python-insecure-design

Python Insecure Design Security Standards (OWASP A04:2021)

This rule enforces security best practices to prevent insecure design vulnerabilities in Python applications, as defined in OWASP Top 10:2021-A04.

actions:

• type: enforce conditions:

  Pattern 1: Lack of input validation

  • pattern: "def\s+[a-zA-Z0-9_]+\([^)]\):\s(?![^#]*validate|[^#]*clean|[^#]*sanitize|[^#]*check|[^#]*is_valid)" message: "Function lacks input validation. Consider implementing validation for all user-supplied inputs."

  Pattern 2: Hardcoded business rules

  • pattern: "if\s+[a-zA-Z0-9_]+\s*(==|!=|>|<|>=|<=)\s*['"][^'"]+['"]:" message: "Hardcoded business rules detected. Consider using configuration files or database-driven rules for better maintainability."

  Pattern 3: Lack of rate limiting

  • pattern: "@(app|api|route|blueprint)\.(get|post|put|delete|patch)\([^)]\)\s\n\s*(?![^#]*rate_limit|[^#]*throttle|[^#]*limiter)" message: "API endpoint lacks rate limiting. Consider implementing rate limiting to prevent abuse."

  Pattern 4: Insecure default configurations

  • pattern: "DEBUG\s*=\sTrue|DEVELOPMENT\s=\sTrue|TESTING\s=\s*True" message: "Insecure default configuration detected. Ensure debug/development modes are disabled in production."

  Pattern 5: Lack of error handling

  • pattern: "(?<!try:\s*\n)[^#]\n\s(?!except|finally)" message: "Consider implementing proper error handling with try-except blocks for operations that might fail."

  Pattern 6: Insecure direct object references

  • pattern: "get_object_or_404\(\s*[^,]+,\spk\s=\srequest\.(GET|POST|args|form|json)\[['"][^'"]+['"]\]\s\)|get\(\sid\s=\s*request\.(GET|POST|args|form|json)" message: "Potential insecure direct object reference. Validate user's permission to access the requested object."

  Pattern 7: Missing authentication checks

  • pattern: "@(app|api|route|blueprint)\.(get|post|put|delete|patch)\([^)]\)\s\n\s*(?!.@login_required|.@auth\.login_required|.*@jwt_required|.*current_user|.*request\.user)" message: "Endpoint lacks authentication checks. Consider adding authentication requirements for sensitive operations."

  Pattern 8: Lack of proper logging

  • pattern: "except\s+[a-zA-Z0-9_]+\s*(?:as\s+[a-zA-Z0-9_]+)?:\s*(?!.*logger\.|.*logging\.|.*print)" message: "Exception caught without proper logging. Implement proper logging for exceptions to aid in debugging and monitoring."

  Pattern 9: Insecure file uploads

  • pattern: "request\.files\[['"][^'"]+['"]\]|FileField\(|FileStorage\(" message: "File upload functionality detected. Ensure proper validation of file types, sizes, and implement virus scanning if applicable."

  Pattern 10: Lack of security headers

  • pattern: "response\.(headers|set_header)\([^)]\)|return\s+Response\([^)]\)|return\s+make_response\([^)]*\)" message: "Consider adding security headers (Content-Security-Policy, X-Content-Type-Options, etc.) to HTTP responses."

• type: suggest message: | Python Secure Design Best Practices:

  1. Implement Defense in Depth:

     • Layer security controls throughout your application
     • Don't rely on a single security mechanism
     • Assume that each security layer can be bypassed

  2. Use Secure Defaults:

     • Start with secure configurations by default
     • Require explicit opt-in for less secure options
     • Example for Flask:

       app.config.update(
           SESSION_COOKIE_SECURE=True,
           SESSION_COOKIE_HTTPONLY=True,
           SESSION_COOKIE_SAMESITE='Lax',
           PERMANENT_SESSION_LIFETIME=timedelta(hours=1)
       )