Semgrep Registry - python.lang.security.audit.insecure-transport.urllib.insecure-openerdirector-open-ftp.insecure-openerdirector-open-ftp

Detected an unsecured transmission channel. 'OpenerDirector.open(...)' is being used with 'ftp://'. Information sent over this connection will be unencrypted. Consider using SFTP instead. urllib does not support SFTP, so consider a library which supports SFTP.

Defintion

Open in Playground

rules:
  - id: insecure-openerdirector-open-ftp
    message: Detected an unsecured transmission channel. 'OpenerDirector.open(...)'
      is being used with 'ftp://'. Information sent over this connection will be
      unencrypted. Consider using SFTP instead. urllib does not support SFTP, so
      consider a library which supports SFTP.
    metadata:
      owasp:
        - A03:2017 - Sensitive Data Exposure
        - A02:2021 - Cryptographic Failures
      cwe:
        - "CWE-319: Cleartext Transmission of Sensitive Information"
      references:
        - https://docs.python.org/3/library/urllib.request.html#urllib.request.OpenerDirector.open
      category: security
      technology:
        - urllib
      subcategory:
        - audit
      likelihood: LOW
      impact: LOW
      confidence: LOW
      license: Commons Clause License Condition v1.0[LGPL-2.1-only]
      vulnerability_class:
        - Mishandled Sensitive Information
    severity: WARNING
    languages:
      - python
    pattern-either:
      - pattern: urllib.request.OpenerDirector(...).open("=~/^[Ff][Tt][Pp]://.*/", ...)
      - patterns:
          - pattern-inside: |
              $OPENERDIRECTOR = urllib.request.OpenerDirector(...)
              ...
          - pattern: $OPENERDIRECTOR.open("=~/^[Ff][Tt][Pp]://.*/", ...)
      - patterns:
          - pattern-inside: |
              $OPENERDIRECTOR = urllib.request.OpenerDirector(...)
              ...
          - pattern: |
              $URL = "=~/^[Ff][Tt][Pp]://.*/"
              ...
              $OPENERDIRECTOR.open($URL, ...)
      - pattern: |
          $URL = "=~/^[Ff][Tt][Pp]://.*/"
          ...
          urllib.request.OpenerDirector(...).open($URL, ...)
      - patterns:
          - pattern-inside: |
              def $FUNC(..., $URL = "=~/^[Ff][Tt][Pp]://.*/", ...):
                ...
          - pattern-either:
              - pattern: urllib.request.OpenerDirector(...).open($URL, ...)
              - patterns:
                  - pattern-inside: |
                      $OPENERDIRECTOR = urllib.request.OpenerDirector(...)
                      ...
                  - pattern: $OPENERDIRECTOR.open($URL, ...)

from urllib.request import OpenerDirector def test1(): od = OpenerDirector() # ruleid: insecure-openerdirector-open-ftp od.open("ftp://example.com") def test1_ok(): od = OpenerDirector() # ok: insecure-openerdirector-open-ftp od.open("sftp://example.com") def test2(): od = OpenerDirector() # ruleid: insecure-openerdirector-open-ftp url = "ftp://example.com" # ruleid: insecure-openerdirector-open-ftp od.open(url) def test2_ok(): od = OpenerDirector() # ok: insecure-openerdirector-open-ftp url = "sftp://example.com" od.open(url) def test3(): # ruleid: insecure-openerdirector-open-ftp OpenerDirector().open("ftp://example.com") def test3_ok(): # ok: insecure-openerdirector-open-ftp OpenerDirector().open("sftp://example.com") def test4(): # ruleid: insecure-openerdirector-open-ftp url = "ftp://example.com" # ruleid: insecure-openerdirector-open-ftp OpenerDirector().open(url) def test4_ok(): # ok: insecure-openerdirector-open-ftp url = "sftp://example.com" OpenerDirector().open(url) def test5(url = "ftp://example.com"): # ruleid: insecure-openerdirector-open-ftp OpenerDirector().open(url) def test5_ok(url = "sftp://example.com"): # ok: insecure-openerdirector-open-ftp OpenerDirector().open(url) def test6(url = "ftp://example.com"): od = OpenerDirector() # ruleid: insecure-openerdirector-open-ftp od.open(url) def test6_ok(url = "sftp://example.com"): od = OpenerDirector() # ok: insecure-openerdirector-open-ftp od.open(url)

python.lang.security.audit.insecure-transport.urllib.insecure-openerdirector-open-ftp.insecure-openerdirector-open-ftp

Run Locally

Run in CI

Defintion

Examples

insecure-openerdirector-open-ftp.py