Cursor rule

1---
2description: Detect and prevent software and data integrity failures in Python applications as defined in OWASP Top 10:2021-A08
3globs: *.py, *.ini, *.cfg, *.yml, *.yaml, *.json, *.toml
4alwaysApply: false
5---
6# Python Software and Data Integrity Failures Standards (OWASP A08:2021)
7 
8This rule enforces security best practices to prevent software and data integrity failures in Python applications, as defined in OWASP Top 10:2021-A08.
9 
10<rule>
11name: python_integrity_failures
12description: Detect and prevent software and data integrity failures in Python applications as defined in OWASP Top 10:2021-A08
13filters:
14  - type: file_extension
15    pattern: "\\.(py|ini|cfg|yml|yaml|json|toml)$"
16  - type: file_path
17    pattern: ".*"
18 
19actions:
20  - type: enforce
21    conditions:
22      # Pattern 1: Insecure deserialization with pickle
23      - pattern: "pickle\\.loads\\(|pickle\\.load\\(|cPickle\\.loads\\(|cPickle\\.load\\("
24        message: "Insecure deserialization detected with pickle. Pickle is not secure against maliciously constructed data and should not be used with untrusted input."
25        
26      # Pattern 2: Insecure deserialization with yaml.load
27      - pattern: "yaml\\.load\\([^,)]+\\)|yaml\\.load\\([^,)]+,\\s*Loader=yaml\\.Loader\\)"
28        message: "Insecure deserialization detected with yaml.load(). Use yaml.safe_load() instead for untrusted input."
29        
30      # Pattern 3: Insecure deserialization with marshal
31      - pattern: "marshal\\.loads\\(|marshal\\.load\\("
32        message: "Insecure deserialization detected with marshal. Marshal is not secure against maliciously constructed data."
33        
34      # Pattern 4: Insecure deserialization with shelve
35      - pattern: "shelve\\.open\\("
36        message: "Potentially insecure deserialization with shelve detected. Shelve uses pickle internally and is not secure against malicious data."
37        
38      # Pattern 5: Insecure use of eval or exec
39      - pattern: "eval\\(|exec\\(|compile\\([^,]+,\\s*['\"][^'\"]+['\"]\\s*,\\s*['\"]exec['\"]\\)"
40        message: "Insecure use of eval() or exec() detected. These functions can execute arbitrary code and should never be used with untrusted input."
41        
42      # Pattern 6: Missing integrity verification for downloads
43      - pattern: "urllib\\.request\\.urlretrieve\\(|requests\\.get\\([^)]*\\.exe['\"]\\)|requests\\.get\\([^)]*\\.zip['\"]\\)|requests\\.get\\([^)]*\\.tar\\.gz['\"]\\)"
44        message: "File download without integrity verification detected. Always verify the integrity of downloaded files using checksums or digital signatures."
45        
46      # Pattern 7: Insecure package installation
47      - pattern: "pip\\s+install\\s+[^-]|subprocess\\.(?:call|run|Popen)\\(['\"]pip\\s+install"
48        message: "Insecure package installation detected. Specify package versions and consider using hash verification for pip installations."
49        
50      # Pattern 8: Missing integrity checks for configuration
51      - pattern: "config\\.read\\(|json\\.loads?\\(|yaml\\.safe_load\\(|toml\\.loads?\\("
52        message: "Configuration loading detected. Ensure integrity verification for configuration files, especially in production environments."
53        
54      # Pattern 9: Insecure temporary file creation
55      - pattern: "tempfile\\.mktemp\\(|os\\.tempnam\\(|os\\.tmpnam\\("
56        message: "Insecure temporary file creation detected. Use tempfile.mkstemp() or tempfile.TemporaryFile() instead to avoid race conditions."
57        
58      # Pattern 10: Insecure file operations with untrusted paths
59      - pattern: "open\\([^,)]+\\+\\s*request\\.|open\\([^,)]+\\+\\s*user_|open\\([^,)]+\\+\\s*input\\("
60        message: "Potentially insecure file operation with user-controlled path detected. Validate and sanitize file paths from untrusted sources."
61        
62      # Pattern 11: Missing integrity checks for updates
63      - pattern: "auto_update|self_update|check_for_updates"
64        message: "Update mechanism detected. Ensure proper integrity verification for software updates using digital signatures or secure checksums."
65        
66      # Pattern 12: Insecure plugin or extension loading
67      - pattern: "importlib\\.import_module\\(|__import__\\(|load_plugin|load_extension|load_module"
68        message: "Dynamic module loading detected. Implement integrity checks and validation before loading external modules or plugins."
69        
70      # Pattern 13: Insecure use of subprocess with shell=True
71      - pattern: "subprocess\\.(?:call|run|Popen)\\([^,)]*shell\\s*=\\s*True"
72        message: "Insecure subprocess execution with shell=True detected. This can lead to command injection if user input is involved."
73        
74      # Pattern 14: Missing integrity verification for serialized data
75      - pattern: "json\\.loads?\\([^,)]*request\\.|json\\.loads?\\([^,)]*user_|json\\.loads?\\([^,)]*input\\("
76        message: "Deserialization of user-controlled data detected. Implement schema validation or integrity checks before processing."
77        
78      # Pattern 15: Insecure use of globals or locals
79      - pattern: "globals\\(\\)\\[|locals\\(\\)\\["
80        message: "Potentially insecure modification of globals or locals detected. This can lead to unexpected behavior or security issues."
81 
82  - type: suggest
83    message: |
84      **Python Software and Data Integrity Best Practices:**
85      
86      1. **Secure Deserialization:**
87         - Avoid using pickle, marshal, or shelve with untrusted data
88         - Use safer alternatives like JSON with schema validation
89         - Example with JSON schema validation:
90```python
91           import json
92           import jsonschema
93           
94           # Define a schema for validation
95           schema = {
96               "type": "object",
97               "properties": {
98                   "name": {"type": "string"},
99                   "age": {"type": "integer", "minimum": 0}
100               },
101               "required": ["name", "age"]
102           }
103           
104           # Validate data against schema
105           try:
106               data = json.loads(user_input)
107               jsonschema.validate(instance=data, schema=schema)
108               # Process data safely
109           except (json.JSONDecodeError, jsonschema.exceptions.ValidationError) as e:
110               # Handle validation error
111               print(f"Invalid data: {e}")
112```
113      
114      2. **YAML Safe Loading:**
115         - Always use yaml.safe_load() instead of yaml.load()
116         - Example:
117```python
118           import yaml
119           
120           # Safe way to load YAML
121           data = yaml.safe_load(yaml_string)
122           
123           # Avoid this:
124           # data = yaml.load(yaml_string)  # Insecure!
125```
126      
127      3. **Integrity Verification for Downloads:**
128         - Verify checksums or signatures for downloaded files
129         - Example:
130```python
131           import hashlib
132           import requests
133           
134           def download_with_integrity_check(url, expected_hash):
135               response = requests.get(url)
136               file_data = response.content
137               
138               # Calculate hash
139               calculated_hash = hashlib.sha256(file_data).hexdigest()
140               
141               # Verify integrity
142               if calculated_hash != expected_hash:
143                   raise ValueError("Integrity check failed: hash mismatch")
144                   
145               return file_data
146```
147      
148      4. **Secure Package Installation:**
149         - Pin dependencies to specific versions
150         - Use hash verification for pip installations
151         - Example requirements.txt with hashes:
152```
153           # requirements.txt
154           requests==2.31.0 --hash=sha256:942c5a758f98d790eaed1a29cb6eefc7ffb0d1cf7af05c3d2791656dbd6ad1e1
155```
156      
157      5. **Secure Configuration Management:**
158         - Validate configuration file integrity
159         - Use environment-specific configurations
160         - Example:
161```python
162           import json
163           import hmac
164           import hashlib
165           
166           def load_config_with_integrity(config_file, secret_key):
167               with open(config_file, 'r') as f:
168                   content = f.read()
169                   
170               # Split content into data and signature
171               data, _, signature = content.rpartition('\n')
172               
173               # Verify integrity
174               expected_signature = hmac.new(
175                   secret_key.encode(), 
176                   data.encode(), 
177                   hashlib.sha256
178               ).hexdigest()
179               
180               if not hmac.compare_digest(signature, expected_signature):
181                   raise ValueError("Configuration integrity check failed")
182                   
183               return json.loads(data)
184```
185      
186      6. **Secure Temporary Files:**
187         - Use secure temporary file functions
188         - Example:
189```python
190           import tempfile
191           import os
192           
193           # Secure temporary file creation
194           fd, temp_path = tempfile.mkstemp()
195           try:
196               with os.fdopen(fd, 'w') as temp_file:
197                   temp_file.write('data')
198               # Process the file
199           finally:
200               os.unlink(temp_path)  # Clean up
201           
202           # Or use context manager
203           with tempfile.TemporaryFile() as temp_file:
204               temp_file.write(b'data')
205               temp_file.seek(0)
206               # Process the file
207```
208      
209      7. **Secure Update Mechanisms:**
210         - Verify signatures for updates
211         - Use HTTPS for update downloads
212         - Example:
213```python
214           import requests
215           import gnupg
216           
217           def secure_update(update_url, signature_url, gpg_key):
218               # Download update and signature
219               update_data = requests.get(update_url).content
220               signature = requests.get(signature_url).content
221               
222               # Verify signature
223               gpg = gnupg.GPG()
224               gpg.import_keys(gpg_key)
225               verified = gpg.verify_data(signature, update_data)
226               
227               if not verified:
228                   raise ValueError("Update signature verification failed")
229                   
230               return update_data
231```
232      
233      8. **Secure Plugin Loading:**
234         - Validate plugins before loading
235         - Implement allowlisting for plugins
236         - Example:
237```python
238           import importlib
239           import hashlib
240           
241           # Allowlist of approved plugins with their hashes
242           APPROVED_PLUGINS = {
243               'safe_plugin': 'sha256:1234567890abcdef',
244               'other_plugin': 'sha256:abcdef1234567890'
245           }
246           
247           def load_plugin_safely(plugin_name, plugin_path):
248               # Check if plugin is in allowlist
249               if plugin_name not in APPROVED_PLUGINS:
250                   raise ValueError(f"Plugin {plugin_name} is not approved")
251                   
252               # Calculate plugin file hash
253               with open(plugin_path, 'rb') as f:
254                   plugin_hash = 'sha256:' + hashlib.sha256(f.read()).hexdigest()
255                   
256               # Verify hash matches expected value
257               if plugin_hash != APPROVED_PLUGINS[plugin_name]:
258                   raise ValueError(f"Plugin {plugin_name} failed integrity check")
259                   
260               # Load plugin safely
261               return importlib.import_module(plugin_name)
262```
263      
264      9. **Secure Subprocess Execution:**
265         - Avoid shell=True
266         - Use allowlists for commands
267         - Example:
268```python
269           import subprocess
270           import shlex
271           
272           def run_command_safely(command, arguments):
273               # Allowlist of safe commands
274               SAFE_COMMANDS = {'ls', 'echo', 'cat'}
275               
276               if command not in SAFE_COMMANDS:
277                   raise ValueError(f"Command {command} is not allowed")
278                   
279               # Build command with arguments
280               cmd = [command] + arguments
281               
282               # Execute without shell
283               return subprocess.run(cmd, shell=False, capture_output=True, text=True)
284```
285      
286      10. **Input Validation and Sanitization:**
287          - Validate all inputs before processing
288          - Use schema validation for structured data
289          - Example with Pydantic:
290```python
291            from pydantic import BaseModel, validator
292            
293            class UserData(BaseModel):
294                username: str
295                age: int
296                
297                @validator('username')
298                def username_must_be_valid(cls, v):
299                    if not v.isalnum() or len(v) > 30:
300                        raise ValueError('Username must be alphanumeric and <= 30 chars')
301                    return v
302                    
303                @validator('age')
304                def age_must_be_reasonable(cls, v):
305                    if v < 0 or v > 120:
306                        raise ValueError('Age must be between 0 and 120')
307                    return v
308            
309            # Usage
310            try:
311                user = UserData(username=user_input_name, age=user_input_age)
312                # Process validated data
313            except ValueError as e:
314                # Handle validation error
315                print(f"Invalid data: {e}")
316```
317 
318  - type: validate
319    conditions:
320      # Check 1: Safe YAML loading
321      - pattern: "yaml\\.safe_load\\("
322        message: "Using safe YAML loading."
323      
324      # Check 2: Secure temporary file usage
325      - pattern: "tempfile\\.mkstemp\\(|tempfile\\.TemporaryFile\\(|tempfile\\.NamedTemporaryFile\\("
326        message: "Using secure temporary file functions."
327      
328      # Check 3: Secure subprocess usage
329      - pattern: "subprocess\\.(?:call|run|Popen)\\([^,)]*shell\\s*=\\s*False"
330        message: "Using subprocess with shell=False."
331      
332      # Check 4: Input validation
333      - pattern: "jsonschema\\.validate|pydantic|dataclass|@validator"
334        message: "Implementing input validation."
335 
336metadata:
337  priority: high
338  version: 1.0
339  tags:
340    - security
341    - python
342    - integrity
343    - deserialization
344    - owasp
345    - language:python
346    - framework:django
347    - framework:flask
348    - framework:fastapi
349    - category:security
350    - subcategory:integrity
351    - standard:owasp-top10
352    - risk:a08-software-data-integrity-failures
353  references:
354    - "https://owasp.org/Top10/A08_2021-Software_and_Data_Integrity_Failures/"
355    - "https://cheatsheetseries.owasp.org/cheatsheets/Deserialization_Cheat_Sheet.html"
356    - "https://cheatsheetseries.owasp.org/cheatsheets/Input_Validation_Cheat_Sheet.html"
357    - "https://docs.python.org/3/library/pickle.html#restricting-globals"
358    - "https://pyyaml.org/wiki/PyYAMLDocumentation"
359    - "https://python-security.readthedocs.io/packages.html"
360    - "https://docs.python.org/3/library/tempfile.html#security"
361</rule>