rules-python

assert statements are stripped when Python runs with -O (optimize). Use explicit if/raise for input validation in production code.

Bare 'except:' or 'except Exception:' swallows all errors including KeyboardInterrupt and SystemExit. Catch specific exception types.

RISK: a hardcoded Django SECRET_KEY compromises session/CSRF signing if committed. FIX: SECRET_KEY = os.environ['DJANGO_SECRET_KEY'] and provision per-environment.

eval() and exec() allow arbitrary code execution and are banned. Refactor to use safe alternatives — if you need dynamic dispatch, use a dict of callables.

RISK: Flask/Werkzeug debug mode exposes an interactive PIN-protected console that allows RCE if the PIN is leaked (CVE-2024-34069 class). FIX: never ship debug=True; gate on an env var that is False in production.

RISK: hardcoded credentials leak when code is committed or shared. FIX: load secrets from environment variables (os.environ) or a secret manager; add the pattern to pre-commit gitleaks.

RISK: Jinja2 Environment() defaults to autoescape=False, enabling XSS in HTML templates. FIX: pass autoescape=select_autoescape(['html','xml']) or autoescape=True.

RISK: string interpolation in LDAP search filters enables LDAP injection (CWE-90). FIX: escape all user-supplied values with ldap3.utils.conv.escape_filter_chars() or ldap.filter.escape_filter_chars() before inserting into a filter string.

RISK: marshal.loads() on untrusted data can execute arbitrary code (CWE-502) — marshal is not a safe serialisation format. FIX: use json or a schema-validated format; marshal is intended only for Python bytecode internals.

RISK: MD5/SHA1 are broken for security use (collisions, length-extension). FIX: use hashlib.sha256() for integrity, or hashlib.blake2b()/SHA-3; add usedforsecurity=False only for non-security hashing.

Mutable default arguments (lists, dicts) are shared across all calls. Use None as default and initialize inside the function body.

RISK: open() with a user-supplied or interpolated path can escape the intended directory (path traversal, CWE-22). FIX: resolve and validate the path with os.path.realpath() and confirm it starts with the expected base directory before opening.

os.system() and os.popen() pass commands to the shell unsanitized. Use subprocess.run() with a list of arguments and shell=False.

pickle.loads() with untrusted data is a remote code execution vulnerability. Use json.loads() or a safe serialization format for untrusted input.

print() detected in source code. Use the logging module for structured output that can be controlled in production.

RISK: random module is not cryptographically secure and is predictable. FIX: use the secrets module — secrets.token_urlsafe(32), secrets.token_hex(), or secrets.choice().

RISK: requests calls without timeout= can hang indefinitely, causing resource exhaustion. FIX: pass timeout=(connect, read) seconds, e.g. requests.get(url, timeout=(5, 30)).

RISK: verify=False disables TLS certificate validation, enabling MITM attacks. FIX: remove the argument, or pass verify='/path/to/ca-bundle.pem' for a private CA.

subprocess with shell=True passes the command through the shell, enabling injection attacks. Use shell=False and pass arguments as a list.

String formatting in SQL queries enables SQL injection. Use parameterized queries: cursor.execute('SELECT * FROM t WHERE id = %s', (user_id,))

RISK: ssl._create_unverified_context / CERT_NONE disables certificate verification. FIX: use ssl.create_default_context() and configure a trusted CA bundle.

subprocess calls with string interpolation/concatenation enable command injection. Pass arguments as a list with shell=False: subprocess.run(['cmd', user_arg], shell=False)

RISK: tarfile extractall without filter= is vulnerable to path traversal (CVE-2007-4559); Python 3.14 requires explicit filter. FIX: pass filter='data' to reject absolute paths, symlinks, and special files.

RISK: tempfile.mktemp() has a TOCTOU race — an attacker can pre-create the path as a symlink. FIX: use tempfile.mkstemp() or NamedTemporaryFile(), which atomically create the file.

Wildcard imports pollute the namespace and make it hard to trace where names come from. Use explicit imports.

RISK: stdlib xml parsers are vulnerable to XXE, billion-laughs, and entity-expansion attacks on untrusted input. FIX: use defusedxml (pip install defusedxml) as a drop-in replacement.

yaml.load() with untrusted input allows arbitrary code execution. Use yaml.safe_load() instead.