-
Notifications
You must be signed in to change notification settings - Fork 8
Commit
This commit does not belong to any branch on this repository, and may belong to a fork outside of the repository.
feat(python): add sql injection rules (#412)
- Loading branch information
Showing
8 changed files
with
355 additions
and
0 deletions.
There are no files selected for viewing
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Original file line number | Diff line number | Diff line change |
---|---|---|
@@ -0,0 +1,49 @@ | ||
imports: | ||
- python_shared_common_sql_user_input | ||
patterns: | ||
- pattern: $<_>.objects.raw($<USER_INPUT>$<...>) | ||
filters: | ||
- variable: USER_INPUT | ||
detection: python_shared_common_sql_user_input | ||
scope: result | ||
languages: | ||
- python | ||
severity: critical | ||
metadata: | ||
description: Unsanitized external input in SQL query | ||
remediation_message: |- | ||
## Description | ||
Using unsanitized data, such as user input or request data, or externally influenced data passed to a function, in SQL query exposes your application to SQL injection attacks. This vulnerability arises when externally controlled data is directly included in SQL statements without proper sanitation, allowing attackers to manipulate queries and access or modify data. | ||
## Remediations | ||
- **Do not** include raw external input in SQL queries. This practice can lead to SQL injection vulnerabilities. | ||
```python | ||
sorting_order = request.GET["untrusted"] | ||
query = f"SELECT id, name FROM products ORDER BY name LIMIT 20 {sorting_order};"; # unsafe | ||
``` | ||
- **Do** validate all external input to ensure it meets the expected format before including it in SQL queries. | ||
```python | ||
sorting_order = "DESC" if request.GET["sortingOrder"] == "DESC" else "ASC" | ||
``` | ||
- **Do** use parameters for database queries to separate SQL logic from external input, significantly reducing the risk of SQL injection. | ||
```python | ||
Product.objects.raw("SELECT * FROM products WHERE id LIKE ?", [f"%{product_id}%"]) | ||
``` | ||
- **Do** escape all external input using appropriate database-specific escaping functions before including it in SQL queries. | ||
```python | ||
from mysql.connector.conversion import MySQLConverter | ||
converter = MySQLConverter(connection) | ||
ok = converter.escape(request.GET["value"]) | ||
``` | ||
## References | ||
- [OWASP SQL injection explained](https://owasp.org/www-community/attacks/SQL_Injection) | ||
- [OWASP SQL injection prevention cheat sheet](https://cheatsheetseries.owasp.org/cheatsheets/SQL_Injection_Prevention_Cheat_Sheet.html) | ||
cwe_id: | ||
- 89 | ||
id: python_django_sql_injection | ||
documentation_url: https://docs.bearer.com/reference/rules/python_django_sql_injection |
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Original file line number | Diff line number | Diff line change |
---|---|---|
@@ -0,0 +1,75 @@ | ||
imports: | ||
- python_shared_common_sql_user_input | ||
- python_shared_lang_import1 | ||
patterns: | ||
- pattern: $<CURSOR>.$<METHOD>($<USER_INPUT>$<...>) | ||
filters: | ||
- variable: CURSOR | ||
detection: python_lang_sql_injection_cursor | ||
scope: cursor | ||
- variable: METHOD | ||
values: | ||
- callproc | ||
- execute | ||
- executemany | ||
- variable: USER_INPUT | ||
detection: python_shared_common_sql_user_input | ||
scope: result | ||
- pattern: $<TEXT>($<USER_INPUT>) | ||
filters: | ||
- variable: TEXT | ||
detection: python_shared_lang_import1 | ||
scope: cursor | ||
filters: | ||
- variable: MODULE1 | ||
values: [sqlalchemy] | ||
- variable: NAME | ||
values: [text] | ||
- variable: USER_INPUT | ||
detection: python_shared_common_sql_user_input | ||
scope: result | ||
auxiliary: | ||
- id: python_lang_sql_injection_cursor | ||
patterns: | ||
- $<_>.cursor() | ||
languages: | ||
- python | ||
severity: critical | ||
metadata: | ||
description: Unsanitized external input in SQL query | ||
remediation_message: |- | ||
## Description | ||
Using unsanitized data, such as user input or request data, or externally influenced data passed to a function, in SQL query exposes your application to SQL injection attacks. This vulnerability arises when externally controlled data is directly included in SQL statements without proper sanitation, allowing attackers to manipulate queries and access or modify data. | ||
## Remediations | ||
- **Do not** include raw external input in SQL queries. This practice can lead to SQL injection vulnerabilities. | ||
```python | ||
sorting_order = request.GET["untrusted"] | ||
query = f"SELECT id, name FROM products ORDER BY name LIMIT 20 {sorting_order};"; # unsafe | ||
``` | ||
- **Do** validate all external input to ensure it meets the expected format before including it in SQL queries. | ||
```python | ||
sorting_order = "DESC" if request.GET["sortingOrder"] == "DESC" else "ASC" | ||
``` | ||
- **Do** use parameters for database queries to separate SQL logic from external input, significantly reducing the risk of SQL injection. | ||
```python | ||
cursor.execute("SELECT * FROM products WHERE id LIKE ?", [f"%{product_id}%"]) | ||
``` | ||
- **Do** escape all external input using appropriate database-specific escaping functions before including it in SQL queries. | ||
```python | ||
from mysql.connector.conversion import MySQLConverter | ||
converter = MySQLConverter(connection) | ||
ok = converter.escape(request.GET["value"]) | ||
``` | ||
## References | ||
- [OWASP SQL injection explained](https://owasp.org/www-community/attacks/SQL_Injection) | ||
- [OWASP SQL injection prevention cheat sheet](https://cheatsheetseries.owasp.org/cheatsheets/SQL_Injection_Prevention_Cheat_Sheet.html) | ||
cwe_id: | ||
- 89 | ||
id: python_lang_sql_injection | ||
documentation_url: https://docs.bearer.com/reference/rules/python_lang_sql_injection |
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Original file line number | Diff line number | Diff line change |
---|---|---|
@@ -0,0 +1,40 @@ | ||
type: shared | ||
languages: | ||
- python | ||
imports: | ||
- python_shared_lang_import1 | ||
- python_shared_lang_instance | ||
- python_shared_common_user_input | ||
- python_shared_django_html_sanitizer | ||
sanitizer: python_shared_common_html_user_input_sanitizer | ||
patterns: | ||
- pattern: $<USER_INPUT> | ||
filters: | ||
- variable: USER_INPUT | ||
detection: python_shared_common_user_input | ||
scope: cursor | ||
auxiliary: | ||
- id: python_shared_common_html_user_input_sanitizer | ||
patterns: | ||
- pattern: $<DJANGO_SANITIZER> | ||
filters: | ||
- variable: DJANGO_SANITIZER | ||
detection: python_shared_django_html_sanitizer | ||
scope: cursor_strict | ||
- pattern: $<SANITIZER>.sanitize($<_>) | ||
filters: | ||
- variable: SANITIZER | ||
detection: python_shared_lang_instance | ||
scope: cursor | ||
filters: | ||
- variable: CLASS | ||
detection: python_shared_lang_import1 | ||
scope: cursor | ||
filters: | ||
- variable: MODULE1 | ||
values: [html_sanitizer] | ||
- variable: NAME | ||
values: [Sanitizer] | ||
metadata: | ||
description: "Python HTML user input." | ||
id: python_shared_common_html_user_input |
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Original file line number | Diff line number | Diff line change |
---|---|---|
@@ -0,0 +1,80 @@ | ||
type: shared | ||
languages: | ||
- python | ||
imports: | ||
- python_shared_common_external_input | ||
- python_shared_lang_instance | ||
- python_shared_lang_import1 | ||
- python_shared_lang_import2 | ||
- python_shared_lang_import3 | ||
sanitizer: python_shared_common_sql_user_input_sanitizer | ||
patterns: | ||
- pattern: $<INPUT> | ||
filters: | ||
- variable: INPUT | ||
detection: python_shared_common_external_input | ||
scope: cursor | ||
auxiliary: | ||
- id: python_shared_common_sql_user_input_sanitizer | ||
patterns: | ||
- pattern: $<CONVERTER>.escape($<_>) | ||
filters: | ||
- variable: CONVERTER | ||
detection: python_shared_lang_instance | ||
scope: cursor | ||
filters: | ||
- variable: CLASS | ||
detection: python_shared_lang_import3 | ||
scope: cursor | ||
filters: | ||
- variable: MODULE1 | ||
values: [mysql] | ||
- variable: MODULE2 | ||
values: [connector] | ||
- variable: MODULE3 | ||
values: [conversion] | ||
- variable: NAME | ||
values: [MySQLConverter] | ||
- pattern: $<CONNECTION>.$<METHOD>($<...>) | ||
filters: | ||
- variable: CONNECTION | ||
detection: python_shared_common_sql_user_input_pymysql_connection | ||
scope: cursor | ||
- variable: METHOD | ||
values: | ||
- escape | ||
- escape_string | ||
- pattern: $<ADAPTER>.getquoted() | ||
filters: | ||
- variable: ADAPTER | ||
detection: python_shared_common_sql_user_input_psycopg_adapter | ||
scope: cursor | ||
- id: python_shared_common_sql_user_input_pymysql_connection | ||
patterns: | ||
- pattern: $<CONNECT>($<...>) | ||
filters: | ||
- variable: CONNECT | ||
detection: python_shared_lang_import1 | ||
scope: cursor | ||
filters: | ||
- variable: MODULE1 | ||
values: [pymysql] | ||
- variable: NAME | ||
values: [connect] | ||
- id: python_shared_common_sql_user_input_psycopg_adapter | ||
patterns: | ||
- pattern: $<ADAPT>($<...>) | ||
filters: | ||
- variable: ADAPT | ||
detection: python_shared_lang_import2 | ||
scope: cursor | ||
filters: | ||
- variable: MODULE1 | ||
values: [psycopg2] | ||
- variable: MODULE2 | ||
values: [extensions] | ||
- variable: NAME | ||
values: [adapt] | ||
metadata: | ||
description: "Python SQL user input." | ||
id: python_shared_common_sql_user_input |
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Original file line number | Diff line number | Diff line change |
---|---|---|
@@ -0,0 +1,20 @@ | ||
const { | ||
createNewInvoker, | ||
getEnvironment, | ||
} = require("../../../helper.js") | ||
const { ruleId, ruleFile, testBase } = getEnvironment(__dirname) | ||
|
||
describe(ruleId, () => { | ||
const invoke = createNewInvoker(ruleId, ruleFile, testBase) | ||
|
||
test("sql_injection", () => { | ||
const testCase = "main.py" | ||
|
||
const results = invoke(testCase) | ||
|
||
expect(results).toEqual({ | ||
Missing: [], | ||
Extra: [] | ||
}) | ||
}) | ||
}) |
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Original file line number | Diff line number | Diff line change |
---|---|---|
@@ -0,0 +1,10 @@ | ||
user_input = input() | ||
|
||
User.objects.raw(f"SELECT * FROM x WHERE y = ?", [user_input]) | ||
# bearer:expected python_django_sql_injection | ||
User.objects.raw(f"SELECT * FROM x WHERE y = {user_input}", []) | ||
|
||
import pymysql | ||
safe = pymysql.connect().escape_string(user_input) | ||
User.objects.raw(f"SELECT * FROM x WHERE y = {safe}", []) | ||
|
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Original file line number | Diff line number | Diff line change |
---|---|---|
@@ -0,0 +1,20 @@ | ||
const { | ||
createNewInvoker, | ||
getEnvironment, | ||
} = require("../../../helper.js") | ||
const { ruleId, ruleFile, testBase } = getEnvironment(__dirname) | ||
|
||
describe(ruleId, () => { | ||
const invoke = createNewInvoker(ruleId, ruleFile, testBase) | ||
|
||
test("sql_injection", () => { | ||
const testCase = "main.py" | ||
|
||
const results = invoke(testCase) | ||
|
||
expect(results).toEqual({ | ||
Missing: [], | ||
Extra: [] | ||
}) | ||
}) | ||
}) |
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Original file line number | Diff line number | Diff line change |
---|---|---|
@@ -0,0 +1,61 @@ | ||
user_input = input() | ||
|
||
def generic(): | ||
cursor = conn.cursor() | ||
|
||
cursor.callproc("SELECT * FROM x WHERE y = :foo", { "foo": user_input }) | ||
# bearer:expected python_lang_sql_injection | ||
cursor.callproc(user_input, { "foo": 42 }) | ||
cursor.execute("SELECT * FROM x WHERE y = ?", [user_input]) | ||
# bearer:expected python_lang_sql_injection | ||
cursor.execute("SELECT * FROM " + user_input, { "foo": 42 }) | ||
|
||
with connection.cursor() as c: | ||
c.executemany("UPDATE bar SET foo = 1 WHERE baz = :b", { "b": user_input }) | ||
# bearer:expected python_lang_sql_injection | ||
c.executemany(f"UPDATE bar SET foo = 1 WHERE baz = {user_input}", {}) | ||
|
||
|
||
def sqlalchemy(): | ||
from sqlalchemy import create_engine, text | ||
|
||
engine = create_engine('sqlite:///example.db') | ||
|
||
with engine.connect() as sqlalcon: | ||
result = sqlalcon.execute(text("SELECT * FROM :x"), { "x": user_input }) | ||
# bearer:expected python_lang_sql_injection | ||
result = sqlalcon.execute(text(f"SELECT * FROM {user_input}")) | ||
|
||
|
||
def mysql_connector_sanitizer(): | ||
import mysql.connector | ||
from mysql.connector.conversion import MySQLConverter | ||
|
||
conn = mysql.connector.connect() | ||
converter = MySQLConverter(conn) | ||
cursor = conn.cursor() | ||
|
||
# bearer:expected python_lang_sql_injection | ||
cursor.execute(user_input) | ||
cursor.execute(converter.escape(user_input)) | ||
|
||
def pymysql_sanitizer(): | ||
import pymysql | ||
|
||
conn = pymysql.connect() | ||
cursor = conn.cursor() | ||
|
||
# bearer:expected python_lang_sql_injection | ||
cursor.execute(user_input) | ||
cursor.execute(conn.escape_string(user_input)) | ||
|
||
def psycopg_sanitizer(): | ||
import psycopg2 | ||
import psycopg2.extensions | ||
|
||
conn = psycopg2.connect(database="your_database") | ||
cursor = conn.cursor() | ||
|
||
# bearer:expected python_lang_sql_injection | ||
cursor.execute(user_input) | ||
cursor.execute(psycopg2.extensions.adapt(user_input).getquoted()) |