feat(python): vulnerable pillow version

rules/python/third_parties/pillow.yml

@@ -0,0 +1,30 @@
+patterns:
+  - import pillow
+  - from pillow import $<_>
+dependency_check: true
+dependency:
+  name: pillow
+  min_version: 6.2.1
+  filename: requirements.txt
+languages:
+  - python
+severity: medium
+metadata:
+  description: Usage of vulnerable Pillow library
+  remediation_message: |
+    ## Description
+
+    A vulnerability was identified in Pillow versions less than 6.2.2, meaning that the library may allocate excessive memory, or have unusually long time processing times, when processing certain (specially crafted, malformed) image files.  
+
+    ## Remediations
+
+    - **Do** ensure that your application uses version 6.2.2 or greater of Pillow.
+
+    ## References
+
+    - [Pillow documentation](https://pillow.readthedocs.io/en/stable/)
+    - [NIST detail for vulnerability](https://nvd.nist.gov/vuln/detail/CVE-2019-16865)
+  cwe_id:
+    - 770
+  id: python_third_parties_pillow
+  documentation_url: https://docs.bearer.com/reference/rules/python_third_parties_pillow

tests/python/third_parties/pillow/test.js

@@ -0,0 +1,36 @@
+const {
+  createNewInvoker,
+  getEnvironment,
+} = require("../../../helper.js")
+const { ruleId, ruleFile, testBase } = getEnvironment(__dirname)
+
+describe(ruleId, () => {
+  const invoke = createNewInvoker(ruleId, ruleFile, testBase)
+
+  test("insecure", () => {
+    const testCase = "insecure"
+
+    const results = invoke(testCase)
+
+    expect(results.Missing).toEqual([])
+    expect(results.Extra).toEqual([])
+  })
+
+  test("secure", () => {
+    const testCase = "secure_dependency"
+
+    const results = invoke(testCase)
+
+    expect(results.Missing).toEqual([])
+    expect(results.Extra).toEqual([])
+  })
+
+  test("secure_dependency", () => {
+    const testCase = "secure_no_dependency"
+
+    const results = invoke(testCase)
+
+    expect(results.Missing).toEqual([])
+    expect(results.Extra).toEqual([])
+  })
+})

tests/python/third_parties/pillow/testdata/insecure/insecure.py

@@ -0,0 +1,2 @@
+# bearer:expected python_third_parties_pillow
+import pillow

tests/python/third_parties/pillow/testdata/insecure/requirements.txt

@@ -0,0 +1 @@
+pillow=6.2.0

tests/python/third_parties/pillow/testdata/secure_dependency/requirements.txt

@@ -0,0 +1 @@
+pillow=6.2.2

tests/python/third_parties/pillow/testdata/secure_dependency/secure_dependency.py

@@ -0,0 +1 @@
+import pillow

tests/python/third_parties/pillow/testdata/secure_no_dependency/requirements.txt

@@ -0,0 +1 @@
+pillow=6.2.0

tests/python/third_parties/pillow/testdata/secure_no_dependency/secure_no_dependency.py

@@ -0,0 +1,2 @@
+# not importing the dodgy library
+import world from hello