avoid-bind-to-all-interfaces-python

ESS-ENN · ESS-ENN · commit 653318556361 · 2024-10-22T18:39:37.000+05:30
diff --git a/rules/python/security/avoid-bind-to-all-interfaces-python.yml b/rules/python/security/avoid-bind-to-all-interfaces-python.yml
@@ -0,0 +1,64 @@
+id: avoid-bind-to-all-interfaces-python
+severity: warning
+language: python
+message: >-
+  Running `socket.bind` to 0.0.0.0, or empty string could unexpectedly
+  expose the server publicly as it binds to all available interfaces.
+  Consider instead getting correct address from an environment variable or
+  configuration file.
+note: >-
+  [CWE-200] Exposure of Sensitive Information to an Unauthorized Actor.
+  [REFERENCES]
+      - https://owasp.org/Top10/A01_2021-Broken_Access_Control
+utils:
+  MATCH_PATTERN_$S.bind:
+    kind: expression_statement
+    all:
+      - has:
+          stopBy: neighbor
+          kind: call
+          all:
+            - has:
+                stopBy: neighbor
+                kind: attribute
+                all:
+                  - has:
+                      stopBy: neighbor
+                      kind: identifier
+                  - has:
+                      stopBy: neighbor
+                      kind: identifier
+                      regex: "^bind$"
+            - has:
+                stopBy: neighbor
+                kind: argument_list
+                has:
+                  stopBy: neighbor
+                  kind: tuple
+                  has:
+                    stopBy: neighbor
+                    kind: string
+                    regex: ^'0.0.0.0'|'::'|''$
+      - follows:
+          stopBy: end
+          kind: expression_statement
+          has:
+            stopBy: end
+            kind: call
+            has:
+              stopBy: neighbor
+              kind: attribute
+              all:
+                - has:
+                    stopBy: neighbor
+                    kind: identifier
+                    regex: "^socket$"
+                - has:
+                    stopBy: neighbor
+                    kind: identifier
+                    regex: "^socket$"
+
+rule:
+  kind: expression_statement
+  any:
+    - matches: MATCH_PATTERN_$S.bind
diff --git a/tests/__snapshots__/avoid-bind-to-all-interfaces-python-snapshot.yml b/tests/__snapshots__/avoid-bind-to-all-interfaces-python-snapshot.yml
@@ -0,0 +1,62 @@
+id: avoid-bind-to-all-interfaces-python
+snapshots:
+  ? |
+    s = socket.socket(doesnt, matter)
+    s.bind(('',))
+    s = socket.socket(doesnt, matter)
+    s.bind(('::', 1337))
+    s = socket.socket(doesnt, matter)
+    s.bind(('0.0.0.0', 1337))
+  : labels:
+    - source: s.bind(('',))
+      style: primary
+      start: 34
+      end: 47
+    - source: s
+      style: secondary
+      start: 34
+      end: 35
+    - source: bind
+      style: secondary
+      start: 36
+      end: 40
+    - source: s.bind
+      style: secondary
+      start: 34
+      end: 40
+    - source: ''''''
+      style: secondary
+      start: 42
+      end: 44
+    - source: ('',)
+      style: secondary
+      start: 41
+      end: 46
+    - source: (('',))
+      style: secondary
+      start: 40
+      end: 47
+    - source: s.bind(('',))
+      style: secondary
+      start: 34
+      end: 47
+    - source: socket
+      style: secondary
+      start: 4
+      end: 10
+    - source: socket
+      style: secondary
+      start: 4
+      end: 10
+    - source: socket.socket
+      style: secondary
+      start: 4
+      end: 17
+    - source: socket.socket(doesnt, matter)
+      style: secondary
+      start: 4
+      end: 33
+    - source: s = socket.socket(doesnt, matter)
+      style: secondary
+      start: 0
+      end: 33
diff --git a/tests/python/avoid-bind-to-all-interfaces-python-test.yml b/tests/python/avoid-bind-to-all-interfaces-python-test.yml
@@ -0,0 +1,13 @@
+id: avoid-bind-to-all-interfaces-python
+valid:
+  - |
+    s = socket.socket(doesnt, matter)
+    s.bind(('fe80::34cb:9850:4868:9d2c', 1337))
+invalid:
+  - |
+    s = socket.socket(doesnt, matter)
+    s.bind(('',))
+    s = socket.socket(doesnt, matter)
+    s.bind(('::', 1337))
+    s = socket.socket(doesnt, matter)
+    s.bind(('0.0.0.0', 1337))
