Last but not least it has an effect on application security. Attackers might be able to decompile the code and thereby discover a potentially sensitive address. They can perform a Denial of Service attack on the service at this address or spoof the IP address. Such an attack is always possible, but in the case of a hardcoded IP address the fix will be much slower, which will increase an attack's impact.
-The disclosed IP address is sensitive, eg:
There is a risk if you answered yes to any of these questions.
+Don't hard-code the IP address in the source code, instead make it configurable.
+ip = '192.168.12.42' sock = socket.socket() diff --git a/python-checks/src/main/resources/org/sonar/l10n/py/rules/python/S1523.html b/python-checks/src/main/resources/org/sonar/l10n/py/rules/python/S1523.html index b56d89b98c..6a1c678fb3 100644 --- a/python-checks/src/main/resources/org/sonar/l10n/py/rules/python/S1523.html +++ b/python-checks/src/main/resources/org/sonar/l10n/py/rules/python/S1523.html @@ -14,8 +14,7 @@Ask Yourself Whether
You are at risk if you answered yes to the first question. You are increasing the security risks for no reason if you answered yes to the second -question.
+There is a risk if you answered yes to any of those questions.
Regarding the execution of unknown code, the best solution is to not run code provided by an untrusted source. If you really need to do it, run the code in a sandboxed environment. Use jails, firewalls and whatever means your diff --git a/python-checks/src/main/resources/org/sonar/l10n/py/rules/python/S2068.html b/python-checks/src/main/resources/org/sonar/l10n/py/rules/python/S2068.html index ce609dea7b..cb013c638e 100644 --- a/python-checks/src/main/resources/org/sonar/l10n/py/rules/python/S2068.html +++ b/python-checks/src/main/resources/org/sonar/l10n/py/rules/python/S2068.html @@ -15,7 +15,7 @@
You are at risk, if you answered yes to any of these questions.
+There is a risk if you answered yes to any of those questions.
You may be at risk if you answered yes to this question.
+There is a risk if you answered yes to any of those questions.
+cursor = connection.cursor(prepared=True) +sql_insert_query = """ select col from sometable here mycol = %s and othercol = %s """ + +select_tuple = (1, value) + +cursor.execute(sql_insert_query, select_tuple) # Compliant, the query is parameterized +connection.commit() +
You are at risk if you answered yes to any of those questions.
+There is a risk if you answered yes to any of those questions.
HTTPs everywhere so setting the secure flag to true should be the default behaviour
when creating cookies. secure flag to true for session-cookies. Flask
from flask import Response diff --git a/python-checks/src/main/resources/org/sonar/l10n/py/rules/python/S2245.html b/python-checks/src/main/resources/org/sonar/l10n/py/rules/python/S2245.html index 5a3f1d410c..1638390a00 100644 --- a/python-checks/src/main/resources/org/sonar/l10n/py/rules/python/S2245.html +++ b/python-checks/src/main/resources/org/sonar/l10n/py/rules/python/S2245.html @@ -14,7 +14,7 @@Ask Yourself Whether
You are at risk if you answered yes to the first question and any of the following ones.
+There is a risk if you answered yes to any of those questions.
HttpOnly attribute offer an additional protection (not the case for an XSRF-TOKEN cookie / CSRF token for example)
You are at risk if you answered yes to any of those questions.
+There is a risk if you answered yes to any of those questions.
HttpOnly flag should be set to true for most of the cookies and it's mandatory for session /
sensitive-security cookies. Flask:
from flask import Response diff --git a/python-checks/src/main/resources/org/sonar/l10n/py/rules/python/S3457.html b/python-checks/src/main/resources/org/sonar/l10n/py/rules/python/S3457.html index 84c893fda2..8066ca8a02 100644 --- a/python-checks/src/main/resources/org/sonar/l10n/py/rules/python/S3457.html +++ b/python-checks/src/main/resources/org/sonar/l10n/py/rules/python/S3457.html @@ -8,7 +8,6 @@
% will not return the expected string because some arguments are not used. str.format will not return the expected string because some arguments are not used. Rule {rule:python:S2275} covers cases where formatting a string will raise an exception.
@@ -18,10 +17,6 @@You are at risk if you answered yes to any of those questions.
+There is a risk if you answered yes to any of those questions.
You are at risk if you answered yes to any of these questions.
+There is a risk if you answered yes to any of those questions.
Do not enable debug features on production servers.
Django
diff --git a/python-checks/src/main/resources/org/sonar/l10n/py/rules/python/S4721.html b/python-checks/src/main/resources/org/sonar/l10n/py/rules/python/S4721.html index 55fcafbe39..e9d9f435d9 100644 --- a/python-checks/src/main/resources/org/sonar/l10n/py/rules/python/S4721.html +++ b/python-checks/src/main/resources/org/sonar/l10n/py/rules/python/S4721.html @@ -1,106 +1,94 @@ -OS commands are security-sensitive. For example, their use has led in the past to the following vulnerabilities:
+Arbitrary OS commands can be executed by an attacker when:
Applications that execute operating system commands or execute commands that interact with the underlying system should neutralize any -externally-provided input used to construct those commands. Failure to do so could allow an attacker to execute unexpected or dangerous commands, -potentially leading to loss of confidentiality, integrity or availability.
--
This rule flags code that specifies the name of the command to run. The goal is to guide security code reviews.
(*) You are at risk if you answered yes to any of those questions.
+There is a risk if you answered yes to any of those questions.
Restrict the control given to the user over the executed command:
--
Restrict which users can have access to the command:
-Reduce the damage the command can do:
Python 3
-import subprocess -import os - -params = ["ls", "-l"] - -subprocess.run(params) # Sensitive -subprocess.Popen(params) # Sensitive - -# Older API - -subprocess.call(params) # Sensitive -subprocess.check_call(params) # Sensitive -subprocess.check_output(params) # Sensitive - -cmd = "ls -l" -os.system(cmd) # Sensitive - -mode = os.P_WAIT -file = "ls" -path = "/bin/ls" -env = os.environ -os.spawnl(mode, path, *params) # Sensitive -os.spawnle(mode, path, *params, env) # Sensitive -os.spawnlp(mode, file, *params) # Sensitive -os.spawnlpe(mode, file, *params, env) # Sensitive -os.spawnv(mode, path, params) # Sensitive -os.spawnve(mode, path, params, env) # Sensitive -os.spawnvp(mode, file, params) # Sensitive -os.spawnvpe(mode, file, params, env) # Sensitive - -mode = 'r' -(child_stdout) = os.popen(cmd, mode, 1) # Sensitive -# print(child_stdout.read()) +subprocess.run(cmd, shell=True) # Sensitive +subprocess.Popen(cmd, shell=True) # Sensitive +subprocess.call(cmd, shell=True) # Sensitive +subprocess.check_call(cmd, shell=True) # Sensitive +subprocess.check_output(cmd, shell=True) # Sensitive +os.system(cmd) # Sensitive: a shell is always spawn ++
Python 2
++cmd = "when a string is passed through these function, a shell is spawn" +(_, child_stdout, _) = os.popen2(cmd) # Sensitive +(_, child_stdout, _) = os.popen3(cmd) # Sensitive +(_, child_stdout) = os.popen4(cmd) # Sensitive -(_, output) = subprocess.getstatusoutput(cmd) # Sensitive -out = subprocess.getoutput(cmd) # Sensitive +(child_stdout, _) = popen2.popen2(cmd) # Sensitive +(child_stdout, _, _) = popen2.popen3(cmd) # Sensitive +(child_stdout, _) = popen2.popen4(cmd) # Sensitive ++
Python 3
++# by default shell=False, a shell is not spawn +subprocess.run(cmd) # Compliant +subprocess.Popen(cmd) # Compliant +subprocess.call(cmd) # Compliant +subprocess.check_call(cmd) # Compliant +subprocess.check_output(cmd) # Compliant -os.startfile(path) # Sensitive +# always in a subprocess: +os.spawnl(mode, path, *cmd) # Compliant +os.spawnle(mode, path, *cmd, env) # Compliant +os.spawnlp(mode, file, *cmd) # Compliant +os.spawnlpe(mode, file, *cmd, env) # Compliant +os.spawnv(mode, path, cmd) # Compliant +os.spawnve(mode, path, cmd, env) # Compliant +os.spawnvp(mode, file, cmd) # Compliant +os.spawnvpe(mode, file, cmd, env) # Compliant -os.execl(path, *params) # Sensitive -os.execle(path, *params, env) # Sensitive -os.execlp(file, *params) # Sensitive -os.execlpe(file, *params, env) # Sensitive -os.execv(path, params) # Sensitive -os.execve(path, params, env) # Sensitive -os.execvp(file, params) # Sensitive -os.execvpe(file, params, env) # Sensitive +(child_stdout) = os.popen(cmd, mode, 1) # Compliant +(_, output) = subprocess.getstatusoutput(cmd) # Compliant +out = subprocess.getoutput(cmd) # Compliant +os.startfile(path) # Compliant +os.execl(path, *cmd) # Compliant +os.execle(path, *cmd, env) # Compliant +os.execlp(file, *cmd) # Compliant +os.execlpe(file, *cmd, env) # Compliant +os.execv(path, cmd) # Compliant +os.execve(path, cmd, env) # Compliant +os.execvp(file, cmd) # Compliant +os.execvpe(file, cmd, env) # Compliant
Python 2
-import os
-import popen2
+cmdsargs = ("use", "a", "sequence", "to", "directly", "start", "a", "subprocess")
-cmd = "ls -l"
-mode = "r"
-(_, child_stdout) = os.popen2(cmd, mode) # Sensitive
-(_, child_stdout, _) = os.popen3(cmd, mode) # Sensitive
-(_, child_stdout) = os.popen4(cmd, mode) # Sensitive
+(_, child_stdout) = os.popen2(cmdsargs) # Compliant
+(_, child_stdout, _) = os.popen3(cmdsargs) # Compliant
+(_, child_stdout) = os.popen4(cmdsargs) # Compliant
-(child_stdout, _) = popen2.popen2(cmd) # Sensitive
-(child_stdout, _, _) = popen2.popen3(cmd) # Sensitive
-(child_stdout, _) = popen2.popen4(cmd) # Sensitive
+(child_stdout, _) = popen2.popen2(cmdsargs) # Compliant
+(child_stdout, _, _) = popen2.popen3(cmdsargs) # Compliant
+(child_stdout, _) = popen2.popen4(cmdsargs) # Compliant
You may be at risk if you answered yes to any of those questions.
+There is a risk if you answered yes to any of those questions.
Check whether your regular expression engine (the algorithm executing your regular expression) has any known vulnerabilities. Search for vulnerability reports mentioning the one engine you're are using.
diff --git a/python-checks/src/main/resources/org/sonar/l10n/py/rules/python/S4787.html b/python-checks/src/main/resources/org/sonar/l10n/py/rules/python/S4787.html index 32b22841a6..bcedb35add 100644 --- a/python-checks/src/main/resources/org/sonar/l10n/py/rules/python/S4787.html +++ b/python-checks/src/main/resources/org/sonar/l10n/py/rules/python/S4787.html @@ -101,4 +101,6 @@This rule is deprecated, and will eventually be removed.
diff --git a/python-checks/src/main/resources/org/sonar/l10n/py/rules/python/S4787.json b/python-checks/src/main/resources/org/sonar/l10n/py/rules/python/S4787.json index 168ca97bf9..5b617c7cdf 100644 --- a/python-checks/src/main/resources/org/sonar/l10n/py/rules/python/S4787.json +++ b/python-checks/src/main/resources/org/sonar/l10n/py/rules/python/S4787.json @@ -1,31 +1,12 @@ { "title": "Encrypting data is security-sensitive", "type": "SECURITY_HOTSPOT", - "status": "ready", + "status": "deprecated", "tags": [ - "cwe", - "owasp-a6", - "sans-top25-porous", - "owasp-a3" + ], "defaultSeverity": "Critical", "ruleSpecification": "RSPEC-4787", "sqKey": "S4787", - "scope": "Main", - "securityStandards": { - "CWE": [ - 321, - 322, - 323, - 324, - 325, - 326, - 327, - 522 - ], - "OWASP": [ - "A3", - "A6" - ] - } + "scope": "Main" } diff --git a/python-checks/src/main/resources/org/sonar/l10n/py/rules/python/S4790.html b/python-checks/src/main/resources/org/sonar/l10n/py/rules/python/S4790.html index f465e4d91b..3e48ded6a7 100644 --- a/python-checks/src/main/resources/org/sonar/l10n/py/rules/python/S4790.html +++ b/python-checks/src/main/resources/org/sonar/l10n/py/rules/python/S4790.html @@ -9,7 +9,7 @@You are at risk if you answered yes to any of those questions.
+There is a risk if you answered yes to any of those questions.
Safer alternatives, such as SHA-256, SHA-512, SHA-3 or bcrypt are recommended, and for password
hashing, it's even better to use algorithms that not compute too "quickly", like bcrypt instead of SHA-256, because it slows
diff --git a/python-checks/src/main/resources/org/sonar/l10n/py/rules/python/S4792.html b/python-checks/src/main/resources/org/sonar/l10n/py/rules/python/S4792.html
index 4d4cec277e..5516c0f16e 100644
--- a/python-checks/src/main/resources/org/sonar/l10n/py/rules/python/S4792.html
+++ b/python-checks/src/main/resources/org/sonar/l10n/py/rules/python/S4792.html
@@ -25,7 +25,7 @@
You are at risk if you answered yes to any of those questions.
+There is a risk if you answered yes to any of those questions.
This rule is deprecated, and will eventually be removed.
diff --git a/python-checks/src/main/resources/org/sonar/l10n/py/rules/python/S4823.json b/python-checks/src/main/resources/org/sonar/l10n/py/rules/python/S4823.json index 613caad9b5..e6601a6198 100644 --- a/python-checks/src/main/resources/org/sonar/l10n/py/rules/python/S4823.json +++ b/python-checks/src/main/resources/org/sonar/l10n/py/rules/python/S4823.json @@ -1,23 +1,12 @@ { "title": "Using command line arguments is security-sensitive", "type": "SECURITY_HOTSPOT", - "status": "ready", + "status": "deprecated", "tags": [ - "cwe", - "owasp-a1", - "sans-top25-insecure" + ], "defaultSeverity": "Critical", "ruleSpecification": "RSPEC-4823", "sqKey": "S4823", - "scope": "Main", - "securityStandards": { - "CWE": [ - 88, - 214 - ], - "OWASP": [ - "A1" - ] - } + "scope": "Main" } diff --git a/python-checks/src/main/resources/org/sonar/l10n/py/rules/python/S4828.html b/python-checks/src/main/resources/org/sonar/l10n/py/rules/python/S4828.html index 1efb9ef1b1..03698927e9 100644 --- a/python-checks/src/main/resources/org/sonar/l10n/py/rules/python/S4828.html +++ b/python-checks/src/main/resources/org/sonar/l10n/py/rules/python/S4828.html @@ -7,7 +7,7 @@* the PID of the process to which the signal will be sent is coming from an untrusted source. It could for example come from a world-writable file.
* users who are asking for the signal to be sent might not have the permission to send those signals.
-You are at risk if you answered yes to any of these questions.
+There is a risk if you answered yes to any of those questions.
* If the signal is sent because of a user's request. Check that the user is allowed to send this signal. You can for example forbid it if the user doesn't own the process.
diff --git a/python-checks/src/main/resources/org/sonar/l10n/py/rules/python/S4829.html b/python-checks/src/main/resources/org/sonar/l10n/py/rules/python/S4829.html index 51387a6dc9..2b2770dadc 100644 --- a/python-checks/src/main/resources/org/sonar/l10n/py/rules/python/S4829.html +++ b/python-checks/src/main/resources/org/sonar/l10n/py/rules/python/S4829.html @@ -63,4 +63,6 @@This rule is deprecated, and will eventually be removed.
diff --git a/python-checks/src/main/resources/org/sonar/l10n/py/rules/python/S4829.json b/python-checks/src/main/resources/org/sonar/l10n/py/rules/python/S4829.json index 2c84dee673..56c25bda46 100644 --- a/python-checks/src/main/resources/org/sonar/l10n/py/rules/python/S4829.json +++ b/python-checks/src/main/resources/org/sonar/l10n/py/rules/python/S4829.json @@ -1,17 +1,12 @@ { "title": "Reading the Standard Input is security-sensitive", "type": "SECURITY_HOTSPOT", - "status": "ready", + "status": "deprecated", "tags": [ - "cwe" + ], "defaultSeverity": "Critical", "ruleSpecification": "RSPEC-4829", "sqKey": "S4829", - "scope": "Main", - "securityStandards": { - "CWE": [ - 20 - ] - } + "scope": "Main" } diff --git a/python-checks/src/main/resources/org/sonar/l10n/py/rules/python/S4830.json b/python-checks/src/main/resources/org/sonar/l10n/py/rules/python/S4830.json index a5efd016de..519217b807 100644 --- a/python-checks/src/main/resources/org/sonar/l10n/py/rules/python/S4830.json +++ b/python-checks/src/main/resources/org/sonar/l10n/py/rules/python/S4830.json @@ -10,6 +10,7 @@ "cwe", "privacy", "owasp-a6", + "sans-top25-porous", "ssl", "owasp-a3" ], diff --git a/python-checks/src/main/resources/org/sonar/l10n/py/rules/python/S5042.html b/python-checks/src/main/resources/org/sonar/l10n/py/rules/python/S5042.html index c24823bfbe..67fb27781d 100644 --- a/python-checks/src/main/resources/org/sonar/l10n/py/rules/python/S5042.html +++ b/python-checks/src/main/resources/org/sonar/l10n/py/rules/python/S5042.html @@ -16,7 +16,7 @@You are at risk if you answered yes to any of those questions.
+There is a risk if you answered yes to any of those questions.
Validate the full path of the extracted file against the full path of the directory where files are expanded:
diff --git a/python-checks/src/main/resources/org/sonar/l10n/py/rules/python/S5122.html b/python-checks/src/main/resources/org/sonar/l10n/py/rules/python/S5122.html index 78d6c82299..8373ecfd35 100644 --- a/python-checks/src/main/resources/org/sonar/l10n/py/rules/python/S5122.html +++ b/python-checks/src/main/resources/org/sonar/l10n/py/rules/python/S5122.html @@ -15,7 +15,7 @@origin header. You are at risk if you answered yes to any of those questions.
+There is a risk if you answered yes to any of those questions.
Access-Control-Allow-Origin header should be set only for a trusted origin and for specific resources. Django
++CORS_ORIGIN_ALLOW_ALL = False # Compliant ++
Flask
+
+from flask import Flask
+from flask_cors import CORS
+
+app = Flask(__name__)
+CORS(app, resources={r"/*": {"origins": "*", "send_wildcard": "False"}}) # Compliant
+
You are at risk if you answered yes to any of those questions.
+There is a risk if you answered yes to any of those questions.
This rule is deprecated, and will eventually be removed.
diff --git a/python-checks/src/main/resources/org/sonar/l10n/py/rules/python/S5300.json b/python-checks/src/main/resources/org/sonar/l10n/py/rules/python/S5300.json index 95eea24af0..36fc46eaf6 100644 --- a/python-checks/src/main/resources/org/sonar/l10n/py/rules/python/S5300.json +++ b/python-checks/src/main/resources/org/sonar/l10n/py/rules/python/S5300.json @@ -1,23 +1,12 @@ { "title": "Sending emails is security-sensitive", "type": "SECURITY_HOTSPOT", - "status": "ready", + "status": "deprecated", "tags": [ - "cwe", - "owasp-a1", - "sans-top25-insecure" + ], "defaultSeverity": "Critical", "ruleSpecification": "RSPEC-5300", "sqKey": "S5300", - "scope": "Main", - "securityStandards": { - "CWE": [ - 93, - 80 - ], - "OWASP": [ - "A1" - ] - } + "scope": "Main" } diff --git a/python-checks/src/main/resources/org/sonar/l10n/py/rules/python/S5332.html b/python-checks/src/main/resources/org/sonar/l10n/py/rules/python/S5332.html index 253b16c6e5..df79d84bb1 100644 --- a/python-checks/src/main/resources/org/sonar/l10n/py/rules/python/S5332.html +++ b/python-checks/src/main/resources/org/sonar/l10n/py/rules/python/S5332.html @@ -16,6 +16,12 @@There is a risk if you answered yes to any of those questions.
ssh as an alternative to telnet You are at risk if you answered yes to any of those questions.
+There is a risk if you answered yes to any of those questions.
\n).
+