Cursor rule

1---
2description: Detect and prevent cryptographic failures in Python applications as defined in OWASP Top 10:2021-A02
3globs: *.py
4alwaysApply: false
5---
6# Python Cryptographic Failures Security Standards (OWASP A02:2021)
7 
8This rule enforces security best practices to prevent cryptographic failures in Python applications, as defined in OWASP Top 10:2021-A02.
9 
10<rule>
11name: python_cryptographic_failures
12description: Detect and prevent cryptographic failures in Python applications as defined in OWASP Top 10:2021-A02
13filters:
14  - type: file_extension
15    pattern: "\\.(py)$"
16  - type: file_path
17    pattern: ".*"
18 
19actions:
20  - type: enforce
21    conditions:
22      # Pattern 1: Weak or insecure cryptographic algorithms
23      - pattern: "import\\s+(md5|sha1)|hashlib\\.(md5|sha1)\\(|Crypto\\.Hash\\.(MD5|SHA1)|cryptography\\.hazmat\\.primitives\\.hashes\\.(MD5|SHA1)"
24        message: "Using weak hashing algorithms (MD5/SHA1). Use SHA-256 or stronger algorithms from the hashlib or cryptography packages."
25        
26      # Pattern 2: Hardcoded secrets/credentials
27      - pattern: "(password|secret|key|token|auth)\\s*=\\s*['\"][^'\"]+['\"]"
28        message: "Potential hardcoded credentials detected. Store secrets in environment variables or a secure vault."
29        
30      # Pattern 3: Insecure random number generation
31      - pattern: "random\\.(random|randint|choice|sample)|import random"
32        message: "Using Python's standard random module for security purposes. Use secrets module or cryptography.hazmat.primitives.asymmetric for cryptographic operations."
33        
34      # Pattern 4: Weak SSL/TLS configuration
35      - pattern: "ssl\\.PROTOCOL_(SSLv2|SSLv3|TLSv1|TLSv1_1)|SSLContext\\(\\s*ssl\\.PROTOCOL_(SSLv2|SSLv3|TLSv1|TLSv1_1)\\)"
36        message: "Using deprecated/insecure SSL/TLS protocol versions. Use TLS 1.2+ (ssl.PROTOCOL_TLS_CLIENT with minimum version set)."
37        
38      # Pattern 5: Missing certificate validation
39      - pattern: "verify\\s*=\\s*False|check_hostname\\s*=\\s*False|CERT_NONE"
40        message: "SSL certificate validation is disabled. Always validate certificates in production environments."
41        
42      # Pattern 6: Insecure cipher usage
43      - pattern: "DES|RC4|Blowfish|ECB"
44        message: "Using insecure encryption cipher or mode. Use AES with GCM or CBC mode with proper padding."
45        
46      # Pattern 7: Insufficient key length
47      - pattern: "RSA\\([^,]+,\\s*[0-9]+\\s*\\)|key_size\\s*=\\s*([0-9]|10[0-9][0-9]|11[0-9][0-9]|12[0-4][0-9])"
48        message: "Using insufficient key length for asymmetric encryption. RSA keys should be at least 2048 bits, preferably 4096 bits."
49        
50      # Pattern 8: Insecure password hashing
51      - pattern: "\\.encode\\(['\"]utf-?8['\"]\\)\\.(digest|hexdigest)\\(\\)|hashlib\\.[a-zA-Z0-9]+\\([^)]*\\)\\.(digest|hexdigest)\\(\\)"
52        message: "Using plain hashing for passwords. Use dedicated password hashing functions like bcrypt, Argon2, or PBKDF2."
53        
54      # Pattern 9: Missing salt in password hashing
55      - pattern: "pbkdf2_hmac\\([^,]+,[^,]+,[^,]+,\\s*[0-9]+\\s*\\)"
56        message: "Ensure you're using a proper random salt with password hashing functions."
57        
58      # Pattern 10: Insecure cookie settings
59      - pattern: "set_cookie\\([^)]*secure\\s*=\\s*False|set_cookie\\([^)]*httponly\\s*=\\s*False"
60        message: "Cookies with sensitive data should have secure and httponly flags enabled."
61 
62  - type: suggest
63    message: |
64      **Python Cryptography Best Practices:**
65      
66      1. **Secure Password Storage:**
67         - Use dedicated password hashing algorithms:
68```python
69           import bcrypt
70           hashed = bcrypt.hashpw(password.encode('utf-8'), bcrypt.gensalt(rounds=12))
71```
72         - Or use Argon2 (preferred) or PBKDF2 with sufficient iterations:
73```python
74           from argon2 import PasswordHasher
75           ph = PasswordHasher()
76           hash = ph.hash(password)
77```
78      
79      2. **Secure Random Number Generation:**
80         - Use the `secrets` module for cryptographic operations:
81```python
82           import secrets
83           token = secrets.token_hex(32)  # 256 bits of randomness
84```
85         - For cryptographic keys, use proper key generation functions:
86```python
87           from cryptography.hazmat.primitives.asymmetric import rsa
88           private_key = rsa.generate_private_key(public_exponent=65537, key_size=4096)
89```
90      
91      3. **Secure Communications:**
92         - Use TLS 1.2+ for all communications:
93```python
94           import ssl
95           context = ssl.create_default_context()
96           context.minimum_version = ssl.TLSVersion.TLSv1_2
97```
98         - Always validate certificates:
99```python
100           import requests
101           response = requests.get('https://example.com', verify=True)
102```
103      
104      4. **Proper Key Management:**
105         - Never hardcode secrets in source code
106         - Use environment variables or secure vaults:
107```python
108           import os
109           api_key = os.environ.get('API_KEY')
110```
111         - Consider using dedicated key management services
112      
113      5. **Secure Encryption:**
114         - Use high-level libraries like `cryptography`:
115```python
116           from cryptography.fernet import Fernet
117           key = Fernet.generate_key()
118           f = Fernet(key)
119           encrypted = f.encrypt(data)
120```
121         - For lower-level needs, use authenticated encryption (AES-GCM):
122```python
123           from cryptography.hazmat.primitives.ciphers.aead import AESGCM
124           key = AESGCM.generate_key(bit_length=256)
125           aesgcm = AESGCM(key)
126           nonce = os.urandom(12)
127           encrypted = aesgcm.encrypt(nonce, data, associated_data)
128```
129      
130      6. **Secure Cookie Handling:**
131         - Set secure and httponly flags:
132```python
133           # Flask example
134           response.set_cookie('session', session_id, httponly=True, secure=True, samesite='Lax')
135```
136         - Use signed cookies or tokens:
137```python
138           # Django example - uses signed cookies by default
139           request.session['user_id'] = user.id
140```
141      
142      7. **Input Validation:**
143         - Validate all cryptographic inputs
144         - Use constant-time comparison for secrets:
145```python
146           import hmac
147           def constant_time_compare(a, b):
148               return hmac.compare_digest(a, b)
149```
150 
151  - type: validate
152    conditions:
153      # Check 1: Proper password hashing
154      - pattern: "bcrypt\\.hashpw|argon2|PasswordHasher|pbkdf2_hmac\\([^,]+,[^,]+,[^,]+,\\s*[0-9]{4,}\\s*\\)"
155        message: "Using secure password hashing algorithm."
156      
157      # Check 2: Secure random generation
158      - pattern: "secrets\\.|urandom|cryptography\\.hazmat\\.primitives\\.asymmetric"
159        message: "Using cryptographically secure random number generation."
160      
161      # Check 3: Strong TLS configuration
162      - pattern: "ssl\\.PROTOCOL_TLS|minimum_version\\s*=\\s*ssl\\.TLSVersion\\.TLSv1_2|create_default_context"
163        message: "Using secure TLS configuration."
164      
165      # Check 4: Proper certificate validation
166      - pattern: "verify\\s*=\\s*True|check_hostname\\s*=\\s*True|CERT_REQUIRED"
167        message: "Properly validating SSL certificates."
168 
169metadata:
170  priority: high
171  version: 1.0
172  tags:
173    - security
174    - python
175    - cryptography
176    - encryption
177    - owasp
178    - language:python
179    - framework:django
180    - framework:flask
181    - framework:fastapi
182    - category:security
183    - subcategory:cryptography
184    - standard:owasp-top10
185    - risk:a02-cryptographic-failures
186  references:
187    - "https://owasp.org/Top10/A02_2021-Cryptographic_Failures/"
188    - "https://cheatsheetseries.owasp.org/cheatsheets/Cryptographic_Storage_Cheat_Sheet.html"
189    - "https://docs.python.org/3/library/secrets.html"
190    - "https://cryptography.io/en/latest/"
191    - "https://pypi.org/project/bcrypt/"
192    - "https://pypi.org/project/argon2-cffi/"
193</rule>