Cursor rule

1---
2description: Detect and prevent insecure design patterns in Python applications as defined in OWASP Top 10:2021-A04
3globs: *.py, *.ini, *.cfg, *.yml, *.yaml, *.json, *.toml
4alwaysApply: false
5---
6 # Python Insecure Design Security Standards (OWASP A04:2021)
7 
8This rule enforces security best practices to prevent insecure design vulnerabilities in Python applications, as defined in OWASP Top 10:2021-A04.
9 
10<rule>
11name: python_insecure_design
12description: Detect and prevent insecure design patterns in Python applications as defined in OWASP Top 10:2021-A04
13filters:
14  - type: file_extension
15    pattern: "\\.(py)$"
16  - type: file_path
17    pattern: ".*"
18 
19actions:
20  - type: enforce
21    conditions:
22      # Pattern 1: Lack of input validation
23      - pattern: "def\\s+[a-zA-Z0-9_]+\\([^)]*\\):\\s*(?![^#]*validate|[^#]*clean|[^#]*sanitize|[^#]*check|[^#]*is_valid)"
24        message: "Function lacks input validation. Consider implementing validation for all user-supplied inputs."
25        
26      # Pattern 2: Hardcoded business rules
27      - pattern: "if\\s+[a-zA-Z0-9_]+\\s*(==|!=|>|<|>=|<=)\\s*['\"][^'\"]+['\"]:"
28        message: "Hardcoded business rules detected. Consider using configuration files or database-driven rules for better maintainability."
29        
30      # Pattern 3: Lack of rate limiting
31      - pattern: "@(app|api|route|blueprint)\\.(get|post|put|delete|patch)\\([^)]*\\)\\s*\\n\\s*(?![^#]*rate_limit|[^#]*throttle|[^#]*limiter)"
32        message: "API endpoint lacks rate limiting. Consider implementing rate limiting to prevent abuse."
33        
34      # Pattern 4: Insecure default configurations
35      - pattern: "DEBUG\\s*=\\s*True|DEVELOPMENT\\s*=\\s*True|TESTING\\s*=\\s*True"
36        message: "Insecure default configuration detected. Ensure debug/development modes are disabled in production."
37        
38      # Pattern 5: Lack of error handling
39      - pattern: "(?<!try:\\s*\\n)[^#]*\\n\\s*(?!except|finally)"
40        message: "Consider implementing proper error handling with try-except blocks for operations that might fail."
41        
42      # Pattern 6: Insecure direct object references
43      - pattern: "get_object_or_404\\(\\s*[^,]+,\\s*pk\\s*=\\s*request\\.(GET|POST|args|form|json)\\[['\"][^'\"]+['\"]\\]\\s*\\)|get\\(\\s*id\\s*=\\s*request\\.(GET|POST|args|form|json)"
44        message: "Potential insecure direct object reference. Validate user's permission to access the requested object."
45        
46      # Pattern 7: Missing authentication checks
47      - pattern: "@(app|api|route|blueprint)\\.(get|post|put|delete|patch)\\([^)]*\\)\\s*\\n\\s*(?!.*@login_required|.*@auth\\.login_required|.*@jwt_required|.*current_user|.*request\\.user)"
48        message: "Endpoint lacks authentication checks. Consider adding authentication requirements for sensitive operations."
49        
50      # Pattern 8: Lack of proper logging
51      - pattern: "except\\s+[a-zA-Z0-9_]+\\s*(?:as\\s+[a-zA-Z0-9_]+)?:\\s*(?!.*logger\\.|.*logging\\.|.*print)"
52        message: "Exception caught without proper logging. Implement proper logging for exceptions to aid in debugging and monitoring."
53        
54      # Pattern 9: Insecure file uploads
55      - pattern: "request\\.files\\[['\"][^'\"]+['\"]\\]|FileField\\(|FileStorage\\("
56        message: "File upload functionality detected. Ensure proper validation of file types, sizes, and implement virus scanning if applicable."
57        
58      # Pattern 10: Lack of security headers
59      - pattern: "response\\.(headers|set_header)\\([^)]*\\)|return\\s+Response\\([^)]*\\)|return\\s+make_response\\([^)]*\\)"
60        message: "Consider adding security headers (Content-Security-Policy, X-Content-Type-Options, etc.) to HTTP responses."
61 
62  - type: suggest
63    message: |
64      **Python Secure Design Best Practices:**
65      
66      1. **Implement Defense in Depth:**
67         - Layer security controls throughout your application
68         - Don't rely on a single security mechanism
69         - Assume that each security layer can be bypassed
70      
71      2. **Use Secure Defaults:**
72         - Start with secure configurations by default
73         - Require explicit opt-in for less secure options
74         - Example for Flask:
75```python
76           app.config.update(
77               SESSION_COOKIE_SECURE=True,
78               SESSION_COOKIE_HTTPONLY=True,
79               SESSION_COOKIE_SAMESITE='Lax',
80               PERMANENT_SESSION_LIFETIME=timedelta(hours=1)
81           )
82```
83      
84      3. **Implement Proper Access Control:**
85         - Use role-based access control (RBAC)
86         - Implement principle of least privilege
87         - Validate access at the controller and service layers
88         - Example:
89```python
90           @app.route('/admin')
91           @roles_required('admin')  # Using Flask-Security
92           def admin_dashboard():
93               return render_template('admin/dashboard.html')
94```
95      
96      4. **Use Rate Limiting:**
97         - Protect against brute force and DoS attacks
98         - Example with Flask-Limiter:
99```python
100           from flask_limiter import Limiter
101           limiter = Limiter(app)
102           
103           @app.route('/login', methods=['POST'])
104           @limiter.limit("5 per minute")
105           def login():
106               # Login logic
107```
108      
109      5. **Implement Proper Error Handling:**
110         - Catch and log exceptions appropriately
111         - Return user-friendly error messages without exposing sensitive details
112         - Example:
113```python
114           try:
115               # Operation that might fail
116               result = perform_operation(user_input)
117           except ValidationError as e:
118               logger.warning(f"Validation error: {str(e)}")
119               return jsonify({"error": "Invalid input provided"}), 400
120           except Exception as e:
121               logger.error(f"Unexpected error: {str(e)}", exc_info=True)
122               return jsonify({"error": "An unexpected error occurred"}), 500
123```
124      
125      6. **Use Configuration Management:**
126         - Store configuration in environment variables or secure vaults
127         - Use different configurations for development and production
128         - Example:
129```python
130           import os
131           from dotenv import load_dotenv
132           
133           load_dotenv()
134           
135           DEBUG = os.getenv('DEBUG', 'False') == 'True'
136           SECRET_KEY = os.getenv('SECRET_KEY')
137           DATABASE_URL = os.getenv('DATABASE_URL')
138```
139      
140      7. **Implement Proper Logging:**
141         - Log security events and exceptions
142         - Include contextual information but avoid sensitive data
143         - Use structured logging
144         - Example:
145```python
146           import logging
147           
148           logger = logging.getLogger(__name__)
149           
150           def user_action(user_id, action):
151               logger.info("User action", extra={
152                   "user_id": user_id,
153                   "action": action,
154                   "timestamp": datetime.now().isoformat()
155               })
156```
157      
158      8. **Use Security Headers:**
159         - Implement Content-Security-Policy, X-Content-Type-Options, etc.
160         - Example with Flask:
161```python
162           from flask_talisman import Talisman
163           
164           talisman = Talisman(
165               app,
166               content_security_policy={
167                   'default-src': "'self'",
168                   'script-src': "'self'"
169               }
170           )
171```
172      
173      9. **Implement Secure File Handling:**
174         - Validate file types, sizes, and content
175         - Store files outside the web root
176         - Use secure file permissions
177         - Example:
178```python
179           import os
180           from werkzeug.utils import secure_filename
181           
182           ALLOWED_EXTENSIONS = {'txt', 'pdf', 'png', 'jpg'}
183           MAX_CONTENT_LENGTH = 1 * 1024 * 1024  # 1MB
184           
185           def allowed_file(filename):
186               return '.' in filename and filename.rsplit('.', 1)[1].lower() in ALLOWED_EXTENSIONS
187           
188           @app.route('/upload', methods=['POST'])
189           def upload_file():
190               if 'file' not in request.files:
191                   return jsonify({"error": "No file part"}), 400
192               
193               file = request.files['file']
194               if file.filename == '':
195                   return jsonify({"error": "No selected file"}), 400
196               
197               if file and allowed_file(file.filename):
198                   filename = secure_filename(file.filename)
199                   file.save(os.path.join(app.config['UPLOAD_FOLDER'], filename))
200                   return jsonify({"success": True}), 200
201               
202               return jsonify({"error": "File type not allowed"}), 400
203```
204      
205      10. **Use Threat Modeling:**
206          - Identify potential threats during design phase
207          - Implement controls to mitigate identified threats
208          - Regularly review and update threat models
209 
210  - type: validate
211    conditions:
212      # Check 1: Proper input validation
213      - pattern: "validate|clean|sanitize|check|is_valid"
214        message: "Implementing input validation."
215      
216      # Check 2: Proper error handling
217      - pattern: "try:\\s*\\n[^#]*\\n\\s*(except|finally)"
218        message: "Using proper error handling with try-except blocks."
219      
220      # Check 3: Rate limiting implementation
221      - pattern: "rate_limit|throttle|limiter"
222        message: "Implementing rate limiting for API endpoints."
223      
224      # Check 4: Proper logging
225      - pattern: "logger\\.|logging\\."
226        message: "Using proper logging mechanisms."
227 
228metadata:
229  priority: high
230  version: 1.0
231  tags:
232    - security
233    - python
234    - design
235    - architecture
236    - owasp
237    - language:python
238    - framework:django
239    - framework:flask
240    - framework:fastapi
241    - category:security
242    - subcategory:design
243    - standard:owasp-top10
244    - risk:a04-insecure-design
245  references:
246    - "https://owasp.org/Top10/A04_2021-Insecure_Design/"
247    - "https://cheatsheetseries.owasp.org/cheatsheets/Secure_Product_Design_Cheat_Sheet.html"
248    - "https://flask.palletsprojects.com/en/latest/security/"
249    - "https://docs.djangoproject.com/en/stable/topics/security/"
250    - "https://fastapi.tiangolo.com/advanced/security/"
251    - "https://owasp.org/www-project-proactive-controls/"
252</rule>