From 0cd501128302e7aacb8605a66a2fa750b57011b2 Mon Sep 17 00:00:00 2001
From: elsapet <elizabeth@bearer.sh>
Date: Thu, 30 May 2024 16:54:44 +0200
Subject: [PATCH] feat(python): vulnerable urllib3 version

---
 rules/python/third_parties/urllib3.yml        | 30 ++++++++++++++++
 tests/python/third_parties/urllib3/test.js    | 36 +++++++++++++++++++
 .../urllib3/testdata/insecure/insecure.py     |  2 ++
 .../testdata/insecure/requirements.txt        |  1 +
 .../third_parties/urllib3/testdata/main.py    |  1 +
 .../secure_dependency/requirements.txt        |  1 +
 .../secure_dependency/secure_dependency.py    |  1 +
 .../secure_no_dependency/requirements.txt     |  1 +
 .../secure_no_dependency.py                   |  2 ++
 9 files changed, 75 insertions(+)
 create mode 100644 rules/python/third_parties/urllib3.yml
 create mode 100644 tests/python/third_parties/urllib3/test.js
 create mode 100644 tests/python/third_parties/urllib3/testdata/insecure/insecure.py
 create mode 100644 tests/python/third_parties/urllib3/testdata/insecure/requirements.txt
 create mode 100644 tests/python/third_parties/urllib3/testdata/main.py
 create mode 100644 tests/python/third_parties/urllib3/testdata/secure_dependency/requirements.txt
 create mode 100644 tests/python/third_parties/urllib3/testdata/secure_dependency/secure_dependency.py
 create mode 100644 tests/python/third_parties/urllib3/testdata/secure_no_dependency/requirements.txt
 create mode 100644 tests/python/third_parties/urllib3/testdata/secure_no_dependency/secure_no_dependency.py

diff --git a/rules/python/third_parties/urllib3.yml b/rules/python/third_parties/urllib3.yml
new file mode 100644
index 00000000..2ec642b2
--- /dev/null
+++ b/rules/python/third_parties/urllib3.yml
@@ -0,0 +1,30 @@
+patterns:
+  - import urllib3
+  - from urllib3 import $<_>
+dependency_check: true
+dependency:
+  name: urllib3
+  min_version: 1.24.1
+  filename: requirements.txt
+languages:
+  - python
+severity: high
+metadata:
+  description: Usage of vulnerable urllib3 library
+  remediation_message: |
+    ## Description
+
+    Versions of urllib3 less than 1.24.2 have multiple security issues and vulnerabilities around SSL certificate validation bypass. This means that SSL connections may succeed in cases where they should be invalidated.  
+
+    ## Remediations
+
+    - **Do** ensure that your application uses version 1.24.2 or greater of urllib3.
+
+    ## References
+
+    - [urllib3 documentation](https://urllib3.readthedocs.io/)
+    - [NIST detail for vulnerability](https://nvd.nist.gov/vuln/detail/cve-2019-11324)
+  cwe_id:
+    - 295
+  id: python_third_parties_urllib3
+  documentation_url: https://docs.bearer.com/reference/rules/python_third_parties_urllib3
diff --git a/tests/python/third_parties/urllib3/test.js b/tests/python/third_parties/urllib3/test.js
new file mode 100644
index 00000000..ce409e27
--- /dev/null
+++ b/tests/python/third_parties/urllib3/test.js
@@ -0,0 +1,36 @@
+const {
+  createNewInvoker,
+  getEnvironment,
+} = require("../../../helper.js")
+const { ruleId, ruleFile, testBase } = getEnvironment(__dirname)
+
+describe(ruleId, () => {
+  const invoke = createNewInvoker(ruleId, ruleFile, testBase)
+
+  test("insecure", () => {
+    const testCase = "insecure"
+
+    const results = invoke(testCase)
+
+    expect(results.Missing).toEqual([])
+    expect(results.Extra).toEqual([])
+  })
+
+  test("secure", () => {
+    const testCase = "secure_dependency"
+
+    const results = invoke(testCase)
+
+    expect(results.Missing).toEqual([])
+    expect(results.Extra).toEqual([])
+  })
+
+  test("secure_dependency", () => {
+    const testCase = "secure_no_dependency"
+
+    const results = invoke(testCase)
+
+    expect(results.Missing).toEqual([])
+    expect(results.Extra).toEqual([])
+  })
+})
\ No newline at end of file
diff --git a/tests/python/third_parties/urllib3/testdata/insecure/insecure.py b/tests/python/third_parties/urllib3/testdata/insecure/insecure.py
new file mode 100644
index 00000000..d4eef869
--- /dev/null
+++ b/tests/python/third_parties/urllib3/testdata/insecure/insecure.py
@@ -0,0 +1,2 @@
+# bearer:expected python_third_parties_urllib3
+import urllib3
\ No newline at end of file
diff --git a/tests/python/third_parties/urllib3/testdata/insecure/requirements.txt b/tests/python/third_parties/urllib3/testdata/insecure/requirements.txt
new file mode 100644
index 00000000..00cd0cf9
--- /dev/null
+++ b/tests/python/third_parties/urllib3/testdata/insecure/requirements.txt
@@ -0,0 +1 @@
+urllib3==1.24.1
\ No newline at end of file
diff --git a/tests/python/third_parties/urllib3/testdata/main.py b/tests/python/third_parties/urllib3/testdata/main.py
new file mode 100644
index 00000000..2717f4c5
--- /dev/null
+++ b/tests/python/third_parties/urllib3/testdata/main.py
@@ -0,0 +1 @@
+# Use bearer:expected python_third_parties_urllib3 to flag expected findings
\ No newline at end of file
diff --git a/tests/python/third_parties/urllib3/testdata/secure_dependency/requirements.txt b/tests/python/third_parties/urllib3/testdata/secure_dependency/requirements.txt
new file mode 100644
index 00000000..0b9e28f2
--- /dev/null
+++ b/tests/python/third_parties/urllib3/testdata/secure_dependency/requirements.txt
@@ -0,0 +1 @@
+urllib3==1.26.9
\ No newline at end of file
diff --git a/tests/python/third_parties/urllib3/testdata/secure_dependency/secure_dependency.py b/tests/python/third_parties/urllib3/testdata/secure_dependency/secure_dependency.py
new file mode 100644
index 00000000..b4e2b3af
--- /dev/null
+++ b/tests/python/third_parties/urllib3/testdata/secure_dependency/secure_dependency.py
@@ -0,0 +1 @@
+import urllib3
\ No newline at end of file
diff --git a/tests/python/third_parties/urllib3/testdata/secure_no_dependency/requirements.txt b/tests/python/third_parties/urllib3/testdata/secure_no_dependency/requirements.txt
new file mode 100644
index 00000000..00cd0cf9
--- /dev/null
+++ b/tests/python/third_parties/urllib3/testdata/secure_no_dependency/requirements.txt
@@ -0,0 +1 @@
+urllib3==1.24.1
\ No newline at end of file
diff --git a/tests/python/third_parties/urllib3/testdata/secure_no_dependency/secure_no_dependency.py b/tests/python/third_parties/urllib3/testdata/secure_no_dependency/secure_no_dependency.py
new file mode 100644
index 00000000..fdccdd32
--- /dev/null
+++ b/tests/python/third_parties/urllib3/testdata/secure_no_dependency/secure_no_dependency.py
@@ -0,0 +1,2 @@
+# not importing the dodgy library
+import world from hello
\ No newline at end of file