python.lang.security.audit.insecure-transport.urllib.insecure-urlopener-open-ftp.insecure-urlopener-open-ftp
semgrep
Author
7,311
Download Count*
License
Detected an insecure transmission channel. 'URLopener.open(...)' is being used with 'ftp://'. Use SFTP instead. urllib does not support SFTP, so consider using a library which supports SFTP.
Run Locally
Run in CI
Defintion
rules:
- id: insecure-urlopener-open-ftp
message: Detected an insecure transmission channel. 'URLopener.open(...)' is
being used with 'ftp://'. Use SFTP instead. urllib does not support SFTP,
so consider using a library which supports SFTP.
metadata:
owasp:
- A03:2017 - Sensitive Data Exposure
- A02:2021 - Cryptographic Failures
cwe:
- "CWE-319: Cleartext Transmission of Sensitive Information"
references:
- https://docs.python.org/3/library/urllib.request.html#urllib.request.URLopener.open
category: security
technology:
- urllib
subcategory:
- audit
likelihood: LOW
impact: LOW
confidence: LOW
license: Commons Clause License Condition v1.0[LGPL-2.1-only]
vulnerability_class:
- Mishandled Sensitive Information
severity: WARNING
languages:
- python
pattern-either:
- pattern: urllib.request.URLopener(...).open("=~/[Ff][Tt][Pp]://.*/", ...)
- patterns:
- pattern-inside: |
$OPENERDIRECTOR = urllib.request.URLopener(...)
...
- pattern: $OPENERDIRECTOR.open("=~/[Ff][Tt][Pp]://.*/", ...)
- patterns:
- pattern-inside: |
$OPENERDIRECTOR = urllib.request.URLopener(...)
...
- pattern: |
$URL = "=~/[Ff][Tt][Pp]://.*/"
...
$OPENERDIRECTOR.open($URL, ...)
- pattern: |
$URL = "=~/[Ff][Tt][Pp]://.*/"
...
urllib.request.URLopener(...).open($URL, ...)
- patterns:
- pattern-inside: |
def $FUNC(..., $URL = "=~/[Ff][Tt][Pp]://.*/", ...):
...
- pattern-either:
- pattern: urllib.request.URLopener(...).open($URL, ...)
- patterns:
- pattern-inside: |
$OPENERDIRECTOR = urllib.request.URLopener(...)
...
- pattern: $OPENERDIRECTOR.open($URL, ...)
Examples
insecure-urlopener-open-ftp.py
from urllib.request import URLopener
def test1():
od = URLopener()
# ruleid: insecure-urlopener-open-ftp
od.open("ftp://example.com")
def test1_ok():
od = URLopener()
# ok: insecure-urlopener-open-ftp
od.open("ftps://example.com")
def test2():
od = URLopener()
# ruleid: insecure-urlopener-open-ftp
url = "ftp://example.com"
# ruleid: insecure-urlopener-open-ftp
od.open(url)
def test2_ok():
od = URLopener()
# ok: insecure-urlopener-open-ftp
url = "ftps://example.com"
od.open(url)
def test3():
# ruleid: insecure-urlopener-open-ftp
URLopener().open("ftp://example.com")
def test3_ok():
# ok: insecure-urlopener-open-ftp
URLopener().open("ftps://example.com")
def test4():
# ruleid: insecure-urlopener-open-ftp
url = "ftp://example.com"
# ruleid: insecure-urlopener-open-ftp
URLopener().open(url)
def test4_ok():
# ok: insecure-urlopener-open-ftp
url = "ftps://example.com"
URLopener().open(url)
def test5(url = "ftp://example.com"):
# ruleid: insecure-urlopener-open-ftp
URLopener().open(url)
def test5_ok(url = "ftps://example.com"):
# ok: insecure-urlopener-open-ftp
URLopener().open(url)
def test6(url = "ftp://example.com"):
od = URLopener()
# ruleid: insecure-urlopener-open-ftp
od.open(url)
def test6_ok(url = "ftps://example.com"):
od = URLopener()
# ok: insecure-urlopener-open-ftp
od.open(url)
Short Link: https://sg.run/zvwG