Cursor rule

1---
2description: Detect and prevent security misconfigurations in Python applications as defined in OWASP Top 10:2021-A05
3globs: *.py, *.ini, *.cfg, *.yml, *.yaml, *.json, *.toml
4alwaysApply: false
5---
6 # Python Security Misconfiguration Standards (OWASP A05:2021)
7 
8This rule enforces security best practices to prevent security misconfigurations in Python applications, as defined in OWASP Top 10:2021-A05.
9 
10<rule>
11name: python_security_misconfiguration
12description: Detect and prevent security misconfigurations in Python applications as defined in OWASP Top 10:2021-A05
13filters:
14  - type: file_extension
15    pattern: "\\.(py|ini|cfg|yml|yaml|json|toml)$"
16  - type: file_path
17    pattern: ".*"
18 
19actions:
20  - type: enforce
21    conditions:
22      # Pattern 1: Debug mode enabled in production settings
23      - pattern: "DEBUG\\s*=\\s*True|debug\\s*=\\s*true|\"debug\"\\s*:\\s*true|debug:\\s*true"
24        message: "Debug mode appears to be enabled. This should be disabled in production environments as it can expose sensitive information."
25        
26      # Pattern 2: Insecure cookie settings
27      - pattern: "SESSION_COOKIE_SECURE\\s*=\\s*False|session_cookie_secure\\s*=\\s*false|\"session_cookie_secure\"\\s*:\\s*false|session_cookie_secure:\\s*false"
28        message: "Insecure cookie configuration detected. Set SESSION_COOKIE_SECURE to True in production environments."
29        
30      # Pattern 3: Missing CSRF protection
31      - pattern: "CSRF_ENABLED\\s*=\\s*False|csrf_enabled\\s*=\\s*false|\"csrf_enabled\"\\s*:\\s*false|csrf_enabled:\\s*false|WTF_CSRF_ENABLED\\s*=\\s*False"
32        message: "CSRF protection appears to be disabled. Enable CSRF protection to prevent cross-site request forgery attacks."
33        
34      # Pattern 4: Insecure CORS settings
35      - pattern: "CORS_ORIGIN_ALLOW_ALL\\s*=\\s*True|cors_origin_allow_all\\s*=\\s*true|\"cors_origin_allow_all\"\\s*:\\s*true|cors_origin_allow_all:\\s*true|Access-Control-Allow-Origin:\\s*\\*"
36        message: "Overly permissive CORS configuration detected. Restrict CORS to specific origins rather than allowing all origins."
37        
38      # Pattern 5: Default or weak secret keys
39      - pattern: "SECRET_KEY\\s*=\\s*['\"]default|SECRET_KEY\\s*=\\s*['\"][a-zA-Z0-9]{1,32}['\"]|secret_key\\s*=\\s*['\"]default|\"secret_key\"\\s*:\\s*\"default|secret_key:\\s*default"
40        message: "Default or potentially weak secret key detected. Use a strong, randomly generated secret key and store it securely."
41        
42      # Pattern 6: Exposed sensitive information in error messages
43      - pattern: "DEBUG_PROPAGATE_EXCEPTIONS\\s*=\\s*True|debug_propagate_exceptions\\s*=\\s*true|\"debug_propagate_exceptions\"\\s*:\\s*true|debug_propagate_exceptions:\\s*true"
44        message: "Exception propagation in debug mode is enabled. This can expose sensitive information in error messages."
45        
46      # Pattern 7: Insecure SSL/TLS configuration
47      - pattern: "SECURE_SSL_REDIRECT\\s*=\\s*False|secure_ssl_redirect\\s*=\\s*false|\"secure_ssl_redirect\"\\s*:\\s*false|secure_ssl_redirect:\\s*false"
48        message: "SSL redirection appears to be disabled. Enable SSL redirection to ensure secure communications."
49        
50      # Pattern 8: Missing security headers
51      - pattern: "SECURE_HSTS_SECONDS\\s*=\\s*0|secure_hsts_seconds\\s*=\\s*0|\"secure_hsts_seconds\"\\s*:\\s*0|secure_hsts_seconds:\\s*0"
52        message: "HTTP Strict Transport Security (HSTS) appears to be disabled. Enable HSTS to enforce secure communications."
53        
54      # Pattern 9: Exposed sensitive directories
55      - pattern: "@app\\.route\\(['\"]/(admin|console|management|config|settings|system)['\"]"
56        message: "Potentially sensitive endpoint exposed without access controls. Ensure proper authentication and authorization for administrative endpoints."
57        
58      # Pattern 10: Default accounts or credentials
59      - pattern: "username\\s*=\\s*['\"]admin['\"]|password\\s*=\\s*['\"]admin|password\\s*=\\s*['\"]password|password\\s*=\\s*['\"]123|user\\s*=\\s*['\"]root['\"]"
60        message: "Default or weak credentials detected. Never use default or easily guessable credentials in any environment."
61        
62      # Pattern 11: Insecure file permissions
63      - pattern: "os\\.chmod\\([^,]+,\\s*0o777\\)|os\\.chmod\\([^,]+,\\s*777\\)"
64        message: "Overly permissive file permissions detected. Use the principle of least privilege for file permissions."
65        
66      # Pattern 12: Exposed version information
67      - pattern: "@app\\.route\\(['\"]/(version|build|status|health)['\"]"
68        message: "Endpoints that may expose version information detected. Ensure these endpoints don't reveal sensitive details about your application."
69        
70      # Pattern 13: Insecure deserialization
71      - pattern: "pickle\\.loads|yaml\\.load\\([^,)]+\\)|json\\.loads\\([^,)]+,\\s*[^)]*object_hook"
72        message: "Potentially insecure deserialization detected. Use safer alternatives like yaml.safe_load() or validate input before deserialization."
73        
74      # Pattern 14: Missing timeout settings
75      - pattern: "requests\\.get\\([^,)]+\\)|requests\\.(post|put|delete|patch)\\([^,)]+\\)"
76        message: "HTTP request without timeout setting detected. Always set timeouts for HTTP requests to prevent denial of service."
77        
78      # Pattern 15: Insecure upload directory
79      - pattern: "UPLOAD_FOLDER\\s*=\\s*['\"][^'\"]*(/tmp|/var/tmp)[^'\"]*['\"]|upload_folder\\s*=\\s*['\"][^'\"]*(/tmp|/var/tmp)[^'\"]*['\"]"
80        message: "Insecure upload directory detected. Use a properly secured directory for file uploads, not temporary directories."
81 
82  - type: suggest
83    message: |
84      **Python Security Configuration Best Practices:**
85      
86      1. **Environment-Specific Configuration:**
87         - Use different configurations for development, testing, and production
88         - Never enable debug mode in production
89         - Example with environment variables:
90```python
91           import os
92           
93           DEBUG = os.environ.get('DEBUG', 'False') == 'True'
94           SECRET_KEY = os.environ.get('SECRET_KEY')
95```
96      
97      2. **Secure Cookie Configuration:**
98         - Enable secure cookies in production
99         - Set appropriate cookie flags
100         - Example for Django:
101```python
102           SESSION_COOKIE_SECURE = True
103           SESSION_COOKIE_HTTPONLY = True
104           SESSION_COOKIE_SAMESITE = 'Lax'
105           CSRF_COOKIE_SECURE = True
106           CSRF_COOKIE_HTTPONLY = True
107```
108         - Example for Flask:
109```python
110           app.config.update(
111               SESSION_COOKIE_SECURE=True,
112               SESSION_COOKIE_HTTPONLY=True,
113               SESSION_COOKIE_SAMESITE='Lax',
114               PERMANENT_SESSION_LIFETIME=timedelta(hours=1)
115           )
116```
117      
118      3. **Security Headers:**
119         - Implement HTTP security headers
120         - Example with Flask-Talisman:
121```python
122           from flask_talisman import Talisman
123           
124           talisman = Talisman(
125               app,
126               content_security_policy={
127                   'default-src': "'self'",
128                   'script-src': "'self'"
129               },
130               strict_transport_security=True,
131               strict_transport_security_max_age=31536000,
132               frame_options='DENY'
133           )
134```
135         - Example for Django:
136```python
137           SECURE_HSTS_SECONDS = 31536000
138           SECURE_HSTS_INCLUDE_SUBDOMAINS = True
139           SECURE_HSTS_PRELOAD = True
140           SECURE_CONTENT_TYPE_NOSNIFF = True
141           SECURE_BROWSER_XSS_FILTER = True
142           X_FRAME_OPTIONS = 'DENY'
143```
144      
145      4. **CORS Configuration:**
146         - Restrict CORS to specific origins
147         - Example with Flask-CORS:
148```python
149           from flask_cors import CORS
150           
151           CORS(app, resources={r"/api/*": {"origins": "https://example.com"}})
152```
153         - Example for Django:
154```python
155           CORS_ALLOWED_ORIGINS = [
156               "https://example.com",
157               "https://sub.example.com",
158           ]
159           CORS_ALLOW_CREDENTIALS = True
160```
161      
162      5. **Secret Management:**
163         - Use environment variables or secure vaults for secrets
164         - Generate strong random secrets
165         - Example:
166```python
167           import secrets
168           
169           # Generate a secure random secret key
170           secret_key = secrets.token_hex(32)
171```
172      
173      6. **Error Handling:**
174         - Use custom error handlers to prevent information leakage
175         - Example for Flask:
176```python
177           @app.errorhandler(Exception)
178           def handle_exception(e):
179               # Log the error
180               app.logger.error(f"Unhandled exception: {str(e)}")
181               # Return a generic error message
182               return jsonify({"error": "An unexpected error occurred"}), 500
183```
184      
185      7. **Secure File Uploads:**
186         - Validate file types and sizes
187         - Store uploaded files outside the web root
188         - Use secure permissions
189         - Example:
190```python
191           import os
192           from werkzeug.utils import secure_filename
193           
194           UPLOAD_FOLDER = '/path/to/secure/location'
195           ALLOWED_EXTENSIONS = {'txt', 'pdf', 'png', 'jpg'}
196           
197           app.config['UPLOAD_FOLDER'] = UPLOAD_FOLDER
198           app.config['MAX_CONTENT_LENGTH'] = 16 * 1024 * 1024  # 16MB limit
199           
200           def allowed_file(filename):
201               return '.' in filename and filename.rsplit('.', 1)[1].lower() in ALLOWED_EXTENSIONS
202```
203      
204      8. **Dependency Management:**
205         - Regularly update dependencies
206         - Use tools like safety or dependabot
207         - Pin dependency versions
208         - Example requirements.txt:
209```
210           Flask==2.0.1
211           Werkzeug==2.0.1
212```
213      
214      9. **Timeout Configuration:**
215         - Set timeouts for all external service calls
216         - Example:
217```python
218           import requests
219           
220           response = requests.get('https://api.example.com', timeout=(3.05, 27))
221```
222      
223      10. **Secure Deserialization:**
224          - Use safe alternatives for deserialization
225          - Validate input before deserialization
226          - Example:
227```python
228            import yaml
229            
230            # Use safe_load instead of load
231            data = yaml.safe_load(yaml_string)
232```
233 
234  - type: validate
235    conditions:
236      # Check 1: Proper debug configuration
237      - pattern: "DEBUG\\s*=\\s*os\\.environ\\.get\\(['\"]DEBUG['\"]|DEBUG\\s*=\\s*False"
238        message: "Using environment-specific or secure debug configuration."
239      
240      # Check 2: Secure cookie settings
241      - pattern: "SESSION_COOKIE_SECURE\\s*=\\s*True|session_cookie_secure\\s*=\\s*true"
242        message: "Using secure cookie configuration."
243      
244      # Check 3: Security headers implementation
245      - pattern: "SECURE_HSTS_SECONDS|X_FRAME_OPTIONS|Talisman\\(|CSP|Content-Security-Policy"
246        message: "Implementing security headers."
247      
248      # Check 4: Proper CORS configuration
249      - pattern: "CORS_ALLOWED_ORIGINS|CORS\\(app,\\s*resources"
250        message: "Using restricted CORS configuration."
251 
252metadata:
253  priority: high
254  version: 1.0
255  tags:
256    - security
257    - python
258    - configuration
259    - deployment
260    - owasp
261    - language:python
262    - framework:django
263    - framework:flask
264    - framework:fastapi
265    - category:security
266    - subcategory:configuration
267    - standard:owasp-top10
268    - risk:a05-security-misconfiguration
269  references:
270    - "https://owasp.org/Top10/A05_2021-Security_Misconfiguration/"
271    - "https://cheatsheetseries.owasp.org/cheatsheets/Configuration_Security_Cheat_Sheet.html"
272    - "https://flask.palletsprojects.com/en/latest/security/"
273    - "https://docs.djangoproject.com/en/stable/topics/security/"
274    - "https://fastapi.tiangolo.com/advanced/security/https/"
275    - "https://owasp.org/www-project-secure-headers/"
276</rule>