Rule for wildcard CORS in FastAPI (#3137)

* Rule for wildcard CORS in FastAPI * Update test case * Add rule subcategory * Add ok: rule-id * Update wildcard-cors.py * Update wildcard-cors.py --------- Co-authored-by: Claudio <[email protected]> Co-authored-by: Vasilii Ermilov <[email protected]>
semgrep · Dec 13, 2023 · 65db589 · 65db589
1 parent 716f8d9
commit 65db589
Show file tree

Hide file tree

Showing 2 changed files with 83 additions and 0 deletions.
diff --git a/python/fastapi/security/wildcard-cors.py b/python/fastapi/security/wildcard-cors.py
@@ -0,0 +1,46 @@
+from fastapi import FastAPI
+from fastapi.middleware.cors import CORSMiddleware
+
+app = FastAPI()
+
+origins = ["*"]
+
+
+app.add_middleware(
+    CORSMiddleware,
+    # ruleid: wildcard-cors
+    allow_origins=origins,
+    allow_credentials=True,
+    allow=["*"]
+)
+
+
+app.add_middleware(
+    CORSMiddleware,
+    # ruleid: wildcard-cors
+    allow_origins=["*"],
+    allow_credentials=True,
+    allow=["*"]
+)
+
+
+app.add_middleware(
+    CORSMiddleware,
+    # ok: wildcard-cors
+    allow_origins=["https://github.com"],
+    allow_credentials=True,
+    allow=["*"]
+)
+
+app.add_middleware(
+    CORSMiddleware,
+    # ok: wildcard-cors
+    allow_origins=["https://github.com"],
+    allow_credentials=True,
+    allow=["www.semgrep.dev"]
+)
+
+
+@app.get("/")
+async def main():
+    return {"message": "Hello Semgrep"}
diff --git a/python/fastapi/security/wildcard-cors.yaml b/python/fastapi/security/wildcard-cors.yaml
@@ -0,0 +1,37 @@
+rules:
+  - id: wildcard-cors
+    languages:
+      - python
+    message: CORS policy allows any origin (using wildcard '*'). This is insecure
+      and should be avoided.
+    mode: taint
+    pattern-sources:
+      - pattern: '[..., "*", ...]'
+    pattern-sinks:
+      - patterns:
+          - pattern: |
+              $APP.add_middleware(
+                CORSMiddleware,
+                allow_origins=$ORIGIN,
+                ...);
+          - focus-metavariable: $ORIGIN
+    severity: WARNING
+    metadata:
+      cwe:
+        - "CWE-942: Permissive Cross-domain Policy with Untrusted Domains"
+      owasp:
+        - A05:2021 - Security Misconfiguration
+      category: security
+      technology:
+        - python
+        - fastapi
+      references:
+        - https://owasp.org/Top10/A05_2021-Security_Misconfiguration
+        - https://cwe.mitre.org/data/definitions/942.html
+      likelihood: HIGH
+      impact: LOW
+      confidence: MEDIUM
+      vulnerability_class:
+        - Configuration
+      subcategory:
+        - vuln