diff --git a/precli/rules/python/third_party/aiohttp/no_certificate_verify.py b/precli/rules/python/third_party/aiohttp/no_certificate_verify.py index eadb9b0d..bd802b54 100644 --- a/precli/rules/python/third_party/aiohttp/no_certificate_verify.py +++ b/precli/rules/python/third_party/aiohttp/no_certificate_verify.py @@ -104,6 +104,9 @@ def analyze(self, context: dict, **kwargs: dict) -> Result: ]: argument = call.get_argument(name="ssl") ssl = argument.value + if ssl is None: + argument = call.get_argument(name="verify_ssl") + ssl = argument.value if ssl is False: fixes = Rule.get_fixes( diff --git a/tests/unit/rules/python/third_party/aiohttp/examples/session_delete_ssl_false.py b/tests/unit/rules/python/third_party/aiohttp/examples/session_delete_ssl_false.py new file mode 100644 index 00000000..a617bf6f --- /dev/null +++ b/tests/unit/rules/python/third_party/aiohttp/examples/session_delete_ssl_false.py @@ -0,0 +1,11 @@ +# level: ERROR +# start_line: 10 +# end_line: 10 +# start_column: 55 +# end_column: 60 +import aiohttp + + +async with aiohttp.ClientSession() as session: + async with session.delete("http://python.org", ssl=False) as response: + print(await response.text()) diff --git a/tests/unit/rules/python/third_party/aiohttp/examples/session_delete_verify_ssl_false.py b/tests/unit/rules/python/third_party/aiohttp/examples/session_delete_verify_ssl_false.py new file mode 100644 index 00000000..054a5ab6 --- /dev/null +++ b/tests/unit/rules/python/third_party/aiohttp/examples/session_delete_verify_ssl_false.py @@ -0,0 +1,13 @@ +# level: ERROR +# start_line: 11 +# end_line: 11 +# start_column: 40 +# end_column: 45 +import aiohttp + + +async with aiohttp.ClientSession() as session: + async with session.delete( + "http://python.org", verify_ssl=False + ) as response: + print(await response.text()) diff --git a/tests/unit/rules/python/third_party/aiohttp/examples/session_get_ssl_false.py b/tests/unit/rules/python/third_party/aiohttp/examples/session_get_ssl_false.py index 34a7bd13..443042b0 100644 --- a/tests/unit/rules/python/third_party/aiohttp/examples/session_get_ssl_false.py +++ b/tests/unit/rules/python/third_party/aiohttp/examples/session_get_ssl_false.py @@ -1,3 +1,8 @@ +# level: ERROR +# start_line: 10 +# end_line: 10 +# start_column: 52 +# end_column: 57 import aiohttp diff --git a/tests/unit/rules/python/third_party/aiohttp/examples/session_get_ssl_true.py b/tests/unit/rules/python/third_party/aiohttp/examples/session_get_ssl_true.py new file mode 100644 index 00000000..0b3d9711 --- /dev/null +++ b/tests/unit/rules/python/third_party/aiohttp/examples/session_get_ssl_true.py @@ -0,0 +1,7 @@ +# level: NONE +import aiohttp + + +async with aiohttp.ClientSession() as session: + async with session.get("http://python.org", ssl=True) as response: + print(await response.text()) diff --git a/tests/unit/rules/python/third_party/aiohttp/examples/session_get_ssl_unset.py b/tests/unit/rules/python/third_party/aiohttp/examples/session_get_ssl_unset.py new file mode 100644 index 00000000..4499b293 --- /dev/null +++ b/tests/unit/rules/python/third_party/aiohttp/examples/session_get_ssl_unset.py @@ -0,0 +1,7 @@ +# level: NONE +import aiohttp + + +async with aiohttp.ClientSession() as session: + async with session.get("http://python.org") as response: + print(await response.text()) diff --git a/tests/unit/rules/python/third_party/aiohttp/examples/session_get_verify_ssl_false.py b/tests/unit/rules/python/third_party/aiohttp/examples/session_get_verify_ssl_false.py new file mode 100644 index 00000000..bbf0e66b --- /dev/null +++ b/tests/unit/rules/python/third_party/aiohttp/examples/session_get_verify_ssl_false.py @@ -0,0 +1,11 @@ +# level: ERROR +# start_line: 10 +# end_line: 10 +# start_column: 59 +# end_column: 64 +import aiohttp + + +async with aiohttp.ClientSession() as session: + async with session.get("http://python.org", verify_ssl=False) as response: + print(await response.text()) diff --git a/tests/unit/rules/python/third_party/aiohttp/examples/session_get_verify_ssl_true.py b/tests/unit/rules/python/third_party/aiohttp/examples/session_get_verify_ssl_true.py new file mode 100644 index 00000000..252ee994 --- /dev/null +++ b/tests/unit/rules/python/third_party/aiohttp/examples/session_get_verify_ssl_true.py @@ -0,0 +1,7 @@ +# level: NONE +import aiohttp + + +async with aiohttp.ClientSession() as session: + async with session.get("http://python.org", verify_ssl=True) as response: + print(await response.text()) diff --git a/tests/unit/rules/python/third_party/aiohttp/examples/session_head_ssl_false.py b/tests/unit/rules/python/third_party/aiohttp/examples/session_head_ssl_false.py new file mode 100644 index 00000000..dc64ce48 --- /dev/null +++ b/tests/unit/rules/python/third_party/aiohttp/examples/session_head_ssl_false.py @@ -0,0 +1,11 @@ +# level: ERROR +# start_line: 10 +# end_line: 10 +# start_column: 53 +# end_column: 58 +import aiohttp + + +async with aiohttp.ClientSession() as session: + async with session.head("http://python.org", ssl=False) as response: + print(await response.text()) diff --git a/tests/unit/rules/python/third_party/aiohttp/examples/session_head_verify_ssl_false.py b/tests/unit/rules/python/third_party/aiohttp/examples/session_head_verify_ssl_false.py new file mode 100644 index 00000000..8bd7c222 --- /dev/null +++ b/tests/unit/rules/python/third_party/aiohttp/examples/session_head_verify_ssl_false.py @@ -0,0 +1,11 @@ +# level: ERROR +# start_line: 10 +# end_line: 10 +# start_column: 60 +# end_column: 65 +import aiohttp + + +async with aiohttp.ClientSession() as session: + async with session.head("http://python.org", verify_ssl=False) as response: + print(await response.text()) diff --git a/tests/unit/rules/python/third_party/aiohttp/examples/session_options_ssl_false.py b/tests/unit/rules/python/third_party/aiohttp/examples/session_options_ssl_false.py new file mode 100644 index 00000000..e090e5cb --- /dev/null +++ b/tests/unit/rules/python/third_party/aiohttp/examples/session_options_ssl_false.py @@ -0,0 +1,11 @@ +# level: ERROR +# start_line: 10 +# end_line: 10 +# start_column: 56 +# end_column: 61 +import aiohttp + + +async with aiohttp.ClientSession() as session: + async with session.options("http://python.org", ssl=False) as response: + print(await response.text()) diff --git a/tests/unit/rules/python/third_party/aiohttp/examples/session_options_verify_ssl_false.py b/tests/unit/rules/python/third_party/aiohttp/examples/session_options_verify_ssl_false.py new file mode 100644 index 00000000..8418d130 --- /dev/null +++ b/tests/unit/rules/python/third_party/aiohttp/examples/session_options_verify_ssl_false.py @@ -0,0 +1,13 @@ +# level: ERROR +# start_line: 11 +# end_line: 11 +# start_column: 40 +# end_column: 45 +import aiohttp + + +async with aiohttp.ClientSession() as session: + async with session.options( + "http://python.org", verify_ssl=False + ) as response: + print(await response.text()) diff --git a/tests/unit/rules/python/third_party/aiohttp/examples/session_patch_ssl_false.py b/tests/unit/rules/python/third_party/aiohttp/examples/session_patch_ssl_false.py new file mode 100644 index 00000000..a2bdb75f --- /dev/null +++ b/tests/unit/rules/python/third_party/aiohttp/examples/session_patch_ssl_false.py @@ -0,0 +1,11 @@ +# level: ERROR +# start_line: 10 +# end_line: 10 +# start_column: 54 +# end_column: 59 +import aiohttp + + +async with aiohttp.ClientSession() as session: + async with session.patch("http://python.org", ssl=False) as response: + print(await response.text()) diff --git a/tests/unit/rules/python/third_party/aiohttp/examples/session_patch_verify_ssl_false.py b/tests/unit/rules/python/third_party/aiohttp/examples/session_patch_verify_ssl_false.py new file mode 100644 index 00000000..4194c541 --- /dev/null +++ b/tests/unit/rules/python/third_party/aiohttp/examples/session_patch_verify_ssl_false.py @@ -0,0 +1,13 @@ +# level: ERROR +# start_line: 11 +# end_line: 11 +# start_column: 40 +# end_column: 45 +import aiohttp + + +async with aiohttp.ClientSession() as session: + async with session.patch( + "http://python.org", verify_ssl=False + ) as response: + print(await response.text()) diff --git a/tests/unit/rules/python/third_party/aiohttp/examples/session_post_ssl_false.py b/tests/unit/rules/python/third_party/aiohttp/examples/session_post_ssl_false.py new file mode 100644 index 00000000..71664144 --- /dev/null +++ b/tests/unit/rules/python/third_party/aiohttp/examples/session_post_ssl_false.py @@ -0,0 +1,11 @@ +# level: ERROR +# start_line: 10 +# end_line: 10 +# start_column: 53 +# end_column: 58 +import aiohttp + + +async with aiohttp.ClientSession() as session: + async with session.post("http://python.org", ssl=False) as response: + print(await response.text()) diff --git a/tests/unit/rules/python/third_party/aiohttp/examples/session_post_verify_ssl_false.py b/tests/unit/rules/python/third_party/aiohttp/examples/session_post_verify_ssl_false.py new file mode 100644 index 00000000..259964c8 --- /dev/null +++ b/tests/unit/rules/python/third_party/aiohttp/examples/session_post_verify_ssl_false.py @@ -0,0 +1,11 @@ +# level: ERROR +# start_line: 10 +# end_line: 10 +# start_column: 60 +# end_column: 65 +import aiohttp + + +async with aiohttp.ClientSession() as session: + async with session.post("http://python.org", verify_ssl=False) as response: + print(await response.text()) diff --git a/tests/unit/rules/python/third_party/aiohttp/examples/session_put_ssl_false.py b/tests/unit/rules/python/third_party/aiohttp/examples/session_put_ssl_false.py new file mode 100644 index 00000000..a8514424 --- /dev/null +++ b/tests/unit/rules/python/third_party/aiohttp/examples/session_put_ssl_false.py @@ -0,0 +1,11 @@ +# level: ERROR +# start_line: 10 +# end_line: 10 +# start_column: 52 +# end_column: 57 +import aiohttp + + +async with aiohttp.ClientSession() as session: + async with session.put("http://python.org", ssl=False) as response: + print(await response.text()) diff --git a/tests/unit/rules/python/third_party/aiohttp/examples/session_put_verify_ssl_false.py b/tests/unit/rules/python/third_party/aiohttp/examples/session_put_verify_ssl_false.py new file mode 100644 index 00000000..79bcdd62 --- /dev/null +++ b/tests/unit/rules/python/third_party/aiohttp/examples/session_put_verify_ssl_false.py @@ -0,0 +1,11 @@ +# level: ERROR +# start_line: 10 +# end_line: 10 +# start_column: 59 +# end_column: 64 +import aiohttp + + +async with aiohttp.ClientSession() as session: + async with session.put("http://python.org", verify_ssl=False) as response: + print(await response.text()) diff --git a/tests/unit/rules/python/third_party/aiohttp/examples/session_request_ssl_false.py b/tests/unit/rules/python/third_party/aiohttp/examples/session_request_ssl_false.py new file mode 100644 index 00000000..de39ab12 --- /dev/null +++ b/tests/unit/rules/python/third_party/aiohttp/examples/session_request_ssl_false.py @@ -0,0 +1,11 @@ +# level: ERROR +# start_line: 10 +# end_line: 10 +# start_column: 56 +# end_column: 61 +import aiohttp + + +async with aiohttp.ClientSession() as session: + async with session.request("http://python.org", ssl=False) as response: + print(await response.text()) diff --git a/tests/unit/rules/python/third_party/aiohttp/examples/session_request_verify_ssl_false.py b/tests/unit/rules/python/third_party/aiohttp/examples/session_request_verify_ssl_false.py new file mode 100644 index 00000000..1b594649 --- /dev/null +++ b/tests/unit/rules/python/third_party/aiohttp/examples/session_request_verify_ssl_false.py @@ -0,0 +1,13 @@ +# level: ERROR +# start_line: 11 +# end_line: 11 +# start_column: 40 +# end_column: 45 +import aiohttp + + +async with aiohttp.ClientSession() as session: + async with session.request( + "http://python.org", verify_ssl=False + ) as response: + print(await response.text()) diff --git a/tests/unit/rules/python/third_party/aiohttp/examples/session_ws_connect_ssl_false.py b/tests/unit/rules/python/third_party/aiohttp/examples/session_ws_connect_ssl_false.py new file mode 100644 index 00000000..21635f44 --- /dev/null +++ b/tests/unit/rules/python/third_party/aiohttp/examples/session_ws_connect_ssl_false.py @@ -0,0 +1,11 @@ +# level: ERROR +# start_line: 10 +# end_line: 10 +# start_column: 59 +# end_column: 64 +import aiohttp + + +async with aiohttp.ClientSession() as session: + async with session.ws_connect("http://python.org", ssl=False) as response: + print(await response.text()) diff --git a/tests/unit/rules/python/third_party/aiohttp/examples/session_ws_connect_verify_ssl_false.py b/tests/unit/rules/python/third_party/aiohttp/examples/session_ws_connect_verify_ssl_false.py new file mode 100644 index 00000000..18ab414b --- /dev/null +++ b/tests/unit/rules/python/third_party/aiohttp/examples/session_ws_connect_verify_ssl_false.py @@ -0,0 +1,13 @@ +# level: ERROR +# start_line: 11 +# end_line: 11 +# start_column: 40 +# end_column: 45 +import aiohttp + + +async with aiohttp.ClientSession() as session: + async with session.ws_connect( + "http://python.org", verify_ssl=False + ) as response: + print(await response.text()) diff --git a/tests/unit/rules/python/third_party/aiohttp/test_no_certificate_verify.py b/tests/unit/rules/python/third_party/aiohttp/test_no_certificate_verify.py new file mode 100644 index 00000000..eaacc908 --- /dev/null +++ b/tests/unit/rules/python/third_party/aiohttp/test_no_certificate_verify.py @@ -0,0 +1,65 @@ +# Copyright 2023 Secure Saurce LLC +import os + +from parameterized import parameterized + +from precli.core.level import Level +from precli.parsers import python +from precli.rules import Rule +from tests.unit.rules.python import test_case + + +class NoCertificateVerifyTests(test_case.TestCase): + def setUp(self): + super().setUp() + self.rule_id = "PRE0501" + self.parser = python.Python(enabled=[self.rule_id]) + self.base_path = os.path.join( + "tests", + "unit", + "rules", + "python", + "third_party", + "aiohttp", + "examples", + ) + + def test_no_certificate_verify_rule_meta(self): + rule = Rule.get_by_id(self.rule_id) + self.assertEqual(self.rule_id, rule.id) + self.assertEqual("improper_certificate_validation", rule.name) + self.assertEqual( + f"https://docs.securesauce.dev/rules/{self.rule_id}", rule.help_url + ) + self.assertEqual(True, rule.default_config.enabled) + self.assertEqual(Level.WARNING, rule.default_config.level) + self.assertEqual(-1.0, rule.default_config.rank) + self.assertEqual("295", rule.cwe.cwe_id) + + @parameterized.expand( + [ + "session_delete_ssl_false", + "session_delete_verify_ssl_false", + "session_get_ssl_false", + "session_get_ssl_true", + "session_get_ssl_unset", + "session_get_verify_ssl_false", + "session_get_verify_ssl_true", + "session_head_ssl_false", + "session_head_verify_ssl_false", + "session_options_ssl_false", + "session_options_verify_ssl_false", + "session_patch_ssl_false", + "session_patch_verify_ssl_false", + "session_post_ssl_false", + "session_post_verify_ssl_false", + "session_put_ssl_false", + "session_put_verify_ssl_false", + "session_request_ssl_false", + "session_request_verify_ssl_false", + "session_ws_connect_ssl_false", + "session_ws_connect_verify_ssl_false", + ] + ) + def test(self, filename): + self.check(filename)