hashids-with-django-secret-python

ESS-ENN · ESS-ENN · commit 55368780c607 · 2024-09-19T17:47:55.000+05:30
diff --git a/rules/python/security/hashids-with-django-secret-python.yml b/rules/python/security/hashids-with-django-secret-python.yml
@@ -0,0 +1,18 @@
+id: hashids-with-django-secret-python
+language: python
+severity: warning
+message: >-
+  The Django secret key is used as salt in HashIDs. The HashID mechanism
+  is not secure. By observing sufficient HashIDs, the salt used to construct
+  them can be recovered. This means the Django secret key can be obtained by
+  attackers, through the HashIDs.
+note: >-
+  [CWE-327]: Use of a Broken or Risky Cryptographic Algorithm
+  [OWASP A02:2021]: Cryptographic Failures
+  [REFERENCES]
+       https://docs.djangoproject.com/en/4.2/ref/settings/#std-setting-SECRET_KEY
+       http://carnage.github.io/2015/08/cryptanalysis-of-hashids
+rule:
+  any:
+    - pattern: Hashids(salt=settings.SECRET_KEY, $$$)
+    - pattern: Hashids(settings.SECRET_KEY, $$$)
diff --git a/tests/__snapshots__/hashids-with-django-secret-python-snapshot.yml b/tests/__snapshots__/hashids-with-django-secret-python-snapshot.yml
@@ -0,0 +1,11 @@
+id: hashids-with-django-secret-python
+snapshots:
+  ? |
+    Hashids(salt=settings.SECRET_KEY, min_length=settings.ID_HASH_MIN_LENGTH)
+    Hashids(salt=settings.SECRET_KEY, min_length=4, alphabet="abcdefghijklmnopqrstuvwxyz")
+    Hashids(settings.SECRET_KEY, min_length=length, alphabet=alphabet)
+  : labels:
+    - source: Hashids(salt=settings.SECRET_KEY, min_length=settings.ID_HASH_MIN_LENGTH)
+      style: primary
+      start: 0
+      end: 73
diff --git a/tests/python/hashids-with-django-secret-python-test.yml b/tests/python/hashids-with-django-secret-python-test.yml
@@ -0,0 +1,9 @@
+id: hashids-with-django-secret-python
+valid:
+  - |
+    Hashids(salt=md5.hexdigest(), min_length=16)
+invalid:
+  - |
+    Hashids(salt=settings.SECRET_KEY, min_length=settings.ID_HASH_MIN_LENGTH)
+    Hashids(salt=settings.SECRET_KEY, min_length=4, alphabet="abcdefghijklmnopqrstuvwxyz")
+    Hashids(settings.SECRET_KEY, min_length=length, alphabet=alphabet)
