feat(python): vulnerable urllib3 version

rules/python/third_parties/urllib3.yml

@@ -0,0 +1,30 @@
+patterns:
+  - import urllib3
+  - from urllib3 import $<_>
+dependency_check: true
+dependency:
+  name: urllib3
+  min_version: 1.24.1
+  filename: requirements.txt
+languages:
+  - python
+severity: high
+metadata:
+  description: Usage of vulnerable urllib3 library
+  remediation_message: |
+    ## Description
+
+    Versions of urllib3 less than 1.24.2 have multiple security issues and vulnerabilities around SSL certificate validation bypass. This means that SSL connections may succeed in cases where they should be invalidated.  
+
+    ## Remediations
+
+    - **Do** ensure that your application uses version 1.24.2 or greater of urllib3.
+
+    ## References
+
+    - [urllib3 documentation](https://urllib3.readthedocs.io/)
+    - [NIST detail for vulnerability](https://nvd.nist.gov/vuln/detail/cve-2019-11324)
+  cwe_id:
+    - 295
+  id: python_third_parties_urllib3
+  documentation_url: https://docs.bearer.com/reference/rules/python_third_parties_urllib3

tests/python/third_parties/urllib3/test.js

@@ -0,0 +1,36 @@
+const {
+  createNewInvoker,
+  getEnvironment,
+} = require("../../../helper.js")
+const { ruleId, ruleFile, testBase } = getEnvironment(__dirname)
+
+describe(ruleId, () => {
+  const invoke = createNewInvoker(ruleId, ruleFile, testBase)
+
+  test("insecure", () => {
+    const testCase = "insecure"
+
+    const results = invoke(testCase)
+
+    expect(results.Missing).toEqual([])
+    expect(results.Extra).toEqual([])
+  })
+
+  test("secure", () => {
+    const testCase = "secure_dependency"
+
+    const results = invoke(testCase)
+
+    expect(results.Missing).toEqual([])
+    expect(results.Extra).toEqual([])
+  })
+
+  test("secure_dependency", () => {
+    const testCase = "secure_no_dependency"
+
+    const results = invoke(testCase)
+
+    expect(results.Missing).toEqual([])
+    expect(results.Extra).toEqual([])
+  })
+})

tests/python/third_parties/urllib3/testdata/insecure/insecure.py

@@ -0,0 +1,2 @@
+# bearer:expected python_third_parties_urllib3
+import urllib3

tests/python/third_parties/urllib3/testdata/insecure/requirements.txt

@@ -0,0 +1 @@
+urllib3==1.24.1

tests/python/third_parties/urllib3/testdata/main.py

@@ -0,0 +1 @@
+# Use bearer:expected python_third_parties_urllib3 to flag expected findings

tests/python/third_parties/urllib3/testdata/secure_dependency/requirements.txt

@@ -0,0 +1 @@
+urllib3==1.26.9

tests/python/third_parties/urllib3/testdata/secure_dependency/secure_dependency.py

@@ -0,0 +1 @@
+import urllib3

tests/python/third_parties/urllib3/testdata/secure_no_dependency/requirements.txt

@@ -0,0 +1 @@
+urllib3==1.24.1

tests/python/third_parties/urllib3/testdata/secure_no_dependency/secure_no_dependency.py

@@ -0,0 +1,2 @@
+# not importing the dodgy library
+import world from hello