codelaw-rules-security-python 0.4.3__py3-none-any.whl → 0.5.1__py3-none-any.whl

codelaw_rules_security_python/README.md

@@ -22,6 +22,18 @@ preview = true   # every rule is `preview` until a corpus run promotes it
 
 <!-- /docs-sync:presets -->
 
+## The fix ladder
+
+Each rule's fix class ([SR-LAW-4](../../records/0006_LAW-4-every-rule-has-a-fix.md)): `manual` rules by their named exception. `codelaw rules --fix-stats` prints the same table.
+
+<!-- rule-docs:fix-ladder -->
+
+| auto | suggest | manual | value | restructure | authored | security | waiting to move up |
+|---|---|---|---|---|---|---|---|
+| 0 | 29 | 37 | 10 | 9 | 1 | 17 | 0 |
+
+<!-- /rule-docs:fix-ladder -->
+
 `recommended` holds only high-confidence rules, at `error`; `strict` adds the
 heuristic ones, at `warn`, so a team can start without noise.
 

codelaw_rules_security_python/codelaw-pack.toml

@@ -1,5 +1,5 @@
 name = "codelaw-rules-security-python"
-version = "0.4.3"
+version = "0.5.1"
 min_codelaw = "0.2.0"
 languages = ["python"]
 presets = ["sec-py/recommended", "sec-py/strict"]

codelaw_rules_security_python/corpus.toml

@@ -54,9 +54,14 @@
 "sec-py/no-xml-unsafe-parser" = 0
 "sec-py/no-xmlrpc" = 0
 "sec-py/no-xpath-injection" = 0
+"sec-py/paramiko-call" = 0
 "sec-py/paramiko-host-key" = 0
 "sec-py/password-hash-effort" = 0
 "sec-py/requests-timeout" = 4
+"sec-py/start-process-with-no-shell" = 0
+"sec-py/suspicious-httpoxy-import" = 0
+"sec-py/suspicious-pyghmi-import" = 0
+"sec-py/suspicious-subprocess-import" = 3
 "sec-py/tarfile-filter" = 0
 "sec-py/torch-load-weights-only" = 0
 "sec-py/upload-secure-filename" = 0

codelaw_rules_security_python/rules/sec-py/django-settings.cases.md

@@ -59,3 +59,17 @@ CSRF_COOKIE_SECURE = True
 ```expect
 (none)
 ```
+
+### case: the insecure cookie is turned on
+
+```py path=settings.py
+SESSION_COOKIE_SECURE = False
+```
+
+```expect
+1:1 sec-py/django-settings
+```
+
+```fixed
+SESSION_COOKIE_SECURE = True
+```

codelaw_rules_security_python/rules/sec-py/django-settings.md

@@ -4,8 +4,8 @@ title: 'Django settings are safe'
 languages: [python]
 files: ["**/settings.py", "**/settings/**/*.py", "**/*_settings.py", "**/settings_*.py"]
 exclude: ["**/*dev*.py", "**/*local*.py", "**/*test*.py"]
-fix: manual
-fix_reason: "the production value comes from the deployment (environment variables, a secret manager)"
+fix: suggest
+fix_reason: "the reviewer confirms each cookie or redirect flag turned on suits the deployment; DEBUG, SECRET_KEY and ALLOWED_HOSTS get no edit (the value comes from the deployment)"
 stability: preview
 ported_from: [ruff/S105]
 security: { cwe: [489, 798, 614], owasp: ["A02:2025"], severity: high }
@@ -36,8 +36,10 @@ match:
             - has:
                 field: left
                 regex: '^(SESSION_COOKIE_SECURE|CSRF_COOKIE_SECURE|SECURE_SSL_REDIRECT|SESSION_COOKIE_HTTPONLY)$'
-            - { has: { field: right, kind: 'false' } }
+            - { has: { field: right, kind: 'false', pattern: $B } }
 message: 'This Django setting is unsafe outside development'
+fix:
+  - replace: { target: $B, with: 'True' }
 ```
 
 ## How to fix
@@ -54,15 +56,11 @@ message: 'This Django setting is unsafe outside development'
 #### Don't
 
 ```py path=settings.py
-DEBUG = True
-ALLOWED_HOSTS = ["*"]
+SESSION_COOKIE_SECURE = False
 ```
 
 #### Do
 
 ```py path=settings.py
-import os
-
-DEBUG = os.environ.get("DJANGO_DEBUG") == "1"
-ALLOWED_HOSTS = ["app.example.com"]
+SESSION_COOKIE_SECURE = True
 ```

codelaw_rules_security_python/rules/sec-py/fastapi-cors.md

@@ -4,6 +4,7 @@ title: 'CORS does not allow every origin with credentials'
 languages: [python]
 fix: manual
 fix_reason: "the list of trusted origins is the application's own"
+fix_exception: value
 stability: preview
 security: { cwe: [942], owasp: ["A02:2025"], severity: high }
 since: 0.2.0

codelaw_rules_security_python/rules/sec-py/flask-settings.cases.md

@@ -49,3 +49,31 @@ app.config["SESSION_COOKIE_SECURE"] = True
 ```expect
 (none)
 ```
+
+### case: a keyword flag is turned on
+
+```py
+app.config.update(SESSION_COOKIE_SECURE=False)
+```
+
+```expect
+1:1 sec-py/flask-settings
+```
+
+```fixed
+app.config.update(SESSION_COOKIE_SECURE=True)
+```
+
+### case: an assigned flag is turned on
+
+```py
+app.config["WTF_CSRF_ENABLED"] = False
+```
+
+```expect
+1:1 sec-py/flask-settings
+```
+
+```fixed
+app.config["WTF_CSRF_ENABLED"] = True
+```

codelaw_rules_security_python/rules/sec-py/flask-settings.md

@@ -3,8 +3,8 @@ id: sec-py/flask-settings
 title: 'Flask configuration is safe'
 languages: [python]
 exclude: ["**/tests/**", "**/test/**", "**/test_*.py", "**/*_test.py", "**/*_tests.py", "**/tests.py", "**/conftest.py"]
-fix: manual
-fix_reason: "the production values come from the deployment (environment variables, a secret manager)"
+fix: suggest
+fix_reason: "the reviewer confirms each flag turned on suits the deployment; a literal SECRET_KEY gets no edit (the value comes from the deployment)"
 stability: preview
 security: { cwe: [798, 352, 614], owasp: ["A02:2025"], severity: high }
 since: 0.2.0
@@ -30,7 +30,7 @@ match:
         - has:
             field: left
             regex: 'config\[\s*[''"](WTF_CSRF_ENABLED|WTF_CSRF_CHECK_DEFAULT|SESSION_COOKIE_SECURE|SESSION_COOKIE_HTTPONLY)[''"]\s*\]$'
-        - { has: { field: right, kind: 'false' } }
+        - { has: { field: right, kind: 'false', pattern: $B } }
     - kind: call
       all:
         - { has: { field: function, regex: '\.config\.(update|from_mapping)$' } }
@@ -48,15 +48,17 @@ match:
                   kind: keyword_argument
                   all:
                     - { has: { field: name, regex: '^WTF_CSRF_ENABLED$' } }
-                    - { has: { field: value, kind: 'false' } }
+                    - { has: { field: value, kind: 'false', pattern: $B } }
             - has:
                 field: arguments
                 has:
                   kind: keyword_argument
                   all:
                     - { has: { field: name, regex: '^SESSION_COOKIE_SECURE$' } }
-                    - { has: { field: value, kind: 'false' } }
+                    - { has: { field: value, kind: 'false', pattern: $B } }
 message: 'This Flask setting is unsafe outside development'
+fix:
+  - replace: { target: $B, with: 'True' }
 ```
 
 ## How to fix
@@ -72,13 +74,11 @@ message: 'This Flask setting is unsafe outside development'
 #### Don't
 
 ```py
-app.config["SECRET_KEY"] = "dev-secret-key"
+app.config["SESSION_COOKIE_SECURE"] = False
 ```
 
 #### Do
 
 ```py
-import os
-
-app.config["SECRET_KEY"] = os.environ["FLASK_SECRET_KEY"]
+app.config["SESSION_COOKIE_SECURE"] = True
 ```

codelaw_rules_security_python/rules/sec-py/hf-pin-revision.md

@@ -4,6 +4,7 @@ title: 'Hugging Face downloads pin a revision'
 languages: [python]
 fix: manual
 fix_reason: "the commit hash to pin is a choice the author makes after reviewing the model"
+fix_exception: value
 stability: preview
 ported_from: [bandit/B615]
 security: { cwe: [494], owasp: ["A03:2025"], severity: medium }

codelaw_rules_security_python/rules/sec-py/logging-listen.md

@@ -4,6 +4,7 @@ title: "`logging.config.listen` is not used"
 languages: [python]
 fix: manual
 fix_reason: "reconfiguring a running process needs another route (a signal handler, a config reload) the author has to choose"
+fix_exception: restructure
 stability: preview
 ported_from: [bandit/B612, ruff/S612]
 security: { cwe: [94], owasp: ["A08:2025"], severity: high }

codelaw_rules_security_python/rules/sec-py/ml-unsafe-load.cases.md

@@ -59,3 +59,17 @@ keras.models.load_model(p)
 ```expect
 (none)
 ```
+
+### case: allow_pickle is dropped with its comma
+
+```py
+arr = np.load(path, allow_pickle=True, mmap_mode="r")
+```
+
+```expect
+1:7 sec-py/ml-unsafe-load
+```
+
+```fixed
+arr = np.load(path, mmap_mode="r")
+```

codelaw_rules_security_python/rules/sec-py/ml-unsafe-load.md

@@ -2,8 +2,8 @@
 id: sec-py/ml-unsafe-load
 title: 'Model and array files are not unpickled'
 languages: [python]
-fix: manual
-fix_reason: "the replacement format (`safetensors`, `.npy` without pickle, Parquet) means converting the stored files"
+fix: suggest
+fix_reason: "the reviewer confirms the arrays are not object arrays, which stop loading once allow_pickle is dropped; the pickle loaders (joblib, read_pickle) and safe_mode=False get no edit (the files must be converted)"
 stability: preview
 security: { cwe: [502], owasp: ["A08:2025"], severity: high }
 since: 0.2.0
@@ -23,6 +23,7 @@ match:
             field: arguments
             has:
               kind: keyword_argument
+              pattern: $K
               all:
                 - { has: { field: name, regex: '^allow_pickle$' } }
                 - { has: { field: value, kind: 'true' } }
@@ -39,6 +40,8 @@ match:
               kind: keyword_argument
               all: [{ has: { field: name, regex: '^safe_mode$' } }, { has: { field: value, kind: 'false' } }]
 message: 'This loads a pickle, which can run code; use `safetensors` or a data-only format'
+fix:
+  - remove: $K
 ```
 
 ## How to fix

codelaw_rules_security_python/rules/sec-py/no-assert-for-auth.cases.md

@@ -29,3 +29,19 @@ assert current_user.id == owner_id
 ```expect
 1:1 sec-py/no-assert-for-auth
 ```
+
+### case: the message goes into the exception
+
+```py
+def delete(request):
+    assert request.user.is_staff, "staff only"
+```
+
+```expect
+2:5 sec-py/no-assert-for-auth
+```
+
+```fixed
+def delete(request):
+    if not (request.user.is_staff): raise AssertionError("staff only")
+```

codelaw_rules_security_python/rules/sec-py/no-assert-for-auth.md

@@ -3,8 +3,8 @@ id: sec-py/no-assert-for-auth
 title: "`assert` is not an access check"
 languages: [python]
 exclude: ["**/tests/**", "**/test/**", "**/test_*.py", "**/*_test.py", "**/*_tests.py", "**/tests.py", "**/conftest.py"]
-fix: manual
-fix_reason: "the replacement raises the right exception for the framework, which only the author knows"
+fix: suggest
+fix_reason: "the edit raises AssertionError so the check survives `python -O`, which changes behaviour on purpose; the reviewer confirms it and may pick the framework's exception (PermissionDenied, 403) instead"
 stability: preview
 ported_from: [bandit/B101, ruff/S101]
 security: { cwe: [703], owasp: ["A10:2025"], severity: medium }
@@ -19,8 +19,20 @@ A permission, role or authentication test is not written as an `assert`.
 match:
   all:
     - { kind: assert_statement }
+    - any:
+        - all:
+            - { pattern: $S1 }
+            - { has: { nthChild: 1, pattern: $X } }
+            - not: { has: { nthChild: 2 } }
+        - all:
+            - { pattern: $S2 }
+            - { has: { nthChild: 1, pattern: $X } }
+            - { has: { nthChild: 2, pattern: $M } }
     - regex: '(?i)(is_authenticated|is_admin|is_staff|is_superuser|has_perm|has_permission|permission|authorized|authenticated|is_owner|\.role\b|\.roles\b|current_user|user\.id\s*==)'
 message: 'An `assert` is removed by `python -O`; raise an exception for an access check'
+fix:
+  - replace: { target: $S1, with: 'if not ($X): raise AssertionError' }
+  - replace: { target: $S2, with: 'if not ($X): raise AssertionError($M)' }
 ```
 
 ## How to fix
@@ -39,6 +51,13 @@ def delete(request, item):
     assert request.user.is_staff
 ```
 
+#### Fixed
+
+```py
+def delete(request, item):
+    if not (request.user.is_staff): raise AssertionError
+```
+
 #### Do
 
 ```py

codelaw_rules_security_python/rules/sec-py/no-bind-all-interfaces.cases.md

@@ -39,3 +39,41 @@ app.run(host=HOST)
 ```expect
 (none)
 ```
+
+### case: the IPv4 wildcard becomes loopback
+
+```py
+s.bind(("0.0.0.0", 80))
+```
+
+```expect
+1:1 sec-py/no-bind-all-interfaces
+```
+
+```fixed
+s.bind(("127.0.0.1", 80))
+```
+
+### case: the IPv6 wildcard becomes its loopback
+
+```py
+app.run(host="::")
+```
+
+```expect
+1:1 sec-py/no-bind-all-interfaces
+```
+
+```fixed
+app.run(host="::1")
+```
+
+### case: a host and port string has no edit
+
+```py
+server.run(bind="0.0.0.0:8000")
+```
+
+```expect
+1:1 sec-py/no-bind-all-interfaces
+```

codelaw_rules_security_python/rules/sec-py/no-bind-all-interfaces.md

@@ -3,8 +3,8 @@ id: sec-py/no-bind-all-interfaces
 title: 'A server does not bind to every interface in code'
 languages: [python]
 severity: warn
-fix: manual
-fix_reason: "the address belongs in configuration, with a loopback default"
+fix: suggest
+fix_reason: "the reviewer confirms the loopback address suits the deployment (a container needs the address from its configuration); a host:port string for bind= gets no edit"
 stability: preview
 ported_from: [bandit/B104, ruff/S104]
 security: { cwe: [605], owasp: ["A02:2025"], severity: low }
@@ -26,7 +26,12 @@ match:
             has:
               nthChild: 1
               kind: tuple
-              has: { nthChild: 1, kind: string, regex: '^[''"](0\.0\.0\.0|::)[''"]$' }
+              has:
+                nthChild: 1
+                kind: string
+                any:
+                  - { regex: '^[''"]0\.0\.0\.0[''"]$', pattern: $A }
+                  - { regex: '^[''"]::[''"]$', pattern: $B }
     - all:
         - { kind: call }
         - has:
@@ -35,7 +40,12 @@ match:
               kind: keyword_argument
               all:
                 - { has: { field: name, regex: '^host$' } }
-                - { has: { field: value, kind: string, regex: '^[''"](0\.0\.0\.0|::)[''"]$' } }
+                - has:
+                    field: value
+                    kind: string
+                    any:
+                      - { regex: '^[''"]0\.0\.0\.0[''"]$', pattern: $A }
+                      - { regex: '^[''"]::[''"]$', pattern: $B }
     - all:
         - { kind: call }
         - has:
@@ -46,6 +56,9 @@ match:
                 - { has: { field: name, regex: '^bind$' } }
                 - { has: { field: value, kind: string, regex: '^[''"](0\.0\.0\.0|\[::\]):[0-9]+[''"]$' } }
 message: 'This binds to every network interface; read the address from configuration'
+fix:
+  - replace: { target: $A, with: '"127.0.0.1"' }
+  - replace: { target: $B, with: '"::1"' }
 ```
 
 ## How to fix
@@ -65,6 +78,14 @@ import uvicorn
 uvicorn.run(app, host="0.0.0.0")
 ```
 
+#### Fixed
+
+```py
+import uvicorn
+
+uvicorn.run(app, host="127.0.0.1")
+```
+
 #### Do
 
 ```py

codelaw_rules_security_python/rules/sec-py/no-cleartext-http.md

@@ -4,6 +4,7 @@ title: 'Requests go over HTTPS'
 languages: [python]
 fix: manual
 fix_reason: "the server must serve HTTPS first, and the URL change has to follow it"
+fix_exception: security
 stability: preview
 security: { cwe: [319], owasp: ["A04:2025"], severity: medium }
 since: 0.2.0

codelaw_rules_security_python/rules/sec-py/no-csrf-exempt.cases.md

@@ -47,3 +47,20 @@ def v(request):
 ```expect
 (none)
 ```
+
+### case: the decorator line is removed
+
+```py
+@csrf_exempt
+def update(request):
+    ...
+```
+
+```expect
+1:1 sec-py/no-csrf-exempt
+```
+
+```fixed
+def update(request):
+    ...
+```

codelaw_rules_security_python/rules/sec-py/no-csrf-exempt.md

@@ -2,8 +2,8 @@
 id: sec-py/no-csrf-exempt
 title: 'No `@csrf_exempt`'
 languages: [python]
-fix: manual
-fix_reason: "an endpoint that needs to be exempt (a webhook) needs its own authentication, which only the author can choose"
+fix: suggest
+fix_reason: "removing the decorator makes the view check CSRF, so a webhook stops working until it has its own authentication; the reviewer confirms the view is not one, and removes the import if nothing else uses it"
 stability: preview
 security: { cwe: [352], owasp: ["A01:2025"], severity: high }
 since: 0.2.0
@@ -18,6 +18,8 @@ match:
   kind: decorator
   regex: '^@\s*((django\.views\.decorators\.csrf\.)|(csrf\.))?csrf_exempt\b'
 message: 'This view skips the CSRF check'
+fix:
+  - remove: $$MATCH
 ```
 
 ## How to fix
@@ -39,6 +41,15 @@ def update(request):
     ...
 ```
 
+#### Fixed
+
+```py
+from django.views.decorators.csrf import csrf_exempt
+
+def update(request):
+    ...
+```
+
 #### Do
 
 ```py

codelaw_rules_security_python/rules/sec-py/no-dynamic-import.md

@@ -4,6 +4,7 @@ title: 'A request value does not choose a module or attribute'
 languages: [python]
 fix: manual
 fix_reason: "the allow-list of names is the author's"
+fix_exception: value
 stability: preview
 security: { cwe: [470], owasp: ["A05:2025"], severity: high }
 since: 0.2.0

codelaw_rules_security_python/rules/sec-py/no-exec-eval.md

@@ -4,6 +4,7 @@ title: "`exec`, `eval` and `compile` of a non-literal"
 languages: [python]
 fix: manual
 fix_reason: "the safe replacement (`ast.literal_eval`, a lookup table, a parser) depends on what the string is for"
+fix_exception: security
 stability: preview
 ported_from: [bandit/B102, bandit/B307]
 security: { cwe: [94], owasp: ["A05:2025"], severity: high }

codelaw_rules_security_python/rules/sec-py/no-format-string-injection.md

@@ -4,6 +4,7 @@ title: 'A request value is not a format string'
 languages: [python]
 fix: manual
 fix_reason: "the template has to be a literal, which needs the format string moved out of the request"
+fix_exception: authored
 stability: preview
 security: { cwe: [134], owasp: ["A05:2025"], severity: high }
 since: 0.2.0

codelaw_rules_security_python/rules/sec-py/no-hardcoded-crypto-key.md

@@ -5,6 +5,7 @@ languages: [python]
 exclude: ["**/tests/**", "**/test/**", "**/test_*.py", "**/*_test.py", "**/*_tests.py", "**/tests.py", "**/conftest.py"]
 fix: manual
 fix_reason: "where the key comes from (a key store, an environment variable) is a deployment decision"
+fix_exception: value
 stability: preview
 security: { cwe: [321, 329], owasp: ["A04:2025"], severity: high }
 since: 0.2.0

codelaw_rules_security_python/rules/sec-py/no-hardcoded-secret.md

@@ -5,6 +5,7 @@ languages: [python]
 exclude: ["**/tests/**", "**/test/**", "**/test_*.py", "**/*_test.py", "**/*_tests.py", "**/tests.py", "**/conftest.py"]
 fix: manual
 fix_reason: "where the secret lives instead (environment, secret manager) is a decision, and the leaked one must be rotated"
+fix_exception: value
 stability: preview
 ported_from: [bandit/B105, bandit/B106, bandit/B107, ruff/S105, ruff/S106, ruff/S107]
 security: { cwe: [798], owasp: ["A07:2025"], severity: high }

codelaw_rules_security_python/rules/sec-py/no-header-injection.cases.md

@@ -43,3 +43,19 @@ def v(request):
 ```expect
 (none)
 ```
+
+### case: the default choice strips line breaks
+
+```py
+def v(request):
+    resp.headers["X-A"] = request.args["a"]
+```
+
+```expect
+2:5 sec-py/no-header-injection
+```
+
+```fixed
+def v(request):
+    resp.headers["X-A"] = str(request.args["a"]).replace("\r", "").replace("\n", "")
+```

codelaw_rules_security_python/rules/sec-py/no-header-injection.md

@@ -2,8 +2,8 @@
 id: sec-py/no-header-injection
 title: 'A request value is not a response header'
 languages: [python]
-fix: manual
-fix_reason: "whether to reject, strip or encode the value depends on what the header is for"
+fix: suggest
+fix_reason: "stripping the line breaks is one of two safe forms; the reviewer picks between them, or rejects the value or encodes it, and confirms the value is meant to be one header line"
 stability: preview
 security: { cwe: [113], owasp: ["A05:2025"], severity: medium }
 since: 0.2.0
@@ -24,6 +24,15 @@ match:
 constraints: { R: { regex: '^(resp|response|res|r|rv|rsp|self\.response|make_response\(.*\))$' } }
 where: { $V: { from_source: { tables: [sources/django, sources/flask, sources/fastapi] } } }
 message: '`$V` comes from the request and is written into a header'
+fix:
+  choices:
+    - label: strip line breaks
+      default: true
+      fix:
+        - replace: { target: $V, with: 'str($V).replace("\r", "").replace("\n", "")' }
+    - label: join lines with a space
+      fix:
+        - replace: { target: $V, with: '" ".join(str($V).splitlines())' }
 ```
 
 ## How to fix
@@ -45,6 +54,24 @@ def view(request):
     return resp
 ```
 
+#### Fixed (strip line breaks)
+
+```py
+def view(request):
+    resp = make_response("ok")
+    resp.headers["X-Name"] = str(request.args["name"]).replace("\r", "").replace("\n", "")
+    return resp
+```
+
+#### Fixed (join lines with a space)
+
+```py
+def view(request):
+    resp = make_response("ok")
+    resp.headers["X-Name"] = " ".join(str(request.args["name"]).splitlines())
+    return resp
+```
+
 #### Do
 
 ```py

codelaw_rules_security_python/rules/sec-py/no-insecure-protocol.md

@@ -3,7 +3,8 @@ id: sec-py/no-insecure-protocol
 title: 'No Telnet, FTP or SNMP v1/v2'
 languages: [python]
 fix: manual
-fix_reason: "the replacement (SSH or SFTP, FTPS, SNMPv3) needs the server to support it"
+fix_reason: "the finding is the import or the community string; the replacement (SSH or SFTP, FTPS, SNMPv3) is a different client and needs the server to support it"
+fix_exception: restructure
 stability: preview
 ported_from: [bandit/B312, bandit/B321, bandit/B401, bandit/B402, bandit/B508, bandit/B509, ruff/S401, ruff/S402, ruff/S312, ruff/S321, ruff/S508, ruff/S509]
 security: { cwe: [319], owasp: ["A04:2025"], severity: high }

codelaw_rules_security_python/rules/sec-py/no-ldap-injection.md

@@ -4,6 +4,7 @@ title: 'LDAP filters are not built from strings'
 languages: [python]
 fix: manual
 fix_reason: "the escaping function belongs to the LDAP library in use"
+fix_exception: security
 stability: preview
 security: { cwe: [90], owasp: ["A05:2025"], severity: high }
 since: 0.2.0

codelaw_rules_security_python/rules/sec-py/no-llm-output-to-sink.md

@@ -5,6 +5,7 @@ languages: [python]
 severity: warn
 fix: manual
 fix_reason: "what to do with the output instead (parse it against a schema, pick from a fixed list of actions) is a design choice"
+fix_exception: restructure
 stability: preview
 security: { cwe: [94], owasp: ["A05:2025"], severity: high }
 since: 0.2.0