codelaw-rules-security-python 0.4.2__py3-none-any.whl → 0.5.1__py3-none-any.whl

codelaw_rules_security_python/rules/sec-py/no-log-injection.cases.md

@@ -43,3 +43,19 @@ def v(request):
 ```expect
 (none)
 ```
+
+### case: the message form is wrapped
+
+```py
+def v(request):
+    logger.warning(request.GET["u"])
+```
+
+```expect
+2:5 sec-py/no-log-injection
+```
+
+```fixed
+def v(request):
+    logger.warning(str(request.GET["u"]).replace("\r", "").replace("\n", " "))
+```

codelaw_rules_security_python/rules/sec-py/no-log-injection.md

@@ -3,8 +3,8 @@ id: sec-py/no-log-injection
 title: 'A request value is not logged raw'
 languages: [python]
 severity: warn
-fix: manual
-fix_reason: "whether to strip, escape or reject the value depends on how the log is read"
+fix: suggest
+fix_reason: "the reviewer confirms line breaks in the value are only noise for this log, since stripping them changes the logged text"
 stability: preview
 security: { cwe: [117], owasp: ["A09:2025"], severity: low }
 since: 0.2.0
@@ -22,6 +22,8 @@ constraints:
   A: { regex: '^[rbf]?[''\"]' }
 where: { $V: { from_source: { tables: [sources/django, sources/flask, sources/fastapi] } } }
 message: '`$V` comes from the request and is logged as it is'
+fix:
+  - replace: { target: $V, with: 'str($V).replace("\r", "").replace("\n", " ")' }
 ```
 
 ## How to fix
@@ -40,6 +42,13 @@ def view(request):
     logger.info("login %s", request.POST["user"])
 ```
 
+#### Fixed
+
+```py
+def view(request):
+    logger.info("login %s", str(request.POST["user"]).replace("\r", "").replace("\n", " "))
+```
+
 #### Do
 
 ```py

codelaw_rules_security_python/rules/sec-py/no-mako.cases.md

@@ -35,3 +35,33 @@ Template(src)
 ```expect
 (none)
 ```
+
+### case: escaping already on
+
+```py
+from mako.template import Template
+
+Template(src, default_filters=["h"])
+```
+
+```expect
+(none)
+```
+
+### case: escaping is turned on
+
+```py
+from mako.template import Template
+
+Template(src, input_encoding="utf-8")
+```
+
+```expect
+3:1 sec-py/no-mako
+```
+
+```fixed
+from mako.template import Template
+
+Template(src, input_encoding="utf-8", default_filters=["str", "h"])
+```

codelaw_rules_security_python/rules/sec-py/no-mako.md

@@ -2,8 +2,8 @@
 id: sec-py/no-mako
 title: 'No Mako templates'
 languages: [python]
-fix: manual
-fix_reason: "moving to another engine (or turning on `default_filters`) changes every template"
+fix: suggest
+fix_reason: "turning escaping on changes every template's output, so the reviewer confirms each one, and adds `|n` where markup is meant"
 stability: preview
 ported_from: [bandit/B702, ruff/S702]
 security: { cwe: [79], owasp: ["A05:2025"], severity: medium }
@@ -15,7 +15,13 @@ since: 0.2.0
 **Why:** Mako does not escape output unless told to, so every `${value}` is a script waiting for a hostile value (CWE-79).
 
 ```codelaw
-match: { any: [{ pattern: '$T($$$A)' }] }
+match:
+  all:
+    - pattern: '$T($$$A)'
+    - not:
+        has:
+          field: arguments
+          has: { kind: keyword_argument, has: { field: name, regex: '^default_filters$' } }
 constraints: { T: { regex: '^(Template|[A-Za-z_]+\.Template|mako\.template\.Template)$' } }
 where:
   $T:
@@ -24,6 +30,7 @@ where:
       - { imported-from: mako.template }
       - { imported-from: { module: mako, name: template } }
 message: 'Mako does not escape by default; use Jinja2 with autoescape, or set `default_filters=[''h'']`'
+fix: '$T($$$A, default_filters=["str", "h"])'
 ```
 
 ## How to fix
@@ -43,6 +50,14 @@ from mako.template import Template
 t = Template(source)
 ```
 
+#### Fixed
+
+```py
+from mako.template import Template
+
+t = Template(source, default_filters=["str", "h"])
+```
+
 #### Do
 
 ```py

codelaw_rules_security_python/rules/sec-py/no-mark-safe.md

@@ -4,6 +4,7 @@ title: 'No `mark_safe` of dynamic text'
 languages: [python]
 fix: manual
 fix_reason: "the right fix is escaping the parts (`format_html`, `escape`) or rendering through a template, not removing the call"
+fix_exception: security
 stability: preview
 ported_from: [bandit/B308, bandit/B703, bandit/B704, ruff/S308, ruff/S703, ruff/S704]
 security: { cwe: [79], owasp: ["A05:2025"], severity: high }

codelaw_rules_security_python/rules/sec-py/no-mass-assignment.md

@@ -4,6 +4,7 @@ title: 'A request is not splatted into a model'
 languages: [python]
 fix: manual
 fix_reason: "which fields a client may set is the author's decision"
+fix_exception: value
 stability: preview
 security: { cwe: [915], owasp: ["A01:2025"], severity: high }
 since: 0.2.0

codelaw_rules_security_python/rules/sec-py/no-nosql-injection.md

@@ -4,6 +4,7 @@ title: 'A request is not a MongoDB query'
 languages: [python]
 fix: manual
 fix_reason: "which fields the client may filter on, and their types, are the author's decision"
+fix_exception: value
 stability: preview
 security: { cwe: [943], owasp: ["A05:2025"], severity: high }
 since: 0.2.0

codelaw_rules_security_python/rules/sec-py/no-open-redirect.md

@@ -4,6 +4,7 @@ title: 'A request value is not a redirect target'
 languages: [python]
 fix: manual
 fix_reason: "the allowed destinations depend on the application"
+fix_exception: security
 stability: preview
 security: { cwe: [601], owasp: ["A01:2025"], severity: medium }
 since: 0.2.0

codelaw_rules_security_python/rules/sec-py/no-partial-path.md

@@ -5,6 +5,7 @@ languages: [python]
 severity: warn
 fix: manual
 fix_reason: "the absolute path differs by system, so it has to come from configuration or `shutil.which` at start-up"
+fix_exception: value
 stability: preview
 ported_from: [bandit/B607, ruff/S607]
 security: { cwe: [426], owasp: ["A08:2025"], severity: low }

codelaw_rules_security_python/rules/sec-py/no-path-traversal.md

@@ -3,7 +3,8 @@ id: sec-py/no-path-traversal
 title: 'A request value is not a file path'
 languages: [python]
 fix: manual
-fix_reason: "the safe form (a lookup by id, a resolved path checked against a base folder) depends on the storage layout"
+fix_reason: "the base folder the path must stay inside, or the id to look the file up by, is not in the code"
+fix_exception: value
 stability: preview
 security: { cwe: [22], owasp: ["A01:2025"], severity: high }
 since: 0.2.0

codelaw_rules_security_python/rules/sec-py/no-prompt-injection.md

@@ -4,6 +4,7 @@ title: 'A request value is not written into a system prompt'
 languages: [python]
 fix: manual
 fix_reason: "what goes in the system role and what goes in the user role is a design decision"
+fix_exception: restructure
 stability: preview
 security: { cwe: [1427], owasp: ["A05:2025"], severity: high }
 since: 0.2.0

codelaw_rules_security_python/rules/sec-py/no-pycrypto.md

@@ -4,6 +4,7 @@ title: 'No `pycrypto`'
 languages: [python]
 fix: manual
 fix_reason: "the replacement package changes the import path and some call signatures"
+fix_exception: restructure
 stability: preview
 ported_from: [bandit/B413, ruff/S413]
 security: { cwe: [1104], owasp: ["A03:2025"], severity: medium }

codelaw_rules_security_python/rules/sec-py/no-reflected-xss.md

@@ -4,7 +4,8 @@ title: 'A request value is not written into the response as it is'
 languages: [python]
 exclude: ["**/tests/**", "**/test/**", "**/test_*.py", "**/*_test.py", "**/*_tests.py", "**/tests.py", "**/conftest.py"]
 fix: manual
-fix_reason: "escaping the value or rendering a template are both fixes; which fits depends on the response"
+fix_reason: "escaping the value or rendering a template are both fixes, and a suggested edit would read as made safe; which fits depends on the response"
+fix_exception: security
 stability: preview
 security: { cwe: [79], owasp: ["A05:2025"], severity: high }
 since: 0.2.0

codelaw_rules_security_python/rules/sec-py/no-secret-in-log.cases.md

@@ -39,3 +39,30 @@ print(api_key)
 ```expect
 1:1 sec-py/no-secret-in-log
 ```
+
+### case: the secret argument is redacted
+
+```py
+log.debug(f"token {token}")
+print(api_key)
+```
+
+```expect
+1:1 sec-py/no-secret-in-log
+2:1 sec-py/no-secret-in-log
+```
+
+```fixed
+log.debug("[REDACTED]")
+print("[REDACTED]")
+```
+
+### case: a keyword argument has no edit
+
+```py
+logger.info("login", extra=dict(password=p))
+```
+
+```expect
+1:1 sec-py/no-secret-in-log
+```

codelaw_rules_security_python/rules/sec-py/no-secret-in-log.md

@@ -2,8 +2,8 @@
 id: sec-py/no-secret-in-log
 title: 'Secrets are not logged'
 languages: [python]
-fix: manual
-fix_reason: "whether to drop the value or mask it depends on what the log is for"
+fix: suggest
+fix_reason: "the reviewer confirms a redacted argument loses nothing the log needs; a keyword argument (`password=...`) gets no edit"
 stability: preview
 security: { cwe: [532], owasp: ["A09:2025"], severity: medium }
 since: 0.2.0
@@ -25,12 +25,14 @@ match:
         has:
           regex: '(?i)(pass(word|wd)?|secret|token|api_?key|auth|otp|nonce|salt|session_?id|csrf|reset_?code|verification_?code)'
           any:
-            - { kind: identifier }
-            - { kind: attribute }
-            - { kind: subscript }
-            - { kind: string, has: { kind: interpolation } }
+            - { kind: identifier, pattern: $S }
+            - { kind: attribute, pattern: $S }
+            - { kind: subscript, pattern: $S }
+            - { kind: string, has: { kind: interpolation }, pattern: $S }
             - { kind: keyword_argument }
 message: 'A secret may be written to the log; log that it was set, not its value'
+fix:
+  - replace: { target: $S, with: '"[REDACTED]"' }
 ```
 
 ## How to fix
@@ -48,6 +50,12 @@ message: 'A secret may be written to the log; log that it was set, not its value
 logger.info("login with password %s", password)
 ```
 
+#### Fixed
+
+```py
+logger.info("login with password %s", "[REDACTED]")
+```
+
 #### Do
 
 ```py

codelaw_rules_security_python/rules/sec-py/no-silent-except.md

@@ -5,6 +5,7 @@ languages: [python]
 exclude: ["**/tests/**", "**/test/**", "**/test_*.py", "**/*_test.py", "**/*_tests.py", "**/tests.py", "**/conftest.py"]
 fix: manual
 fix_reason: "what to do with the error (log, retry, stop) is a decision"
+fix_exception: security
 stability: preview
 ported_from: [bandit/B110, bandit/B112, ruff/S110, ruff/S112]
 security: { cwe: [703], owasp: ["A10:2025"], severity: low }

codelaw_rules_security_python/rules/sec-py/no-sql-string.md

@@ -4,6 +4,7 @@ title: 'SQL built from a string'
 languages: [python]
 fix: manual
 fix_reason: "which placeholder style the driver takes, and where each value goes, depends on the driver"
+fix_exception: security
 stability: preview
 ported_from: [bandit/B608, bandit/B610, bandit/B611]
 security: { cwe: [89], owasp: ["A05:2025"], severity: high }

codelaw_rules_security_python/rules/sec-py/no-ssrf.md

@@ -4,6 +4,7 @@ title: 'A request value is not a URL to fetch'
 languages: [python]
 fix: manual
 fix_reason: "which hosts are allowed is a policy only the author knows"
+fix_exception: value
 stability: preview
 security: { cwe: [918], owasp: ["A01:2025"], severity: high }
 since: 0.2.0

codelaw_rules_security_python/rules/sec-py/no-stack-trace-response.md

@@ -5,6 +5,7 @@ languages: [python]
 exclude: ["**/tests/**", "**/test/**", "**/test_*.py", "**/*_test.py", "**/*_tests.py", "**/tests.py", "**/conftest.py"]
 fix: manual
 fix_reason: "what the client sees instead (a generic message and an error id) is a product decision"
+fix_exception: security
 stability: preview
 security: { cwe: [209], owasp: ["A10:2025"], severity: medium }
 since: 0.2.0

codelaw_rules_security_python/rules/sec-py/no-trust-remote-code.cases.md

@@ -29,3 +29,17 @@ load_dataset("x", trust_remote_code=True)
 ```expect
 1:1 sec-py/no-trust-remote-code
 ```
+
+### case: the keyword is removed with its comma
+
+```py
+AutoModel.from_pretrained(n, trust_remote_code=True, revision=r)
+```
+
+```expect
+1:1 sec-py/no-trust-remote-code
+```
+
+```fixed
+AutoModel.from_pretrained(n, revision=r)
+```

codelaw_rules_security_python/rules/sec-py/no-trust-remote-code.md

@@ -2,8 +2,8 @@
 id: sec-py/no-trust-remote-code
 title: 'No `trust_remote_code=True`'
 languages: [python]
-fix: manual
-fix_reason: "using a model that needs custom code means reviewing and vendoring that code, which is the author's call"
+fix: suggest
+fix_reason: "removing the keyword fails closed, but a model that needs its custom code stops loading, so the reviewer confirms it does not, or vendors and pins the code"
 stability: preview
 security: { cwe: [94], owasp: ["A03:2025"], severity: high }
 since: 0.2.0
@@ -21,10 +21,13 @@ match:
         field: arguments
         has:
           kind: keyword_argument
+          pattern: $K
           all:
             - { has: { field: name, regex: '^trust_remote_code$' } }
             - { has: { field: value, kind: 'true' } }
 message: 'This runs code from the model repository; review it and vendor it, or use a model without custom code'
+fix:
+  - remove: $K
 ```
 
 ## How to fix
@@ -43,6 +46,12 @@ message: 'This runs code from the model repository; review it and vendor it, or
 model = AutoModel.from_pretrained(name, trust_remote_code=True)
 ```
 
+#### Fixed
+
+```py
+model = AutoModel.from_pretrained(name)
+```
+
 #### Do
 
 ```py

codelaw_rules_security_python/rules/sec-py/no-unsafe-deserialize.md

@@ -4,6 +4,7 @@ title: 'Deserialising with `pickle` and its relatives'
 languages: [python]
 fix: manual
 fix_reason: "the replacement format (JSON, a schema, a signed payload) is a design choice"
+fix_exception: restructure
 stability: preview
 ported_from: [bandit/B301, bandit/B302, bandit/B403]
 security: { cwe: [502], owasp: ["A08:2025"], severity: high }

codelaw_rules_security_python/rules/sec-py/no-weak-cipher.md

@@ -4,6 +4,7 @@ title: 'No DES, RC4, Blowfish or ECB'
 languages: [python]
 fix: manual
 fix_reason: "the new cipher changes key size, nonce handling and the stored format"
+fix_exception: restructure
 stability: preview
 ported_from: [bandit/B304, bandit/B305, ruff/S304, ruff/S305]
 security: { cwe: [327], owasp: ["A04:2025"], severity: high }

codelaw_rules_security_python/rules/sec-py/no-wildcard-injection.md

@@ -4,6 +4,7 @@ title: 'A shell wildcard after `tar`, `chown`, `chmod` or `rsync`'
 languages: [python]
 fix: manual
 fix_reason: "the files have to be listed (`glob`) and passed after `--`, which changes the call"
+fix_exception: security
 stability: preview
 ported_from: [bandit/B609, ruff/S609]
 security: { cwe: [155], owasp: ["A05:2025"], severity: medium }

codelaw_rules_security_python/rules/sec-py/no-xmlrpc.md

@@ -4,6 +4,7 @@ title: 'No `xmlrpc` without `defusedxml`'
 languages: [python]
 fix: manual
 fix_reason: "the patch has to run once before any xmlrpc object exists, and where that is depends on the program's start-up"
+fix_exception: restructure
 stability: preview
 ported_from: [bandit/B411, ruff/S411]
 security: { cwe: [776], owasp: ["A05:2025"], severity: medium }

codelaw_rules_security_python/rules/sec-py/no-xpath-injection.md

@@ -4,6 +4,7 @@ title: 'XPath expressions are not built from strings'
 languages: [python]
 fix: manual
 fix_reason: "the expression has to be rewritten around `$name` variables, and which parts are values is the author's call"
+fix_exception: security
 stability: preview
 security: { cwe: [643], owasp: ["A05:2025"], severity: high }
 since: 0.2.0

codelaw_rules_security_python/rules/sec-py/paramiko-call.md

@@ -0,0 +1,51 @@
+---
+id: sec-py/paramiko-call
+title: "`paramiko.exec_command`"
+languages: [python]
+fix: manual
+fix_reason: "what makes the command safe is the program's, not an edit"
+fix_exception: security
+stability: preview
+ported_from: [ruff/S601]
+security: { cwe: [78], owasp: ["A05:2025"], severity: medium }
+since: 0.5.0
+---
+
+A call that resolves to `paramiko.exec_command` is reported.
+
+**Why:** A command line sent to a remote shell is parsed there: a quote or `;` in any part of it runs another command (CWE-78).
+
+```codelaw
+native: sec-py/paramiko-call
+```
+
+## How to fix
+
+1. Build the command from constants and `shlex.quote()` every variable part.
+2. Or send the arguments over a channel that does not go through a shell.
+
+
+## Examples
+
+### Python
+
+#### Don't
+
+```python
+import paramiko
+
+paramiko.exec_command("ls " + path)
+```
+
+#### Do
+
+```python
+import paramiko
+
+client = paramiko.SSHClient()
+client.exec_command("uptime")
+```
+
+## Differences from the source
+
+This is Ruff's check as written: a call whose name resolves to `paramiko.exec_command`. The usual `client.exec_command(…)` on an `SSHClient` instance does not resolve to that name and is not reported; Ruff does not report it either.

codelaw_rules_security_python/rules/sec-py/paramiko-host-key.md

@@ -2,8 +2,8 @@
 id: sec-py/paramiko-host-key
 title: 'SSH host keys are checked'
 languages: [python]
-fix: manual
-fix_reason: "where the known host keys come from is deployment-specific"
+fix: suggest
+fix_reason: "`RejectPolicy` refuses an unknown host, which breaks a connection that relied on accepting it; where the known keys come from (`load_system_host_keys`, a known_hosts file) is deployment-specific"
 stability: preview
 ported_from: [bandit/B507, ruff/S507]
 security: { cwe: [295], owasp: ["A07:2025"], severity: high }
@@ -18,14 +18,10 @@ since: 0.2.0
 match: { any: [{ pattern: '$C.set_missing_host_key_policy($P)' }] }
 constraints: { P: { regex: '(AutoAddPolicy|WarningPolicy)' } }
 message: 'This accepts any SSH host key; load known hosts and reject unknown ones'
+fix:
+  - replace: { target: $P, with: "paramiko.RejectPolicy()" }
 ```
 
-## How to fix
-
-1. Call `client.load_system_host_keys()` or `load_host_keys(path)`.
-2. Use `client.set_missing_host_key_policy(paramiko.RejectPolicy())`.
-3. Put the server's key in `known_hosts` ahead of time.
-
 ## Examples
 
 ### Python
@@ -36,6 +32,12 @@ message: 'This accepts any SSH host key; load known hosts and reject unknown one
 client.set_missing_host_key_policy(paramiko.AutoAddPolicy())
 ```
 
+#### Fixed
+
+```py
+client.set_missing_host_key_policy(paramiko.RejectPolicy())
+```
+
 #### Do
 
 ```py

codelaw_rules_security_python/rules/sec-py/password-hash-effort.md

@@ -4,6 +4,7 @@ title: 'Passwords are hashed with a slow function'
 languages: [python]
 fix: manual
 fix_reason: "moving to Argon2 or bcrypt means rehashing at the next login and changing the stored format"
+fix_exception: restructure
 stability: preview
 security: { cwe: [916], owasp: ["A04:2025"], severity: high }
 since: 0.2.0

codelaw_rules_security_python/rules/sec-py/start-process-with-no-shell.cases.md

@@ -0,0 +1,25 @@
+# sec-py/start-process-with-no-shell — cases
+
+### case: imported by name
+
+```python
+from os import execv
+
+execv("/bin/ls", ["ls"])
+```
+
+```expect
+3:1 sec-py/start-process-with-no-shell
+```
+
+### case: os.system is another rule's
+
+```python
+import os
+
+os.system("ls")
+```
+
+```expect
+(none)
+```

codelaw_rules_security_python/rules/sec-py/start-process-with-no-shell.md

@@ -0,0 +1,50 @@
+---
+id: sec-py/start-process-with-no-shell
+title: "A process is started with `os.exec*`, `os.spawn*` or `os.startfile`"
+languages: [python]
+fix: manual
+fix_reason: "starting the process is the point; whether its arguments are safe is the author's"
+fix_exception: security
+stability: preview
+ported_from: [ruff/S606]
+security: { cwe: [78], owasp: ["A05:2025"], severity: low }
+since: 0.5.0
+---
+
+A call that resolves to `os.execl`, `execle`, `execlp`, `execlpe`, `execv`, `execve`, `execvp`, `execvpe`, `spawnl`, `spawnle`, `spawnlp`, `spawnlpe`, `spawnv`, `spawnve`, `spawnvp`, `spawnvpe` or `startfile` is reported. These start a process without a shell, which is a smaller risk than `os.system` (`sec-py/no-shell`).
+
+**Why:** A process started with a value the program did not write runs whatever that value names. The `os` functions have no shell to inject into, so the risk is the program or the arguments an attacker can choose (CWE-78).
+
+```codelaw
+native: sec-py/start-process-with-no-shell
+```
+
+## How to fix
+
+1. Pass a fixed program and validate every argument.
+2. Use `subprocess.run([...])` with a list and `check=True`, which reports a failed start.
+
+
+## Examples
+
+### Python
+
+#### Don't
+
+```python
+import os
+
+os.execv(program, [program, name])
+```
+
+#### Do
+
+```python
+import subprocess
+
+subprocess.run(["/usr/bin/tool", name], check=True)
+```
+
+## Differences from the source
+
+Names are resolved through the file's imports (`from os import execv` counts); the rule reports the call, where Ruff reports the same range.

codelaw_rules_security_python/rules/sec-py/suspicious-httpoxy-import.md

@@ -0,0 +1,50 @@
+---
+id: sec-py/suspicious-httpoxy-import
+title: "`CGIHandler` or `CGIScript` is imported"
+languages: [python]
+fix: manual
+fix_reason: "the replacement is a different server model, not an edit"
+fix_exception: security
+stability: preview
+ported_from: [ruff/S412]
+security: { cwe: [20], owasp: ["A05:2025"], severity: medium }
+since: 0.5.0
+---
+
+`from wsgiref.handlers import CGIHandler` and `from twisted.web.twcgi import CGIScript` are reported at the module name.
+
+**Why:** CGI passes the `Proxy` request header to the program as the `HTTP_PROXY` environment variable, which HTTP clients in the same process then obey: a request can route the program's outgoing calls through an attacker's proxy (httpoxy, CVE-2016-5385). Avoiding CGI for web applications avoids the class of attack.
+
+```codelaw
+native: sec-py/suspicious-httpoxy-import
+```
+
+## How to fix
+
+1. Serve the application through a WSGI or ASGI server (`gunicorn`, `uvicorn`, `waitress`) instead of CGI.
+2. If CGI cannot be avoided, drop `HTTP_PROXY` from the environment before any outgoing request.
+
+
+## Examples
+
+### Python
+
+#### Don't
+
+```python
+from wsgiref.handlers import CGIHandler
+
+CGIHandler().run(app)
+```
+
+#### Do
+
+```python
+from wsgiref.simple_server import make_server
+
+make_server("", 8000, app).serve_forever()
+```
+
+## Differences from the source
+
+Only the two `from … import` forms are reported, as in Ruff; `import wsgiref.handlers` and a later `wsgiref.handlers.CGIHandler` are not. The CWE is codelaw's mapping (20, input validation); Ruff does not give one.