claude-skills/security-review/languages/python.md

Python Security Patterns

Framework Detection

Indicator	Framework
from django, settings.py, urls.py, views.py	Django
from flask, @app.route	Flask
from fastapi, @app.get, @app.post	FastAPI
import tornado	Tornado
from pyramid	Pyramid

---

Django

Server-Controlled Values (NEVER Flag)

Django settings are deployment configuration, not attacker input:

# SAFE: All django.conf.settings values are server-controlled
from django.conf import settings

requests.get(settings.EXTERNAL_API_URL)      # NOT SSRF - configured at deployment
requests.get(f"{settings.SEER_URL}{path}")   # NOT SSRF - base URL is server-controlled
open(settings.LOG_FILE_PATH)                 # NOT path traversal
db.connect(settings.DATABASE_URL)            # NOT injection

# SAFE: Environment-based configuration
API_URL = os.environ.get('API_URL')
requests.get(API_URL)  # Server operator controls this

# SAFE: Settings from Django's settings.py
DEBUG = settings.DEBUG
ALLOWED_HOSTS = settings.ALLOWED_HOSTS
SECRET_KEY = settings.SECRET_KEY  # (check it's not hardcoded in repo though)

Only flag settings-based code if:

• The setting value itself is hardcoded in committed code (secrets exposure)
• The setting value is somehow derived from user input (rare, investigate)

Auto-Escaped (Do Not Flag)

# SAFE: Django auto-escapes template variables
{{ variable }}
{{ user.name }}
{{ form.field }}

# SAFE: ORM methods are parameterized
User.objects.filter(username=user_input)
User.objects.get(id=user_id)
User.objects.exclude(status=status)
MyModel.objects.create(name=name)

# SAFE: Django's built-in CSRF protection (if enabled)
{% csrf_token %}
@csrf_protect

Flag These (Django-Specific)

# XSS - Explicit unsafe marking
{{ variable|safe }}                    # FLAG: Disables escaping
{% autoescape off %}...{% endautoescape %}  # FLAG: Disables escaping
mark_safe(user_input)                  # FLAG: If user_input is user-controlled
format_html() with unescaped input     # CHECK: Depends on usage

# SQL Injection
User.objects.raw(f"SELECT * FROM users WHERE name = '{user_input}'")  # FLAG
User.objects.extra(where=[f"name = '{user_input}'"])  # FLAG (deprecated)
cursor.execute(f"SELECT * FROM users WHERE id = {user_id}")  # FLAG
RawSQL(f"SELECT * FROM x WHERE y = '{input}'")  # FLAG
connection.execute(query % user_input)  # FLAG

# Command Injection
os.system(f"cmd {user_input}")  # FLAG
subprocess.run(cmd, shell=True)  # FLAG if cmd contains user input
subprocess.Popen(cmd, shell=True)  # FLAG if cmd contains user input

# Deserialization
pickle.loads(user_data)  # FLAG: Always critical
yaml.load(user_data)  # FLAG: Use yaml.safe_load()
yaml.load(data, Loader=yaml.Loader)  # FLAG: Unsafe loader

# File Operations
open(user_controlled_path)  # CHECK: Path traversal
send_file(user_path)  # CHECK: Path traversal

Django Security Settings

# Check settings.py for:

# VULNERABLE configurations
DEBUG = True  # FLAG in production
ALLOWED_HOSTS = ['*']  # FLAG
SECRET_KEY = 'hardcoded-value'  # FLAG if committed
CSRF_COOKIE_SECURE = False  # FLAG in production
SESSION_COOKIE_SECURE = False  # FLAG in production

# Missing security middleware - CHECK if absent
MIDDLEWARE = [
    # Should include:
    'django.middleware.security.SecurityMiddleware',
    'django.middleware.csrf.CsrfViewMiddleware',
]

---

Flask

Safe Patterns (Do Not Flag)

# SAFE: Jinja2 auto-escapes by default
{{ variable }}
render_template('template.html', name=user_input)

# SAFE: Parameterized queries with SQLAlchemy
db.session.query(User).filter(User.name == user_input)
db.session.execute(text("SELECT * FROM users WHERE id = :id"), {"id": user_id})

# SAFE: Flask-WTF CSRF (if configured)
form.validate_on_submit()

Flag These (Flask-Specific)

# XSS
Markup(user_input)  # FLAG: Marks as safe HTML
render_template_string(user_input)  # FLAG: SSTI vulnerability
{{ variable|safe }}  # FLAG in templates

# SQL Injection
db.engine.execute(f"SELECT * FROM users WHERE name = '{user_input}'")  # FLAG
text(f"SELECT * FROM users WHERE id = {user_id}")  # FLAG

# SSTI (Server-Side Template Injection)
render_template_string(user_controlled_template)  # FLAG: Critical
Template(user_input).render()  # FLAG: Critical

# Session Security
app.secret_key = 'hardcoded'  # FLAG
app.config['SECRET_KEY'] = 'weak'  # FLAG

# Debug Mode
app.run(debug=True)  # FLAG in production
app.debug = True  # FLAG in production

---

FastAPI

Safe Patterns (Do Not Flag)

# SAFE: Pydantic validates and sanitizes
@app.post("/users/")
async def create_user(user: UserCreate):  # Pydantic model validates
    pass

# SAFE: Path parameters with type hints
@app.get("/users/{user_id}")
async def get_user(user_id: int):  # Validated as int
    pass

# SAFE: SQLAlchemy ORM
db.query(User).filter(User.id == user_id).first()

Flag These (FastAPI-Specific)

# SQL Injection (same as Flask/SQLAlchemy)
db.execute(f"SELECT * FROM users WHERE id = {user_id}")  # FLAG
text(f"SELECT * FROM users WHERE name = '{name}'")  # FLAG

# Response without validation
@app.get("/data")
async def get_data():
    return user_controlled_dict  # CHECK: May expose sensitive fields

# Dependency injection bypass
@app.get("/admin")
async def admin(user: User = Depends(get_current_user)):
    # CHECK: Ensure get_current_user validates properly
    pass

---

General Python

Always Flag

# Deserialization - Always Critical
pickle.loads(data)
pickle.load(file)
cPickle.loads(data)
shelve.open(user_path)
marshal.loads(data)
yaml.load(data)  # Without Loader=SafeLoader
yaml.load(data, Loader=yaml.FullLoader)  # Still unsafe
yaml.load(data, Loader=yaml.UnsafeLoader)

# Code Execution - Always Critical
eval(user_input)
exec(user_input)
compile(user_input, '<string>', 'exec')
__import__(user_input)

# Command Injection - Critical
os.system(user_cmd)
os.popen(user_cmd)
subprocess.call(cmd, shell=True)  # If cmd has user input
subprocess.run(cmd, shell=True)   # If cmd has user input
subprocess.Popen(cmd, shell=True) # If cmd has user input
commands.getoutput(user_cmd)  # Python 2

Check Context

# SSRF - Check if URL is user-controlled
requests.get(user_url)
urllib.request.urlopen(user_url)
httpx.get(user_url)
aiohttp.ClientSession().get(user_url)

# Path Traversal - Check if path is user-controlled
open(user_path)
pathlib.Path(user_path).read_text()
os.path.join(base, user_input)  # ../../../etc/passwd possible
shutil.copy(user_src, user_dst)

# Weak Crypto - Check if for security purpose
hashlib.md5(password)  # FLAG if for passwords
hashlib.sha1(password)  # FLAG if for passwords
random.random()  # FLAG if for security (use secrets module)
random.randint()  # FLAG if for security

# Safe Alternatives
secrets.token_hex()  # For tokens
secrets.token_urlsafe()  # For URL-safe tokens
hashlib.pbkdf2_hmac()  # For password hashing
bcrypt.hashpw()  # For password hashing

Input Validation

# VULNERABLE: No validation
def process(data):
    return eval(data['expression'])

# SAFE: Type validation
def process(data: dict):
    if not isinstance(data.get('value'), int):
        raise ValueError("Invalid input")
    return data['value'] * 2

# SAFE: Schema validation
from pydantic import BaseModel, validator

class UserInput(BaseModel):
    name: str
    age: int

    @validator('name')
    def name_must_be_safe(cls, v):
        if not v.isalnum():
            raise ValueError('Name must be alphanumeric')
        return v

---

SQLAlchemy Patterns

Safe (Do Not Flag)

# ORM methods - automatically parameterized
session.query(User).filter(User.name == name)
session.query(User).filter_by(name=name)
User.query.filter(User.id == id).first()

# Parameterized text queries
from sqlalchemy import text
session.execute(text("SELECT * FROM users WHERE id = :id"), {"id": user_id})

Flag These

# String interpolation in queries
session.execute(f"SELECT * FROM users WHERE name = '{name}'")
session.execute("SELECT * FROM users WHERE name = '%s'" % name)
session.execute("SELECT * FROM users WHERE name = '" + name + "'")

# text() with interpolation
session.execute(text(f"SELECT * FROM users WHERE id = {user_id}"))

---

Common Mistakes

Type Confusion

# VULNERABLE: JSON numbers become floats
data = request.get_json()
user_id = data['id']  # Could be float, string, dict, etc.
User.query.get(user_id)  # May behave unexpectedly

# SAFE: Explicit type conversion
user_id = int(data['id'])

Race Conditions

# VULNERABLE: TOCTOU
if user.balance >= amount:
    # Another request could modify balance here
    user.balance -= amount

# SAFE: Atomic operation
User.query.filter(User.id == user_id, User.balance >= amount).update(
    {User.balance: User.balance - amount}
)

---

Grep Patterns

# Django unsafe patterns
grep -rn "mark_safe\||safe\|autoescape off\|\.raw(\|\.extra(" --include="*.py"

# Flask SSTI
grep -rn "render_template_string\|Template(" --include="*.py"

# Deserialization
grep -rn "pickle\.load\|yaml\.load\|marshal\.load" --include="*.py"

# Command injection
grep -rn "os\.system\|subprocess.*shell=True\|os\.popen" --include="*.py"

# SQL injection
grep -rn "execute.*f\"\|execute.*%\|\.raw.*f\"" --include="*.py"