Cursor rule

1---
2description: Detect and prevent injection vulnerabilities in Python applications as defined in OWASP Top 10:2021-A03
3globs: *.py, *.ini, *.cfg, *.yml, *.yaml, *.json, *.toml
4alwaysApply: false
5---
6 # Python Injection Security Standards (OWASP A03:2021)
7 
8This rule enforces security best practices to prevent injection vulnerabilities in Python applications, as defined in OWASP Top 10:2021-A03.
9 
10<rule>
11name: python_injection
12description: Detect and prevent injection vulnerabilities in Python applications as defined in OWASP Top 10:2021-A03
13filters:
14  - type: file_extension
15    pattern: "\\.(py)$"
16  - type: file_path
17    pattern: ".*"
18 
19actions:
20  - type: enforce
21    conditions:
22      # Pattern 1: SQL Injection - String concatenation in SQL queries
23      - pattern: "cursor\\.(execute|executemany)\\([\"'][^\"']*\\s*[\\+%]|cursor\\.(execute|executemany)\\([^,]+\\+\\s*[a-zA-Z_][a-zA-Z0-9_]*"
24        message: "Potential SQL injection vulnerability. Use parameterized queries with placeholders instead of string concatenation."
25        
26      # Pattern 2: SQL Injection - String formatting in SQL queries
27      - pattern: "cursor\\.(execute|executemany)\\([\"'][^\"']*%[^\"']*[\"']\\s*%\\s*|cursor\\.(execute|executemany)\\([\"'][^\"']*{[^\"']*}[\"']\\.format"
28        message: "Potential SQL injection vulnerability. Use parameterized queries with placeholders instead of string formatting."
29        
30      # Pattern 3: Command Injection - Shell command execution with user input
31      - pattern: "(os\\.system|os\\.popen|subprocess\\.Popen|subprocess\\.call|subprocess\\.run|subprocess\\.check_output)\\([^)]*\\+\\s*[a-zA-Z_][a-zA-Z0-9_]*|\\b(os\\.system|os\\.popen|subprocess\\.Popen|subprocess\\.call|subprocess\\.run|subprocess\\.check_output)\\([^)]*format\\(|\\b(os\\.system|os\\.popen|subprocess\\.Popen|subprocess\\.call|subprocess\\.run|subprocess\\.check_output)\\([^)]*f['\"]"
32        message: "Potential command injection vulnerability. Never use string concatenation or formatting with shell commands. Use subprocess with shell=False and pass arguments as a list."
33        
34      # Pattern 4: Command Injection - Shell=True in subprocess
35      - pattern: "(subprocess\\.Popen|subprocess\\.call|subprocess\\.run|subprocess\\.check_output)\\([^)]*shell\\s*=\\s*True"
36        message: "Using shell=True with subprocess functions is dangerous and can lead to command injection. Use shell=False (default) and pass arguments as a list."
37        
38      # Pattern 5: XSS - Unescaped template variables
39      - pattern: "\\{\\{\\s*[^|]*\\s*\\}\\}|\\{\\%\\s*autoescape\\s+off\\s*\\%\\}"
40        message: "Potential XSS vulnerability. Ensure all template variables are properly escaped. Avoid using 'autoescape off' in templates."
41        
42      # Pattern 6: XSS - Unsafe HTML rendering in Flask/Django
43      - pattern: "render_template\\([^)]*\\)|render\\([^)]*\\)|mark_safe\\([^)]*\\)|safe\\s*\\|"
44        message: "Potential XSS vulnerability. Ensure all user-supplied data is properly escaped before rendering in templates."
45        
46      # Pattern 7: Path Traversal - Unsafe file operations
47      - pattern: "open\\([^)]*\\+|open\\([^)]*format\\(|open\\([^)]*f['\"]"
48        message: "Potential path traversal vulnerability. Validate and sanitize file paths before opening files. Consider using os.path.abspath and os.path.normpath."
49        
50      # Pattern 8: LDAP Injection - Unsafe LDAP queries
51      - pattern: "ldap\\.search\\([^)]*\\+|ldap\\.search\\([^)]*format\\(|ldap\\.search\\([^)]*f['\"]"
52        message: "Potential LDAP injection vulnerability. Use proper LDAP escaping for user-supplied input in LDAP queries."
53        
54      # Pattern 9: NoSQL Injection - Unsafe MongoDB queries
55      - pattern: "find\\(\\{[^}]*\\+|find\\(\\{[^}]*format\\(|find\\(\\{[^}]*f['\"]"
56        message: "Potential NoSQL injection vulnerability. Use parameterized queries or proper escaping for MongoDB queries."
57        
58      # Pattern 10: Template Injection - Unsafe template rendering
59      - pattern: "Template\\([^)]*\\)\\.(render|substitute)\\(|eval\\([^)]*\\)|exec\\([^)]*\\)"
60        message: "Potential template injection or code injection vulnerability. Avoid using eval() or exec() with user input, and ensure template variables are properly validated."
61 
62  - type: suggest
63    message: |
64      **Python Injection Prevention Best Practices:**
65      
66      1. **SQL Injection Prevention:**
67         - Use parameterized queries (prepared statements) with placeholders:
68```python
69           # Safe SQL query with parameters
70           cursor.execute("SELECT * FROM users WHERE username = %s AND password = %s", (username, password))
71           
72           # Django ORM (safe by default)
73           User.objects.filter(username=username, password=password)
74           
75           # SQLAlchemy (safe by default)
76           session.query(User).filter(User.username == username, User.password == password)
77```
78         - Use ORM frameworks when possible (Django ORM, SQLAlchemy)
79         - Apply proper input validation and sanitization
80      
81      2. **Command Injection Prevention:**
82         - Never use shell=True with subprocess functions
83         - Pass command arguments as a list, not a string:
84```python
85           # Safe command execution
86           subprocess.run(["ls", "-l", user_dir], shell=False)
87```
88         - Use shlex.quote() if you must include user input in shell commands
89         - Consider using safer alternatives like Python libraries instead of shell commands
90      
91      3. **XSS Prevention:**
92         - Use template auto-escaping (enabled by default in modern frameworks)
93         - Explicitly escape user input before rendering:
94```python
95           # Django
96           from django.utils.html import escape
97           safe_data = escape(user_input)
98           
99           # Flask/Jinja2
100           from markupsafe import escape
101           safe_data = escape(user_input)
102```
103         - Use Content-Security-Policy headers
104         - Validate input against allowlists
105      
106      4. **Path Traversal Prevention:**
107         - Validate and sanitize file paths:
108```python
109           import os
110           safe_path = os.path.normpath(os.path.join(safe_base_dir, user_filename))
111           if not safe_path.startswith(safe_base_dir):
112               raise ValueError("Invalid path")
113```
114         - Use os.path.abspath() and os.path.normpath()
115         - Implement proper access controls
116         - Consider using libraries like Werkzeug's secure_filename()
117      
118      5. **NoSQL Injection Prevention:**
119         - Use parameterized queries or query builders
120         - Validate input against schemas
121         - Apply proper type checking
122```python
123           # Safe MongoDB query
124           collection.find({"username": username, "status": "active"})
125```
126      
127      6. **Template Injection Prevention:**
128         - Avoid using eval() or exec() with user input
129         - Use sandboxed template engines
130         - Limit template functionality to what's necessary
131         - Apply proper input validation
132 
133  - type: validate
134    conditions:
135      # Check 1: Safe SQL queries
136      - pattern: "cursor\\.(execute|executemany)\\([\"'][^\"']*[\"']\\s*,\\s*\\(|cursor\\.(execute|executemany)\\([\"'][^\"']*[\"']\\s*,\\s*\\[|Model\\.objects\\.filter\\(|session\\.query\\("
137        message: "Using parameterized queries or ORM for database access."
138      
139      # Check 2: Safe command execution
140      - pattern: "(subprocess\\.Popen|subprocess\\.call|subprocess\\.run|subprocess\\.check_output)\\(\\[[^\\]]*\\]"
141        message: "Using subprocess with arguments as a list (safe pattern)."
142      
143      # Check 3: Proper input validation
144      - pattern: "validate|sanitize|clean|escape|is_valid\\(|validators\\."
145        message: "Implementing input validation or sanitization."
146      
147      # Check 4: Safe file operations
148      - pattern: "os\\.path\\.join|os\\.path\\.abspath|os\\.path\\.normpath|secure_filename"
149        message: "Using safe file path handling techniques."
150 
151metadata:
152  priority: high
153  version: 1.0
154  tags:
155    - security
156    - python
157    - injection
158    - sql-injection
159    - xss
160    - command-injection
161    - owasp
162    - language:python
163    - framework:django
164    - framework:flask
165    - framework:fastapi
166    - category:security
167    - subcategory:injection
168    - standard:owasp-top10
169    - risk:a03-injection
170  references:
171    - "https://owasp.org/Top10/A03_2021-Injection/"
172    - "https://cheatsheetseries.owasp.org/cheatsheets/SQL_Injection_Prevention_Cheat_Sheet.html"
173    - "https://cheatsheetseries.owasp.org/cheatsheets/Cross_Site_Scripting_Prevention_Cheat_Sheet.html"
174    - "https://cheatsheetseries.owasp.org/cheatsheets/OS_Command_Injection_Defense_Cheat_Sheet.html"
175    - "https://docs.python.org/3/library/subprocess.html"
176    - "https://docs.djangoproject.com/en/stable/topics/security/"
177    - "https://flask.palletsprojects.com/en/latest/security/"
178</rule>