python-broken-access-control

Python Broken Access Control Security Standards (OWASP A01:2021)

This rule enforces security best practices to prevent broken access control vulnerabilities in Python applications, as defined in OWASP Top 10:2021-A01.

actions:

• type: enforce conditions:

  Pattern 1: Missing access control in Flask routes

  • pattern: "@(app|blueprint)\.route\([^)]\)\s\n\sdef\s+[a-zA-Z0-9_]+\([^)]\):\s*(?![^#]*@login_required|[^#]*current_user\.|[^#]*session\[)" message: "Flask route lacks access control. Consider using @login_required or checking user permissions within the function."

  Pattern 2: Missing access control in Django views

  • pattern: "class\s+[A-Za-z0-9_]+View\((?!LoginRequiredMixin|PermissionRequiredMixin|UserPassesTestMixin)[^)]*\):" message: "Django class-based view lacks access control mixins. Consider using LoginRequiredMixin, PermissionRequiredMixin, or UserPassesTestMixin."

  Pattern 3: Insecure direct object reference

  • pattern: "(get|filter|find)_by_id\(\srequest\.(GET|POST|args|form|json)\[['"][^'"]+['"]\]\s\)" message: "Potential insecure direct object reference (IDOR). Validate that the current user has permission to access this object."

  Pattern 4: Hardcoded role checks

  • pattern: "if\s+user\.role\s*==\s*['"]admin['"]|if\s+user\.(is_staff|is_superuser)\s*:" message: "Hardcoded role checks can be fragile. Consider using a permission system or role-based access control framework."

  Pattern 5: Missing authorization in FastAPI

  • pattern: "@(app|router)\.([a-z]+)\([^)]\)\s\n\s*(?:async\s+)?def\s+[a-zA-Z0-9_]+\([^)]\):\s(?![^#]*Depends\(|[^#]*Security\(|[^#]*HTTPBearer\()" message: "FastAPI endpoint lacks security dependencies. Consider using Depends(get_current_user) or similar security dependencies."

  Pattern 6: Bypassing access control with admin flags

  • pattern: "if\s+request\.(GET|POST|args|form|json)\[['"]admin['"]\]|if\s+request\.(GET|POST|args|form|json)\[['"]debug['"]\]" message: "Dangerous admin/debug flags in request parameters could bypass access control. Remove or secure these backdoors."

  Pattern 7: Insecure use of eval or exec with user input

  • pattern: "eval\(|exec\(.*request\." message: "Extremely dangerous use of eval() or exec() with user input can lead to code execution. Avoid these functions entirely."

  Pattern 8: Missing access control in API endpoints

  • pattern: "@api_view\(|@api\.route\(|@app\.api_route\(" message: "API endpoint may lack access control. Ensure proper authentication and authorization checks are implemented."

  Pattern 9: Insecure Flask session usage

  • pattern: "session\[['"][^'"]+['"]\]\s*=\s*request\." message: "Setting session variables directly from request data without validation can lead to session-based access control bypasses."

  Pattern 10: Missing CSRF protection

  • pattern: "class\s+[A-Za-z0-9_]+Form\((?!.csrf).\):|@csrf_exempt" message: "Form or view appears to be missing CSRF protection. Ensure CSRF tokens are properly implemented."

• type: suggest message: | Python Access Control Best Practices:

  1. Framework-Specific Controls:
     • Django: Use built-in authentication and permission decorators/mixins
       • @login_required, LoginRequiredMixin
       • @permission_required, PermissionRequiredMixin
       • UserPassesTestMixin for custom permission logic
     • Flask: Use Flask-Login or similar extensions
       • @login_required decorator
       • current_user.is_authenticated checks
       • Role-based access control with Flask-Principal
     • FastAPI: Use dependency injection for security
       • Depends(get_current_user) pattern
       • OAuth2 with Security(oauth2_scheme)
       • JWT validation middleware