f-string, `%`, `+` or `.format`; values go in as XPath variables.
+
+**Why:** A quote in the value ends the string in the expression and the rest of the value is read as XPath (CWE-643).
+
+```codelaw
+match:
+  kind: call
+  all:
+    - { has: { field: function, regex: '\.(xpath|findall|find|findtext|iterfind)$' } }
+    - has:
+        field: arguments
+        has:
+          nthChild: 1
+          any:
+            - { kind: string, has: { kind: interpolation } }
+            - { kind: binary_operator, has: { field: operator, regex: '^(%|\+)$' } }
+            - { kind: call, has: { field: function, regex: '\.format$' } }
+          regex: '(//|/|\[@)'
+message: 'This XPath is built from a string; pass the values as variables'
+```
+
+## How to fix
+
+1. Write the expression with variables: `tree.xpath("//user[@name=$name]", name=name)` (lxml).
+2. ElementTree has no variables: select by a simple path and compare the attribute in Python.
+
+## Examples
+
+### Python
+
+#### Don't
+
+```py
+nodes = tree.xpath(f"//user[@name='{name}']")
+```
+
+#### Do
+
+```py
+nodes = tree.xpath("//user[@name=$name]", name=name)
+```

codelaw_rules_security_python/rules/sec-py/paramiko-host-key.cases.md

@@ -0,0 +1,21 @@
+# sec-py/paramiko-host-key — cases
+
+### case: auto add
+
+```py
+client.set_missing_host_key_policy(paramiko.AutoAddPolicy())
+```
+
+```expect
+1:1 sec-py/paramiko-host-key
+```
+
+### case: reject
+
+```py
+client.set_missing_host_key_policy(paramiko.RejectPolicy())
+```
+
+```expect
+(none)
+```

codelaw_rules_security_python/rules/sec-py/paramiko-host-key.md

@@ -0,0 +1,44 @@
+---
+id: sec-py/paramiko-host-key
+title: 'SSH host keys are checked'
+languages: [python]
+fix: manual
+fix_reason: "where the known host keys come from is deployment-specific"
+stability: preview
+ported_from: [bandit/B507, ruff/S507]
+security: { cwe: [295], owasp: ["A07:2025"], severity: high }
+since: 0.2.0
+---
+
+`paramiko` is not told to accept unknown host keys with `AutoAddPolicy` or `WarningPolicy`.
+
+**Why:** A connection to an impostor goes through unnoticed, and the credentials are handed to it (CWE-295).
+
+```codelaw
+match: { any: [{ pattern: '$C.set_missing_host_key_policy($P)' }] }
+constraints: { P: { regex: '(AutoAddPolicy|WarningPolicy)' } }
+message: 'This accepts any SSH host key; load known hosts and reject unknown ones'
+```
+
+## How to fix
+
+1. Call `client.load_system_host_keys()` or `load_host_keys(path)`.
+2. Use `client.set_missing_host_key_policy(paramiko.RejectPolicy())`.
+3. Put the server's key in `known_hosts` ahead of time.
+
+## Examples
+
+### Python
+
+#### Don't
+
+```py
+client.set_missing_host_key_policy(paramiko.AutoAddPolicy())
+```
+
+#### Do
+
+```py
+client.load_system_host_keys()
+client.set_missing_host_key_policy(paramiko.RejectPolicy())
+```