feat(python): add common user input (#396)

Bearer · May 14, 2024 · fc6d428 · fc6d428
1 parent 9ad387b
commit fc6d428
Show file tree

Hide file tree

Showing 5 changed files with 130 additions and 0 deletions.
diff --git a/rules/python/shared/common/external_input.yml b/rules/python/shared/common/external_input.yml
@@ -0,0 +1,20 @@
+imports:
+  - python_shared_common_user_input
+  - python_shared_lang_dynamic_input
+type: shared
+languages:
+  - python
+patterns:
+  - pattern: $<USER_INPUT>
+    filters:
+      - variable: USER_INPUT
+        detection: python_shared_common_user_input
+        scope: cursor_strict
+  - pattern: $<DYNAMIC_INPUT>
+    filters:
+      - variable: DYNAMIC_INPUT
+        detection: python_shared_lang_dynamic_input
+        scope: cursor_strict
+metadata:
+  description: Python externally influenced (user or dynamic) input.
+  id: python_shared_common_external_input
diff --git a/rules/python/shared/common/user_input.yml b/rules/python/shared/common/user_input.yml
@@ -0,0 +1,19 @@
+type: shared
+languages:
+  - python
+imports:
+  - python_shared_django_user_input
+  - python_shared_lang_user_input
+patterns:
+  - pattern: $<PYTHON_SHARED_COMMON_USER_INPUT>
+    filters:
+      - either:
+          - variable: PYTHON_SHARED_COMMON_USER_INPUT
+            detection: python_shared_django_user_input
+            scope: cursor_strict
+          - variable: PYTHON_SHARED_COMMON_USER_INPUT
+            detection: python_shared_lang_user_input
+            scope: cursor_strict
+metadata:
+  description: "Python user input."
+  id: python_shared_common_user_input
diff --git a/rules/python/shared/django/user_input.yml b/rules/python/shared/django/user_input.yml
@@ -0,0 +1,40 @@
+type: shared
+languages:
+  - python
+patterns:
+  - pattern: $<REQUEST>.$<METHOD>.get()
+    filters:
+      - variable: REQUEST
+        detection: python_shared_django_user_input_request
+        scope: cursor
+      - variable: METHOD
+        regex: (?i)\A(post|files|get|data|query_params|content_type|stream)\z
+  - pattern: $<REQUEST>.$<METHOD>[$<_>]
+    filters:
+      - variable: REQUEST
+        detection: python_shared_django_user_input_request
+        scope: cursor
+      - variable: METHOD
+        regex: (?i)\A(post|files|get|data|query_params|content_type|stream)\z
+  - pattern: $<FORM>.$<METHOD>[$<_>]
+    filters:
+      - variable: FORM
+        regex: \A(un)?(bound_)?form\z
+      - variable: METHOD
+        values:
+          - data
+          - changed_data
+          - cleaned_data
+  - pattern: $<FORM>[$<_>].value()
+    filters:
+      - variable: FORM
+        regex: \A(un)?(bound_)?form\z
+auxiliary:
+  - id: python_shared_django_user_input_request
+    patterns:
+      - request
+      - req
+      - r
+metadata:
+  description: "Django user input."
+  id: python_shared_django_user_input
diff --git a/rules/python/shared/lang/dynamic_input.yml b/rules/python/shared/lang/dynamic_input.yml
@@ -0,0 +1,43 @@
+type: shared
+languages:
+  - python
+patterns:
+  - sys.argv[$<_>]
+  - pattern: $<PARSER>.parse_args($<...>)
+    filters:
+      - variable: PARSER
+        detection: python_shared_lang_dynamic_input_parser
+        scope: result
+  - pattern: $<GETOPT>.getopt($<...>)
+    filters:
+      - variable: GETOPT
+        detection: python_shared_lang_dynamic_input_getopt
+        scope: result
+auxiliary:
+  - id: python_shared_lang_dynamic_input_parser
+    patterns:
+      - pattern: $<ARG_PARSER>()
+        filters:
+          - variable: ARG_PARSER
+            detection: python_shared_lang_dynamic_input_argument_parser
+  - id: python_shared_lang_dynamic_input_argument_parser
+    patterns:
+      - ArgumentParser # fallback
+      - from argparse import ArgumentParser as $<!>$<_>
+      - pattern: $<ARGPARSE>.ArgumentParser
+        filters:
+          - variable: ARGPARSE
+            detection: python_shared_lang_dynamic_input_argparse_import
+  - id: python_shared_lang_dynamic_input_argparse_import
+    patterns:
+      - import $<!>argparse
+      - import argparse as $<!>$<_>
+      - argparse # fallback
+  - id: python_shared_lang_dynamic_input_getopt
+    patterns:
+      - import $<!>getopt
+      - import getopt as $<!>$<_>
+      - getopt # fallback
+metadata:
+  description: "Python dynamic input."
+  id: python_shared_lang_dynamic_input
diff --git a/rules/python/shared/lang/user_input.yml b/rules/python/shared/lang/user_input.yml
@@ -0,0 +1,8 @@
+type: shared
+languages:
+  - python
+patterns:
+  - input($<...>)
+metadata:
+  description: "Python lang user input."
+  id: python_shared_lang_user_input