diff --git a/rules/python/third_parties/urllib3.yml b/rules/python/third_parties/urllib3.yml new file mode 100644 index 00000000..2ec642b2 --- /dev/null +++ b/rules/python/third_parties/urllib3.yml @@ -0,0 +1,30 @@ +patterns: + - import urllib3 + - from urllib3 import $<_> +dependency_check: true +dependency: + name: urllib3 + min_version: 1.24.1 + filename: requirements.txt +languages: + - python +severity: high +metadata: + description: Usage of vulnerable urllib3 library + remediation_message: | + ## Description + + Versions of urllib3 less than 1.24.2 have multiple security issues and vulnerabilities around SSL certificate validation bypass. This means that SSL connections may succeed in cases where they should be invalidated. + + ## Remediations + + - **Do** ensure that your application uses version 1.24.2 or greater of urllib3. + + ## References + + - [urllib3 documentation](https://urllib3.readthedocs.io/) + - [NIST detail for vulnerability](https://nvd.nist.gov/vuln/detail/cve-2019-11324) + cwe_id: + - 295 + id: python_third_parties_urllib3 + documentation_url: https://docs.bearer.com/reference/rules/python_third_parties_urllib3 diff --git a/tests/python/third_parties/urllib3/test.js b/tests/python/third_parties/urllib3/test.js new file mode 100644 index 00000000..ce409e27 --- /dev/null +++ b/tests/python/third_parties/urllib3/test.js @@ -0,0 +1,36 @@ +const { + createNewInvoker, + getEnvironment, +} = require("../../../helper.js") +const { ruleId, ruleFile, testBase } = getEnvironment(__dirname) + +describe(ruleId, () => { + const invoke = createNewInvoker(ruleId, ruleFile, testBase) + + test("insecure", () => { + const testCase = "insecure" + + const results = invoke(testCase) + + expect(results.Missing).toEqual([]) + expect(results.Extra).toEqual([]) + }) + + test("secure", () => { + const testCase = "secure_dependency" + + const results = invoke(testCase) + + expect(results.Missing).toEqual([]) + expect(results.Extra).toEqual([]) + }) + + test("secure_dependency", () => { + const testCase = "secure_no_dependency" + + const results = invoke(testCase) + + expect(results.Missing).toEqual([]) + expect(results.Extra).toEqual([]) + }) +}) \ No newline at end of file diff --git a/tests/python/third_parties/urllib3/testdata/insecure/insecure.py b/tests/python/third_parties/urllib3/testdata/insecure/insecure.py new file mode 100644 index 00000000..d4eef869 --- /dev/null +++ b/tests/python/third_parties/urllib3/testdata/insecure/insecure.py @@ -0,0 +1,2 @@ +# bearer:expected python_third_parties_urllib3 +import urllib3 \ No newline at end of file diff --git a/tests/python/third_parties/urllib3/testdata/insecure/requirements.txt b/tests/python/third_parties/urllib3/testdata/insecure/requirements.txt new file mode 100644 index 00000000..00cd0cf9 --- /dev/null +++ b/tests/python/third_parties/urllib3/testdata/insecure/requirements.txt @@ -0,0 +1 @@ +urllib3==1.24.1 \ No newline at end of file diff --git a/tests/python/third_parties/urllib3/testdata/main.py b/tests/python/third_parties/urllib3/testdata/main.py new file mode 100644 index 00000000..2717f4c5 --- /dev/null +++ b/tests/python/third_parties/urllib3/testdata/main.py @@ -0,0 +1 @@ +# Use bearer:expected python_third_parties_urllib3 to flag expected findings \ No newline at end of file diff --git a/tests/python/third_parties/urllib3/testdata/secure_dependency/requirements.txt b/tests/python/third_parties/urllib3/testdata/secure_dependency/requirements.txt new file mode 100644 index 00000000..0b9e28f2 --- /dev/null +++ b/tests/python/third_parties/urllib3/testdata/secure_dependency/requirements.txt @@ -0,0 +1 @@ +urllib3==1.26.9 \ No newline at end of file diff --git a/tests/python/third_parties/urllib3/testdata/secure_dependency/secure_dependency.py b/tests/python/third_parties/urllib3/testdata/secure_dependency/secure_dependency.py new file mode 100644 index 00000000..b4e2b3af --- /dev/null +++ b/tests/python/third_parties/urllib3/testdata/secure_dependency/secure_dependency.py @@ -0,0 +1 @@ +import urllib3 \ No newline at end of file diff --git a/tests/python/third_parties/urllib3/testdata/secure_no_dependency/requirements.txt b/tests/python/third_parties/urllib3/testdata/secure_no_dependency/requirements.txt new file mode 100644 index 00000000..00cd0cf9 --- /dev/null +++ b/tests/python/third_parties/urllib3/testdata/secure_no_dependency/requirements.txt @@ -0,0 +1 @@ +urllib3==1.24.1 \ No newline at end of file diff --git a/tests/python/third_parties/urllib3/testdata/secure_no_dependency/secure_no_dependency.py b/tests/python/third_parties/urllib3/testdata/secure_no_dependency/secure_no_dependency.py new file mode 100644 index 00000000..fdccdd32 --- /dev/null +++ b/tests/python/third_parties/urllib3/testdata/secure_no_dependency/secure_no_dependency.py @@ -0,0 +1,2 @@ +# not importing the dodgy library +import world from hello \ No newline at end of file