#python

ci

r2c

Scan for runtime errors, logic bugs, and high-confidence security vulnerabilities. Recommended for use in CI to block serious issues from reaching production. Supports Python, Java, JavaScript, and Go.

r2c

Grayson Hardaway

Default ruleset, by r2c

r2c-ci

r2c

Scan for runtime errors, logic bugs, and high-confidence security vulnerabilities. Recommended for use in CI to block serious issues from reaching production. Supports Python, Java, JavaScript, and Go.

python

Grayson Hardaway

Default ruleset for Python, by r2c

bandit

r2c

Selected rules from Bandit, a security checker for Python, rewritten in Semgrep.

django

Grayson Hardaway

Default ruleset for Django, by r2c

flask

Grayson Hardaway

Default ruleset for Flask, by r2c.

xss

Grayson Hardaway

Secure defaults for XSS prevention across 5 different languages

jwt

Vasilii Ermilov

Avoid common JWT security mistakes

r2c-best-practices

r2c

A collection of opinionated rules for best practices in popular languages. Recommended for users who want really strict coding standards.

minusworld.omni-xss

r2c

Secure defaults for XSS prevention

r2c-bug-scan

r2c

Find common bugs, errors, and logic issues in popular languages.

insecure-transport

Colleen Dai

Ensure your code communicates over encrypted channels instead of plaintext.

r2c-owasp-presentation

Grayson Hardaway

Ruleset accompanying r2c OWASP presentation.

r2c

Secure defaults for XSS prevention in Django

Drew Dennison

Rules for OWASP security checks for python

auto

r2c

Use recommended rulesets specific to your project. Auto config is not a ruleset but a mode that scans for languages and frameworks and then uses the Semgrep Registry to select recommended rules. Semgrep will send a list of languages, frameworks, and your project URL to the Registry when using auto mode (but code is never uploaded).

command-injection

r2c

Secure defaults for Command injection prevention across 5 different languages

trailofbits

Written by the Trail of Bits security experts. See https://github.com/trailofbits/semgrep-rules for more.

r2c

Omni pack for insecure transport rules

Bandit rules in Gitlab SAST, written by Gitlab and r2c.

r2c

Scan for runtime errors, logic bus, and high-confidence security vulnerabilities. Recommended for use in CI to block serious issues from reaching production. Supports Python, Java, JavaScript, and Go.

r2c

Scan for runtime errors, logic bus, and high-confidence security vulnerabilities. Recommended for use in CI to block serious issues from reaching production.

Colleen Dai

SQL injection guardrails. Checks for non-constant SQL queries and other SQLi.

Grayson Hardaway

Ruleset for OWASP SF

r2c

The OWASP Top 10 is an industry-recognized report of top web application security risks. Use this ruleset to scan for OWASP Top 10 vulnerabilities.

Vasilii Ermilov

Secure defaults for Command injection prevention

Grayson Hardaway

Python Meetup Check Ruleset

Colleen Dai

SQL injection guardrails. Checks for non-constant SQL queries and other SQLi.

Detected ECB cipher mode which is considered insecure. The algorithm can potentially leak information about the plaintext. Use CBC mode instead.

Consider possible security implications associated with xmlrpclib module.

Consider possible security implications associated with httpoxy module.

Use of assert detected. The enclosed code will be removed when compiling to optimised byte code.

The use of `exec` is risky.

Chmod setting a permissive mask on file.

Running `socket.bind` to 0.0.0.0, ::, or empty string could unexpectedly expose the server publicly as it binds to all available interfaces. Consider instead getting correct address from an environment variable or configuration file.

Possible hardcoded password

Detected MD5 hash algorithm which is considered insecure. MD5 is not collision resistant and is therefore not suitable as a cryptographic signature. Use SHA256 or SHA3 instead.

Detected SHA1 hash algorithm which is considered insecure. SHA1 is not collision resistant and is therefore not suitable as a cryptographic signature. Use SHA256 or SHA3 instead.

Detected MD5 hash algorithm which is considered insecure. MD5 is not collision resistant and is therefore not suitable as a cryptographic signature. Use SHA256 or SHA3 instead.

Detected SHA1 hash algorithm which is considered insecure. SHA1 is not collision resistant and is therefore not suitable as a cryptographic signature. Use SHA256 or SHA3 instead.

Detected MD2 hash algorithm which is considered insecure. This algorithm has many known vulnerabilities and has been deprecated. Use SHA256 or SHA3 instead.

Detected MD4 hash algorithm which is considered insecure. This algorithm has many known vulnerabilities and has been deprecated. Use SHA256 or SHA3 instead.

Detected MD5 hash algorithm which is considered insecure. MD5 is not collision resistant and is therefore not suitable as a cryptographic signature. Use SHA256 or SHA3 instead.

Detected SHA1 hash algorithm which is considered insecure. SHA1 is not collision resistant and is therefore not suitable as a cryptographic signature. Use SHA256 or SHA3 instead.

Detected RC2 cipher algorithm which is considered insecure. The algorithm has known vulnerabilities and is difficult to use securely. Use AES instead.

Detected RC4 cipher algorithm which is considered insecure. The algorithm has many known vulnerabilities. Use AES instead.

Detected Blowfish cipher algorithm which is considered insecure. The algorithm has many known vulnerabilities. Use AES instead.

returntocorp

this function is only available on Python 3.7+

Detected DES cipher algorithm which is considered insecure. The algorithm is considered weak and has been deprecated. Use AES instead.

Possible hardcoded password

Hardcoded password is used as a default argument to '$FUNC'. This could be dangerous if a real password is not supplied.

Detected hardcoded temp directory. Consider using 'tempfile.TemporaryFile' instead.

Probable insecure usage of temp file/directory.

Try, Except, Pass

Try, Except, Continue

Detected Flask app with debug=True. Do not deploy to production with this flag enabled as it will leak sensitive information. Instead, consider using Flask configuration variables or setting 'debug' using system environment variables.

Detected XOR cipher algorithm which is considered insecure. This algorithm is not cryptographically secure and can be reversed easily. Use AES instead.

Avoid using `pickle`, which is known to lead to code execution vulnerabilities. When unpickling, the serialized data could be manipulated to run arbitrary code. Instead, consider serializing the relevant data as JSON or a similar text-based serialization format.

Avoid using `cPickle`, which is known to lead to code execution vulnerabilities. When unpickling, the serialized data could be manipulated to run arbitrary code. Instead, consider serializing the relevant data as JSON or a similar text-based serialization format.

Detected RC4 cipher algorithm which is considered insecure. The algorithm has many known vulnerabilities. Use AES instead.

Avoid using `dill`, which uses `pickle`, which is known to lead to code execution vulnerabilities. When unpickling, the serialized data could be manipulated to run arbitrary code. Instead, consider serializing the relevant data as JSON or a similar text-based serialization format.

Avoid using `shelve`, which uses `pickle`, which is known to lead to code execution vulnerabilities. When unpickling, the serialized data could be manipulated to run arbitrary code. Instead, consider serializing the relevant data as JSON or a similar text-based serialization format.

Detected Blowfish cipher algorithm which is considered insecure. The algorithm has many known vulnerabilities. Use AES instead.

The marshal module is not intended to be secure against erroneous or maliciously constructed data. Never unmarshal data received from an untrusted or unauthenticated source. See more details: https://docs.python.org/3/library/marshal.html?highlight=security

Detected MD5 hash algorithm which is considered insecure. MD5 is not collision resistant and is therefore not suitable as a cryptographic signature. Use SHA256 or SHA3 instead.

Detected SHA1 hash algorithm which is considered insecure. SHA1 is not collision resistant and is therefore not suitable as a cryptographic signature. Use SHA256 or SHA3 instead.

Detected MD2 hash algorithm which is considered insecure. This algorithm has many known vulnerabilities and has been deprecated. Use SHA256 or SHA3 instead.

Detected IDEA cipher algorithm which is considered insecure. The algorithm is considered weak and has been deprecated. Use AES instead.

Detected MD4 hash algorithm which is considered insecure. This algorithm has many known vulnerabilities and has been deprecated. Use SHA256 or SHA3 instead.

Use tempfile.NamedTemporaryFile instead. From the official Python documentation: THIS FUNCTION IS UNSAFE AND SHOULD NOT BE USED. The file name may refer to a file that did not exist at some point, but by the time you get around to creating it, someone else may have beaten you to the punch.

Detected the use of eval(). eval() can be dangerous if used to evaluate dynamic content. If this content can be input from outside the program, this may be a code injection vulnerability. Ensure evaluated content is not definable by external sources. Consider using safer ast.literal_eval.

'mark_safe()' is used to mark a string as "safe" for HTML output. This disables escaping and could therefore subject the content to XSS attacks. Use 'django.utils.html.format_html()' to build HTML for rendering instead.

The HTTPSConnection API has changed frequently with minor releases of Python. Ensure you are using the API for your version of Python securely. For example, Python 3 versions prior to 3.4.3 will not verify SSL certificates by default. See https://docs.python.org/3/library/http.client.html#http.client.HTTPSConnection for more information.

Detected a dynamic value being used with urllib. urllib supports 'file://' schemes, so a dynamic value controlled by a malicious actor may allow them to read arbitrary files. Audit uses of urllib calls to ensure user data cannot control the URLs, or consider using the 'requests' library instead.

Detected a dynamic value being used with urllib. urllib supports 'file://' schemes, so a dynamic value controlled by a malicious actor may allow them to read arbitrary files. Audit uses of urllib calls to ensure user data cannot control the URLs, or consider using the 'requests' library instead.

Standard pseudo-random generators are not suitable for security/cryptographic purposes.

Telnet does not encrypt communications. Use SSH instead.

Unverified SSL context detected. This will permit insecure connections without verifying SSL certificates. Use 'ssl.create_default_context()' instead.

Found use of the native Python XML libraries, which is vulnerable to XML external entity (XXE) attacks. The Python documentation recommends the 'defusedxml' library instead. Use 'defusedxml'. See https://github.com/tiran/defusedxml for more information.

Insecure XML parsing functionality, prefer 'defusedxml'

FTP does not encrypt communications by default. This can lead to sensitive data being exposed. Ensure use of FTP here does not expose sensitive data.

Unverified SSL context detected. This will permit insecure connections without verifying SSL certificates. Use 'ssl.create_default_context()' instead.

Detected use of an insecure MD4 or MD5 hash function. These functions have known vulnerabilities and are considered deprecated. Consider using 'SHA256' or a similar function instead.

The Python 'os' tempnam|tmpnam functions are vulnerable to symlink attacks

Telnet-related functions are being called. Telnet is considered insecure. Use SSH or some other encrypted protocol.

functions are being called. FTP is considered insecure. Use SSH/SFTP/SCP or some other encrypted protocol

Consider possible security implications associated with pickle module.

Consider possible security implications associated with subprocess module.

Consider possible security implications associated with pycrypto module.

Certificate verification has been explicitly disabled. This permits insecure connections to insecure servers. Re-enable certification validation.

An insecure SSL version was detected. TLS versions 1.0, 1.1, and all SSL versions are considered weak encryption and are deprecated. Use 'ssl.PROTOCOL_TLSv1_2' or higher.

ssl.wrap_socket call with no SSL/TLS protocol version specified, the default SSLv23 could be insecure, possible security issue.

Detected an insufficient key size for DSA. NIST recommends a key size of 2048 or higher.

Detected an insufficient curve size for EC. NIST recommends a key size of 224 or higher. For example, use 'ec.SECP256R1'.

Avoid using `load()`. `PyYAML.load` can create arbitrary Python objects. A malicious actor could exploit this to run arbitrary code. Use `safe_load()` instead.

Detected a paramiko host key policy that implicitly trusts a server's host key. Host keys should be verified to ensure the connection is not to a malicious server. Use RejectPolicy or a custom subclass instead.

Found 'subprocess' function '$FUNC' with 'shell=True'. This is dangerous because this call will spawn the command using a shell process. Doing so propagates current shell settings and variables, which makes it much easier for a malicious actor to execute commands. Use 'shell=False' instead.

subprocess call - check for execution of untrusted input

subprocess call - check for execution of untrusted input

Starting a process with a shell: Seems safe, but may be changed in the future, consider rewriting without shell

Found dynamic content when spawning a process. This is dangerous if external data can reach this function call because it allows a malicious actor to execute commands. Ensure no external data reaches here.

Starting a process with a partial executable path

Detected possible formatted SQL query. Use parameterized queries instead.

Detected use of the wildcard character in a system call that spawns a shell. This subjects the wildcard to normal shell expansion, which can have unintended consequences if there exist any non-standard file names. Consider a file named '-e sh script.sh' -- this will execute a script when 'rsync' is called. See https://www.defensecode.com/public/DefenseCode_Unix_WildCards_Gone_Wild.txt for more information.

This is a last resort. You should be careful when using QuerySet.extra due to SQLi https://docs.djangoproject.com/en/3.0/ref/models/querysets/#django.db.models.query.QuerySet.extra

You should be very careful whenever you write raw SQL. Consider using Django ORM before raw SQL. See https://docs.djangoproject.com/en/3.0/topics/db/sql/#passing-parameters-into-raw

Detected a Jinja2 environment without autoescaping. Jinja2 does not autoescape by default. This is dangerous if you are rendering to a browser because this allows for cross-site scripting (XSS) attacks. If you are in a web context, enable autoescaping by setting 'autoescape=True.' You may also consider using 'jinja2.select_autoescape()' to only enable automatic escaping for certain file extensions.

Mako templates do not provide a global HTML escaping mechanism. This means you must escape all sensitive data in your templates using '| u' for URL escaping or '| h' for HTML escaping. If you are using Mako to serve web content, consider using a system such as Jinja2 which enables global escaping.

'mark_safe()' is used to mark a string as "safe" for HTML output. This disables escaping and could therefore subject the content to XSS attacks. Use 'django.utils.html.format_html()' to build HTML for rendering instead.

returntocorp

Warning MONGODB-CR was deprecated with the release of MongoDB 3.6 and is no longer supported by MongoDB 4.0 (see https://api.mongodb.com/python/current/examples/authentication.html for details).

returntocorp

Detected `django.http` being imported, indicating this app uses the Python Django web framework

returntocorp

Detected `Flask()` being instantiated, indicating this app uses the Python Flask web framework

returntocorp

The Python 'pickle' module is not secure against maliciously constructed input

returntocorp

The Python 'eval' function is not secure against maliciously constructed input

returntocorp

The Python 'exec' function is not secure against maliciously constructed input

returntocorp

The Python 'os' execution functions are not secure against maliciously constructed input

returntocorp

The Python 'os' tempnam|tmpnam functions are vulnerable to symlink attacks

returntocorp

Insecure XML parsing functionality, prefer 'defusedxml'

returntocorp

The Python 'yaml' module is not secure against maliciously constructed input

returntocorp

The Python 'compile' function is not secure against maliciously constructed input

returntocorp

The Python 'zipfile' extract|extractall functions are vulnerable to arbitrary file overwrites

returntocorp

The Python 'xmlrpc' module used with 'allow_dotted_names' is not secure against maliciously constructed input

returntocorp

The Python 'commands' module is not secure against maliciously constructed input

returntocorp

The Python 'popen2' module is not secure against maliciously constructed input

returntocorp

Weak or insecure 'xmlsec' module attribute usage

python.django.security.injection.path-traversal.path-traversal-file-name.path-traversal-file-name

returntocorp

Data from request is passed to a file name `$FILE`. This is a path traversal vulnerability, which can lead to sensitive data being leaked. To mitigate, consider using os.path.abspath or os.path.realpath or the pathlib library.

returntocorp

Data from request is passed to os.path.join() and to open(). This is a path traversal vulnerability, which can lead to sensitive data being leaked. To mitigate, consider using os.path.abspath or os.path.realpath or Path library.

python.django.security.injection.path-traversal.path-traversal-open.path-traversal-open

returntocorp

Found request data in a call to 'open'. Ensure the request data is validated or sanitized, otherwise it could result in path traversal attacks and therefore sensitive data being leaked. To mitigate, consider using os.path.abspath or os.path.realpath or the pathlib library.

python.lang.security.use-defused-xml.use-defused-xml

returntocorp

Found use of the native Python XML libraries, which is vulnerable to XML external entity (XXE) attacks and can lead to discolsure of confidential data. The Python documentation recommends the 'defusedxml' library instead.

returntocorp

The Python third-party 'requests' module used with SSL verification disabled

returntocorp

The Python 'tarfile' extract|extractall functions are vulnerable to arbitrary file overwrites

returntocorp

The Python 'subprocess' module called with 'shell=True' may allow for shell injection

returntocorp

The Python 'dl' module may cause segmentation faults or other incorrect behavior

returntocorp

The Python 'gl' module may cause core dumps or other unsafe behavior

returntocorp

The Python 'shelve' module is not secure against maliciously constructed input

returntocorp

The Python 'marshal' module is not secure against maliciously constructed input

returntocorp

The Python 'tempfile.mktemp' function allows for race conditions

returntocorp

Weak or insecure 'ssl' module usage

returntocorp

The Python third-party 'duo_client' module used with SSL verfication disabled

returntocorp

Weak or insecure 'onelogin' module attribute usage

returntocorp

Weak or insecure 'hashlib' module usage

returntocorp

Warnings disabled on insecure network requests with Python 'urllib3' module

returntocorp

The Python 'urllib3' module used with SSL verfication disabled

returntocorp

The Python third-party 'Crypto' module is unmaintained and has known vulnerabilities and exploits

returntocorp

Weak or insecure 'cryptography' module attribute usage

returntocorp

The Python third-party 'itsdangerous' module used with 'none' signing algorithm

trailofbits

If possible, it is better to rely on automatic pinning in PyTorch to avoid undefined behavior and for efficiency

trailofbits

Found usage of the lxml library, which is vulnerable to attacks such as XML external entity (XXE) attacks. For more information, see https://lxml.de/FAQ.html

trailofbits

Avoid using NumPy in PyTorch modules for efficiency and proper ONNX loading

trailofbits

Using the NumPy RNG inside of a Torch dataset can lead to a number of issues with loading data, including identical augmentations. Instead, use the random number generators built into Python and PyTorch. See https://tanelp.github.io/posts/a-bug-that-plagues-thousands-of-open-source-ml-projects/ for more details

trailofbits

Functions reliant on pickle can result in arbitrary code execution. Consider using fickling or switching to a safer serialization method. For more information, see https://blog.trailofbits.com/2021/03/15/never-a-dill-moment-exploiting-machine-learning-pickle-files/

trailofbits

Functions reliant on pickle can result in arbitrary code execution. Consider loading from state_dict, using fickling, or switching to a safer serialization method like ONNX. For more information, see https://blog.trailofbits.com/2021/03/15/never-a-dill-moment-exploiting-machine-learning-pickle-files/

trailofbits

Functions reliant on pickle can result in arbitrary code execution. For more information, see https://blog.trailofbits.com/2021/03/15/never-a-dill-moment-exploiting-machine-learning-pickle-files/

trailofbits

Avoid torch.package; it can result in arbitrary code execution

trailofbits

Avoid using torch.Tensor() to directly create a tensor for efficiency and proper parsing. For more information, see https://pytorch.org/docs/stable/tensors.html

trailofbits

Not waiting for requests is a source of undefined behavior.

returntocorp

This code contains bidirectional (bidi) characters. While this is useful for support of right-to-left languages such as Arabic or Hebrew, it can also be used to trick language parsers into executing code in a manner that is different from how it is displayed in code editing and review tools. If this is not what you were expecting, please review this code in an editor that can reveal hidden Unicode characters.

trailofbits

Possible path traversal through `tarfile.open($PATH).extractall()` if the source tar is controlled by an attacker. See https://docs.python.org/3/library/tarfile.html#tarfile.TarFile.extractall for more details.

returntocorp

path for `$URL` is uselessly assigned twice

returntocorp

The path for `$URL` is assigned once to view `$VIEW` and once to `$DIFFERENT_VIEW`, which can lead to unexpected behavior. Verify what the intended target view is and delete the other route.

returntocorp

path for `$URL` is assigned twice with different names

returntocorp

The name `$NAME` is used for both `$URL` and `$OTHER_URL`, which can lead to unexpected behavior when using URL reversing. Pick a unique name for each path.

returntocorp

You should use ITEM.user_id rather than ITEM.user.id to prevent running an extra query.

returntocorp

Passing a formatted string as first parameter to `format_html` disables the proper encoding of variables. Any HTML in the first parameter is not encoded. Using a formatted string as first parameter obscures which parameters are encoded. Correct use of `format_html` is passing a static format string as first parameter, and the variables to substitute as subsequent parameters.

returntocorp

Detected user input flowing into a manually constructed HTML string. You may be accidentally bypassing secure methods of rendering HTML by manually constructing HTML and this could create a cross-site scripting vulnerability, which could let attackers steal sensitive user data. To be sure this is safe, check that the HTML is rendered safely. Otherwise, use templates (`django.shortcuts.render`) which will safely render HTML instead.

returntocorp

Detected user input used to manually construct a SQL string. This is usually bad practice because manual construction could accidentally result in a SQL injection. An attacker could use a SQL injection to steal or modify contents of the database. Instead, use a parameterized query which is available by default in most database engines. Alternatively, consider using the Django object-relational mappers (ORM) instead of raw SQL queries.

returntocorp

User data flows into the host portion of this manually-constructed URL. This could allow an attacker to send data to their own server, potentially exposing sensitive data such as cookies or authorization information sent with this request. They could also probe internal servers or other resources that the server runnig this code can access. (This is called server-side request forgery, or SSRF.) Do not allow arbitrary hosts. Instead, create an allowlist for approved hosts hardcode the correct host.

returntocorp

Detected user input flowing into a manually constructed HTML string. You may be accidentally bypassing secure methods of rendering HTML by manually constructing HTML and this could create a cross-site scripting vulnerability, which could let attackers steal sensitive user data. To be sure this is safe, check that the HTML is rendered safely. Otherwise, use templates (`flask.render_template`) which will safely render HTML instead.

returntocorp

Detected user input used to manually construct a SQL string. This is usually bad practice because manual construction could accidentally result in a SQL injection. An attacker could use a SQL injection to steal or modify contents of the database. Instead, use a parameterized query which is available by default in most database engines. Alternatively, consider using an object-relational mapper (ORM) such as SQLAlchemy which will protect your queries.

returntocorp

User data flows into the host portion of this manually-constructed URL. This could allow an attacker to send data to their own server, potentially exposing sensitive data such as cookies or authorization information sent with this request. They could also probe internal servers or other resources that the server runnig this code can access. (This is called server-side request forgery, or SSRF.) Do not allow arbitrary hosts. Instead, create an allowlist for approved hosts hardcode the correct host.

returntocorp

Errors should only be logged when handled. The code logs the error and propogates the exception, consider reducing the level to warning or info.

returntocorp

Missing 'encoding' parameter. 'open()' uses device locale encodings by default, corrupting files with special characters. Specify the encoding to ensure cross-platform support when opening files in text mode (e.g. encoding="utf-8").

trailofbits

Functions reliant on pickle can result in arbitrary code execution. Consider using fickling or switching to a safer serialization method. For more information, see https://blog.trailofbits.com/2021/03/15/never-a-dill-moment-exploiting-machine-learning-pickle-files/

returntocorp

Found usage of the 'blocksize' argument in a HTTPSConnection call. This is only available on Python 3.7+ and is therefore not backwards compatible. Remove this in order for this code to work in Python 3.6 and below.

returntocorp

Synchronous time.sleep in async code will block the event loop and not allow other tasks to execute. Use asyncio.sleep() instead.

returntocorp

This expression will evaluate to be ONLY value the of the `else` clause if the condition `$EXPRESSION` is false. If you meant to do list concatenation, put parentheses around the entire concatenation expression, like this: `['a', 'b', 'c'] + (['d'] if x else ['e'])`. If this is the intended behavior, the expression may be confusing to others, and you may wish to add parentheses for readability.

returntocorp

Is "$FUNC" a function or an attribute? If it is a function, you may have meant $X.$FUNC() because $X.$FUNC is always true.

returntocorp

It looks like MD5 is used as a password hash. MD5 is not considered a secure password hash because it can be cracked by an attacker in a short amount of time. Use a suitable password hashing function such as scrypt. You can use `hashlib.scrypt`.

returntocorp

Semgrep found a Python reverse shell using $BINPATH to $IP at $PORT

returntocorp

sqlalchemy.text passes the constructed SQL statement to the database mostly unchanged. This means that the usual SQL injection protections are not applied and this function is vulnerable to SQL injection if user input can reach here. Use normal SQLAlchemy operators (such as or_, and_, etc.) to construct SQL.

returntocorp

Warning MONGODB-CR was deprecated with the release of MongoDB 3.6 and is no longer supported by MongoDB 4.0 (see https://api.mongodb.com/python/current/examples/authentication.html for details).

returntocorp

Use JsonResponse instead

python.airflow.security.audit.formatted-string-bashoperator.formatted-string-bashoperator

returntocorp

Found a formatted string in BashOperator: $CMD. This could be vulnerable to injection. Be extra sure your variables are not controllable by external sources.

returntocorp

Unsafe usage of mutable initializer with attr.s decorator. Multiple instances of this class will re-use the same data structure, which is likely not the desired behavior. Consider instead: replace assignment to mutable initializer (ex. dict() or {}) with attr.ib(factory=type) where type is dict, set, or list

returntocorp

These APIs are deprecated in Bokeh see https://docs.bokeh.org/en/latest/docs/releases.html#api-deprecations

python.boto3.security.hardcoded-token.hardcoded-token

returntocorp

Hardcoded AWS access token detected. Attackers can possibly freely read this value and gain access to the AWS environment. Instead, use environment variables to access tokens (e.g., os.environ.get(...)) or use non version-controlled configuration files.

returntocorp

Use `click.secho($X)` instead. It combines click.echo() and click.style().

python.cryptography.security.insecure-cipher-algorithms.insecure-cipher-algorithm-rc4

returntocorp

Detected RC4 cipher algorithm which is considered insecure. The algorithm has many known vulnerabilities. Use AES instead.

python.cryptography.security.insecure-cipher-algorithms.insecure-cipher-algorithm-blowfish

returntocorp

Detected Blowfish cipher algorithm which is considered insecure. The algorithm has many known vulnerabilities. Use AES instead.

python.cryptography.security.insecure-cipher-algorithms.insecure-cipher-algorithm-idea

returntocorp

Detected IDEA cipher algorithm which is considered insecure. The algorithm is considered weak and has been deprecated. Use AES instead.

python.cryptography.security.insecure-cipher-mode-ecb.insecure-cipher-mode-ecb

returntocorp

Detected ECB cipher mode which is considered insecure. The algorithm can potentially leak information about the plaintext. Use CBC mode instead.

python.cryptography.security.insecure-hash-algorithms.insecure-hash-algorithm-md5

returntocorp

Detected MD5 hash algorithm which is considered insecure. MD5 is not collision resistant and is therefore not suitable as a cryptographic signature. Use SHA256 or SHA3 instead.

python.cryptography.security.insecure-hash-algorithms.insecure-hash-algorithm-sha1

returntocorp

Detected SHA1 hash algorithm which is considered insecure. SHA1 is not collision resistant and is therefore not suitable as a cryptographic signature. Use SHA256 or SHA3 instead.

returntocorp

Detected an insufficient key size for DSA. NIST recommends a key size of 2048 or higher.

python.cryptography.security.insufficient-ec-key-size.insufficient-ec-key-size

returntocorp

Detected an insufficient curve size for EC. NIST recommends a key size of 224 or higher. For example, use 'ec.SECP256R1'.

returntocorp

Detected an insufficient key size for RSA. NIST recommends a key size of 2048 or higher.

returntocorp

Initializing the a security context for Dask (`distributed`) without "require_encription" keyword argument may silently fail to provide security. See https://distributed.dask.org/en/latest/tls.html?highlight=require_encryption#parameters

returntocorp

You are using environment variables inside django app. Use `django-environ` as it a better alternative for deployment.

returntocorp

Use 'django.db.models.OneToOneField' instead of 'ForeignKey' with unique=True. 'OneToOneField' is used to create one-to-one relationships.

returntocorp

The weak argument to django.dispatch.signals.Signal.disconnect() is removed in Django 2.0.

returntocorp

django.db.backends.base.BaseDatabaseOperations.check_aggregate_support() is removed in Django 2.0.

python.django.security.audit.secure-cookies.django-secure-set-cookie

returntocorp

Django cookies should be handled securely by setting secure=True, httponly=True, and samesite='Lax' in response.set_cookie(...). If your situation calls for different settings, explicitly disable the setting. If you want to send the cookie over http, set secure=False. If you want to let client-side JavaScript read the cookie, set httponly=False. If you want to attach cookies to requests for external sites, set samesite=None.

returntocorp

The django.forms.extras package is removed in Django 2.0.

returntocorp

The assignment_tag helper is removed in Django 2.0.

returntocorp

The host argument to assertRedirects is removed in Django 2.0.

returntocorp

Detected a django model `$MODEL` is not calling super().save() inside of the save method.

python.django.correctness.nontext-field-must-set-null-true.nontext-field-must-set-null-true

returntocorp

null=True should be set if blank=True is set on non-text fields.

returntocorp

Avoid using null on string-based fields such as CharField and TextField. If a string-based field has null=True, that means it has two possible values for "no data": NULL, and the empty string. In most cases, it's redundant to have two possible values for "no data;" the Django convention is to use the empty string, not NULL.

python.django.correctness.string-field-null-checks.string-field-must-set-null-true

returntocorp

If a text field declares unique=True and blank=True, null=True must also be set to avoid unique constraint violations when saving multiple objects with blank values.

returntocorp

Found a FloatField used for variable $F. Use DecimalField for currency fields to avoid float-rounding errors.

returntocorp

Looks like you need to determine the number of records. Django provides the count() method which is more efficient than .len(). See https://docs.djangoproject.com/en/3.0/ref/models/querysets/

returntocorp

Looks like you are only accessing first element of an ordered QuerySet. Use `latest()` or `earliest()` instead. See https://docs.djangoproject.com/en/3.0/ref/models/querysets/#django.db.models.query.QuerySet.latest

python.django.security.audit.avoid-insecure-deserialization.avoid-insecure-deserialization

returntocorp

Avoid using insecure deserialization library, backed by `pickle`, `_pickle`, `cpickle`, `dill`, `shelve`, or `yaml`, which are known to lead to remote code execution vulnerabilities.

python.django.security.audit.avoid-mark-safe.avoid-mark-safe

returntocorp

'mark_safe()' is used to mark a string as "safe" for HTML output. This disables escaping and could therefore subject the content to XSS attacks. Use 'django.utils.html.format_html()' to build HTML for rendering instead.

python.django.security.audit.csrf-exempt.no-csrf-exempt

returntocorp

Detected usage of @csrf_exempt, which indicates that there is no CSRF token set for this route. This could lead to an attacker manipulating the user's account and exfiltration of private data. Instead, create a function without this decorator.

python.django.security.audit.custom-expression-as-sql.custom-expression-as-sql

returntocorp

Detected a Custom Expression ''$EXPRESSION'' calling ''as_sql(...).'' This could lead to SQL injection, which can result in attackers exfiltrating sensitive data. Instead, ensure no user input enters this function or that user input is properly sanitized.

returntocorp

Function '$FUNC' is missing a rate-limiting decorator. High volume traffic to this function could starve application resources. Consider adding rate limiting from a library such as 'django-ratelimit'.

returntocorp

Django REST framework configuration is missing default rate- limiting options. This could inadvertently allow resource starvation or Denial of Service (DoS) attacks. Add 'DEFAULT_THROTTLE_CLASSES' and 'DEFAULT_THROTTLE_RATES' to add rate-limiting to your application.

python.django.security.audit.extends-custom-expression.extends-custom-expression

returntocorp

Found extension of custom expression: $CLASS. Extending expressions in this way could inadvertently lead to a SQL injection vulnerability, which can result in attackers exfiltrating sensitive data. Instead, ensure no user input enters this function or that user input is properly sanitized.

python.django.security.audit.query-set-extra.avoid-query-set-extra

returntocorp

QuerySet.extra' does not provide safeguards against SQL injection and requires very careful use. SQL injection can lead to critical data being stolen by attackers. Instead of using '.extra', use the Django ORM and parameterized queries such as `People.objects.get(name='Bob')`.

python.django.security.audit.raw-query.avoid-raw-sql

returntocorp

Detected the use of 'RawSQL' or 'raw' indicating the execution of a non-parameterized SQL query. This could lead to a SQL injection and therefore protected information could be leaked. Instead, use Django ORM and parameterized queries before raw SQL. An example of using the Django ORM is: `People.objects.get(name='Bob')`

python.django.security.audit.unvalidated-password.unvalidated-password

returntocorp

The password on '$MODEL' is being set without validating the password. Call django.contrib.auth.password_validation.validate_password() with validation functions before setting the password. See https://docs.djangoproject.com/en/3.0/topics/auth/passwords/ for more information.

returntocorp

Found a class extending 'SafeString', 'SafeText' or 'SafeData'. These classes are for bypassing the escaping engine built in to Django and should not be used directly. Improper use of this class exposes your application to cross-site scripting (XSS) vulnerabilities. If you need this functionality, use 'mark_safe' instead and ensure no user data can reach it.

python.django.security.audit.xss.context-autoescape-off.context-autoescape-off

returntocorp

Detected a Context with autoescape disabled. If you are rendering any web pages, this exposes your application to cross-site scripting (XSS) vulnerabilities. Remove 'autoescape: False' or set it to 'True'.

returntocorp

Detected data rendered directly to the end user via 'HttpResponse' or a similar object. This bypasses Django's built-in cross-site scripting (XSS) defenses and could result in an XSS vulnerability. Use Django's template engine to safely render HTML.

returntocorp

Detected Django filters flagged with 'is_safe'. 'is_safe' tells Django not to apply escaping on the value returned by this filter (although the input is escaped). Used improperly, 'is_safe' could expose your application to cross-site scripting (XSS) vulnerabilities. Ensure this filter does not 1) add HTML characters, 2) remove characters, or 3) use external data in any way. Consider instead removing 'is_safe' and explicitly marking safe content with 'mark_safe()'.

python.django.security.audit.xss.global-autoescape-off.global-autoescape-off

returntocorp

Autoescape is globally disbaled for this Django application. If you are rendering any web pages, this exposes your application to cross-site scripting (XSS) vulnerabilities. Remove 'autoescape: False' or set it to 'True'.

returntocorp

The `__html__` method indicates to the Django template engine that the value is 'safe' for rendering. This means that normal HTML escaping will not be applied to the return value. This exposes your application to cross-site scripting (XSS) vulnerabilities. If you need to render raw HTML, consider instead using `mark_safe()` which more clearly marks the intent to render raw HTML than a class with a magic method.

returntocorp

`html_safe()` add the `__html__` magic method to the provided class. The `__html__` method indicates to the Django template engine that the value is 'safe' for rendering. This means that normal HTML escaping will not be applied to the return value. This exposes your application to cross-site scripting (XSS) vulnerabilities. If you need to render raw HTML, consider instead using `mark_safe()` which more clearly marks the intent to render raw HTML than a class with a magic method.

returntocorp

Using 'globals()' as a context to 'render(...)' is extremely dangerous. This exposes Python functions to the template that were not meant to be exposed. An attacker could use these functions to execute code that was not intended to run and could compromise the application. (This is server-side template injection (SSTI)). Do not use 'globals()'. Instead, specify each variable in a dictionary or 'django.template.Context' object, like '{"var1": "hello"}' and use that instead.

python.django.security.injection.code.globals-misuse-code-execution.globals-misuse-code-execution

returntocorp

Found request data as an index to 'globals()'. This is extremely dangerous because it allows an attacker to execute arbitrary code on the system. Refactor your code not to use 'globals()'.

returntocorp

Found user data in a call to 'eval'. This is extremely dangerous because it can enable an attacker to execute remote code. See https://owasp.org/www-community/attacks/Code_Injection for more information.

python.django.security.injection.code.user-eval.user-eval

returntocorp

Found user data in a call to 'eval'. This is extremely dangerous because it can enable an attacker to execute arbitrary remote code on the system. Instead, refactor your code to not use 'eval' and instead use a safe library for the specific functionality you need.

returntocorp

Found user data in a call to 'exec'. This is extremely dangerous because it can enable an attacker to execute arbitrary remote code on the system. Instead, refactor your code to not use 'eval' and instead use a safe library for the specific functionality you need.

returntocorp

Data from request ($DATA) is passed to redirect(). This is an open redirect and could be exploited. Ensure you are redirecting to safe URLs by using django.utils.http.is_safe_url(). See https://cwe.mitre.org/data/definitions/601.html for more information.

python.django.security.injection.code.user-exec.user-exec

returntocorp

Found user data in a call to 'exec'. This is extremely dangerous because it can enable an attacker to execute arbitrary remote code on the system. Instead, refactor your code to not use 'eval' and instead use a safe library for the specific functionality you need.

python.django.security.injection.command.command-injection-os-system.command-injection-os-system

returntocorp

Request data detected in os.system. This could be vulnerable to a command injection and should be avoided. If this must be done, use the 'subprocess' module instead and pass the arguments as a list. See https://owasp.org/www-community/attacks/Command_Injection for more information.

python.django.security.injection.email.xss-html-email-body.xss-html-email-body

returntocorp

Found request data in an EmailMessage that is set to use HTML. This is dangerous because HTML emails are susceptible to XSS. An attacker could inject data into this HTML email, causing XSS.

python.django.security.injection.email.xss-send-mail-html-message.xss-send-mail-html-message

returntocorp

Found request data in 'send_mail(...)' that uses 'html_message'. This is dangerous because HTML emails are susceptible to XSS. An attacker could inject data into this HTML email, causing XSS.

python.django.security.injection.mass-assignment.mass-assignment

returntocorp

Mass assignment detected. This can result in assignment to model fields that are unintended and can be exploited by an attacker. Instead of using '**request.$W', assign each field you want to edit individually to prevent mass assignment. You can read more about mass assignment at https://cheatsheetseries.owasp.org/cheatsheets/Mass_Assignment_Cheat_Sheet.html.

python.django.security.injection.reflected-data-httpresponse.reflected-data-httpresponse

returntocorp

Found user-controlled request data passed into HttpResponse. This could be vulnerable to XSS, leading to attackers gaining access to user cookies and protected information. Ensure that the request data is properly escaped or sanitzed.

python.django.security.injection.reflected-data-httpresponsebadrequest.reflected-data-httpresponsebadrequest

returntocorp

Found user-controlled request data passed into a HttpResponseBadRequest. This could be vulnerable to XSS, leading to attackers gaining access to user cookies and protected information. Ensure that the request data is properly escaped or sanitzed.

python.django.security.injection.request-data-fileresponse.request-data-fileresponse

returntocorp

Found user-controlled request data being passed into a file open, which is them passed as an argument into the FileResponse. This is dangerous because an attacker could specify an arbitrary file to read, which could result in leaking important data. Be sure to validate or sanitize the user-inputted filename in the request data before using it in FileResponse.

returntocorp

Found user-controlled request data passed into '.write(...)'. This could be dangerous if a malicious actor is able to control data into sensitive files. For example, a malicious actor could force rolling of critical log files, or cause a denial-of-service by using up available disk space. Instead, ensure that request data is properly escaped or sanitized.

python.django.security.injection.sql.sql-injection-extra.sql-injection-using-extra-where

returntocorp

User-controlled data from a request is passed to 'extra()'. This could lead to a SQL injection and therefore protected information could be leaked. Instead, use parameterized queries or escape the user-controlled data by using `params` and not using quote placeholders in the SQL string.

python.django.security.injection.sql.sql-injection-rawsql.sql-injection-using-rawsql

returntocorp

User-controlled data from request is passed to 'RawSQL()'. This could lead to a SQL injection and therefore protected information could be leaked. Instead, use parameterized queries or escape the user-controlled data by using `params` and not using quote placeholders in the SQL string.

python.django.security.injection.sql.sql-injection-using-db-cursor-execute.sql-injection-db-cursor-execute

returntocorp

User-controlled data from a request is passed to 'execute()'. This could lead to a SQL injection and therefore protected information could be leaked. Instead, use django's QuerySets, which are built with query parameterization and therefore not vulnerable to sql injection. For example, you could use `Entry.objects.filter(date=2006)`.

python.django.security.injection.sql.sql-injection-using-raw.sql-injection-using-raw

returntocorp

Data that is possible user-controlled from a python request is passed to `raw()`. This could lead to SQL injection and attackers gaining access to protected information. Instead, use django's QuerySets, which are built with query parameterization and therefore not vulnerable to sql injection. For example, you could use `Entry.objects.filter(date=2006)`.

returntocorp

Data from request object is passed to a new server-side request. This could lead to a server-side request forgery (SSRF). To mitigate, ensure that schemes and hosts are validated against an allowlist, do not forward the response to the user, and ensure proper authentication and transport-layer security in the proxied request. See https://owasp.org/www-community/attacks/Server_Side_Request_Forgery to learn more about SSRF vulnerabilities.

returntocorp

Data from request object is passed to a new server-side request. This could lead to a server-side request forgery (SSRF), which could result in attackers gaining access to private organization data. To mitigate, ensure that schemes and hosts are validated against an allowlist, do not forward the response to the user, and ensure proper authentication and transport-layer security in the proxied request.

returntocorp

Using 'locals()' as a context to 'render(...)' is extremely dangerous. This exposes Python functions to the template that were not meant to be exposed. An attacker could use these functions to execute code that was not intended to run and could compromise the application. (This is server-side template injection (SSTI)). Do not use 'locals()'. Instead, specify each variable in a dictionary or 'django.template.Context' object, like '{"var1": "hello"}' and use that instead.

python.flask.security.audit.app-run-param-config.avoid_app_run_with_bad_host

returntocorp

Running flask app with host 0.0.0.0 could expose the server publicly.

returntocorp

'$VAR' is the empty string and is being used to set the password on '$MODEL'. If you meant to set an unusable password, set the password to None or call 'set_unusable_password()'.

python.django.security.passwords.use-none-for-password-default.use-none-for-password-default

returntocorp

'$VAR' is using the empty string as its default and is being used to set the password on '$MODEL'. If you meant to set an unusable password, set the default value to 'None' or call 'set_unusable_password()'.

returntocorp

If unverified user data can reach the `run` or `create` method it can result in running arbitrary container.

returntocorp

Flask class method GET with side effects

returntocorp

Be careful with `flask.make_response()`. If this response is rendered onto a webpage, this could create a cross-site scripting (XSS) vulnerability. `flask.make_response()` will not autoescape HTML. If you are rendering HTML, write your HTML in a template file and use `flask.render_template()` which will take care of escaping. If you are returning data from an API, consider using `flask.jsonify()`.

returntocorp

flask.jsonify() is a Flask helper method which handles the correct settings for returning JSON from Flask routes

returntocorp

Flask-caching doesn't cache query strings by default. You have to use `query_string=True`. Also you shouldn't cache verbs that can mutate state.

returntocorp

Accessing request object inside a route handle for HTTP GET command will throw due to missing request body.

returntocorp

Looks like `$R` is a flask function handler that registered to two different routes. This will cause a runtime error

returntocorp

deprecated Flask API

python.flask.security.audit.app-run-security-config.avoid_using_app_run_directly

returntocorp

top-level app.run(...) is ignored by flask. Consider putting app.run(...) behind a guard, like inside a function

python.flask.security.audit.debug-enabled.debug-enabled

returntocorp

Detected Flask app with debug=True. Do not deploy to production with this flag enabled as it will leak sensitive information. Instead, consider using Flask configuration variables or setting 'debug' using system environment variables.

returntocorp

Detected Flask route directly returning a formatted string. This is subject to cross-site scripting if user input can reach the string. Consider using the template engine instead and rendering pages with 'render_template()'.

python.flask.security.audit.hardcoded-config.avoid_hardcoded_config_TESTING

returntocorp

Hardcoded variable `TESTING` detected. Use environment variables or config files instead

python.flask.security.audit.hardcoded-config.avoid_hardcoded_config_SECRET_KEY

returntocorp

Hardcoded variable `SECRET_KEY` detected. Use environment variables or config files instead

python.flask.security.audit.hardcoded-config.avoid_hardcoded_config_ENV

returntocorp

Hardcoded variable `ENV` detected. Set this by using FLASK_ENV environment variable

python.flask.security.audit.hardcoded-config.avoid_hardcoded_config_DEBUG

returntocorp

Hardcoded variable `DEBUG` detected. Set this by using FLASK_DEBUG environment variable

python.flask.security.audit.render-template-string.render-template-string

returntocorp

Found a template created with string formatting. This is susceptible to server-side template injection and cross-site scripting attacks.

python.flask.security.audit.secure-set-cookie.secure-set-cookie

returntocorp

Found a Flask cookie without secure, httponly, or samesite correctly set. Flask cookies should be handled securely by setting secure=True, httponly=True, and samesite='Lax' in response.set_cookie(...). If these parameters are not properly set, your cookies are not properly protected and are at risk of being stolen by an attacker. Include the 'secure=True', 'httponly=True', samesite='Lax' arguments or set these to be true in the Flask configuration.

python.flask.security.audit.wtf-csrf-disabled.flask-wtf-csrf-disabled

returntocorp

Setting 'WTF_CSRF_ENABLED' to 'False' explicitly disables CSRF protection.

python.flask.security.dangerous-template-string.dangerous-template-string

returntocorp

Found a template created with string formatting. This is susceptible to server-side template injection and cross-site scripting attacks.

returntocorp

Method $METHOD in API controller $CLASS provides user arg $ARG to requests method $REQMETHOD

python.flask.security.injection.os-system-injection.os-system-injection

returntocorp

User data detected in os.system. This could be vulnerable to a command injection and should be avoided. If this must be done, use the 'subprocess' module instead and pass the arguments as a list.

python.flask.security.injection.path-traversal-open.path-traversal-open

returntocorp

Found request data in a call to 'open'. Ensure the request data is validated or sanitized, otherwise it could result in path traversal attacks.

python.flask.security.injection.ssrf-requests.ssrf-requests

returntocorp

Data from request object is passed to a new server-side request. This could lead to a server-side request forgery (SSRF). To mitigate, ensure that schemes and hosts are validated against an allowlist, do not forward the response to the user, and ensure proper authentication and transport-layer security in the proxied request.

python.flask.security.unescaped-template-extension.unescaped-template-extension

returntocorp

Flask does not automatically escape Jinja templates unless they have .html, .htm, .xml, or .xhtml extensions. This could lead to XSS attacks. Use .html, .htm, .xml, or .xhtml for your template extensions. See https://flask.palletsprojects.com/en/1.1.x/templating/#jinja-setup for more information.

python.flask.security.injection.user-eval.eval-injection

returntocorp

Detected user data flowing into eval. This is code injection and should be avoided.

python.flask.security.injection.user-exec.exec-injection

returntocorp

Detected user data flowing into exec. This is code injection and should be avoided.

python.flask.security.insecure-deserialization.insecure-deserialization

returntocorp

Detected the use of an insecure deserialization library in a Flask route. These libraries are prone to code execution vulnerabilities. Ensure user data does not enter this function. To fix this, try to avoid serializing whole objects. Consider instead using a serializer such as JSON.

python.flask.security.open-redirect.open-redirect

returntocorp

Data from request is passed to redirect(). This is an open redirect and could be exploited. Consider using 'url_for()' to generate links to known locations. If you must use a URL to unknown pages, consider using 'urlparse()' or similar and checking if the 'netloc' property is the same as your site's host name. See the references for more information.

python.flask.security.secure-static-file-serve.avoid_send_file_without_path_sanitization

returntocorp

Detected a user-controlled `filename` that could flow to `flask.send_file()` function. This could lead to an attacker reading arbitrary file from the system, leaking private information. Make sure to properly sanitize filename or use `flask.send_from_directory`

python.flask.security.unsanitized-input.response-contains-unsanitized-input

returntocorp

Flask response reflects unsanitized user input. This could lead to a cross-site scripting vulnerability (https://owasp.org/www-community/attacks/xss/) in which an attacker causes arbitrary code to be executed in the user's browser. To prevent, please sanitize the user input, e.g. by rendering the response in a Jinja2 template (see considerations in https://flask.palletsprojects.com/en/1.0.x/security/).

returntocorp

Detected direct use of jinja2. If not done properly, this may bypass HTML escaping which opens up the application to cross-site scripting (XSS) vulnerabilities. Prefer using the Flask method 'render_template()' and templates with a '.html' extension in order to prevent XSS.

returntocorp

Detected explicitly unescaped content using 'Markup()'. This permits the unescaped data to include unescaped HTML which could result in cross-site scripting. Ensure this data is not externally controlled, or consider rewriting to not use 'Markup()'.

python.jinja2.security.audit.autoescape-disabled.autoescape-disabled

returntocorp

Detected a Jinja2 environment without autoescaping. Jinja2 does not autoescape by default. This is dangerous if you are rendering to a browser because this allows for cross-site scripting (XSS) attacks. If you are in a web context, enable autoescaping by setting 'autoescape=True.' You may also consider using 'jinja2.select_autoescape()' to only enable automatic escaping for certain file extensions.

returntocorp

The object is passed strictly to jwt.encode(...) Make sure that sensitive information is not exposed through JWT token payload.

returntocorp

Password is exposed through JWT token payload. This is not encrypted and the password could be compromised. Do not store passwords in JWT tokens.

returntocorp

Hardcoded JWT secret or private key is used. This is a Insufficiently Protected Credentials weakness: https://cwe.mitre.org/data/definitions/522.html Consider using an appropriate security mechanism to protect the credentials (e.g. keeping secrets in environment variables)

returntocorp

Detected use of the 'none' algorithm in a JWT token. The 'none' algorithm assumes the integrity of the token has already been verified. This would allow a malicious actor to forge a JWT token that will automatically be verified. Do not explicitly use the 'none' algorithm. Instead, use an algorithm such as 'HS256'.

returntocorp

Detected JWT token decoded with 'verify=False'. This bypasses any integrity checks for the token which means the token could be tampered with by malicious actors. Ensure that the JWT token is verified.

returntocorp

Detected hardcoded temp directory. Consider using 'tempfile.TemporaryFile' instead.