Skip to content

Add Security Rules for Flask, Cassandra, and Couchbase in YAML Configs #65

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
merged 3 commits into from
Dec 11, 2024
Merged

Add Security Rules for Flask, Cassandra, and Couchbase in YAML Configs #65

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
3 commits
Select commit Hold shift + click to select a range
e108346
python-cassandra-empty-password-python
ESS-ENN Dec 4, 2024
f1883e7
python-couchbase-empty-password-python
ESS-ENN Dec 4, 2024
0747c3d
hashids-with-flask-secret-python
ESS-ENN Dec 4, 2024
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
201 changes: 201 additions & 0 deletions rules/python/security/hashids-with-flask-secret-python.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -0,0 +1,201 @@
id: hashids-with-flask-secret-python
severity: warning
language: python
message: >-
The Flask secret key is used as salt in HashIDs. The HashID mechanism
is not secure. By observing sufficient HashIDs, the salt used to construct
them can be recovered. This means the Flask secret key can be obtained by
attackers, through the HashIDs).
note: >-
[CWE-327] Use of a Broken or Risky Cryptographic Algorithm.
[REFERENCES]
- https://flask.palletsprojects.com/en/2.2.x/config/#SECRET_KEY
- http://carnage.github.io/2015/08/cryptanalysis-of-hashids
utils:
hashids.Hashids(..., salt=flask.current_app.config['SECRET_KEY'], ...):
# hashids.Hashids(..., salt=flask.current_app.config['SECRET_KEY'], ...)
kind: call
all:
- has:
stopBy: neighbor
kind: attribute
regex: ^hashids.Hashids$
- has:
stopBy: neighbor
kind: argument_list
has:
stopBy: end
kind: keyword_argument
all:
- has:
stopBy: neighbor
kind: identifier
regex: ^salt$
- has:
stopBy: neighbor
kind: subscript
pattern: flask.current_app.config['SECRET_KEY']
hashids.Hashids(flask.current_app.config['SECRET_KEY'], ...):
# hashids.Hashids(flask.current_app.config['SECRET_KEY'], ...)
kind: call
all:
- has:
stopBy: neighbor
kind: attribute
regex: ^hashids.Hashids$
- has:
stopBy: neighbor
kind: argument_list
has:
stopBy: neighbor
kind: subscript
pattern: flask.current_app.config['SECRET_KEY']
hashids.Hashids($APP.config['SECRET_KEY'], ...):
# hashids.Hashids($APP.config['SECRET_KEY'], ...)
kind: call
all:
- has:
stopBy: neighbor
kind: attribute
regex: ^hashids.Hashids$
- has:
stopBy: neighbor
kind: argument_list
has:
stopBy: neighbor
kind: subscript
pattern: $APP.config['SECRET_KEY']
- inside:
stopBy: end
kind: module
has:
stopBy: end
kind: expression_statement
has:
stopBy: neighbor
kind: assignment
pattern: $APP = flask.Flask($$$)
hashids.Hashids(..., salt=$APP.config['SECRET_KEY'], ...):
# hashids.Hashids(..., salt=$APP.config['SECRET_KEY'], ...)
kind: call
all:
- has:
stopBy: neighbor
kind: attribute
regex: ^hashids.Hashids$
- has:
stopBy: neighbor
kind: argument_list
has:
stopBy: end
kind: keyword_argument
all:
- has:
stopBy: neighbor
kind: identifier
regex: ^salt$
- has:
stopBy: neighbor
kind: subscript
pattern: $APP.config['SECRET_KEY']
- inside:
stopBy: end
kind: module
has:
stopBy: end
kind: expression_statement
has:
stopBy: neighbor
kind: assignment
pattern: $APP = flask.Flask($$$)
Hashids(salt=app.config['SECRET_KEY']):
# from hashids import Hashids
# from flask import current_app as app
# hash_id = Hashids(salt=app.config['SECRET_KEY'])
kind: call
all:
- has:
stopBy: neighbor
kind: identifier
regex: ^Hashids$
- has:
stopBy: neighbor
kind: argument_list
has:
stopBy: end
kind: keyword_argument
all:
- has:
stopBy: neighbor
kind: identifier
regex: ^salt$
- has:
stopBy: neighbor
kind: subscript
pattern: $APP.config['SECRET_KEY']
- inside:
stopBy: end
kind: module
all:
- has:
stopBy: end
kind: import_from_statement
pattern: from hashids import Hashids
- any:
- has:
stopBy: end
kind: import_from_statement
pattern: from flask import current_app as $APP
- has:
stopBy: end
kind: expression_statement
has:
stopBy: end
kind: assignment
pattern: $APP = Flask($$$)
Hashids(salt=current_app.config['SECRET_KEY']):
# from hashids import Hashids
# from flask import current_app
# hashids = Hashids(min_length=5, salt=current_app.config['SECRET_KEY'])
kind: call
all:
- has:
stopBy: neighbor
kind: identifier
regex: ^Hashids$
- has:
stopBy: neighbor
kind: argument_list
has:
stopBy: end
kind: keyword_argument
all:
- has:
stopBy: neighbor
kind: identifier
regex: ^salt$
- has:
stopBy: neighbor
kind: subscript
pattern: current_app.config['SECRET_KEY']
- inside:
stopBy: end
kind: module
all:
- has:
stopBy: end
kind: import_from_statement
pattern: from hashids import Hashids
- has:
stopBy: end
kind: import_from_statement
pattern: from flask import current_app
rule:
kind: call
any:
- matches: hashids.Hashids(..., salt=flask.current_app.config['SECRET_KEY'], ...)
- matches: hashids.Hashids(flask.current_app.config['SECRET_KEY'], ...)
- matches: hashids.Hashids($APP.config['SECRET_KEY'], ...)
- matches: hashids.Hashids(..., salt=$APP.config['SECRET_KEY'], ...)
- matches: Hashids(salt=app.config['SECRET_KEY'])
- matches: Hashids(salt=current_app.config['SECRET_KEY'])
Loading