Cursor rule

1---
2description: Detect and prevent vulnerabilities related to outdated dependencies and components in Python applications as defined in OWASP Top 10:2021-A06
3globs: *.py, *.txt, *.ini, *.cfg, *.yml, *.yaml, *.json, *.toml
4alwaysApply: false
5---
6 # Python Vulnerable and Outdated Components Standards (OWASP A06:2021)
7 
8This rule enforces security best practices to prevent vulnerabilities related to outdated dependencies and components in Python applications, as defined in OWASP Top 10:2021-A06.
9 
10<rule>
11name: python_vulnerable_outdated_components
12description: Detect and prevent vulnerabilities related to outdated dependencies and components in Python applications as defined in OWASP Top 10:2021-A06
13filters:
14  - type: file_extension
15    pattern: "\\.(py|txt|ini|cfg|yml|yaml|json|toml)$"
16  - type: file_path
17    pattern: ".*"
18 
19actions:
20  - type: enforce
21    conditions:
22      # Pattern 1: Unpinned dependencies in requirements files
23      - pattern: "^(django|flask|fastapi|requests|cryptography|pyyaml|sqlalchemy|celery|numpy|pandas|pillow|tensorflow|torch|boto3|psycopg2)\\s*$"
24        file_pattern: "requirements.*\\.txt$|setup\\.py$|pyproject\\.toml$"
25        message: "Unpinned dependency detected. Always pin dependencies to specific versions to prevent automatic updates to potentially vulnerable versions."
26        
27      # Pattern 2: Outdated/vulnerable Django versions
28      - pattern: "django([<>=]=|~=|==)\\s*[\"']?(1\\.|2\\.[0-2]\\.|3\\.[0-2]\\.|4\\.0\\.)[0-9]+[\"']?"
29        message: "Potentially outdated Django version detected. Consider upgrading to the latest stable version with security updates."
30        
31      # Pattern 3: Outdated/vulnerable Flask versions
32      - pattern: "flask([<>=]=|~=|==)\\s*[\"']?(0\\.|1\\.[0-3]\\.|2\\.0\\.[0-3])[0-9]*[\"']?"
33        message: "Potentially outdated Flask version detected. Consider upgrading to the latest stable version with security updates."
34        
35      # Pattern 4: Outdated/vulnerable Requests versions
36      - pattern: "requests([<>=]=|~=|==)\\s*[\"']?(0\\.|1\\.|2\\.[0-2][0-5]\\.[0-9]+)[\"']?"
37        message: "Potentially outdated Requests version detected. Consider upgrading to the latest stable version with security updates."
38        
39      # Pattern 5: Outdated/vulnerable Cryptography versions
40      - pattern: "cryptography([<>=]=|~=|==)\\s*[\"']?(0\\.|1\\.|2\\.|3\\.[0-3]\\.|3\\.4\\.[0-7])[0-9]*[\"']?"
41        message: "Potentially outdated Cryptography version detected. Consider upgrading to the latest stable version with security updates."
42        
43      # Pattern 6: Outdated/vulnerable PyYAML versions
44      - pattern: "pyyaml([<>=]=|~=|==)\\s*[\"']?(0\\.|1\\.|2\\.|3\\.|4\\.|5\\.[0-5]\\.[0-9]+)[\"']?"
45        message: "Potentially outdated PyYAML version detected. Consider upgrading to the latest stable version with security updates."
46        
47      # Pattern 7: Outdated/vulnerable Pillow versions
48      - pattern: "pillow([<>=]=|~=|==)\\s*[\"']?(0\\.|1\\.|2\\.|3\\.|4\\.|5\\.|6\\.|7\\.|8\\.[0-3]\\.[0-9]+)[\"']?"
49        message: "Potentially outdated Pillow version detected. Consider upgrading to the latest stable version with security updates."
50        
51      # Pattern 8: Direct imports of deprecated modules
52      - pattern: "from\\s+xml\\.etree\\.ElementTree\\s+import\\s+.*parse|from\\s+urllib2\\s+import|from\\s+urllib\\s+import\\s+urlopen|import\\s+cgi|import\\s+imp"
53        message: "Use of deprecated or insecure module detected. Consider using more secure alternatives."
54        
55      # Pattern 9: Use of deprecated functions
56      - pattern: "\\.set_password\\([^)]*\\)|hashlib\\.md5\\(|hashlib\\.sha1\\(|random\\.random\\(|random\\.randrange\\(|random\\.randint\\("
57        message: "Use of deprecated or insecure function detected. Consider using more secure alternatives."
58        
59      # Pattern 10: Insecure dependency loading
60      - pattern: "__import__\\(|importlib\\.import_module\\(|exec\\(|eval\\("
61        message: "Dynamic code execution or module loading detected. This can lead to code injection if user input is involved."
62        
63      # Pattern 11: Outdated TLS/SSL versions
64      - pattern: "ssl\\.PROTOCOL_TLSv1|ssl\\.PROTOCOL_TLSv1_1|ssl\\.PROTOCOL_SSLv2|ssl\\.PROTOCOL_SSLv3|ssl\\.PROTOCOL_TLSv1_2"
65        message: "Outdated TLS/SSL protocol version detected. Use ssl.PROTOCOL_TLS_CLIENT or ssl.PROTOCOL_TLS_SERVER instead."
66        
67      # Pattern 12: Insecure deserialization libraries
68      - pattern: "import\\s+pickle|import\\s+marshal|import\\s+shelve"
69        message: "Use of potentially insecure deserialization library detected. Ensure these are not used with untrusted data."
70        
71      # Pattern 13: Outdated/vulnerable SQLAlchemy versions
72      - pattern: "sqlalchemy([<>=]=|~=|==)\\s*[\"']?(0\\.|1\\.[0-3]\\.[0-9]+)[\"']?"
73        message: "Potentially outdated SQLAlchemy version detected. Consider upgrading to the latest stable version with security updates."
74        
75      # Pattern 14: Outdated/vulnerable Celery versions
76      - pattern: "celery([<>=]=|~=|==)\\s*[\"']?(0\\.|1\\.|2\\.|3\\.|4\\.[0-4]\\.[0-9]+)[\"']?"
77        message: "Potentially outdated Celery version detected. Consider upgrading to the latest stable version with security updates."
78        
79      # Pattern 15: Insecure package installation
80      - pattern: "pip\\s+install\\s+.*--no-deps|pip\\s+install\\s+.*--user|pip\\s+install\\s+.*--pre|pip\\s+install\\s+.*--index-url\\s+http://"
81        message: "Insecure pip installation options detected. Avoid using --no-deps, ensure HTTPS for index URLs, and be cautious with --pre and --user flags."
82 
83  - type: suggest
84    message: |
85      **Python Dependency and Component Security Best Practices:**
86      
87      1. **Dependency Management:**
88         - Always pin dependencies to specific versions
89         - Use a lockfile (requirements.txt, Pipfile.lock, poetry.lock)
90         - Example requirements.txt:
91```
92           Django==4.2.7
93           requests==2.31.0
94           cryptography==41.0.5
95```
96      
97      2. **Vulnerability Scanning:**
98         - Regularly scan dependencies for vulnerabilities
99         - Use tools like safety, pip-audit, or dependabot
100         - Example safety check:
101```bash
102           pip install safety
103           safety check -r requirements.txt
104```
105      
106      3. **Dependency Updates:**
107         - Establish a regular update schedule
108         - Automate updates with tools like Renovate or Dependabot
109         - Test thoroughly after updates
110         - Example GitHub workflow:
111```yaml
112           name: Dependency Update
113           on:
114             schedule:
115               - cron: '0 0 * * 1'  # Weekly on Monday
116           jobs:
117             update-deps:
118               runs-on: ubuntu-latest
119               steps:
120                 - uses: actions/checkout@v3
121                 - name: Update dependencies
122                   run: |
123                     pip install pip-upgrader
124                     pip-upgrader -p requirements.txt
125```
126      
127      4. **Secure Package Installation:**
128         - Use trusted package sources
129         - Verify package integrity with hashes
130         - Example with pip and hashes:
131```
132           # requirements.txt
133           Django==4.2.7 --hash=sha256:8e0f1c2c2786b5c0e39fe1afce24c926040fad47c8ea8ad30aaa2c03b76293b8
134```
135      
136      5. **Minimal Dependencies:**
137         - Limit the number of dependencies
138         - Regularly audit and remove unused dependencies
139         - Consider security history when selecting packages
140         - Example dependency audit:
141```bash
142           pip install pipdeptree
143           pipdeptree --warn silence | grep -v &quot;^\s&quot;
144```
145      
146      6. **Virtual Environments:**
147         - Use isolated environments for each project
148         - Document environment setup
149         - Example:
150```bash
151           python -m venv venv
152           source venv/bin/activate  # On Windows: venv\Scripts\activate
153           pip install -r requirements.txt
154```
155      
156      7. **Container Security:**
157         - Use official base images
158         - Pin image versions
159         - Scan container images
160         - Example Dockerfile:
161```dockerfile
162           FROM python:3.11-slim@sha256:1234567890abcdef
163           
164           WORKDIR /app
165           COPY requirements.txt .
166           RUN pip install --no-cache-dir -r requirements.txt
167           
168           COPY . .
169           RUN pip install --no-cache-dir -e .
170           
171           USER nobody
172           CMD ["gunicorn", "myapp.wsgi:application"]
173```
174      
175      8. **Compile-time Dependencies:**
176         - Separate runtime and development dependencies
177         - Example with pip-tools:
178```
179           # requirements.in
180           Django>=4.2,<5.0
181           requests>=2.31.0
182           
183           # dev-requirements.in
184           -r requirements.in
185           pytest>=7.0.0
186           black>=23.0.0
187```
188      
189      9. **Deprecated API Usage:**
190         - Stay informed about deprecation notices
191         - Plan migrations away from deprecated APIs
192         - Example Django deprecation check:
193```bash
194           python manage.py check --deploy
195```
196      
197      10. **Supply Chain Security:**
198          - Use tools like pip-audit to check for supply chain attacks
199          - Consider using a private PyPI mirror
200          - Example:
201```bash
202            pip install pip-audit
203            pip-audit
204```
205 
206  - type: validate
207    conditions:
208      # Check 1: Pinned dependencies
209      - pattern: "^[a-zA-Z0-9_-]+==\\d+\\.\\d+\\.\\d+"
210        file_pattern: "requirements.*\\.txt$"
211        message: "Dependencies are properly pinned to specific versions."
212      
213      # Check 2: Use of dependency scanning tools
214      - pattern: "safety|pip-audit|pyup|dependabot|renovate"
215        file_pattern: "\\.github/workflows/.*\\.ya?ml$|\\.gitlab-ci\\.ya?ml$|tox\\.ini$|setup\\.py$|pyproject\\.toml$"
216        message: "Dependency scanning tools are being used."
217      
218      # Check 3: Modern TLS usage
219      - pattern: "ssl\\.PROTOCOL_TLS_CLIENT|ssl\\.PROTOCOL_TLS_SERVER|ssl\\.create_default_context\\(\\)"
220        message: "Using secure TLS protocol versions."
221      
222      # Check 4: Secure random generation
223      - pattern: "secrets\\.token_|secrets\\.choice|cryptography\\.hazmat"
224        message: "Using secure random generation methods."
225 
226metadata:
227  priority: high
228  version: 1.0
229  tags:
230    - security
231    - python
232    - dependencies
233    - supply-chain
234    - owasp
235    - language:python
236    - framework:django
237    - framework:flask
238    - framework:fastapi
239    - category:security
240    - subcategory:dependencies
241    - standard:owasp-top10
242    - risk:a06-vulnerable-outdated-components
243  references:
244    - "https://owasp.org/Top10/A06_2021-Vulnerable_and_Outdated_Components/"
245    - "https://cheatsheetseries.owasp.org/cheatsheets/Vulnerable_Dependency_Management_Cheat_Sheet.html"
246    - "https://pypi.org/project/safety/"
247    - "https://pypi.org/project/pip-audit/"
248    - "https://github.com/pyupio/safety-db"
249    - "https://github.com/pypa/advisory-database"
250    - "https://python-security.readthedocs.io/packages.html"
251</rule>