python.lang.security.audit.insecure-transport.urllib.insecure-urlopen-ftp.insecure-urlopen-ftp
semgrep
Author
7,311
Download Count*
License
Detected 'urllib.urlopen()' using 'ftp://'. This request will not be encrypted. Consider using SFTP instead. urllib does not support SFTP, so consider switching to a library which supports SFTP.
Run Locally
Run in CI
Defintion
rules:
- id: insecure-urlopen-ftp
message: Detected 'urllib.urlopen()' using 'ftp://'. This request will not be
encrypted. Consider using SFTP instead. urllib does not support SFTP, so
consider switching to a library which supports SFTP.
metadata:
owasp:
- A03:2017 - Sensitive Data Exposure
- A02:2021 - Cryptographic Failures
cwe:
- "CWE-319: Cleartext Transmission of Sensitive Information"
references:
- https://docs.python.org/3/library/urllib.request.html#urllib.request.urlopen
category: security
technology:
- urllib
subcategory:
- audit
likelihood: LOW
impact: LOW
confidence: LOW
license: Commons Clause License Condition v1.0[LGPL-2.1-only]
vulnerability_class:
- Mishandled Sensitive Information
severity: WARNING
languages:
- python
pattern-either:
- pattern: urllib.request.urlopen("=~/^[Ff][Tt][Pp]://.*/", ...)
- pattern: |
$URL = "=~/^[Ff][Tt][Pp]://.*/"
...
urllib.request.urlopen($URL, ...)
- pattern: |-
def $FUNC(..., $URL = "=~/^[Ff][Tt][Pp]://.*/", ...):
...
urllib.request.urlopen($URL, ...)
Examples
insecure-urlopen-ftp.py
from urllib.request import urlopen
def test1():
# ruleid: insecure-urlopen-ftp
urlopen("ftp://example.com")
def test1_ok():
# ok: insecure-urlopen-ftp
urlopen("sftp://example.com")
def test2():
# ruleid: insecure-urlopen-ftp
url = "ftp://example.com"
# ruleid: insecure-urlopen-ftp
urlopen(url)
def test2_ok():
# ok: insecure-urlopen-ftp
url = "sftp://example.com"
urlopen(url)
# ruleid: insecure-urlopen-ftp
def test3(url = "ftp://example.com"):
urlopen(url)
# ok: insecure-urlopen-ftp
def test3_ok(url = "sftp://example.com"):
urlopen(url)
Short Link: https://sg.run/6n1o