Cursor rule

1---
2description: Detect and prevent broken access control vulnerabilities in Python applications as defined in OWASP Top 10:2021-A01
3globs: *.py
4alwaysApply: false
5---
6# Python Broken Access Control Security Standards (OWASP A01:2021)
7 
8This rule enforces security best practices to prevent broken access control vulnerabilities in Python applications, as defined in OWASP Top 10:2021-A01.
9 
10<rule>
11name: python_broken_access_control
12description: Detect and prevent broken access control vulnerabilities in Python applications as defined in OWASP Top 10:2021-A01
13filters:
14  - type: file_extension
15    pattern: "\\.(py)$"
16  - type: file_path
17    pattern: ".*"
18 
19actions:
20  - type: enforce
21    conditions:
22      # Pattern 1: Missing access control in Flask routes
23      - pattern: "@(app|blueprint)\\.route\\([^)]*\\)\\s*\\n\\s*def\\s+[a-zA-Z0-9_]+\\([^)]*\\):\\s*(?![^#]*@login_required|[^#]*current_user\\.|[^#]*session\\[)"
24        message: "Flask route lacks access control. Consider using @login_required or checking user permissions within the function."
25        
26      # Pattern 2: Missing access control in Django views
27      - pattern: "class\\s+[A-Za-z0-9_]+View\\((?!LoginRequiredMixin|PermissionRequiredMixin|UserPassesTestMixin)[^)]*\\):"
28        message: "Django class-based view lacks access control mixins. Consider using LoginRequiredMixin, PermissionRequiredMixin, or UserPassesTestMixin."
29        
30      # Pattern 3: Insecure direct object reference
31      - pattern: "(get|filter|find)_by_id\\(\\s*request\\.(GET|POST|args|form|json)\\[['\"][^'\"]+['\"]\\]\\s*\\)"
32        message: "Potential insecure direct object reference (IDOR). Validate that the current user has permission to access this object."
33        
34      # Pattern 4: Hardcoded role checks
35      - pattern: "if\\s+user\\.role\\s*==\\s*['\"]admin['\"]|if\\s+user\\.(is_staff|is_superuser)\\s*:"
36        message: "Hardcoded role checks can be fragile. Consider using a permission system or role-based access control framework."
37        
38      # Pattern 5: Missing authorization in FastAPI
39      - pattern: "@(app|router)\\.([a-z]+)\\([^)]*\\)\\s*\\n\\s*(?:async\\s+)?def\\s+[a-zA-Z0-9_]+\\([^)]*\\):\\s*(?![^#]*Depends\\(|[^#]*Security\\(|[^#]*HTTPBearer\\()"
40        message: "FastAPI endpoint lacks security dependencies. Consider using Depends(get_current_user) or similar security dependencies."
41        
42      # Pattern 6: Bypassing access control with admin flags
43      - pattern: "if\\s+request\\.(GET|POST|args|form|json)\\[['\"]admin['\"]\\]|if\\s+request\\.(GET|POST|args|form|json)\\[['\"]debug['\"]\\]"
44        message: "Dangerous admin/debug flags in request parameters could bypass access control. Remove or secure these backdoors."
45        
46      # Pattern 7: Insecure use of eval or exec with user input
47      - pattern: "eval\\(|exec\\(.*request\\."
48        message: "Extremely dangerous use of eval() or exec() with user input can lead to code execution. Avoid these functions entirely."
49        
50      # Pattern 8: Missing access control in API endpoints
51      - pattern: "@api_view\\(|@api\\.route\\(|@app\\.api_route\\("
52        message: "API endpoint may lack access control. Ensure proper authentication and authorization checks are implemented."
53        
54      # Pattern 9: Insecure Flask session usage
55      - pattern: "session\\[['\"][^'\"]+['\"]\\]\\s*=\\s*request\\."
56        message: "Setting session variables directly from request data without validation can lead to session-based access control bypasses."
57        
58      # Pattern 10: Missing CSRF protection
59      - pattern: "class\\s+[A-Za-z0-9_]+Form\\((?!.*csrf).*\\):|@csrf_exempt"
60        message: "Form or view appears to be missing CSRF protection. Ensure CSRF tokens are properly implemented."
61 
62  - type: suggest
63    message: |
64      **Python Access Control Best Practices:**
65      
66      1. **Framework-Specific Controls:**
67         - **Django**: Use built-in authentication and permission decorators/mixins
68           - `@login_required`, `LoginRequiredMixin`
69           - `@permission_required`, `PermissionRequiredMixin`
70           - `UserPassesTestMixin` for custom permission logic
71         - **Flask**: Use Flask-Login or similar extensions
72           - `@login_required` decorator
73           - `current_user.is_authenticated` checks
74           - Role-based access control with Flask-Principal
75         - **FastAPI**: Use dependency injection for security
76           - `Depends(get_current_user)` pattern
77           - OAuth2 with `Security(oauth2_scheme)`
78           - JWT validation middleware
79      
80      2. **General Access Control Principles:**
81         - Implement access control at the server side, never rely on client-side checks
82         - Use deny-by-default approach (whitelist vs blacklist)
83         - Implement proper session management
84         - Apply principle of least privilege
85         - Use contextual access control (time, location, device-based restrictions when appropriate)
86      
87      3. **Object-Level Authorization:**
88         - Validate user has permission to access specific resources
89         - Implement row-level security for database access
90         - Use UUIDs instead of sequential IDs when possible
91         - Always verify ownership or permission before allowing operations on objects
92      
93      4. **API Security:**
94         - Implement proper authentication for all API endpoints
95         - Use token-based authentication with proper validation
96         - Apply rate limiting to prevent brute force attacks
97         - Implement proper CORS configuration
98         - Log and monitor access control failures
99      
100      5. **Testing Access Control:**
101         - Write tests specifically for authorization logic
102         - Test vertical access control (different permission levels)
103         - Test horizontal access control (same permission level, different users)
104         - Verify access control works after session timeout/expiration
105 
106  - type: validate
107    conditions:
108      # Check 1: Proper Django permission usage
109      - pattern: "@login_required|@permission_required|LoginRequiredMixin|PermissionRequiredMixin"
110        message: "Using Django's built-in access control mechanisms."
111      
112      # Check 2: Proper Flask authentication
113      - pattern: "@login_required|current_user\\.is_authenticated|@auth\\.login_required"
114        message: "Implementing proper Flask authentication checks."
115      
116      # Check 3: Object-level permission checks
117      - pattern: "\\.has_permission\\(|has_object_permission\\(|can_view\\(|can_edit\\("
118        message: "Implementing object-level permission checks."
119      
120      # Check 4: FastAPI security dependencies
121      - pattern: "Depends\\(get_current_user\\)|Security\\(|HTTPBearer\\("
122        message: "Using FastAPI's security dependency injection."
123 
124metadata:
125  priority: 90
126  version: "1.0"
127  tags:
128    - python
129    - security
130    - access_control
131    - owasp
132    - language:python
133    - category:security
134    - subcategory:authorisation
135    - subcategory:access-control
136    - standard:owasp-top10
137    - risk:a01-broken-access-control
138    - framework:django
139    - framework:flask
140    - framework:fastapi
141  references:
142    - https://owasp.org/Top10/A01_2021-Broken_Access_Control/
143    - https://cheatsheetseries.owasp.org/cheatsheets/Authorization_Cheat_Sheet.html
144    - https://cheatsheetseries.owasp.org/cheatsheets/Access_Control_Cheat_Sheet.html
145    - https://docs.djangoproject.com/en/stable/topics/auth/default/
146    - https://flask-login.readthedocs.io/en/latest/
147    - https://fastapi.tiangolo.com/tutorial/security/
148    - https://cheatsheetseries.owasp.org/cheatsheets/Access_Control_Cheat_Sheet.html
149</rule>