codelaw-rules-security-python

codelaw's Python security rules (Bandit's set, Django, Flask, FastAPI, ML loaders) — one of codelaw's first-party rule packs (SR-RULE-PACKS). It ships on PyPI only, as codelaw-rules-security-python (L6 decision 11).

# codelaw.toml
extends = ["codelaw:py/recommended", "codelaw:sec-py/recommended"]
preview = true   # every rule is `preview` until a corpus run promotes it

codelaw init does not add it: a security pack is chosen, not detected.

Presets

recommended holds only high-confidence rules, at error; strict adds the heuristic ones, at warn, so a team can start without noise.

Rules

61 rules, each a match: rule (no Rust). Every rule carries security: { cwe, owasp, severity } (SR-RULE-FORMAT decision 2a), so

• its finding names the CWE (sec-py/<rule> (CWE-79) …);
• codelaw rules --tag cwe:79 and --tag owasp:A05 find it, and codelaw rules --security-coverage puts it in the OWASP Top 10:2025 matrix;
• SARIF carries its security and external/cwe/cwe-<n> tags and a security-severity that GitHub code scanning ranks by (SR-CLI-MCP decision 4).

A rule that says suggest has a fix: that codelaw fix --unsafe applies to the common shape of the code; a match of another shape stays manual, with the steps in the rule's How to fix. Three rules the catalogue called suggest are manual here, because no edit of the code alone is right: sec-py/no-xpath-injection (the expression has to be rewritten around variables), sec-py/no-xmlrpc (the patch must run at start-up) and sec-py/no-cleartext-http (the server must serve HTTPS first).

What the rules see

The rules match the code as written. They follow an alias only where a rule says so (sec-py/no-xml-unsafe-parser and sec-py/no-mako use the imported-from predicate); import numpy as np is matched by its common name np, and from subprocess import run is not matched at all. A value that a function receives as a parameter is not a request value.

from_source: is not taint analysis

A rule here that asks whether a sink's argument comes from a request uses the from_source: predicate (SR-RULE-FORMAT decision 3a). It holds when the argument is a listed request source (or a method called on one), is built from one by concatenation, interpolation or ?:, or is a local name bound to one in the same function — one or more assignments or destructurings away. It never follows a call, a return value, a parameter, a closure's outer variable or another file, so a value that crosses a function boundary is not seen (cross-function flow waits on a deeper analysis, as B-049's type-aware rules do). Every rule page that uses it says so. The sources are listed per framework in this pack's data/sources/<framework>.json: Django (request.GET, request.POST, request.COOKIES, request.body, request.FILES, request.META, request.headers, DRF's request.data and request.query_params), Flask (request.args, form, values, json, get_json, data, cookies, files, headers, view_args) and FastAPI/Starlette's Request (query_params, path_params, headers, cookies, form, json, body).

Two limits follow. FastAPI's typed handler parameters (def f(q: str)) are function parameters, so they are not sources; only the request object is. And a method called on a source stays a source: request.args.get("x").strip() is still the request value, so the way out of a finding is to pass the value through a function of your own.

Not ported, and why

This pack accounts for every check of Bandit (Apache-2.0) and the Ruff S rules (MIT) that mirror it. The rules are written for codelaw; ported_from: names the Bandit and Ruff ids they cover (NOTICE).

Beyond Bandit and Ruff the pack adds the framework and library rules of the catalogue: Django, Flask and FastAPI settings and sinks, mass assignment, uploads, header, LDAP, XPath and NoSQL injection, ML model loading (torch.load, joblib, numpy, Hugging Face), trust_remote_code, prompt injection and language-model output reaching a sink. Two parts of the catalogue are not built: the strict ReDoS check for a literal pattern with nested quantifiers (sec-py/no-regex-injection handles only a request-supplied pattern), and a from_source check on every argument of a call (it reads the first, and for a logger the second).

Corpus

packs/security-python/corpus.toml holds the finding count per rule over the pinned repositories (scripts/corpus.json): Flask, Starlette, full-stack-fastapi-template and djangoproject.com, 946 files. On 2026-10-26 the rules gave 34 findings, all of them read by hand: one false positive (sec-py/no-open-redirect on a redirect to a trusted URL that had ?q=… appended from the request, which from_source: cannot tell from a hostile target), about 3%. The other 33 are what the rules say: a mark_safe of a non-literal, an MD5 or SHA-1 digest, an exec of a config file, a request without a timeout, a subprocess started by a bare name (strict), and the like. Two limits of that number: four repositories are a small sample, and the noisy rules skip test files (exclude: in their frontmatter) because the first run, before they did, was mostly asserts and password="password" in tests. Every rule is preview until its count has been reviewed again over a larger corpus.