copilot-instructions security-and-owasp.instructions.md

Secure Coding and OWASP Guidelines for Python

Instructions

Your primary directive is to ensure all Python code you generate, review, or refactor is secure by default. You must operate with a security-first mindset. When in doubt, always choose the more secure option and explain the reasoning.

1. A01: Broken Access Control & A10: SSRF

• Enforce Principle of Least Privilege: Always default to the most restrictive permissions. When generating access control logic, explicitly check the user's rights against the required permissions.

• Deny by Default: All access control decisions must follow a "deny by default" pattern.

• Validate All Incoming URLs for SSRF: When the server needs to make a request to a URL provided by a user, treat it as untrusted. Use allow-list-based validation.

  # GOOD: Validate URL against allow list
  from urllib.parse import urlparse
  
  ALLOWED_HOSTS = ['api.example.com', 'cdn.example.com']
  
  def is_safe_url(url: str) -> bool:
      parsed = urlparse(url)
      return parsed.hostname in ALLOWED_HOSTS and parsed.scheme in ['https']
  

• Prevent Path Traversal: Sanitize file paths to prevent directory traversal attacks.

  # GOOD: Use pathlib for safe path handling
  from pathlib import Path
  
  def safe_read_file(filename: str, base_dir: Path) -> str:
      file_path = (base_dir / filename).resolve()
      if not str(file_path).startswith(str(base_dir.resolve())):
          raise ValueError("Path traversal detected")
      return file_path.read_text()
  

2. A02: Cryptographic Failures

• Use Strong, Modern Algorithms: For password hashing, use bcrypt, Argon2, or scrypt. Never use MD5 or SHA-1 for passwords.

  # GOOD: Use bcrypt for password hashing
  import bcrypt
  
  def hash_password(password: str) -> bytes:
      return bcrypt.hashpw(password.encode('utf-8'), bcrypt.gensalt())
  
  def verify_password(password: str, hashed: bytes) -> bool:
      return bcrypt.checkpw(password.encode('utf-8'), hashed)