{
  "rules": [
    {
      "id": "python.boto3.security.hardcoded-token.hardcoded-token",
      "message": "A hard-coded credential was detected. It is not recommended to store credentials in source-code, as this risks secrets being leaked and used by either an internal or external malicious adversary. It is recommended to use environment variables to securely provide credentials or retrieve credentials from a secure vault or HSM (Hardware Security Module).",
      "metadata": {
        "cwe": [
          "CWE-798: Use of Hard-coded Credentials"
        ],
        "references": [
          "https://cheatsheetseries.owasp.org/cheatsheets/Secrets_Management_Cheat_Sheet.html",
          "https://bento.dev/checks/boto3/hardcoded-access-token/",
          "https://aws.amazon.com/blogs/security/what-to-do-if-you-inadvertently-expose-an-aws-access-key/"
        ],
        "owasp": [
          "A07:2021 - Identification and Authentication Failures",
          "A07:2025 - Authentication Failures"
        ],
        "category": "security",
        "technology": [
          "boto3",
          "secrets"
        ],
        "cwe2022-top25": true,
        "cwe2021-top25": true,
        "subcategory": [
          "vuln"
        ],
        "likelihood": "HIGH",
        "impact": "MEDIUM",
        "confidence": "MEDIUM",
        "license": "Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license",
        "vulnerability_class": [
          "Hard-coded Secrets"
        ],
        "source": "https://semgrep.dev/r/python.boto3.security.hardcoded-token.hardcoded-token",
        "shortlink": "https://sg.run/LwQ6",
        "semgrep.dev": {
          "rule": {
            "r_id": 9439,
            "rv_id": 1263347,
            "rule_id": "5rUOwK",
            "version_id": "gETB78n",
            "url": "https://semgrep.dev/playground/r/gETB78n/python.boto3.security.hardcoded-token.hardcoded-token",
            "origin": "community"
          }
        }
      },
      "languages": [
        "python"
      ],
      "severity": "WARNING",
      "mode": "taint",
      "pattern-sources": [
        {
          "pattern": "\"...\"\n"
        }
      ],
      "pattern-sinks": [
        {
          "patterns": [
            {
              "pattern-either": [
                {
                  "pattern": "$W(...,$TOKEN=\"$VALUE\",...)"
                },
                {
                  "pattern": "$BOTO. ... .$W(...,$TOKEN=\"$VALUE\",...)"
                }
              ]
            },
            {
              "metavariable-regex": {
                "metavariable": "$TOKEN",
                "regex": "(aws_session_token|aws_access_key_id|aws_secret_access_key)"
              }
            },
            {
              "metavariable-pattern": {
                "language": "generic",
                "metavariable": "$VALUE",
                "patterns": [
                  {
                    "pattern-either": [
                      {
                        "pattern-regex": "^AKI"
                      },
                      {
                        "pattern-regex": "^[A-Za-z0-9/+=]+$"
                      }
                    ]
                  }
                ]
              }
            },
            {
              "metavariable-analysis": {
                "metavariable": "$VALUE",
                "analyzer": "entropy"
              }
            }
          ]
        }
      ]
    },
    {
      "id": "python.cryptography.security.insecure-cipher-algorithms.insecure-cipher-algorithm-idea",
      "message": "IDEA (International Data Encryption Algorithm) is a block cipher created in 1991.  It is an optional component of the OpenPGP standard. This cipher is susceptible to attacks when using weak keys.  It is recommended that you do not use this cipher for new applications. Use a strong symmetric cipher such as EAS instead. With the `cryptography` package it is recommended to use `Fernet` which is a secure implementation of AES in CBC mode with a 128-bit key.  Alternatively, keep using the `Cipher` class from the hazmat primitives but use the AES algorithm instead.",
      "metadata": {
        "source-rule-url": "https://github.com/PyCQA/bandit/blob/d5f8fa0d89d7b11442fc6ec80ca42953974354c8/bandit/blacklists/calls.py#L98",
        "cwe": [
          "CWE-327: Use of a Broken or Risky Cryptographic Algorithm"
        ],
        "owasp": [
          "A03:2017 - Sensitive Data Exposure",
          "A02:2021 - Cryptographic Failures",
          "A04:2025 - Cryptographic Failures"
        ],
        "bandit-code": "B304",
        "references": [
          "https://tools.ietf.org/html/rfc5469",
          "https://cryptography.io/en/latest/hazmat/primitives/symmetric-encryption/#cryptography.hazmat.primitives.ciphers.algorithms.IDEA"
        ],
        "category": "security",
        "technology": [
          "cryptography"
        ],
        "subcategory": [
          "vuln"
        ],
        "likelihood": "MEDIUM",
        "impact": "MEDIUM",
        "confidence": "MEDIUM",
        "functional-categories": [
          "crypto::search::symmetric-algorithm::cryptography"
        ],
        "license": "Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license",
        "vulnerability_class": [
          "Cryptographic Issues"
        ],
        "source": "https://semgrep.dev/r/python.cryptography.security.insecure-cipher-algorithms.insecure-cipher-algorithm-idea",
        "shortlink": "https://sg.run/3xyK",
        "semgrep.dev": {
          "rule": {
            "r_id": 9443,
            "rv_id": 1263350,
            "rule_id": "BYUNPg",
            "version_id": "44TEjNJ",
            "url": "https://semgrep.dev/playground/r/44TEjNJ/python.cryptography.security.insecure-cipher-algorithms.insecure-cipher-algorithm-idea",
            "origin": "community"
          }
        }
      },
      "severity": "WARNING",
      "languages": [
        "python"
      ],
      "patterns": [
        {
          "pattern": "cryptography.hazmat.primitives.ciphers.algorithms.$IDEA($KEY)"
        },
        {
          "metavariable-regex": {
            "metavariable": "$IDEA",
            "regex": "^(IDEA)$"
          }
        },
        {
          "focus-metavariable": "$IDEA"
        }
      ],
      "fix": "AES"
    },
    {
      "id": "python.cryptography.security.insecure-cipher-mode-ecb.insecure-cipher-mode-ecb",
      "message": "ECB (Electronic Code Book) is the simplest mode of operation for block ciphers.  Each block of data is encrypted in the same way.  This means identical plaintext blocks will always result in identical ciphertext blocks, which can leave significant patterns in the output. Use a different, cryptographically strong mode instead, such as GCM.",
      "metadata": {
        "source-rule-url": "https://github.com/PyCQA/bandit/blob/d5f8fa0d89d7b11442fc6ec80ca42953974354c8/bandit/blacklists/calls.py#L101",
        "cwe": [
          "CWE-327: Use of a Broken or Risky Cryptographic Algorithm"
        ],
        "owasp": [
          "A03:2017 - Sensitive Data Exposure",
          "A02:2021 - Cryptographic Failures",
          "A04:2025 - Cryptographic Failures"
        ],
        "bandit-code": "B305",
        "references": [
          "https://cryptography.io/en/latest/hazmat/primitives/symmetric-encryption/#insecure-modes",
          "https://crypto.stackexchange.com/questions/20941/why-shouldnt-i-use-ecb-encryption"
        ],
        "category": "security",
        "technology": [
          "cryptography"
        ],
        "subcategory": [
          "audit"
        ],
        "likelihood": "LOW",
        "impact": "LOW",
        "confidence": "MEDIUM",
        "functional-categories": [
          "crypto::search::mode::cryptography"
        ],
        "license": "Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license",
        "vulnerability_class": [
          "Cryptographic Issues"
        ],
        "source": "https://semgrep.dev/r/python.cryptography.security.insecure-cipher-mode-ecb.insecure-cipher-mode-ecb",
        "shortlink": "https://sg.run/4xr5",
        "semgrep.dev": {
          "rule": {
            "r_id": 9444,
            "rv_id": 1263351,
            "rule_id": "DbUp5g",
            "version_id": "PkTR3w7",
            "url": "https://semgrep.dev/playground/r/PkTR3w7/python.cryptography.security.insecure-cipher-mode-ecb.insecure-cipher-mode-ecb",
            "origin": "community"
          }
        }
      },
      "severity": "WARNING",
      "languages": [
        "python"
      ],
      "pattern": "cryptography.hazmat.primitives.ciphers.modes.ECB($IV)",
      "fix": "cryptography.hazmat.primitives.ciphers.modes.GCM($IV)"
    },
    {
      "id": "python.cryptography.security.insecure-hash-algorithms.insecure-hash-algorithm-sha1",
      "patterns": [
        {
          "pattern": "cryptography.hazmat.primitives.hashes.$SHA(...)"
        },
        {
          "metavariable-pattern": {
            "metavariable": "$SHA",
            "pattern": "SHA1\n"
          }
        },
        {
          "focus-metavariable": "$SHA"
        }
      ],
      "fix": "SHA256\n",
      "message": "Detected SHA1 hash algorithm which is considered insecure. SHA1 is not collision resistant and is therefore not suitable as a cryptographic signature. Use SHA256 or SHA3 instead.",
      "metadata": {
        "source-rule-url": "https://github.com/PyCQA/bandit/blob/d5f8fa0d89d7b11442fc6ec80ca42953974354c8/bandit/blacklists/calls.py#L59",
        "cwe": [
          "CWE-327: Use of a Broken or Risky Cryptographic Algorithm"
        ],
        "owasp": [
          "A03:2017 - Sensitive Data Exposure",
          "A02:2021 - Cryptographic Failures",
          "A04:2025 - Cryptographic Failures"
        ],
        "bandit-code": "B303",
        "references": [
          "https://cryptography.io/en/latest/hazmat/primitives/cryptographic-hashes/#sha-1",
          "https://www.schneier.com/blog/archives/2012/10/when_will_we_se.html",
          "https://www.trendmicro.com/vinfo/us/security/news/vulnerabilities-and-exploits/sha-1-collision-signals-the-end-of-the-algorithm-s-viability",
          "http://2012.sharcs.org/slides/stevens.pdf",
          "https://pycryptodome.readthedocs.io/en/latest/src/hash/sha3_256.html"
        ],
        "category": "security",
        "technology": [
          "cryptography"
        ],
        "subcategory": [
          "vuln"
        ],
        "likelihood": "LOW",
        "impact": "MEDIUM",
        "confidence": "MEDIUM",
        "functional-categories": [
          "crypto::search::symmetric-algorithm::cryptography"
        ],
        "license": "Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license",
        "vulnerability_class": [
          "Cryptographic Issues"
        ],
        "source": "https://semgrep.dev/r/python.cryptography.security.insecure-hash-algorithms.insecure-hash-algorithm-sha1",
        "shortlink": "https://sg.run/J9Qy",
        "semgrep.dev": {
          "rule": {
            "r_id": 9446,
            "rv_id": 1263353,
            "rule_id": "0oU5dN",
            "version_id": "5PTo1l0",
            "url": "https://semgrep.dev/playground/r/5PTo1l0/python.cryptography.security.insecure-hash-algorithms.insecure-hash-algorithm-sha1",
            "origin": "community"
          }
        }
      },
      "severity": "WARNING",
      "languages": [
        "python"
      ]
    },
    {
      "id": "python.cryptography.security.insufficient-dsa-key-size.insufficient-dsa-key-size",
      "patterns": [
        {
          "pattern-either": [
            {
              "pattern": "cryptography.hazmat.primitives.asymmetric.dsa.generate_private_key(..., key_size=$SIZE, ...)"
            },
            {
              "pattern": "cryptography.hazmat.primitives.asymmetric.dsa.generate_private_key($SIZE, ...)"
            }
          ]
        },
        {
          "metavariable-comparison": {
            "metavariable": "$SIZE",
            "comparison": "$SIZE < 2048"
          }
        },
        {
          "focus-metavariable": "$SIZE"
        }
      ],
      "fix": "2048\n",
      "message": "Detected an insufficient key size for DSA. NIST recommends a key size of 2048 or higher.",
      "metadata": {
        "cwe": [
          "CWE-326: Inadequate Encryption Strength"
        ],
        "owasp": [
          "A03:2017 - Sensitive Data Exposure",
          "A02:2021 - Cryptographic Failures",
          "A04:2025 - Cryptographic Failures"
        ],
        "source-rule-url": "https://github.com/PyCQA/bandit/blob/b1411bfb43795d3ffd268bef17a839dee954c2b1/bandit/plugins/weak_cryptographic_key.py",
        "references": [
          "https://www.cosic.esat.kuleuven.be/ecrypt/ecrypt2/documents/D.SPA.20.pdf",
          "https://cryptography.io/en/latest/hazmat/primitives/asymmetric/dsa/",
          "https://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-57Pt3r1.pdf"
        ],
        "category": "security",
        "technology": [
          "cryptography"
        ],
        "subcategory": [
          "vuln"
        ],
        "likelihood": "MEDIUM",
        "impact": "MEDIUM",
        "confidence": "MEDIUM",
        "functional-categories": [
          "crypto::search::key-length::cryptography"
        ],
        "license": "Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license",
        "vulnerability_class": [
          "Cryptographic Issues"
        ],
        "source": "https://semgrep.dev/r/python.cryptography.security.insufficient-dsa-key-size.insufficient-dsa-key-size",
        "shortlink": "https://sg.run/5Qb0",
        "semgrep.dev": {
          "rule": {
            "r_id": 9447,
            "rv_id": 1263354,
            "rule_id": "KxUb0x",
            "version_id": "GxTkeOK",
            "url": "https://semgrep.dev/playground/r/GxTkeOK/python.cryptography.security.insufficient-dsa-key-size.insufficient-dsa-key-size",
            "origin": "community"
          }
        }
      },
      "languages": [
        "python"
      ],
      "severity": "WARNING"
    },
    {
      "id": "python.cryptography.security.insufficient-ec-key-size.insufficient-ec-key-size",
      "patterns": [
        {
          "pattern-inside": "cryptography.hazmat.primitives.asymmetric.ec.generate_private_key(...)"
        },
        {
          "pattern": "cryptography.hazmat.primitives.asymmetric.ec.$SIZE"
        },
        {
          "metavariable-pattern": {
            "metavariable": "$SIZE",
            "pattern-either": [
              {
                "pattern": "SECP192R1"
              },
              {
                "pattern": "SECT163K1"
              },
              {
                "pattern": "SECT163R2"
              }
            ]
          }
        },
        {
          "focus-metavariable": "$SIZE"
        }
      ],
      "fix": "SECP256R1\n",
      "message": "Detected an insufficient curve size for EC. NIST recommends a key size of 224 or higher. For example, use 'ec.SECP256R1'.",
      "metadata": {
        "cwe": [
          "CWE-326: Inadequate Encryption Strength"
        ],
        "owasp": [
          "A03:2017 - Sensitive Data Exposure",
          "A02:2021 - Cryptographic Failures",
          "A04:2025 - Cryptographic Failures"
        ],
        "source-rule-url": "https://github.com/PyCQA/bandit/blob/b1411bfb43795d3ffd268bef17a839dee954c2b1/bandit/plugins/weak_cryptographic_key.py",
        "references": [
          "https://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-57Pt3r1.pdf",
          "https://cryptography.io/en/latest/hazmat/primitives/asymmetric/ec/#elliptic-curves"
        ],
        "category": "security",
        "technology": [
          "cryptography"
        ],
        "subcategory": [
          "audit"
        ],
        "likelihood": "MEDIUM",
        "impact": "MEDIUM",
        "confidence": "MEDIUM",
        "functional-categories": [
          "crypto::search::key-length::cryptography"
        ],
        "license": "Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license",
        "vulnerability_class": [
          "Cryptographic Issues"
        ],
        "source": "https://semgrep.dev/r/python.cryptography.security.insufficient-ec-key-size.insufficient-ec-key-size",
        "shortlink": "https://sg.run/GeQq",
        "semgrep.dev": {
          "rule": {
            "r_id": 9448,
            "rv_id": 1263355,
            "rule_id": "qNUjZ3",
            "version_id": "RGT0LW6",
            "url": "https://semgrep.dev/playground/r/RGT0LW6/python.cryptography.security.insufficient-ec-key-size.insufficient-ec-key-size",
            "origin": "community"
          }
        }
      },
      "languages": [
        "python"
      ],
      "severity": "WARNING"
    },
    {
      "id": "python.cryptography.security.insufficient-rsa-key-size.insufficient-rsa-key-size",
      "patterns": [
        {
          "pattern-either": [
            {
              "pattern": "cryptography.hazmat.primitives.asymmetric.rsa.generate_private_key(..., key_size=$SIZE, ...)"
            },
            {
              "pattern": "cryptography.hazmat.primitives.asymmetric.rsa.generate_private_key($EXP, $SIZE, ...)"
            }
          ]
        },
        {
          "metavariable-comparison": {
            "metavariable": "$SIZE",
            "comparison": "$SIZE < 2048"
          }
        },
        {
          "focus-metavariable": "$SIZE"
        }
      ],
      "fix": "2048\n",
      "message": "Detected an insufficient key size for RSA. NIST recommends a key size of 2048 or higher.",
      "metadata": {
        "cwe": [
          "CWE-326: Inadequate Encryption Strength"
        ],
        "owasp": [
          "A03:2017 - Sensitive Data Exposure",
          "A02:2021 - Cryptographic Failures",
          "A04:2025 - Cryptographic Failures"
        ],
        "source-rule-url": "https://github.com/PyCQA/bandit/blob/b1411bfb43795d3ffd268bef17a839dee954c2b1/bandit/plugins/weak_cryptographic_key.py",
        "references": [
          "https://cryptography.io/en/latest/hazmat/primitives/asymmetric/rsa/",
          "https://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-57Pt3r1.pdf"
        ],
        "category": "security",
        "technology": [
          "cryptography"
        ],
        "subcategory": [
          "audit"
        ],
        "likelihood": "MEDIUM",
        "impact": "MEDIUM",
        "confidence": "MEDIUM",
        "functional-categories": [
          "crypto::search::key-length::cryptography"
        ],
        "license": "Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license",
        "vulnerability_class": [
          "Cryptographic Issues"
        ],
        "source": "https://semgrep.dev/r/python.cryptography.security.insufficient-rsa-key-size.insufficient-rsa-key-size",
        "shortlink": "https://sg.run/RoQq",
        "semgrep.dev": {
          "rule": {
            "r_id": 9449,
            "rv_id": 1263356,
            "rule_id": "lBU9jn",
            "version_id": "A8TgdPK",
            "url": "https://semgrep.dev/playground/r/A8TgdPK/python.cryptography.security.insufficient-rsa-key-size.insufficient-rsa-key-size",
            "origin": "community"
          }
        }
      },
      "languages": [
        "python"
      ],
      "severity": "WARNING"
    },
    {
      "id": "python.distributed.security.require-encryption",
      "patterns": [
        {
          "pattern": "distributed.security.Security(..., require_encryption=$VAL, ...)\n"
        },
        {
          "metavariable-pattern": {
            "metavariable": "$VAL",
            "pattern": "False\n"
          }
        },
        {
          "focus-metavariable": "$VAL"
        }
      ],
      "fix": "True\n",
      "message": "Initializing a security context for Dask (`distributed`) without \"require_encryption\" keyword argument may silently fail to provide security.",
      "severity": "WARNING",
      "metadata": {
        "cwe": [
          "CWE-319: Cleartext Transmission of Sensitive Information"
        ],
        "owasp": [
          "A03:2017 - Sensitive Data Exposure",
          "A02:2021 - Cryptographic Failures",
          "A04:2025 - Cryptographic Failures"
        ],
        "references": [
          "https://distributed.dask.org/en/latest/tls.html?highlight=require_encryption#parameters"
        ],
        "category": "security",
        "technology": [
          "distributed"
        ],
        "subcategory": [
          "vuln"
        ],
        "likelihood": "MEDIUM",
        "impact": "MEDIUM",
        "confidence": "MEDIUM",
        "license": "Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license",
        "vulnerability_class": [
          "Mishandled Sensitive Information"
        ],
        "source": "https://semgrep.dev/r/python.distributed.security.require-encryption",
        "shortlink": "https://sg.run/AvQ2",
        "semgrep.dev": {
          "rule": {
            "r_id": 9450,
            "rv_id": 1263358,
            "rule_id": "YGURy0",
            "version_id": "DkTRbol",
            "url": "https://semgrep.dev/playground/r/DkTRbol/python.distributed.security.require-encryption",
            "origin": "community"
          }
        }
      },
      "languages": [
        "python"
      ]
    },
    {
      "id": "python.django.security.audit.avoid-insecure-deserialization.avoid-insecure-deserialization",
      "metadata": {
        "owasp": [
          "A08:2017 - Insecure Deserialization",
          "A08:2021 - Software and Data Integrity Failures",
          "A08:2025 - Software or Data Integrity Failures"
        ],
        "cwe": [
          "CWE-502: Deserialization of Untrusted Data"
        ],
        "references": [
          "https://docs.python.org/3/library/pickle.html"
        ],
        "category": "security",
        "technology": [
          "django"
        ],
        "cwe2022-top25": true,
        "cwe2021-top25": true,
        "subcategory": [
          "vuln"
        ],
        "likelihood": "MEDIUM",
        "impact": "MEDIUM",
        "confidence": "MEDIUM",
        "license": "Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license",
        "vulnerability_class": [
          "Insecure Deserialization "
        ],
        "source": "https://semgrep.dev/r/python.django.security.audit.avoid-insecure-deserialization.avoid-insecure-deserialization",
        "shortlink": "https://sg.run/9oyr",
        "semgrep.dev": {
          "rule": {
            "r_id": 9467,
            "rv_id": 1409400,
            "rule_id": "OrU3e6",
            "version_id": "GxTlb9e",
            "url": "https://semgrep.dev/playground/r/GxTlb9e/python.django.security.audit.avoid-insecure-deserialization.avoid-insecure-deserialization",
            "origin": "community"
          }
        }
      },
      "message": "Avoid using insecure deserialization library, backed by `pickle`, `_pickle`, `cpickle`, `dill`, `shelve`, or `yaml`, which are known to lead to remote code execution vulnerabilities.",
      "languages": [
        "python"
      ],
      "severity": "ERROR",
      "mode": "taint",
      "pattern-sources": [
        {
          "pattern-either": [
            {
              "patterns": [
                {
                  "pattern-inside": "def $INSIDE(..., $PARAM, ...):\n  ...\n"
                },
                {
                  "pattern-either": [
                    {
                      "pattern": "request.$REQFUNC(...)"
                    },
                    {
                      "pattern": "request.$REQFUNC.get(...)"
                    },
                    {
                      "pattern": "request.$REQFUNC[...]"
                    }
                  ]
                }
              ]
            }
          ]
        }
      ],
      "pattern-sinks": [
        {
          "pattern-either": [
            {
              "patterns": [
                {
                  "pattern-either": [
                    {
                      "pattern": "pickle.$PICKLEFUNC(...)\n"
                    },
                    {
                      "pattern": "_pickle.$PICKLEFUNC(...)\n"
                    },
                    {
                      "pattern": "cPickle.$PICKLEFUNC(...)\n"
                    },
                    {
                      "pattern": "shelve.$PICKLEFUNC(...)\n"
                    }
                  ]
                },
                {
                  "metavariable-regex": {
                    "metavariable": "$PICKLEFUNC",
                    "regex": "dumps|dump|load|loads"
                  }
                }
              ]
            },
            {
              "patterns": [
                {
                  "pattern": "dill.$DILLFUNC(...)"
                },
                {
                  "metavariable-regex": {
                    "metavariable": "$DILLFUNC",
                    "regex": "dump|dump_session|dumps|load|load_session|loads"
                  }
                }
              ]
            },
            {
              "patterns": [
                {
                  "pattern": "yaml.$YAMLFUNC(...)"
                },
                {
                  "pattern-not": "yaml.$YAMLFUNC(..., Dumper=SafeDumper, ...)"
                },
                {
                  "pattern-not": "yaml.$YAMLFUNC(..., Dumper=yaml.SafeDumper, ...)"
                },
                {
                  "pattern-not": "yaml.$YAMLFUNC(..., Loader=SafeLoader, ...)"
                },
                {
                  "pattern-not": "yaml.$YAMLFUNC(..., Loader=yaml.SafeLoader, ...)"
                },
                {
                  "metavariable-regex": {
                    "metavariable": "$YAMLFUNC",
                    "regex": "dump|dump_all|load|load_all"
                  }
                }
              ]
            }
          ]
        }
      ]
    },
    {
      "id": "python.django.security.injection.open-redirect.open-redirect",
      "message": "Data from request ($DATA) is passed to redirect(). This is an open redirect and could be exploited. Ensure you are redirecting to safe URLs by using django.utils.http.is_safe_url(). See https://cwe.mitre.org/data/definitions/601.html for more information.",
      "metadata": {
        "cwe": [
          "CWE-601: URL Redirection to Untrusted Site ('Open Redirect')"
        ],
        "owasp": [
          "A01:2021 - Broken Access Control",
          "A01:2025 - Broken Access Control"
        ],
        "references": [
          "https://www.djm.org.uk/posts/djangos-little-protections-word-redirect-dangers/",
          "https://github.com/django/django/blob/d1b7bd030b1db111e1a3505b1fc029ab964382cc/django/utils/http.py#L231"
        ],
        "category": "security",
        "technology": [
          "django"
        ],
        "subcategory": [
          "vuln"
        ],
        "likelihood": "LOW",
        "impact": "MEDIUM",
        "confidence": "MEDIUM",
        "license": "Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license",
        "vulnerability_class": [
          "Open Redirect"
        ],
        "source": "https://semgrep.dev/r/python.django.security.injection.open-redirect.open-redirect",
        "shortlink": "https://sg.run/Ave2",
        "semgrep.dev": {
          "rule": {
            "r_id": 9494,
            "rv_id": 1263393,
            "rule_id": "PeUZgr",
            "version_id": "3ZT4XD7",
            "url": "https://semgrep.dev/playground/r/3ZT4XD7/python.django.security.injection.open-redirect.open-redirect",
            "origin": "community"
          }
        }
      },
      "languages": [
        "python"
      ],
      "severity": "WARNING",
      "patterns": [
        {
          "pattern-inside": "def $FUNC(...):\n  ...\n"
        },
        {
          "pattern-not-inside": "def $FUNC(...):\n  ...\n  django.utils.http.is_safe_url(...)\n  ...\n"
        },
        {
          "pattern-not-inside": "def $FUNC(...):\n  ...\n  if <... django.utils.http.is_safe_url(...) ...>:\n    ...\n"
        },
        {
          "pattern-not-inside": "def $FUNC(...):\n  ...\n  django.utils.http.url_has_allowed_host_and_scheme(...)\n  ...\n"
        },
        {
          "pattern-not-inside": "def $FUNC(...):\n  ...\n  if <... django.utils.http.url_has_allowed_host_and_scheme(...) ...>:\n    ...\n"
        },
        {
          "pattern-either": [
            {
              "pattern": "django.shortcuts.redirect(..., request.$W.get(...), ...)"
            },
            {
              "pattern": "django.shortcuts.redirect(..., $S.format(..., request.$W.get(...), ...), ...)"
            },
            {
              "pattern": "django.shortcuts.redirect(..., $S % request.$W.get(...), ...)"
            },
            {
              "pattern": "django.shortcuts.redirect(..., f\"...{request.$W.get(...)}...\", ...)"
            },
            {
              "pattern": "$DATA = request.$W.get(...)\n...\ndjango.shortcuts.redirect(..., $DATA, ...)\n"
            },
            {
              "pattern": "$DATA = request.$W.get(...)\n...\n$INTERM = $DATA\n...\ndjango.shortcuts.redirect(..., $INTERM, ...)\n"
            },
            {
              "pattern": "$DATA = request.$W.get(...)\n...\ndjango.shortcuts.redirect(..., $STR.format(..., $DATA, ...), ...)\n"
            },
            {
              "pattern": "$DATA = request.$W.get(...)\n...\n$INTERM = $STR.format(..., $DATA, ...)\n...\ndjango.shortcuts.redirect(..., $INTERM, ...)\n"
            },
            {
              "pattern": "$DATA = request.$W.get(...)\n...\ndjango.shortcuts.redirect(..., $STR % $DATA, ...)\n"
            },
            {
              "pattern": "$DATA = request.$W.get(...)\n...\n$INTERM = $STR % $DATA\n...\ndjango.shortcuts.redirect(..., $INTERM, ...)\n"
            },
            {
              "pattern": "$DATA = request.$W.get(...)\n...\ndjango.shortcuts.redirect(..., f\"...{$DATA}...\", ...)\n"
            },
            {
              "pattern": "$DATA = request.$W.get(...)\n...\n$INTERM = f\"...{$DATA}...\"\n...\ndjango.shortcuts.redirect(..., $INTERM, ...)\n"
            },
            {
              "pattern": "$DATA = request.$W.get(...)\n...\ndjango.shortcuts.redirect(..., $STR + $DATA, ...)\n"
            },
            {
              "pattern": "$DATA = request.$W.get(...)\n...\n$INTERM = $STR + $DATA\n...\ndjango.shortcuts.redirect(..., $INTERM, ...)\n"
            },
            {
              "pattern": "$A = django.shortcuts.redirect(..., request.$W.get(...), ...)"
            },
            {
              "pattern": "$A = django.shortcuts.redirect(..., $S.format(..., request.$W.get(...), ...), ...)"
            },
            {
              "pattern": "$A = django.shortcuts.redirect(..., $S % request.$W.get(...), ...)"
            },
            {
              "pattern": "$A = django.shortcuts.redirect(..., f\"...{request.$W.get(...)}...\", ...)"
            },
            {
              "pattern": "return django.shortcuts.redirect(..., request.$W.get(...), ...)"
            },
            {
              "pattern": "return django.shortcuts.redirect(..., $S.format(..., request.$W.get(...), ...), ...)"
            },
            {
              "pattern": "return django.shortcuts.redirect(..., $S % request.$W.get(...), ...)"
            },
            {
              "pattern": "return django.shortcuts.redirect(..., f\"...{request.$W.get(...)}...\", ...)"
            },
            {
              "pattern": "django.shortcuts.redirect(..., request.$W(...), ...)"
            },
            {
              "pattern": "django.shortcuts.redirect(..., $S.format(..., request.$W(...), ...), ...)"
            },
            {
              "pattern": "django.shortcuts.redirect(..., $S % request.$W(...), ...)"
            },
            {
              "pattern": "django.shortcuts.redirect(..., f\"...{request.$W(...)}...\", ...)"
            },
            {
              "pattern": "$DATA = request.$W(...)\n...\ndjango.shortcuts.redirect(..., $DATA, ...)\n"
            },
            {
              "pattern": "$DATA = request.$W(...)\n...\n$INTERM = $DATA\n...\ndjango.shortcuts.redirect(..., $INTERM, ...)\n"
            },
            {
              "pattern": "$DATA = request.$W(...)\n...\ndjango.shortcuts.redirect(..., $STR.format(..., $DATA, ...), ...)\n"
            },
            {
              "pattern": "$DATA = request.$W(...)\n...\n$INTERM = $STR.format(..., $DATA, ...)\n...\ndjango.shortcuts.redirect(..., $INTERM, ...)\n"
            },
            {
              "pattern": "$DATA = request.$W(...)\n...\ndjango.shortcuts.redirect(..., $STR % $DATA, ...)\n"
            },
            {
              "pattern": "$DATA = request.$W(...)\n...\n$INTERM = $STR % $DATA\n...\ndjango.shortcuts.redirect(..., $INTERM, ...)\n"
            },
            {
              "pattern": "$DATA = request.$W(...)\n...\ndjango.shortcuts.redirect(..., f\"...{$DATA}...\", ...)\n"
            },
            {
              "pattern": "$DATA = request.$W(...)\n...\n$INTERM = f\"...{$DATA}...\"\n...\ndjango.shortcuts.redirect(..., $INTERM, ...)\n"
            },
            {
              "pattern": "$DATA = request.$W(...)\n...\ndjango.shortcuts.redirect(..., $STR + $DATA, ...)\n"
            },
            {
              "pattern": "$DATA = request.$W(...)\n...\n$INTERM = $STR + $DATA\n...\ndjango.shortcuts.redirect(..., $INTERM, ...)\n"
            },
            {
              "pattern": "$A = django.shortcuts.redirect(..., request.$W(...), ...)"
            },
            {
              "pattern": "$A = django.shortcuts.redirect(..., $S.format(..., request.$W(...), ...), ...)"
            },
            {
              "pattern": "$A = django.shortcuts.redirect(..., $S % request.$W(...), ...)"
            },
            {
              "pattern": "$A = django.shortcuts.redirect(..., f\"...{request.$W(...)}...\", ...)"
            },
            {
              "pattern": "return django.shortcuts.redirect(..., request.$W(...), ...)"
            },
            {
              "pattern": "return django.shortcuts.redirect(..., $S.format(..., request.$W(...), ...), ...)"
            },
            {
              "pattern": "return django.shortcuts.redirect(..., $S % request.$W(...), ...)"
            },
            {
              "pattern": "return django.shortcuts.redirect(..., f\"...{request.$W(...)}...\", ...)"
            },
            {
              "pattern": "django.shortcuts.redirect(..., request.$W[...], ...)"
            },
            {
              "pattern": "django.shortcuts.redirect(..., $S.format(..., request.$W[...], ...), ...)"
            },
            {
              "pattern": "django.shortcuts.redirect(..., $S % request.$W[...], ...)"
            },
            {
              "pattern": "django.shortcuts.redirect(..., f\"...{request.$W[...]}...\", ...)"
            },
            {
              "pattern": "$DATA = request.$W[...]\n...\ndjango.shortcuts.redirect(..., $DATA, ...)\n"
            },
            {
              "pattern": "$DATA = request.$W[...]\n...\n$INTERM = $DATA\n...\ndjango.shortcuts.redirect(..., $INTERM, ...)\n"
            },
            {
              "pattern": "$DATA = request.$W[...]\n...\ndjango.shortcuts.redirect(..., $STR.format(..., $DATA, ...), ...)\n"
            },
            {
              "pattern": "$DATA = request.$W[...]\n...\n$INTERM = $STR.format(..., $DATA, ...)\n...\ndjango.shortcuts.redirect(..., $INTERM, ...)\n"
            },
            {
              "pattern": "$DATA = request.$W[...]\n...\ndjango.shortcuts.redirect(..., $STR % $DATA, ...)\n"
            },
            {
              "pattern": "$DATA = request.$W[...]\n...\n$INTERM = $STR % $DATA\n...\ndjango.shortcuts.redirect(..., $INTERM, ...)\n"
            },
            {
              "pattern": "$DATA = request.$W[...]\n...\ndjango.shortcuts.redirect(..., f\"...{$DATA}...\", ...)\n"
            },
            {
              "pattern": "$DATA = request.$W[...]\n...\n$INTERM = f\"...{$DATA}...\"\n...\ndjango.shortcuts.redirect(..., $INTERM, ...)\n"
            },
            {
              "pattern": "$DATA = request.$W[...]\n...\ndjango.shortcuts.redirect(..., $STR + $DATA, ...)\n"
            },
            {
              "pattern": "$DATA = request.$W[...]\n...\n$INTERM = $STR + $DATA\n...\ndjango.shortcuts.redirect(..., $INTERM, ...)\n"
            },
            {
              "pattern": "$A = django.shortcuts.redirect(..., request.$W[...], ...)"
            },
            {
              "pattern": "$A = django.shortcuts.redirect(..., $S.format(..., request.$W[...], ...), ...)"
            },
            {
              "pattern": "$A = django.shortcuts.redirect(..., $S % request.$W[...], ...)"
            },
            {
              "pattern": "$A = django.shortcuts.redirect(..., f\"...{request.$W[...]}...\", ...)"
            },
            {
              "pattern": "return django.shortcuts.redirect(..., request.$W[...], ...)"
            },
            {
              "pattern": "return django.shortcuts.redirect(..., $S.format(..., request.$W[...], ...), ...)"
            },
            {
              "pattern": "return django.shortcuts.redirect(..., $S % request.$W[...], ...)"
            },
            {
              "pattern": "return django.shortcuts.redirect(..., f\"...{request.$W[...]}...\", ...)"
            },
            {
              "pattern": "django.shortcuts.redirect(..., request.$W, ...)"
            },
            {
              "pattern": "django.shortcuts.redirect(..., $S.format(..., request.$W, ...), ...)"
            },
            {
              "pattern": "django.shortcuts.redirect(..., $S % request.$W, ...)"
            },
            {
              "pattern": "django.shortcuts.redirect(..., f\"...{request.$W}...\", ...)"
            },
            {
              "pattern": "$DATA = request.$W\n...\ndjango.shortcuts.redirect(..., $DATA, ...)\n"
            },
            {
              "pattern": "$DATA = request.$W\n...\n$INTERM = $DATA\n...\ndjango.shortcuts.redirect(..., $INTERM, ...)\n"
            },
            {
              "pattern": "$DATA = request.$W\n...\ndjango.shortcuts.redirect(..., $STR.format(..., $DATA, ...), ...)\n"
            },
            {
              "pattern": "$DATA = request.$W\n...\n$INTERM = $STR.format(..., $DATA, ...)\n...\ndjango.shortcuts.redirect(..., $INTERM, ...)\n"
            },
            {
              "pattern": "$DATA = request.$W\n...\ndjango.shortcuts.redirect(..., $STR % $DATA, ...)\n"
            },
            {
              "pattern": "$DATA = request.$W\n...\n$INTERM = $STR % $DATA\n...\ndjango.shortcuts.redirect(..., $INTERM, ...)\n"
            },
            {
              "pattern": "$DATA = request.$W\n...\ndjango.shortcuts.redirect(..., f\"...{$DATA}...\", ...)\n"
            },
            {
              "pattern": "$DATA = request.$W\n...\n$INTERM = f\"...{$DATA}...\"\n...\ndjango.shortcuts.redirect(..., $INTERM, ...)\n"
            },
            {
              "pattern": "$DATA = request.$W\n...\ndjango.shortcuts.redirect(..., $STR + $DATA, ...)\n"
            },
            {
              "pattern": "$DATA = request.$W\n...\n$INTERM = $STR + $DATA\n...\ndjango.shortcuts.redirect(..., $INTERM, ...)\n"
            },
            {
              "pattern": "$A = django.shortcuts.redirect(..., request.$W, ...)"
            },
            {
              "pattern": "$A = django.shortcuts.redirect(..., $S.format(..., request.$W, ...), ...)"
            },
            {
              "pattern": "$A = django.shortcuts.redirect(..., $S % request.$W, ...)"
            },
            {
              "pattern": "$A = django.shortcuts.redirect(..., f\"...{request.$W}...\", ...)"
            },
            {
              "pattern": "return django.shortcuts.redirect(..., request.$W, ...)"
            },
            {
              "pattern": "return django.shortcuts.redirect(..., $S.format(..., request.$W, ...), ...)"
            },
            {
              "pattern": "return django.shortcuts.redirect(..., $S % request.$W, ...)"
            },
            {
              "pattern": "return django.shortcuts.redirect(..., f\"...{request.$W}...\", ...)"
            },
            {
              "pattern": "django.http.HttpResponseRedirect(..., request.$W.get(...), ...)"
            },
            {
              "pattern": "django.http.HttpResponseRedirect(..., $S.format(..., request.$W.get(...), ...), ...)"
            },
            {
              "pattern": "django.http.HttpResponseRedirect(..., $S % request.$W.get(...), ...)"
            },
            {
              "pattern": "django.http.HttpResponseRedirect(..., f\"...{request.$W.get(...)}...\", ...)"
            },
            {
              "pattern": "$DATA = request.$W.get(...)\n...\ndjango.http.HttpResponseRedirect(..., $DATA, ...)\n"
            },
            {
              "pattern": "$DATA = request.$W.get(...)\n...\n$INTERM = $DATA\n...\ndjango.http.HttpResponseRedirect(..., $INTERM, ...)\n"
            },
            {
              "pattern": "$DATA = request.$W.get(...)\n...\ndjango.http.HttpResponseRedirect(..., $STR.format(..., $DATA, ...), ...)\n"
            },
            {
              "pattern": "$DATA = request.$W.get(...)\n...\n$INTERM = $STR.format(..., $DATA, ...)\n...\ndjango.http.HttpResponseRedirect(..., $INTERM, ...)\n"
            },
            {
              "pattern": "$DATA = request.$W.get(...)\n...\ndjango.http.HttpResponseRedirect(..., $STR % $DATA, ...)\n"
            },
            {
              "pattern": "$DATA = request.$W.get(...)\n...\n$INTERM = $STR % $DATA\n...\ndjango.http.HttpResponseRedirect(..., $INTERM, ...)\n"
            },
            {
              "pattern": "$DATA = request.$W.get(...)\n...\ndjango.http.HttpResponseRedirect(..., f\"...{$DATA}...\", ...)\n"
            },
            {
              "pattern": "$DATA = request.$W.get(...)\n...\n$INTERM = f\"...{$DATA}...\"\n...\ndjango.http.HttpResponseRedirect(..., $INTERM, ...)\n"
            },
            {
              "pattern": "$DATA = request.$W.get(...)\n...\ndjango.http.HttpResponseRedirect(..., $STR + $DATA, ...)\n"
            },
            {
              "pattern": "$DATA = request.$W.get(...)\n...\n$INTERM = $STR + $DATA\n...\ndjango.http.HttpResponseRedirect(..., $INTERM, ...)\n"
            },
            {
              "pattern": "$A = django.http.HttpResponseRedirect(..., request.$W.get(...), ...)"
            },
            {
              "pattern": "$A = django.http.HttpResponseRedirect(..., $S.format(..., request.$W.get(...), ...), ...)"
            },
            {
              "pattern": "$A = django.http.HttpResponseRedirect(..., $S % request.$W.get(...), ...)"
            },
            {
              "pattern": "$A = django.http.HttpResponseRedirect(..., f\"...{request.$W.get(...)}...\", ...)"
            },
            {
              "pattern": "return django.http.HttpResponseRedirect(..., request.$W.get(...), ...)"
            },
            {
              "pattern": "return django.http.HttpResponseRedirect(..., $S.format(..., request.$W.get(...), ...), ...)"
            },
            {
              "pattern": "return django.http.HttpResponseRedirect(..., $S % request.$W.get(...), ...)"
            },
            {
              "pattern": "return django.http.HttpResponseRedirect(..., f\"...{request.$W.get(...)}...\", ...)"
            },
            {
              "pattern": "django.http.HttpResponseRedirect(..., request.$W(...), ...)"
            },
            {
              "pattern": "django.http.HttpResponseRedirect(..., $S.format(..., request.$W(...), ...), ...)"
            },
            {
              "pattern": "django.http.HttpResponseRedirect(..., $S % request.$W(...), ...)"
            },
            {
              "pattern": "django.http.HttpResponseRedirect(..., f\"...{request.$W(...)}...\", ...)"
            },
            {
              "pattern": "$DATA = request.$W(...)\n...\ndjango.http.HttpResponseRedirect(..., $DATA, ...)\n"
            },
            {
              "pattern": "$DATA = request.$W(...)\n...\n$INTERM = $DATA\n...\ndjango.http.HttpResponseRedirect(..., $INTERM, ...)\n"
            },
            {
              "pattern": "$DATA = request.$W(...)\n...\ndjango.http.HttpResponseRedirect(..., $STR.format(..., $DATA, ...), ...)\n"
            },
            {
              "pattern": "$DATA = request.$W(...)\n...\n$INTERM = $STR.format(..., $DATA, ...)\n...\ndjango.http.HttpResponseRedirect(..., $INTERM, ...)\n"
            },
            {
              "pattern": "$DATA = request.$W(...)\n...\ndjango.http.HttpResponseRedirect(..., $STR % $DATA, ...)\n"
            },
            {
              "pattern": "$DATA = request.$W(...)\n...\n$INTERM = $STR % $DATA\n...\ndjango.http.HttpResponseRedirect(..., $INTERM, ...)\n"
            },
            {
              "pattern": "$DATA = request.$W(...)\n...\ndjango.http.HttpResponseRedirect(..., f\"...{$DATA}...\", ...)\n"
            },
            {
              "pattern": "$DATA = request.$W(...)\n...\n$INTERM = f\"...{$DATA}...\"\n...\ndjango.http.HttpResponseRedirect(..., $INTERM, ...)\n"
            },
            {
              "pattern": "$DATA = request.$W(...)\n...\ndjango.http.HttpResponseRedirect(..., $STR + $DATA, ...)\n"
            },
            {
              "pattern": "$DATA = request.$W(...)\n...\n$INTERM = $STR + $DATA\n...\ndjango.http.HttpResponseRedirect(..., $INTERM, ...)\n"
            },
            {
              "pattern": "$A = django.http.HttpResponseRedirect(..., request.$W(...), ...)"
            },
            {
              "pattern": "$A = django.http.HttpResponseRedirect(..., $S.format(..., request.$W(...), ...), ...)"
            },
            {
              "pattern": "$A = django.http.HttpResponseRedirect(..., $S % request.$W(...), ...)"
            },
            {
              "pattern": "$A = django.http.HttpResponseRedirect(..., f\"...{request.$W(...)}...\", ...)"
            },
            {
              "pattern": "return django.http.HttpResponseRedirect(..., request.$W(...), ...)"
            },
            {
              "pattern": "return django.http.HttpResponseRedirect(..., $S.format(..., request.$W(...), ...), ...)"
            },
            {
              "pattern": "return django.http.HttpResponseRedirect(..., $S % request.$W(...), ...)"
            },
            {
              "pattern": "return django.http.HttpResponseRedirect(..., f\"...{request.$W(...)}...\", ...)"
            },
            {
              "pattern": "django.http.HttpResponseRedirect(..., request.$W[...], ...)"
            },
            {
              "pattern": "django.http.HttpResponseRedirect(..., $S.format(..., request.$W[...], ...), ...)"
            },
            {
              "pattern": "django.http.HttpResponseRedirect(..., $S % request.$W[...], ...)"
            },
            {
              "pattern": "django.http.HttpResponseRedirect(..., f\"...{request.$W[...]}...\", ...)"
            },
            {
              "pattern": "$DATA = request.$W[...]\n...\ndjango.http.HttpResponseRedirect(..., $DATA, ...)\n"
            },
            {
              "pattern": "$DATA = request.$W[...]\n...\n$INTERM = $DATA\n...\ndjango.http.HttpResponseRedirect(..., $INTERM, ...)\n"
            },
            {
              "pattern": "$DATA = request.$W[...]\n...\ndjango.http.HttpResponseRedirect(..., $STR.format(..., $DATA, ...), ...)\n"
            },
            {
              "pattern": "$DATA = request.$W[...]\n...\n$INTERM = $STR.format(..., $DATA, ...)\n...\ndjango.http.HttpResponseRedirect(..., $INTERM, ...)\n"
            },
            {
              "pattern": "$DATA = request.$W[...]\n...\ndjango.http.HttpResponseRedirect(..., $STR % $DATA, ...)\n"
            },
            {
              "pattern": "$DATA = request.$W[...]\n...\n$INTERM = $STR % $DATA\n...\ndjango.http.HttpResponseRedirect(..., $INTERM, ...)\n"
            },
            {
              "pattern": "$DATA = request.$W[...]\n...\ndjango.http.HttpResponseRedirect(..., f\"...{$DATA}...\", ...)\n"
            },
            {
              "pattern": "$DATA = request.$W[...]\n...\n$INTERM = f\"...{$DATA}...\"\n...\ndjango.http.HttpResponseRedirect(..., $INTERM, ...)\n"
            },
            {
              "pattern": "$DATA = request.$W[...]\n...\ndjango.http.HttpResponseRedirect(..., $STR + $DATA, ...)\n"
            },
            {
              "pattern": "$DATA = request.$W[...]\n...\n$INTERM = $STR + $DATA\n...\ndjango.http.HttpResponseRedirect(..., $INTERM, ...)\n"
            },
            {
              "pattern": "$A = django.http.HttpResponseRedirect(..., request.$W[...], ...)"
            },
            {
              "pattern": "$A = django.http.HttpResponseRedirect(..., $S.format(..., request.$W[...], ...), ...)"
            },
            {
              "pattern": "$A = django.http.HttpResponseRedirect(..., $S % request.$W[...], ...)"
            },
            {
              "pattern": "$A = django.http.HttpResponseRedirect(..., f\"...{request.$W[...]}...\", ...)"
            },
            {
              "pattern": "return django.http.HttpResponseRedirect(..., request.$W[...], ...)"
            },
            {
              "pattern": "return django.http.HttpResponseRedirect(..., $S.format(..., request.$W[...], ...), ...)"
            },
            {
              "pattern": "return django.http.HttpResponseRedirect(..., $S % request.$W[...], ...)"
            },
            {
              "pattern": "return django.http.HttpResponseRedirect(..., f\"...{request.$W[...]}...\", ...)"
            },
            {
              "pattern": "django.http.HttpResponseRedirect(..., request.$W, ...)"
            },
            {
              "pattern": "django.http.HttpResponseRedirect(..., $S.format(..., request.$W, ...), ...)"
            },
            {
              "pattern": "django.http.HttpResponseRedirect(..., $S % request.$W, ...)"
            },
            {
              "pattern": "django.http.HttpResponseRedirect(..., f\"...{request.$W}...\", ...)"
            },
            {
              "pattern": "$DATA = request.$W\n...\ndjango.http.HttpResponseRedirect(..., $DATA, ...)\n"
            },
            {
              "pattern": "$DATA = request.$W\n...\n$INTERM = $DATA\n...\ndjango.http.HttpResponseRedirect(..., $INTERM, ...)\n"
            },
            {
              "pattern": "$DATA = request.$W\n...\ndjango.http.HttpResponseRedirect(..., $STR.format(..., $DATA, ...), ...)\n"
            },
            {
              "pattern": "$DATA = request.$W\n...\n$INTERM = $STR.format(..., $DATA, ...)\n...\ndjango.http.HttpResponseRedirect(..., $INTERM, ...)\n"
            },
            {
              "pattern": "$DATA = request.$W\n...\ndjango.http.HttpResponseRedirect(..., $STR % $DATA, ...)\n"
            },
            {
              "pattern": "$DATA = request.$W\n...\n$INTERM = $STR % $DATA\n...\ndjango.http.HttpResponseRedirect(..., $INTERM, ...)\n"
            },
            {
              "pattern": "$DATA = request.$W\n...\ndjango.http.HttpResponseRedirect(..., f\"...{$DATA}...\", ...)\n"
            },
            {
              "pattern": "$DATA = request.$W\n...\n$INTERM = f\"...{$DATA}...\"\n...\ndjango.http.HttpResponseRedirect(..., $INTERM, ...)\n"
            },
            {
              "pattern": "$DATA = request.$W\n...\ndjango.http.HttpResponseRedirect(..., $STR + $DATA, ...)\n"
            },
            {
              "pattern": "$DATA = request.$W\n...\n$INTERM = $STR + $DATA\n...\ndjango.http.HttpResponseRedirect(..., $INTERM, ...)\n"
            },
            {
              "pattern": "$A = django.http.HttpResponseRedirect(..., request.$W, ...)"
            },
            {
              "pattern": "$A = django.http.HttpResponseRedirect(..., $S.format(..., request.$W, ...), ...)"
            },
            {
              "pattern": "$A = django.http.HttpResponseRedirect(..., $S % request.$W, ...)"
            },
            {
              "pattern": "$A = django.http.HttpResponseRedirect(..., f\"...{request.$W}...\", ...)"
            },
            {
              "pattern": "return django.http.HttpResponseRedirect(..., request.$W, ...)"
            },
            {
              "pattern": "return django.http.HttpResponseRedirect(..., $S.format(..., request.$W, ...), ...)"
            },
            {
              "pattern": "return django.http.HttpResponseRedirect(..., $S % request.$W, ...)"
            },
            {
              "pattern": "return django.http.HttpResponseRedirect(..., f\"...{request.$W}...\", ...)"
            }
          ]
        },
        {
          "metavariable-regex": {
            "metavariable": "$W",
            "regex": "(?!get_full_path)"
          }
        }
      ]
    },
    {
      "id": "python.django.security.injection.reflected-data-httpresponse.reflected-data-httpresponse",
      "message": "Found user-controlled request data passed into HttpResponse. This could be vulnerable to XSS, leading to attackers gaining access to user cookies and protected information. Ensure that the request data is properly escaped or sanitzed.",
      "metadata": {
        "cwe": [
          "CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')"
        ],
        "owasp": [
          "A07:2017 - Cross-Site Scripting (XSS)",
          "A03:2021 - Injection",
          "A05:2025 - Injection"
        ],
        "references": [
          "https://django-book.readthedocs.io/en/latest/chapter20.html#cross-site-scripting-xss"
        ],
        "category": "security",
        "technology": [
          "django"
        ],
        "cwe2022-top25": true,
        "cwe2021-top25": true,
        "subcategory": [
          "vuln"
        ],
        "likelihood": "MEDIUM",
        "impact": "MEDIUM",
        "confidence": "MEDIUM",
        "license": "Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license",
        "vulnerability_class": [
          "Cross-Site-Scripting (XSS)"
        ],
        "source": "https://semgrep.dev/r/python.django.security.injection.reflected-data-httpresponse.reflected-data-httpresponse",
        "shortlink": "https://sg.run/BkvA",
        "semgrep.dev": {
          "rule": {
            "r_id": 9495,
            "rv_id": 1263398,
            "rule_id": "JDUydR",
            "version_id": "GxTke5K",
            "url": "https://semgrep.dev/playground/r/GxTke5K/python.django.security.injection.reflected-data-httpresponse.reflected-data-httpresponse",
            "origin": "community"
          }
        }
      },
      "languages": [
        "python"
      ],
      "severity": "WARNING",
      "patterns": [
        {
          "pattern-inside": "def $FUNC(...):\n  ...\n"
        },
        {
          "pattern-either": [
            {
              "pattern": "django.http.HttpResponse(..., $S.format(..., request.$W.get(...), ...), ...)"
            },
            {
              "pattern": "django.http.HttpResponse(..., $S % request.$W.get(...), ...)"
            },
            {
              "pattern": "django.http.HttpResponse(..., f\"...{request.$W.get(...)}...\", ...)"
            },
            {
              "pattern": "django.http.HttpResponse(..., request.$W.get(...), ...)"
            },
            {
              "pattern": "$DATA = request.$W.get(...)\n...\ndjango.http.HttpResponse(..., $DATA, ...)\n"
            },
            {
              "pattern": "$DATA = request.$W.get(...)\n...\n$INTERM = $DATA\n...\ndjango.http.HttpResponse(..., $INTERM, ...)\n"
            },
            {
              "pattern": "$DATA = request.$W.get(...)\n...\ndjango.http.HttpResponse(..., $STR.format(..., $DATA, ...), ...)\n"
            },
            {
              "pattern": "$DATA = request.$W.get(...)\n...\n$INTERM = $STR.format(..., $DATA, ...)\n...\ndjango.http.HttpResponse(..., $INTERM, ...)\n"
            },
            {
              "pattern": "$DATA = request.$W.get(...)\n...\ndjango.http.HttpResponse(..., $STR % $DATA, ...)\n"
            },
            {
              "pattern": "$DATA = request.$W.get(...)\n...\n$INTERM = $STR % $DATA\n...\ndjango.http.HttpResponse(..., $INTERM, ...)\n"
            },
            {
              "pattern": "$DATA = request.$W.get(...)\n...\ndjango.http.HttpResponse(..., f\"...{$DATA}...\", ...)\n"
            },
            {
              "pattern": "$DATA = request.$W.get(...)\n...\n$INTERM = f\"...{$DATA}...\"\n...\ndjango.http.HttpResponse(..., $INTERM, ...)\n"
            },
            {
              "pattern": "$DATA = request.$W.get(...)\n...\ndjango.http.HttpResponse(..., $STR + $DATA, ...)\n"
            },
            {
              "pattern": "$DATA = request.$W.get(...)\n...\n$INTERM = $STR + $DATA\n...\ndjango.http.HttpResponse(..., $INTERM, ...)\n"
            },
            {
              "pattern": "$A = django.http.HttpResponse(..., request.$W.get(...), ...)"
            },
            {
              "pattern": "return django.http.HttpResponse(..., request.$W.get(...), ...)"
            },
            {
              "pattern": "django.http.HttpResponse(..., $S.format(..., request.$W(...), ...), ...)"
            },
            {
              "pattern": "django.http.HttpResponse(..., $S % request.$W(...), ...)"
            },
            {
              "pattern": "django.http.HttpResponse(..., f\"...{request.$W(...)}...\", ...)"
            },
            {
              "pattern": "django.http.HttpResponse(..., request.$W(...), ...)"
            },
            {
              "pattern": "$DATA = request.$W(...)\n...\ndjango.http.HttpResponse(..., $DATA, ...)\n"
            },
            {
              "pattern": "$DATA = request.$W(...)\n...\n$INTERM = $DATA\n...\ndjango.http.HttpResponse(..., $INTERM, ...)\n"
            },
            {
              "pattern": "$DATA = request.$W(...)\n...\ndjango.http.HttpResponse(..., $STR.format(..., $DATA, ...), ...)\n"
            },
            {
              "pattern": "$DATA = request.$W(...)\n...\n$INTERM = $STR.format(..., $DATA, ...)\n...\ndjango.http.HttpResponse(..., $INTERM, ...)\n"
            },
            {
              "pattern": "$DATA = request.$W(...)\n...\ndjango.http.HttpResponse(..., $STR % $DATA, ...)\n"
            },
            {
              "pattern": "$DATA = request.$W(...)\n...\n$INTERM = $STR % $DATA\n...\ndjango.http.HttpResponse(..., $INTERM, ...)\n"
            },
            {
              "pattern": "$DATA = request.$W(...)\n...\ndjango.http.HttpResponse(..., f\"...{$DATA}...\", ...)\n"
            },
            {
              "pattern": "$DATA = request.$W(...)\n...\n$INTERM = f\"...{$DATA}...\"\n...\ndjango.http.HttpResponse(..., $INTERM, ...)\n"
            },
            {
              "pattern": "$DATA = request.$W(...)\n...\ndjango.http.HttpResponse(..., $STR + $DATA, ...)\n"
            },
            {
              "pattern": "$DATA = request.$W(...)\n...\n$INTERM = $STR + $DATA\n...\ndjango.http.HttpResponse(..., $INTERM, ...)\n"
            },
            {
              "pattern": "$A = django.http.HttpResponse(..., request.$W(...), ...)"
            },
            {
              "pattern": "return django.http.HttpResponse(..., request.$W(...), ...)"
            },
            {
              "pattern": "django.http.HttpResponse(..., $S.format(..., request.$W[...], ...), ...)"
            },
            {
              "pattern": "django.http.HttpResponse(..., $S % request.$W[...], ...)"
            },
            {
              "pattern": "django.http.HttpResponse(..., f\"...{request.$W[...]}...\", ...)"
            },
            {
              "pattern": "django.http.HttpResponse(..., request.$W[...], ...)"
            },
            {
              "pattern": "$DATA = request.$W[...]\n...\ndjango.http.HttpResponse(..., $DATA, ...)\n"
            },
            {
              "pattern": "$DATA = request.$W[...]\n...\n$INTERM = $DATA\n...\ndjango.http.HttpResponse(..., $INTERM, ...)\n"
            },
            {
              "pattern": "$DATA = request.$W[...]\n...\ndjango.http.HttpResponse(..., $STR.format(..., $DATA, ...), ...)\n"
            },
            {
              "pattern": "$DATA = request.$W[...]\n...\n$INTERM = $STR.format(..., $DATA, ...)\n...\ndjango.http.HttpResponse(..., $INTERM, ...)\n"
            },
            {
              "pattern": "$DATA = request.$W[...]\n...\ndjango.http.HttpResponse(..., $STR % $DATA, ...)\n"
            },
            {
              "pattern": "$DATA = request.$W[...]\n...\n$INTERM = $STR % $DATA\n...\ndjango.http.HttpResponse(..., $INTERM, ...)\n"
            },
            {
              "pattern": "$DATA = request.$W[...]\n...\ndjango.http.HttpResponse(..., f\"...{$DATA}...\", ...)\n"
            },
            {
              "pattern": "$DATA = request.$W[...]\n...\n$INTERM = f\"...{$DATA}...\"\n...\ndjango.http.HttpResponse(..., $INTERM, ...)\n"
            },
            {
              "pattern": "$DATA = request.$W[...]\n...\ndjango.http.HttpResponse(..., $STR + $DATA, ...)\n"
            },
            {
              "pattern": "$DATA = request.$W[...]\n...\n$INTERM = $STR + $DATA\n...\ndjango.http.HttpResponse(..., $INTERM, ...)\n"
            },
            {
              "pattern": "$A = django.http.HttpResponse(..., request.$W[...], ...)"
            },
            {
              "pattern": "return django.http.HttpResponse(..., request.$W[...], ...)"
            },
            {
              "pattern": "django.http.HttpResponse(..., $S.format(..., request.$W, ...), ...)"
            },
            {
              "pattern": "django.http.HttpResponse(..., $S % request.$W, ...)"
            },
            {
              "pattern": "django.http.HttpResponse(..., f\"...{request.$W}...\", ...)"
            },
            {
              "pattern": "django.http.HttpResponse(..., request.$W, ...)"
            },
            {
              "pattern": "$DATA = request.$W\n...\ndjango.http.HttpResponse(..., $DATA, ...)\n"
            },
            {
              "pattern": "$DATA = request.$W\n...\n$INTERM = $DATA\n...\ndjango.http.HttpResponse(..., $INTERM, ...)\n"
            },
            {
              "pattern": "$DATA = request.$W\n...\ndjango.http.HttpResponse(..., $STR.format(..., $DATA, ...), ...)\n"
            },
            {
              "pattern": "$DATA = request.$W\n...\n$INTERM = $STR.format(..., $DATA, ...)\n...\ndjango.http.HttpResponse(..., $INTERM, ...)\n"
            },
            {
              "pattern": "$DATA = request.$W\n...\ndjango.http.HttpResponse(..., $STR % $DATA, ...)\n"
            },
            {
              "pattern": "$DATA = request.$W\n...\n$INTERM = $STR % $DATA\n...\ndjango.http.HttpResponse(..., $INTERM, ...)\n"
            },
            {
              "pattern": "$DATA = request.$W\n...\ndjango.http.HttpResponse(..., f\"...{$DATA}...\", ...)\n"
            },
            {
              "pattern": "$A = django.http.HttpResponse(..., request.$W, ...)"
            },
            {
              "pattern": "$DATA = request.$W\n...\n$INTERM = $STR + $DATA\n...\n$A = django.http.HttpResponse(..., $INTERM, ...)\n"
            },
            {
              "pattern": "return django.http.HttpResponse(..., request.$W, ...)"
            },
            {
              "pattern": "$DATA = request.$W\n...\n$INTERM = f\"...{$DATA}...\"\n...\ndjango.http.HttpResponse(..., $INTERM, ...)\n"
            },
            {
              "pattern": "$DATA = request.$W\n...\ndjango.http.HttpResponse(..., $STR + $DATA, ...)\n"
            },
            {
              "pattern": "$DATA = request.$W\n...\n$INTERM = $STR + $DATA\n...\ndjango.http.HttpResponse(..., $INTERM, ...)\n"
            }
          ]
        }
      ]
    },
    {
      "id": "python.django.security.injection.reflected-data-httpresponsebadrequest.reflected-data-httpresponsebadrequest",
      "message": "Found user-controlled request data passed into a HttpResponseBadRequest. This could be vulnerable to XSS, leading to attackers gaining access to user cookies and protected information. Ensure that the request data is properly escaped or sanitzed.",
      "metadata": {
        "cwe": [
          "CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')"
        ],
        "owasp": [
          "A07:2017 - Cross-Site Scripting (XSS)",
          "A03:2021 - Injection",
          "A05:2025 - Injection"
        ],
        "references": [
          "https://django-book.readthedocs.io/en/latest/chapter20.html#cross-site-scripting-xss"
        ],
        "category": "security",
        "technology": [
          "django"
        ],
        "cwe2022-top25": true,
        "cwe2021-top25": true,
        "subcategory": [
          "vuln"
        ],
        "likelihood": "LOW",
        "impact": "MEDIUM",
        "confidence": "MEDIUM",
        "license": "Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license",
        "vulnerability_class": [
          "Cross-Site-Scripting (XSS)"
        ],
        "source": "https://semgrep.dev/r/python.django.security.injection.reflected-data-httpresponsebadrequest.reflected-data-httpresponsebadrequest",
        "shortlink": "https://sg.run/DoZP",
        "semgrep.dev": {
          "rule": {
            "r_id": 9496,
            "rv_id": 1263399,
            "rule_id": "5rUOX1",
            "version_id": "RGT0LY6",
            "url": "https://semgrep.dev/playground/r/RGT0LY6/python.django.security.injection.reflected-data-httpresponsebadrequest.reflected-data-httpresponsebadrequest",
            "origin": "community"
          }
        }
      },
      "languages": [
        "python"
      ],
      "severity": "WARNING",
      "patterns": [
        {
          "pattern-inside": "def $FUNC(...):\n  ...\n"
        },
        {
          "pattern-either": [
            {
              "pattern": "django.http.HttpResponseBadRequest(..., $S.format(..., request.$W.get(...), ...), ...)"
            },
            {
              "pattern": "django.http.HttpResponseBadRequest(..., $S % request.$W.get(...), ...)"
            },
            {
              "pattern": "django.http.HttpResponseBadRequest(..., f\"...{request.$W.get(...)}...\", ...)"
            },
            {
              "pattern": "django.http.HttpResponseBadRequest(..., request.$W.get(...), ...)"
            },
            {
              "pattern": "$DATA = request.$W.get(...)\n...\ndjango.http.HttpResponseBadRequest(..., $DATA, ...)\n"
            },
            {
              "pattern": "$DATA = request.$W.get(...)\n...\n$INTERM = $DATA\n...\ndjango.http.HttpResponseBadRequest(..., $INTERM, ...)\n"
            },
            {
              "pattern": "$DATA = request.$W.get(...)\n...\ndjango.http.HttpResponseBadRequest(..., $STR.format(..., $DATA, ...), ...)\n"
            },
            {
              "pattern": "$DATA = request.$W.get(...)\n...\n$INTERM = $STR.format(..., $DATA, ...)\n...\ndjango.http.HttpResponseBadRequest(..., $INTERM, ...)\n"
            },
            {
              "pattern": "$DATA = request.$W.get(...)\n...\ndjango.http.HttpResponseBadRequest(..., $STR % $DATA, ...)\n"
            },
            {
              "pattern": "$DATA = request.$W.get(...)\n...\n$INTERM = $STR % $DATA\n...\ndjango.http.HttpResponseBadRequest(..., $INTERM, ...)\n"
            },
            {
              "pattern": "$DATA = request.$W.get(...)\n...\ndjango.http.HttpResponseBadRequest(..., f\"...{$DATA}...\", ...)\n"
            },
            {
              "pattern": "$DATA = request.$W.get(...)\n...\n$INTERM = f\"...{$DATA}...\"\n...\ndjango.http.HttpResponseBadRequest(..., $INTERM, ...)\n"
            },
            {
              "pattern": "$DATA = request.$W.get(...)\n...\ndjango.http.HttpResponseBadRequest(..., $STR + $DATA, ...)\n"
            },
            {
              "pattern": "$DATA = request.$W.get(...)\n...\n$INTERM = $STR + $DATA\n...\ndjango.http.HttpResponseBadRequest(..., $INTERM, ...)\n"
            },
            {
              "pattern": "$A = django.http.HttpResponseBadRequest(..., request.$W.get(...), ...)"
            },
            {
              "pattern": "return django.http.HttpResponseBadRequest(..., request.$W.get(...), ...)"
            },
            {
              "pattern": "django.http.HttpResponseBadRequest(..., $S.format(..., request.$W(...), ...), ...)"
            },
            {
              "pattern": "django.http.HttpResponseBadRequest(..., $S % request.$W(...), ...)"
            },
            {
              "pattern": "django.http.HttpResponseBadRequest(..., f\"...{request.$W(...)}...\", ...)"
            },
            {
              "pattern": "django.http.HttpResponseBadRequest(..., request.$W(...), ...)"
            },
            {
              "pattern": "$DATA = request.$W(...)\n...\ndjango.http.HttpResponseBadRequest(..., $DATA, ...)\n"
            },
            {
              "pattern": "$DATA = request.$W(...)\n...\n$INTERM = $DATA\n...\ndjango.http.HttpResponseBadRequest(..., $INTERM, ...)\n"
            },
            {
              "pattern": "$DATA = request.$W(...)\n...\ndjango.http.HttpResponseBadRequest(..., $STR.format(..., $DATA, ...), ...)\n"
            },
            {
              "pattern": "$DATA = request.$W(...)\n...\n$INTERM = $STR.format(..., $DATA, ...)\n...\ndjango.http.HttpResponseBadRequest(..., $INTERM, ...)\n"
            },
            {
              "pattern": "$DATA = request.$W(...)\n...\ndjango.http.HttpResponseBadRequest(..., $STR % $DATA, ...)\n"
            },
            {
              "pattern": "$DATA = request.$W(...)\n...\n$INTERM = $STR % $DATA\n...\ndjango.http.HttpResponseBadRequest(..., $INTERM, ...)\n"
            },
            {
              "pattern": "$DATA = request.$W(...)\n...\ndjango.http.HttpResponseBadRequest(..., f\"...{$DATA}...\", ...)\n"
            },
            {
              "pattern": "$DATA = request.$W(...)\n...\n$INTERM = f\"...{$DATA}...\"\n...\ndjango.http.HttpResponseBadRequest(..., $INTERM, ...)\n"
            },
            {
              "pattern": "$DATA = request.$W(...)\n...\ndjango.http.HttpResponseBadRequest(..., $STR + $DATA, ...)\n"
            },
            {
              "pattern": "$DATA = request.$W(...)\n...\n$INTERM = $STR + $DATA\n...\ndjango.http.HttpResponseBadRequest(..., $INTERM, ...)\n"
            },
            {
              "pattern": "$A = django.http.HttpResponseBadRequest(..., request.$W(...), ...)"
            },
            {
              "pattern": "return django.http.HttpResponseBadRequest(..., request.$W(...), ...)"
            },
            {
              "pattern": "django.http.HttpResponseBadRequest(..., $S.format(..., request.$W[...], ...), ...)"
            },
            {
              "pattern": "django.http.HttpResponseBadRequest(..., $S % request.$W[...], ...)"
            },
            {
              "pattern": "django.http.HttpResponseBadRequest(..., f\"...{request.$W[...]}...\", ...)"
            },
            {
              "pattern": "django.http.HttpResponseBadRequest(..., request.$W[...], ...)"
            },
            {
              "pattern": "$DATA = request.$W[...]\n...\ndjango.http.HttpResponseBadRequest(..., $DATA, ...)\n"
            },
            {
              "pattern": "$DATA = request.$W[...]\n...\n$INTERM = $DATA\n...\ndjango.http.HttpResponseBadRequest(..., $INTERM, ...)\n"
            },
            {
              "pattern": "$DATA = request.$W[...]\n...\ndjango.http.HttpResponseBadRequest(..., $STR.format(..., $DATA, ...), ...)\n"
            },
            {
              "pattern": "$DATA = request.$W[...]\n...\n$INTERM = $STR.format(..., $DATA, ...)\n...\ndjango.http.HttpResponseBadRequest(..., $INTERM, ...)\n"
            },
            {
              "pattern": "$DATA = request.$W[...]\n...\ndjango.http.HttpResponseBadRequest(..., $STR % $DATA, ...)\n"
            },
            {
              "pattern": "$DATA = request.$W[...]\n...\n$INTERM = $STR % $DATA\n...\ndjango.http.HttpResponseBadRequest(..., $INTERM, ...)\n"
            },
            {
              "pattern": "$DATA = request.$W[...]\n...\ndjango.http.HttpResponseBadRequest(..., f\"...{$DATA}...\", ...)\n"
            },
            {
              "pattern": "$DATA = request.$W[...]\n...\n$INTERM = f\"...{$DATA}...\"\n...\ndjango.http.HttpResponseBadRequest(..., $INTERM, ...)\n"
            },
            {
              "pattern": "$DATA = request.$W[...]\n...\ndjango.http.HttpResponseBadRequest(..., $STR + $DATA, ...)\n"
            },
            {
              "pattern": "$DATA = request.$W[...]\n...\n$INTERM = $STR + $DATA\n...\ndjango.http.HttpResponseBadRequest(..., $INTERM, ...)\n"
            },
            {
              "pattern": "$A = django.http.HttpResponseBadRequest(..., request.$W[...], ...)"
            },
            {
              "pattern": "return django.http.HttpResponseBadRequest(..., request.$W[...], ...)"
            },
            {
              "pattern": "django.http.HttpResponseBadRequest(..., $S.format(..., request.$W, ...), ...)"
            },
            {
              "pattern": "django.http.HttpResponseBadRequest(..., $S % request.$W, ...)"
            },
            {
              "pattern": "django.http.HttpResponseBadRequest(..., f\"...{request.$W}...\", ...)"
            },
            {
              "pattern": "django.http.HttpResponseBadRequest(..., request.$W, ...)"
            },
            {
              "pattern": "$DATA = request.$W\n...\ndjango.http.HttpResponseBadRequest(..., $DATA, ...)\n"
            },
            {
              "pattern": "$DATA = request.$W\n...\n$INTERM = $DATA\n...\ndjango.http.HttpResponseBadRequest(..., $INTERM, ...)\n"
            },
            {
              "pattern": "$DATA = request.$W\n...\ndjango.http.HttpResponseBadRequest(..., $STR.format(..., $DATA, ...), ...)\n"
            },
            {
              "pattern": "$DATA = request.$W\n...\n$INTERM = $STR.format(..., $DATA, ...)\n...\ndjango.http.HttpResponseBadRequest(..., $INTERM, ...)\n"
            },
            {
              "pattern": "$DATA = request.$W\n...\ndjango.http.HttpResponseBadRequest(..., $STR % $DATA, ...)\n"
            },
            {
              "pattern": "$DATA = request.$W\n...\n$INTERM = $STR % $DATA\n...\ndjango.http.HttpResponseBadRequest(..., $INTERM, ...)\n"
            },
            {
              "pattern": "$DATA = request.$W\n...\ndjango.http.HttpResponseBadRequest(..., f\"...{$DATA}...\", ...)\n"
            },
            {
              "pattern": "$DATA = request.$W\n...\n$INTERM = f\"...{$DATA}...\"\n...\ndjango.http.HttpResponseBadRequest(..., $INTERM, ...)\n"
            },
            {
              "pattern": "$DATA = request.$W\n...\ndjango.http.HttpResponseBadRequest(..., $STR + $DATA, ...)\n"
            },
            {
              "pattern": "$DATA = request.$W\n...\n$INTERM = $STR + $DATA\n...\ndjango.http.HttpResponseBadRequest(..., $INTERM, ...)\n"
            },
            {
              "pattern": "$A = django.http.HttpResponseBadRequest(..., request.$W, ...)"
            },
            {
              "pattern": "return django.http.HttpResponseBadRequest(..., request.$W, ...)"
            }
          ]
        }
      ]
    },
    {
      "id": "python.django.security.injection.request-data-fileresponse.request-data-fileresponse",
      "message": "Found user-controlled request data being passed into a file open, which is them passed as an argument into the FileResponse. This is dangerous because an attacker could specify an arbitrary file to read, which could result in leaking important data. Be sure to validate or sanitize the user-inputted filename in the request data before using it in FileResponse.",
      "metadata": {
        "cwe": [
          "CWE-22: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')"
        ],
        "owasp": [
          "A05:2017 - Broken Access Control",
          "A01:2021 - Broken Access Control",
          "A01:2025 - Broken Access Control"
        ],
        "references": [
          "https://django-book.readthedocs.io/en/latest/chapter20.html#cross-site-scripting-xss"
        ],
        "category": "security",
        "technology": [
          "django"
        ],
        "cwe2022-top25": true,
        "cwe2021-top25": true,
        "subcategory": [
          "vuln"
        ],
        "likelihood": "LOW",
        "impact": "MEDIUM",
        "confidence": "MEDIUM",
        "license": "Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license",
        "vulnerability_class": [
          "Path Traversal"
        ],
        "source": "https://semgrep.dev/r/python.django.security.injection.request-data-fileresponse.request-data-fileresponse",
        "shortlink": "https://sg.run/W862",
        "semgrep.dev": {
          "rule": {
            "r_id": 9497,
            "rv_id": 1263400,
            "rule_id": "GdU7QR",
            "version_id": "A8Tgd1K",
            "url": "https://semgrep.dev/playground/r/A8Tgd1K/python.django.security.injection.request-data-fileresponse.request-data-fileresponse",
            "origin": "community"
          }
        }
      },
      "languages": [
        "python"
      ],
      "severity": "WARNING",
      "patterns": [
        {
          "pattern-inside": "def $FUNC(...):\n  ...\n"
        },
        {
          "pattern-either": [
            {
              "pattern": "django.http.FileResponse(..., request.$W.get(...), ...)"
            },
            {
              "pattern": "$DATA = request.$W.get(...)\n...\ndjango.http.FileResponse(..., open($DATA, ...), ...)\n"
            },
            {
              "pattern": "$DATA = request.$W.get(...)\n...\n$INTERM = open($DATA, ...)\n...\ndjango.http.FileResponse(..., $INTERM, ...)\n"
            },
            {
              "pattern": "$A = django.http.FileResponse(..., request.$W.get(...), ...)"
            },
            {
              "pattern": "return django.http.FileResponse(..., request.$W.get(...), ...)"
            },
            {
              "pattern": "django.http.FileResponse(..., request.$W(...), ...)"
            },
            {
              "pattern": "$DATA = request.$W(...)\n...\ndjango.http.FileResponse(..., open($DATA, ...), ...)\n"
            },
            {
              "pattern": "$DATA = request.$W(...)\n...\n$INTERM = open($DATA, ...)\n...\ndjango.http.FileResponse(..., $INTERM, ...)\n"
            },
            {
              "pattern": "$A = django.http.FileResponse(..., request.$W(...), ...)"
            },
            {
              "pattern": "return django.http.FileResponse(..., request.$W(...), ...)"
            },
            {
              "pattern": "django.http.FileResponse(..., request.$W[...], ...)"
            },
            {
              "pattern": "$DATA = request.$W[...]\n...\ndjango.http.FileResponse(..., open($DATA, ...), ...)\n"
            },
            {
              "pattern": "$DATA = request.$W[...]\n...\n$INTERM = open($DATA, ...)\n...\ndjango.http.FileResponse(..., $INTERM, ...)\n"
            },
            {
              "pattern": "$A = django.http.FileResponse(..., request.$W[...], ...)"
            },
            {
              "pattern": "return django.http.FileResponse(..., request.$W[...], ...)"
            },
            {
              "pattern": "django.http.FileResponse(..., request.$W, ...)"
            },
            {
              "pattern": "$DATA = request.$W\n...\ndjango.http.FileResponse(..., open($DATA, ...), ...)\n"
            },
            {
              "pattern": "$DATA = request.$W\n...\n$INTERM = open($DATA, ...)\n...\ndjango.http.FileResponse(..., $INTERM, ...)\n"
            },
            {
              "pattern": "$A = django.http.FileResponse(..., request.$W, ...)"
            },
            {
              "pattern": "return django.http.FileResponse(..., request.$W, ...)"
            }
          ]
        }
      ]
    },
    {
      "id": "python.django.security.injection.request-data-write.request-data-write",
      "message": "Found user-controlled request data passed into '.write(...)'. This could be dangerous if a malicious actor is able to control data into sensitive files. For example, a malicious actor could force rolling of critical log files, or cause a denial-of-service by using up available disk space. Instead, ensure that request data is properly escaped or sanitized.",
      "metadata": {
        "cwe": [
          "CWE-93: Improper Neutralization of CRLF Sequences ('CRLF Injection')"
        ],
        "owasp": [
          "A03:2021 - Injection",
          "A05:2025 - Injection"
        ],
        "category": "security",
        "technology": [
          "django"
        ],
        "references": [
          "https://owasp.org/Top10/A03_2021-Injection"
        ],
        "subcategory": [
          "vuln"
        ],
        "likelihood": "MEDIUM",
        "impact": "MEDIUM",
        "confidence": "MEDIUM",
        "license": "Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license",
        "vulnerability_class": [
          "Improper Validation"
        ],
        "source": "https://semgrep.dev/r/python.django.security.injection.request-data-write.request-data-write",
        "shortlink": "https://sg.run/0Q6j",
        "semgrep.dev": {
          "rule": {
            "r_id": 9498,
            "rv_id": 1263401,
            "rule_id": "ReUg5z",
            "version_id": "BjTkZO5",
            "url": "https://semgrep.dev/playground/r/BjTkZO5/python.django.security.injection.request-data-write.request-data-write",
            "origin": "community"
          }
        }
      },
      "languages": [
        "python"
      ],
      "severity": "WARNING",
      "pattern-either": [
        {
          "pattern": "$F.write(..., request.$W.get(...), ...)"
        },
        {
          "pattern": "$DATA = request.$W.get(...)\n...\n$F.write(..., $DATA, ...)\n"
        },
        {
          "pattern": "$DATA = request.$W.get(...)\n...\n$INTERM = $DATA\n...\n$F.write(..., $INTERM, ...)\n"
        },
        {
          "pattern": "$DATA = request.$W.get(...)\n...\n$F.write(..., $B.$C(..., $DATA, ...), ...)\n"
        },
        {
          "pattern": "$DATA = request.$W.get(...)\n...\n$INTERM = $B.$C(..., $DATA, ...)\n...\n$F.write(..., $INTERM, ...)\n"
        },
        {
          "pattern": "$DATA = request.$W.get(...)\n...\n$F.write(..., $STR % $DATA, ...)\n"
        },
        {
          "pattern": "$DATA = request.$W.get(...)\n...\n$INTERM = $STR % $DATA\n...\n$F.write(..., $INTERM, ...)\n"
        },
        {
          "pattern": "$DATA = request.$W.get(...)\n...\n$F.write(..., f\"...{$DATA}...\", ...)\n"
        },
        {
          "pattern": "$DATA = request.$W.get(...)\n...\n$INTERM = f\"...{$DATA}...\"\n...\n$F.write(..., $INTERM, ...)\n"
        },
        {
          "pattern": "$A = $F.write(..., request.$W.get(...), ...)"
        },
        {
          "pattern": "return $F.write(..., request.$W.get(...), ...)"
        },
        {
          "pattern": "$F.write(..., request.$W(...), ...)"
        },
        {
          "pattern": "$DATA = request.$W(...)\n...\n$F.write(..., $DATA, ...)\n"
        },
        {
          "pattern": "$DATA = request.$W(...)\n...\n$INTERM = $DATA\n...\n$F.write(..., $INTERM, ...)\n"
        },
        {
          "pattern": "$DATA = request.$W(...)\n...\n$F.write(..., $B.$C(..., $DATA, ...), ...)\n"
        },
        {
          "pattern": "$DATA = request.$W(...)\n...\n$INTERM = $B.$C(..., $DATA, ...)\n...\n$F.write(..., $INTERM, ...)\n"
        },
        {
          "pattern": "$DATA = request.$W(...)\n...\n$F.write(..., $STR % $DATA, ...)\n"
        },
        {
          "pattern": "$DATA = request.$W(...)\n...\n$INTERM = $STR % $DATA\n...\n$F.write(..., $INTERM, ...)\n"
        },
        {
          "pattern": "$DATA = request.$W(...)\n...\n$F.write(..., f\"...{$DATA}...\", ...)\n"
        },
        {
          "pattern": "$DATA = request.$W(...)\n...\n$INTERM = f\"...{$DATA}...\"\n...\n$F.write(..., $INTERM, ...)\n"
        },
        {
          "pattern": "$A = $F.write(..., request.$W(...), ...)"
        },
        {
          "pattern": "return $F.write(..., request.$W(...), ...)"
        },
        {
          "pattern": "$F.write(..., request.$W[...], ...)"
        },
        {
          "pattern": "$DATA = request.$W[...]\n...\n$F.write(..., $DATA, ...)\n"
        },
        {
          "pattern": "$DATA = request.$W[...]\n...\n$INTERM = $DATA\n...\n$F.write(..., $INTERM, ...)\n"
        },
        {
          "pattern": "$DATA = request.$W[...]\n...\n$F.write(..., $B.$C(..., $DATA, ...), ...)\n"
        },
        {
          "pattern": "$DATA = request.$W[...]\n...\n$INTERM = $B.$C(..., $DATA, ...)\n...\n$F.write(..., $INTERM, ...)\n"
        },
        {
          "pattern": "$DATA = request.$W[...]\n...\n$F.write(..., $STR % $DATA, ...)\n"
        },
        {
          "pattern": "$DATA = request.$W[...]\n...\n$INTERM = $STR % $DATA\n...\n$F.write(..., $INTERM, ...)\n"
        },
        {
          "pattern": "$DATA = request.$W[...]\n...\n$F.write(..., f\"...{$DATA}...\", ...)\n"
        },
        {
          "pattern": "$DATA = request.$W[...]\n...\n$INTERM = f\"...{$DATA}...\"\n...\n$F.write(..., $INTERM, ...)\n"
        },
        {
          "pattern": "$A = $F.write(..., request.$W[...], ...)"
        },
        {
          "pattern": "return $F.write(..., request.$W[...], ...)"
        },
        {
          "pattern": "$F.write(..., request.$W, ...)"
        },
        {
          "pattern": "$DATA = request.$W\n...\n$F.write(..., $DATA, ...)\n"
        },
        {
          "pattern": "$DATA = request.$W\n...\n$INTERM = $DATA\n...\n$F.write(..., $INTERM, ...)\n"
        },
        {
          "pattern": "$DATA = request.$W\n...\n$F.write(..., $B.$C(..., $DATA, ...), ...)\n"
        },
        {
          "pattern": "$DATA = request.$W\n...\n$INTERM = $B.$C(..., $DATA, ...)\n...\n$F.write(..., $INTERM, ...)\n"
        },
        {
          "pattern": "$DATA = request.$W\n...\n$F.write(..., $STR % $DATA, ...)\n"
        },
        {
          "pattern": "$DATA = request.$W\n...\n$INTERM = $STR % $DATA\n...\n$F.write(..., $INTERM, ...)\n"
        },
        {
          "pattern": "$DATA = request.$W\n...\n$F.write(..., f\"...{$DATA}...\", ...)\n"
        },
        {
          "pattern": "$DATA = request.$W\n...\n$INTERM = f\"...{$DATA}...\"\n...\n$F.write(..., $INTERM, ...)\n"
        },
        {
          "pattern": "$A = $F.write(..., request.$W, ...)"
        },
        {
          "pattern": "return $F.write(..., request.$W, ...)"
        }
      ]
    },
    {
      "id": "python.django.security.injection.code.user-eval-format-string.user-eval-format-string",
      "message": "Found user data in a call to 'eval'. This is extremely dangerous because it can enable an attacker to execute remote code. See https://owasp.org/www-community/attacks/Code_Injection for more information.",
      "metadata": {
        "cwe": [
          "CWE-95: Improper Neutralization of Directives in Dynamically Evaluated Code ('Eval Injection')"
        ],
        "owasp": [
          "A03:2021 - Injection",
          "A05:2025 - Injection"
        ],
        "references": [
          "https://nedbatchelder.com/blog/201206/eval_really_is_dangerous.html"
        ],
        "category": "security",
        "technology": [
          "django"
        ],
        "subcategory": [
          "vuln"
        ],
        "likelihood": "MEDIUM",
        "impact": "HIGH",
        "confidence": "MEDIUM",
        "license": "Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license",
        "vulnerability_class": [
          "Code Injection"
        ],
        "source": "https://semgrep.dev/r/python.django.security.injection.code.user-eval-format-string.user-eval-format-string",
        "shortlink": "https://sg.run/4x2z",
        "semgrep.dev": {
          "rule": {
            "r_id": 9500,
            "rv_id": 1263383,
            "rule_id": "BYUNw9",
            "version_id": "vdT06xG",
            "url": "https://semgrep.dev/playground/r/vdT06xG/python.django.security.injection.code.user-eval-format-string.user-eval-format-string",
            "origin": "community"
          }
        }
      },
      "patterns": [
        {
          "pattern-inside": "def $F(...):\n  ...\n"
        },
        {
          "pattern-either": [
            {
              "pattern": "eval(..., $STR % request.$W.get(...), ...)"
            },
            {
              "pattern": "$V = request.$W.get(...)\n...\neval(..., $STR % $V, ...)\n"
            },
            {
              "pattern": "$V = request.$W.get(...)\n...\n$S = $STR % $V\n...\neval(..., $S, ...)\n"
            },
            {
              "pattern": "eval(..., \"...\" % request.$W(...), ...)"
            },
            {
              "pattern": "$V = request.$W(...)\n...\neval(..., $STR % $V, ...)\n"
            },
            {
              "pattern": "$V = request.$W(...)\n...\n$S = $STR % $V\n...\neval(..., $S, ...)\n"
            },
            {
              "pattern": "eval(..., $STR % request.$W[...], ...)"
            },
            {
              "pattern": "$V = request.$W[...]\n...\neval(..., $STR % $V, ...)\n"
            },
            {
              "pattern": "$V = request.$W[...]\n...\n$S = $STR % $V\n...\neval(..., $S, ...)\n"
            },
            {
              "pattern": "eval(..., $STR.format(..., request.$W.get(...), ...), ...)"
            },
            {
              "pattern": "$V = request.$W.get(...)\n...\neval(..., $STR.format(..., $V, ...), ...)\n"
            },
            {
              "pattern": "$V = request.$W.get(...)\n...\n$S = $STR.format(..., $V, ...)\n...\neval(..., $S, ...)\n"
            },
            {
              "pattern": "eval(..., $STR.format(..., request.$W(...), ...), ...)"
            },
            {
              "pattern": "$V = request.$W(...)\n...\neval(..., $STR.format(..., $V, ...), ...)\n"
            },
            {
              "pattern": "$V = request.$W(...)\n...\n$S = $STR.format(..., $V, ...)\n...\neval(..., $S, ...)\n"
            },
            {
              "pattern": "eval(..., $STR.format(..., request.$W[...], ...), ...)"
            },
            {
              "pattern": "$V = request.$W[...]\n...\neval(..., $STR.format(..., $V, ...), ...)\n"
            },
            {
              "pattern": "$V = request.$W[...]\n...\n$S = $STR.format(..., $V, ...)\n...\neval(..., $S, ...)\n"
            },
            {
              "pattern": "$V = request.$W.get(...)\n...\neval(..., f\"...{$V}...\", ...)\n"
            },
            {
              "pattern": "$V = request.$W.get(...)\n...\n$S = f\"...{$V}...\"\n...\neval(..., $S, ...)\n"
            },
            {
              "pattern": "$V = request.$W(...)\n...\neval(..., f\"...{$V}...\", ...)\n"
            },
            {
              "pattern": "$V = request.$W(...)\n...\n$S = f\"...{$V}...\"\n...\neval(..., $S, ...)\n"
            },
            {
              "pattern": "$V = request.$W[...]\n...\neval(..., f\"...{$V}...\", ...)\n"
            },
            {
              "pattern": "$V = request.$W[...]\n...\n$S = f\"...{$V}...\"\n...\neval(..., $S, ...)\n"
            }
          ]
        }
      ],
      "languages": [
        "python"
      ],
      "severity": "WARNING"
    },
    {
      "id": "python.django.security.injection.code.user-eval.user-eval",
      "message": "Found user data in a call to 'eval'. This is extremely dangerous because it can enable an attacker to execute arbitrary remote code on the system. Instead, refactor your code to not use 'eval' and instead use a safe library for the specific functionality you need.",
      "metadata": {
        "cwe": [
          "CWE-95: Improper Neutralization of Directives in Dynamically Evaluated Code ('Eval Injection')"
        ],
        "owasp": [
          "A03:2021 - Injection",
          "A05:2025 - Injection"
        ],
        "references": [
          "https://nedbatchelder.com/blog/201206/eval_really_is_dangerous.html",
          "https://owasp.org/www-community/attacks/Code_Injection"
        ],
        "category": "security",
        "technology": [
          "django"
        ],
        "subcategory": [
          "vuln"
        ],
        "likelihood": "MEDIUM",
        "impact": "HIGH",
        "confidence": "MEDIUM",
        "license": "Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license",
        "vulnerability_class": [
          "Code Injection"
        ],
        "source": "https://semgrep.dev/r/python.django.security.injection.code.user-eval.user-eval",
        "shortlink": "https://sg.run/PJDW",
        "semgrep.dev": {
          "rule": {
            "r_id": 9501,
            "rv_id": 1263384,
            "rule_id": "DbUpDQ",
            "version_id": "d6Tyx2A",
            "url": "https://semgrep.dev/playground/r/d6Tyx2A/python.django.security.injection.code.user-eval.user-eval",
            "origin": "community"
          }
        }
      },
      "patterns": [
        {
          "pattern-inside": "def $F(...):\n  ...\n"
        },
        {
          "pattern-either": [
            {
              "pattern": "eval(..., request.$W.get(...), ...)"
            },
            {
              "pattern": "$V = request.$W.get(...)\n...\neval(..., $V, ...)\n"
            },
            {
              "pattern": "eval(..., request.$W(...), ...)"
            },
            {
              "pattern": "$V = request.$W(...)\n...\neval(..., $V, ...)\n"
            },
            {
              "pattern": "eval(..., request.$W[...], ...)"
            },
            {
              "pattern": "$V = request.$W[...]\n...\neval(..., $V, ...)\n"
            }
          ]
        }
      ],
      "languages": [
        "python"
      ],
      "severity": "WARNING"
    },
    {
      "id": "python.django.security.injection.code.user-exec-format-string.user-exec-format-string",
      "message": "Found user data in a call to 'exec'. This is extremely dangerous because it can enable an attacker to execute arbitrary remote code on the system. Instead, refactor your code to not use 'eval' and instead use a safe library for the specific functionality you need.",
      "metadata": {
        "cwe": [
          "CWE-95: Improper Neutralization of Directives in Dynamically Evaluated Code ('Eval Injection')"
        ],
        "owasp": [
          "A03:2021 - Injection",
          "A05:2025 - Injection"
        ],
        "category": "security",
        "technology": [
          "django"
        ],
        "references": [
          "https://owasp.org/www-community/attacks/Code_Injection"
        ],
        "subcategory": [
          "vuln"
        ],
        "likelihood": "MEDIUM",
        "impact": "HIGH",
        "confidence": "MEDIUM",
        "license": "Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license",
        "vulnerability_class": [
          "Code Injection"
        ],
        "source": "https://semgrep.dev/r/python.django.security.injection.code.user-exec-format-string.user-exec-format-string",
        "shortlink": "https://sg.run/J9JW",
        "semgrep.dev": {
          "rule": {
            "r_id": 9502,
            "rv_id": 1263385,
            "rule_id": "WAUovx",
            "version_id": "ZRTKA1p",
            "url": "https://semgrep.dev/playground/r/ZRTKA1p/python.django.security.injection.code.user-exec-format-string.user-exec-format-string",
            "origin": "community"
          }
        }
      },
      "patterns": [
        {
          "pattern-inside": "def $F(...):\n  ...\n"
        },
        {
          "pattern-either": [
            {
              "pattern": "exec(..., $STR % request.$W.get(...), ...)"
            },
            {
              "pattern": "$V = request.$W.get(...)\n...\nexec(..., $STR % $V, ...)\n"
            },
            {
              "pattern": "$V = request.$W.get(...)\n...\n$S = $STR % $V\n...\nexec(..., $S, ...)\n"
            },
            {
              "pattern": "exec(..., \"...\" % request.$W(...), ...)"
            },
            {
              "pattern": "$V = request.$W(...)\n...\nexec(..., $STR % $V, ...)\n"
            },
            {
              "pattern": "$V = request.$W(...)\n...\n$S = $STR % $V\n...\nexec(..., $S, ...)\n"
            },
            {
              "pattern": "exec(..., $STR % request.$W[...], ...)"
            },
            {
              "pattern": "$V = request.$W[...]\n...\nexec(..., $STR % $V, ...)\n"
            },
            {
              "pattern": "$V = request.$W[...]\n...\n$S = $STR % $V\n...\nexec(..., $S, ...)\n"
            },
            {
              "pattern": "exec(..., $STR.format(..., request.$W.get(...), ...), ...)"
            },
            {
              "pattern": "$V = request.$W.get(...)\n...\nexec(..., $STR.format(..., $V, ...), ...)\n"
            },
            {
              "pattern": "$V = request.$W.get(...)\n...\n$S = $STR.format(..., $V, ...)\n...\nexec(..., $S, ...)\n"
            },
            {
              "pattern": "exec(..., $STR.format(..., request.$W(...), ...), ...)"
            },
            {
              "pattern": "$V = request.$W(...)\n...\nexec(..., $STR.format(..., $V, ...), ...)\n"
            },
            {
              "pattern": "$V = request.$W(...)\n...\n$S = $STR.format(..., $V, ...)\n...\nexec(..., $S, ...)\n"
            },
            {
              "pattern": "exec(..., $STR.format(..., request.$W[...], ...), ...)"
            },
            {
              "pattern": "$V = request.$W[...]\n...\nexec(..., $STR.format(..., $V, ...), ...)\n"
            },
            {
              "pattern": "$V = request.$W[...]\n...\n$S = $STR.format(..., $V, ...)\n...\nexec(..., $S, ...)\n"
            },
            {
              "pattern": "$V = request.$W.get(...)\n...\nexec(..., f\"...{$V}...\", ...)\n"
            },
            {
              "pattern": "$V = request.$W.get(...)\n...\n$S = f\"...{$V}...\"\n...\nexec(..., $S, ...)\n"
            },
            {
              "pattern": "$V = request.$W(...)\n...\nexec(..., f\"...{$V}...\", ...)\n"
            },
            {
              "pattern": "$V = request.$W(...)\n...\n$S = f\"...{$V}...\"\n...\nexec(..., $S, ...)\n"
            },
            {
              "pattern": "$V = request.$W[...]\n...\nexec(..., f\"...{$V}...\", ...)\n"
            },
            {
              "pattern": "$V = request.$W[...]\n...\n$S = f\"...{$V}...\"\n...\nexec(..., $S, ...)\n"
            },
            {
              "pattern": "exec(..., base64.decodestring($S.format(..., request.$W.get(...), ...), ...), ...)"
            },
            {
              "pattern": "exec(..., base64.decodestring($S % request.$W.get(...), ...), ...)"
            },
            {
              "pattern": "exec(..., base64.decodestring(f\"...{request.$W.get(...)}...\", ...), ...)"
            },
            {
              "pattern": "exec(..., base64.decodestring(request.$W.get(...), ...), ...)"
            },
            {
              "pattern": "exec(..., base64.decodestring(bytes($S.format(..., request.$W.get(...), ...), ...), ...), ...)"
            },
            {
              "pattern": "exec(..., base64.decodestring(bytes($S % request.$W.get(...), ...), ...), ...)"
            },
            {
              "pattern": "exec(..., base64.decodestring(bytes(f\"...{request.$W.get(...)}...\", ...), ...), ...)"
            },
            {
              "pattern": "exec(..., base64.decodestring(bytes(request.$W.get(...), ...), ...), ...)"
            },
            {
              "pattern": "$DATA = request.$W.get(...)\n...\nexec(..., base64.decodestring($DATA, ...), ...)\n"
            },
            {
              "pattern": "$DATA = request.$W.get(...)\n...\n$INTERM = base64.decodestring($DATA, ...)\n...\nexec(..., $INTERM, ...)\n"
            },
            {
              "pattern": "$DATA = request.$W.get(...)\n...\nexec(..., base64.decodestring(bytes($DATA, ...), ...), ...)\n"
            },
            {
              "pattern": "$DATA = request.$W.get(...)\n...\n$INTERM = base64.decodestring(bytes($DATA, ...), ...)\n...\nexec(..., $INTERM, ...)\n"
            },
            {
              "pattern": "$DATA = request.$W(...)\n...\nexec(..., base64.decodestring($DATA, ...), ...)\n"
            },
            {
              "pattern": "$DATA = request.$W(...)\n...\n$INTERM = base64.decodestring($DATA, ...)\n...\nexec(..., $INTERM, ...)\n"
            },
            {
              "pattern": "$DATA = request.$W(...)\n...\nexec(..., base64.decodestring(bytes($DATA, ...), ...), ...)\n"
            },
            {
              "pattern": "$DATA = request.$W(...)\n...\n$INTERM = base64.decodestring(bytes($DATA, ...), ...)\n...\nexec(..., $INTERM, ...)\n"
            },
            {
              "pattern": "$DATA = request.$W[...]\n...\nexec(..., base64.decodestring($DATA, ...), ...)\n"
            },
            {
              "pattern": "$DATA = request.$W[...]\n...\n$INTERM = base64.decodestring($DATA, ...)\n...\nexec(..., $INTERM, ...)\n"
            },
            {
              "pattern": "$DATA = request.$W[...]\n...\nexec(..., base64.decodestring(bytes($DATA, ...), ...), ...)\n"
            },
            {
              "pattern": "$DATA = request.$W[...]\n...\n$INTERM = base64.decodestring(bytes($DATA, ...), ...)\n...\nexec(..., $INTERM, ...)\n"
            },
            {
              "pattern": "$DATA = request.$W\n...\nexec(..., base64.decodestring($DATA, ...), ...)\n"
            },
            {
              "pattern": "$DATA = request.$W\n...\n$INTERM = base64.decodestring($DATA, ...)\n...\nexec(..., $INTERM, ...)\n"
            },
            {
              "pattern": "$DATA = request.$W\n...\nexec(..., base64.decodestring(bytes($DATA, ...), ...), ...)\n"
            },
            {
              "pattern": "$DATA = request.$W\n...\n$INTERM = base64.decodestring(bytes($DATA, ...), ...)\n...\nexec(..., $INTERM, ...)\n"
            }
          ]
        }
      ],
      "languages": [
        "python"
      ],
      "severity": "WARNING"
    },
    {
      "id": "python.django.security.injection.code.user-exec.user-exec",
      "message": "Found user data in a call to 'exec'. This is extremely dangerous because it can enable an attacker to execute arbitrary remote code on the system. Instead, refactor your code to not use 'eval' and instead use a safe library for the specific functionality you need.",
      "metadata": {
        "cwe": [
          "CWE-95: Improper Neutralization of Directives in Dynamically Evaluated Code ('Eval Injection')"
        ],
        "owasp": [
          "A03:2021 - Injection",
          "A05:2025 - Injection"
        ],
        "category": "security",
        "technology": [
          "django"
        ],
        "references": [
          "https://owasp.org/www-community/attacks/Code_Injection"
        ],
        "subcategory": [
          "vuln"
        ],
        "likelihood": "MEDIUM",
        "impact": "HIGH",
        "confidence": "MEDIUM",
        "license": "Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license",
        "vulnerability_class": [
          "Code Injection"
        ],
        "source": "https://semgrep.dev/r/python.django.security.injection.code.user-exec.user-exec",
        "shortlink": "https://sg.run/5Q3X",
        "semgrep.dev": {
          "rule": {
            "r_id": 9503,
            "rv_id": 1263386,
            "rule_id": "0oU5AW",
            "version_id": "nWT2LA2",
            "url": "https://semgrep.dev/playground/r/nWT2LA2/python.django.security.injection.code.user-exec.user-exec",
            "origin": "community"
          }
        }
      },
      "patterns": [
        {
          "pattern-inside": "def $F(...):\n  ...\n"
        },
        {
          "pattern-either": [
            {
              "pattern": "exec(..., request.$W.get(...), ...)"
            },
            {
              "pattern": "$V = request.$W.get(...)\n...\nexec(..., $V, ...)\n"
            },
            {
              "pattern": "exec(..., request.$W(...), ...)"
            },
            {
              "pattern": "$V = request.$W(...)\n...\nexec(..., $V, ...)\n"
            },
            {
              "pattern": "exec(..., request.$W[...], ...)"
            },
            {
              "pattern": "$V = request.$W[...]\n...\nexec(..., $V, ...)\n"
            },
            {
              "pattern": "loop = asyncio.get_running_loop()\n...\nawait loop.run_in_executor(None, exec, request.$W[...])\n"
            },
            {
              "pattern": "$V = request.$W[...]\n...\nloop = asyncio.get_running_loop()\n...\nawait loop.run_in_executor(None, exec, $V)\n"
            },
            {
              "pattern": "loop = asyncio.get_running_loop()\n...\nawait loop.run_in_executor(None, exec, request.$W.get(...))\n"
            },
            {
              "pattern": "$V = request.$W.get(...)\n...\nloop = asyncio.get_running_loop()\n...\nawait loop.run_in_executor(None, exec, $V)\n"
            }
          ]
        }
      ],
      "languages": [
        "python"
      ],
      "severity": "WARNING"
    },
    {
      "id": "python.django.security.injection.command.command-injection-os-system.command-injection-os-system",
      "message": "Request data detected in os.system. This could be vulnerable to a command injection and should be avoided. If this must be done, use the 'subprocess' module instead and pass the arguments as a list. See https://owasp.org/www-community/attacks/Command_Injection for more information.",
      "metadata": {
        "cwe": [
          "CWE-78: Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')"
        ],
        "owasp": [
          "A01:2017 - Injection",
          "A03:2021 - Injection",
          "A05:2025 - Injection"
        ],
        "references": [
          "https://owasp.org/www-community/attacks/Command_Injection"
        ],
        "category": "security",
        "technology": [
          "django"
        ],
        "cwe2022-top25": true,
        "cwe2021-top25": true,
        "subcategory": [
          "vuln"
        ],
        "likelihood": "MEDIUM",
        "impact": "HIGH",
        "confidence": "MEDIUM",
        "license": "Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license",
        "vulnerability_class": [
          "Command Injection"
        ],
        "source": "https://semgrep.dev/r/python.django.security.injection.command.command-injection-os-system.command-injection-os-system",
        "shortlink": "https://sg.run/Gen2",
        "semgrep.dev": {
          "rule": {
            "r_id": 9504,
            "rv_id": 1263387,
            "rule_id": "KxUbp2",
            "version_id": "ExTExPo",
            "url": "https://semgrep.dev/playground/r/ExTExPo/python.django.security.injection.command.command-injection-os-system.command-injection-os-system",
            "origin": "community"
          }
        }
      },
      "languages": [
        "python"
      ],
      "severity": "ERROR",
      "patterns": [
        {
          "pattern-inside": "def $FUNC(...):\n  ...\n"
        },
        {
          "pattern-either": [
            {
              "pattern": "os.system(..., request.$W.get(...), ...)"
            },
            {
              "pattern": "os.system(..., $S.format(..., request.$W.get(...), ...), ...)"
            },
            {
              "pattern": "os.system(..., $S % request.$W.get(...), ...)"
            },
            {
              "pattern": "os.system(..., f\"...{request.$W.get(...)}...\", ...)"
            },
            {
              "pattern": "$DATA = request.$W.get(...)\n...\nos.system(..., $DATA, ...)\n"
            },
            {
              "pattern": "$DATA = request.$W.get(...)\n...\n$INTERM = $DATA\n...\nos.system(..., $INTERM, ...)\n"
            },
            {
              "pattern": "$DATA = request.$W.get(...)\n...\nos.system(..., $STR.format(..., $DATA, ...), ...)\n"
            },
            {
              "pattern": "$DATA = request.$W.get(...)\n...\n$INTERM = $STR.format(..., $DATA, ...)\n...\nos.system(..., $INTERM, ...)\n"
            },
            {
              "pattern": "$DATA = request.$W.get(...)\n...\nos.system(..., $STR % $DATA, ...)\n"
            },
            {
              "pattern": "$DATA = request.$W.get(...)\n...\n$INTERM = $STR % $DATA\n...\nos.system(..., $INTERM, ...)\n"
            },
            {
              "pattern": "$DATA = request.$W.get(...)\n...\nos.system(..., f\"...{$DATA}...\", ...)\n"
            },
            {
              "pattern": "$DATA = request.$W.get(...)\n...\n$INTERM = f\"...{$DATA}...\"\n...\nos.system(..., $INTERM, ...)\n"
            },
            {
              "pattern": "$DATA = request.$W.get(...)\n...\nos.system(..., $STR + $DATA, ...)\n"
            },
            {
              "pattern": "$DATA = request.$W.get(...)\n...\n$INTERM = $STR + $DATA\n...\nos.system(..., $INTERM, ...)\n"
            },
            {
              "pattern": "$A = os.system(..., request.$W.get(...), ...)"
            },
            {
              "pattern": "$A = os.system(..., $S.format(..., request.$W.get(...), ...), ...)"
            },
            {
              "pattern": "$A = os.system(..., $S % request.$W.get(...), ...)"
            },
            {
              "pattern": "$A = os.system(..., f\"...{request.$W.get(...)}...\", ...)"
            },
            {
              "pattern": "return os.system(..., request.$W.get(...), ...)"
            },
            {
              "pattern": "return os.system(..., $S.format(..., request.$W.get(...), ...), ...)"
            },
            {
              "pattern": "return os.system(..., $S % request.$W.get(...), ...)"
            },
            {
              "pattern": "return os.system(..., f\"...{request.$W.get(...)}...\", ...)"
            },
            {
              "pattern": "os.system(..., request.$W(...), ...)"
            },
            {
              "pattern": "os.system(..., $S.format(..., request.$W(...), ...), ...)"
            },
            {
              "pattern": "os.system(..., $S % request.$W(...), ...)"
            },
            {
              "pattern": "os.system(..., f\"...{request.$W(...)}...\", ...)"
            },
            {
              "pattern": "$DATA = request.$W(...)\n...\nos.system(..., $DATA, ...)\n"
            },
            {
              "pattern": "$DATA = request.$W(...)\n...\n$INTERM = $DATA\n...\nos.system(..., $INTERM, ...)\n"
            },
            {
              "pattern": "$DATA = request.$W(...)\n...\nos.system(..., $STR.format(..., $DATA, ...), ...)\n"
            },
            {
              "pattern": "$DATA = request.$W(...)\n...\n$INTERM = $STR.format(..., $DATA, ...)\n...\nos.system(..., $INTERM, ...)\n"
            },
            {
              "pattern": "$DATA = request.$W(...)\n...\nos.system(..., $STR % $DATA, ...)\n"
            },
            {
              "pattern": "$DATA = request.$W(...)\n...\n$INTERM = $STR % $DATA\n...\nos.system(..., $INTERM, ...)\n"
            },
            {
              "pattern": "$DATA = request.$W(...)\n...\nos.system(..., f\"...{$DATA}...\", ...)\n"
            },
            {
              "pattern": "$DATA = request.$W(...)\n...\n$INTERM = f\"...{$DATA}...\"\n...\nos.system(..., $INTERM, ...)\n"
            },
            {
              "pattern": "$DATA = request.$W(...)\n...\nos.system(..., $STR + $DATA, ...)\n"
            },
            {
              "pattern": "$DATA = request.$W(...)\n...\n$INTERM = $STR + $DATA\n...\nos.system(..., $INTERM, ...)\n"
            },
            {
              "pattern": "$A = os.system(..., request.$W(...), ...)"
            },
            {
              "pattern": "$A = os.system(..., $S.format(..., request.$W(...), ...), ...)"
            },
            {
              "pattern": "$A = os.system(..., $S % request.$W(...), ...)"
            },
            {
              "pattern": "$A = os.system(..., f\"...{request.$W(...)}...\", ...)"
            },
            {
              "pattern": "return os.system(..., request.$W(...), ...)"
            },
            {
              "pattern": "return os.system(..., $S.format(..., request.$W(...), ...), ...)"
            },
            {
              "pattern": "return os.system(..., $S % request.$W(...), ...)"
            },
            {
              "pattern": "return os.system(..., f\"...{request.$W(...)}...\", ...)"
            },
            {
              "pattern": "os.system(..., request.$W[...], ...)"
            },
            {
              "pattern": "os.system(..., $S.format(..., request.$W[...], ...), ...)"
            },
            {
              "pattern": "os.system(..., $S % request.$W[...], ...)"
            },
            {
              "pattern": "os.system(..., f\"...{request.$W[...]}...\", ...)"
            },
            {
              "pattern": "$DATA = request.$W[...]\n...\nos.system(..., $DATA, ...)\n"
            },
            {
              "pattern": "$DATA = request.$W[...]\n...\n$INTERM = $DATA\n...\nos.system(..., $INTERM, ...)\n"
            },
            {
              "pattern": "$DATA = request.$W[...]\n...\nos.system(..., $STR.format(..., $DATA, ...), ...)\n"
            },
            {
              "pattern": "$DATA = request.$W[...]\n...\n$INTERM = $STR.format(..., $DATA, ...)\n...\nos.system(..., $INTERM, ...)\n"
            },
            {
              "pattern": "$DATA = request.$W[...]\n...\nos.system(..., $STR % $DATA, ...)\n"
            },
            {
              "pattern": "$DATA = request.$W[...]\n...\n$INTERM = $STR % $DATA\n...\nos.system(..., $INTERM, ...)\n"
            },
            {
              "pattern": "$DATA = request.$W[...]\n...\nos.system(..., f\"...{$DATA}...\", ...)\n"
            },
            {
              "pattern": "$DATA = request.$W[...]\n...\n$INTERM = f\"...{$DATA}...\"\n...\nos.system(..., $INTERM, ...)\n"
            },
            {
              "pattern": "$DATA = request.$W[...]\n...\nos.system(..., $STR + $DATA, ...)\n"
            },
            {
              "pattern": "$DATA = request.$W[...]\n...\n$INTERM = $STR + $DATA\n...\nos.system(..., $INTERM, ...)\n"
            },
            {
              "pattern": "$A = os.system(..., request.$W[...], ...)"
            },
            {
              "pattern": "$A = os.system(..., $S.format(..., request.$W[...], ...), ...)"
            },
            {
              "pattern": "$A = os.system(..., $S % request.$W[...], ...)"
            },
            {
              "pattern": "$A = os.system(..., f\"...{request.$W[...]}...\", ...)"
            },
            {
              "pattern": "return os.system(..., request.$W[...], ...)"
            },
            {
              "pattern": "return os.system(..., $S.format(..., request.$W[...], ...), ...)"
            },
            {
              "pattern": "return os.system(..., $S % request.$W[...], ...)"
            },
            {
              "pattern": "return os.system(..., f\"...{request.$W[...]}...\", ...)"
            },
            {
              "pattern": "os.system(..., request.$W, ...)"
            },
            {
              "pattern": "os.system(..., $S.format(..., request.$W, ...), ...)"
            },
            {
              "pattern": "os.system(..., $S % request.$W, ...)"
            },
            {
              "pattern": "os.system(..., f\"...{request.$W}...\", ...)"
            },
            {
              "pattern": "$DATA = request.$W\n...\nos.system(..., $DATA, ...)\n"
            },
            {
              "pattern": "$DATA = request.$W\n...\n$INTERM = $DATA\n...\nos.system(..., $INTERM, ...)\n"
            },
            {
              "pattern": "$DATA = request.$W\n...\nos.system(..., $STR.format(..., $DATA, ...), ...)\n"
            },
            {
              "pattern": "$DATA = request.$W\n...\n$INTERM = $STR.format(..., $DATA, ...)\n...\nos.system(..., $INTERM, ...)\n"
            },
            {
              "pattern": "$DATA = request.$W\n...\nos.system(..., $STR % $DATA, ...)\n"
            },
            {
              "pattern": "$DATA = request.$W\n...\n$INTERM = $STR % $DATA\n...\nos.system(..., $INTERM, ...)\n"
            },
            {
              "pattern": "$DATA = request.$W\n...\nos.system(..., f\"...{$DATA}...\", ...)\n"
            },
            {
              "pattern": "$DATA = request.$W\n...\n$INTERM = f\"...{$DATA}...\"\n...\nos.system(..., $INTERM, ...)\n"
            },
            {
              "pattern": "$DATA = request.$W\n...\nos.system(..., $STR + $DATA, ...)\n"
            },
            {
              "pattern": "$DATA = request.$W\n...\n$INTERM = $STR + $DATA\n...\nos.system(..., $INTERM, ...)\n"
            },
            {
              "pattern": "$A = os.system(..., request.$W, ...)"
            },
            {
              "pattern": "$A = os.system(..., $S.format(..., request.$W, ...), ...)"
            },
            {
              "pattern": "$A = os.system(..., $S % request.$W, ...)"
            },
            {
              "pattern": "$A = os.system(..., f\"...{request.$W}...\", ...)"
            },
            {
              "pattern": "return os.system(..., request.$W, ...)"
            },
            {
              "pattern": "return os.system(..., $S.format(..., request.$W, ...), ...)"
            },
            {
              "pattern": "return os.system(..., $S % request.$W, ...)"
            },
            {
              "pattern": "return os.system(..., f\"...{request.$W}...\", ...)"
            }
          ]
        }
      ]
    },
    {
      "id": "python.django.security.injection.email.xss-html-email-body.xss-html-email-body",
      "message": "Found request data in an EmailMessage that is set to use HTML. This is dangerous because HTML emails are susceptible to XSS. An attacker could inject data into this HTML email, causing XSS.",
      "metadata": {
        "cwe": [
          "CWE-74: Improper Neutralization of Special Elements in Output Used by a Downstream Component ('Injection')"
        ],
        "owasp": [
          "A03:2021 - Injection",
          "A05:2025 - Injection"
        ],
        "references": [
          "https://www.damonkohler.com/2008/12/email-injection.html"
        ],
        "category": "security",
        "technology": [
          "django"
        ],
        "subcategory": [
          "vuln"
        ],
        "likelihood": "MEDIUM",
        "impact": "MEDIUM",
        "confidence": "MEDIUM",
        "license": "Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license",
        "vulnerability_class": [
          "Other"
        ],
        "source": "https://semgrep.dev/r/python.django.security.injection.email.xss-html-email-body.xss-html-email-body",
        "shortlink": "https://sg.run/RoBe",
        "semgrep.dev": {
          "rule": {
            "r_id": 9505,
            "rv_id": 1263390,
            "rule_id": "qNUj02",
            "version_id": "8KT5rOn",
            "url": "https://semgrep.dev/playground/r/8KT5rOn/python.django.security.injection.email.xss-html-email-body.xss-html-email-body",
            "origin": "community"
          }
        }
      },
      "languages": [
        "python"
      ],
      "severity": "WARNING",
      "patterns": [
        {
          "pattern-inside": "def $FUNC(...):\n  ...\n  $EMAIL.content_subtype = \"html\"\n  ...\n"
        },
        {
          "pattern-either": [
            {
              "pattern": "django.core.mail.EmailMessage($SUBJ, request.$W.get(...), ...)"
            },
            {
              "pattern": "$DATA = request.$W.get(...)\n...\ndjango.core.mail.EmailMessage($SUBJ, $DATA, ...)\n"
            },
            {
              "pattern": "$DATA = request.$W.get(...)\n...\n$INTERM = $DATA\n...\ndjango.core.mail.EmailMessage($SUBJ, $INTERM, ...)\n"
            },
            {
              "pattern": "$DATA = request.$W.get(...)\n...\ndjango.core.mail.EmailMessage($SUBJ, $B.$C(..., $DATA, ...), ...)\n"
            },
            {
              "pattern": "$DATA = request.$W.get(...)\n...\n$INTERM = $B.$C(..., $DATA, ...)\n...\ndjango.core.mail.EmailMessage($SUBJ, $INTERM, ...)\n"
            },
            {
              "pattern": "$DATA = request.$W.get(...)\n...\ndjango.core.mail.EmailMessage($SUBJ, $STR % $DATA, ...)\n"
            },
            {
              "pattern": "$DATA = request.$W.get(...)\n...\n$INTERM = $STR % $DATA\n...\ndjango.core.mail.EmailMessage($SUBJ, $INTERM, ...)\n"
            },
            {
              "pattern": "$DATA = request.$W.get(...)\n...\ndjango.core.mail.EmailMessage($SUBJ, f\"...{$DATA}...\", ...)\n"
            },
            {
              "pattern": "$DATA = request.$W.get(...)\n...\n$INTERM = f\"...{$DATA}...\"\n...\ndjango.core.mail.EmailMessage($SUBJ, $INTERM, ...)\n"
            },
            {
              "pattern": "$A = django.core.mail.EmailMessage($SUBJ, request.$W.get(...), ...)"
            },
            {
              "pattern": "return django.core.mail.EmailMessage($SUBJ, request.$W.get(...), ...)"
            },
            {
              "pattern": "django.core.mail.EmailMessage($SUBJ, request.$W(...), ...)"
            },
            {
              "pattern": "$DATA = request.$W(...)\n...\ndjango.core.mail.EmailMessage($SUBJ, $DATA, ...)\n"
            },
            {
              "pattern": "$DATA = request.$W(...)\n...\n$INTERM = $DATA\n...\ndjango.core.mail.EmailMessage($SUBJ, $INTERM, ...)\n"
            },
            {
              "pattern": "$DATA = request.$W(...)\n...\ndjango.core.mail.EmailMessage($SUBJ, $B.$C(..., $DATA, ...), ...)\n"
            },
            {
              "pattern": "$DATA = request.$W(...)\n...\n$INTERM = $B.$C(..., $DATA, ...)\n...\ndjango.core.mail.EmailMessage($SUBJ, $INTERM, ...)\n"
            },
            {
              "pattern": "$DATA = request.$W(...)\n...\ndjango.core.mail.EmailMessage($SUBJ, $STR % $DATA, ...)\n"
            },
            {
              "pattern": "$DATA = request.$W(...)\n...\n$INTERM = $STR % $DATA\n...\ndjango.core.mail.EmailMessage($SUBJ, $INTERM, ...)\n"
            },
            {
              "pattern": "$DATA = request.$W(...)\n...\ndjango.core.mail.EmailMessage($SUBJ, f\"...{$DATA}...\", ...)\n"
            },
            {
              "pattern": "$DATA = request.$W(...)\n...\n$INTERM = f\"...{$DATA}...\"\n...\ndjango.core.mail.EmailMessage($SUBJ, $INTERM, ...)\n"
            },
            {
              "pattern": "$A = django.core.mail.EmailMessage($SUBJ, request.$W(...), ...)"
            },
            {
              "pattern": "return django.core.mail.EmailMessage($SUBJ, request.$W(...), ...)"
            },
            {
              "pattern": "django.core.mail.EmailMessage($SUBJ, request.$W[...], ...)"
            },
            {
              "pattern": "$DATA = request.$W[...]\n...\ndjango.core.mail.EmailMessage($SUBJ, $DATA, ...)\n"
            },
            {
              "pattern": "$DATA = request.$W[...]\n...\n$INTERM = $DATA\n...\ndjango.core.mail.EmailMessage($SUBJ, $INTERM, ...)\n"
            },
            {
              "pattern": "$DATA = request.$W[...]\n...\ndjango.core.mail.EmailMessage($SUBJ, $B.$C(..., $DATA, ...), ...)\n"
            },
            {
              "pattern": "$DATA = request.$W[...]\n...\n$INTERM = $B.$C(..., $DATA, ...)\n...\ndjango.core.mail.EmailMessage($SUBJ, $INTERM, ...)\n"
            },
            {
              "pattern": "$DATA = request.$W[...]\n...\ndjango.core.mail.EmailMessage($SUBJ, $STR % $DATA, ...)\n"
            },
            {
              "pattern": "$DATA = request.$W[...]\n...\n$INTERM = $STR % $DATA\n...\ndjango.core.mail.EmailMessage($SUBJ, $INTERM, ...)\n"
            },
            {
              "pattern": "$DATA = request.$W[...]\n...\ndjango.core.mail.EmailMessage($SUBJ, f\"...{$DATA}...\", ...)\n"
            },
            {
              "pattern": "$DATA = request.$W[...]\n...\n$INTERM = f\"...{$DATA}...\"\n...\ndjango.core.mail.EmailMessage($SUBJ, $INTERM, ...)\n"
            },
            {
              "pattern": "$A = django.core.mail.EmailMessage($SUBJ, request.$W[...], ...)"
            },
            {
              "pattern": "return django.core.mail.EmailMessage($SUBJ, request.$W[...], ...)"
            },
            {
              "pattern": "django.core.mail.EmailMessage($SUBJ, request.$W, ...)"
            },
            {
              "pattern": "$DATA = request.$W\n...\ndjango.core.mail.EmailMessage($SUBJ, $DATA, ...)\n"
            },
            {
              "pattern": "$DATA = request.$W\n...\n$INTERM = $DATA\n...\ndjango.core.mail.EmailMessage($SUBJ, $INTERM, ...)\n"
            },
            {
              "pattern": "$DATA = request.$W\n...\ndjango.core.mail.EmailMessage($SUBJ, $B.$C(..., $DATA, ...), ...)\n"
            },
            {
              "pattern": "$DATA = request.$W\n...\n$INTERM = $B.$C(..., $DATA, ...)\n...\ndjango.core.mail.EmailMessage($SUBJ, $INTERM, ...)\n"
            },
            {
              "pattern": "$DATA = request.$W\n...\ndjango.core.mail.EmailMessage($SUBJ, $STR % $DATA, ...)\n"
            },
            {
              "pattern": "$DATA = request.$W\n...\n$INTERM = $STR % $DATA\n...\ndjango.core.mail.EmailMessage($SUBJ, $INTERM, ...)\n"
            },
            {
              "pattern": "$DATA = request.$W\n...\ndjango.core.mail.EmailMessage($SUBJ, f\"...{$DATA}...\", ...)\n"
            },
            {
              "pattern": "$DATA = request.$W\n...\n$INTERM = f\"...{$DATA}...\"\n...\ndjango.core.mail.EmailMessage($SUBJ, $INTERM, ...)\n"
            },
            {
              "pattern": "$A = django.core.mail.EmailMessage($SUBJ, request.$W, ...)"
            },
            {
              "pattern": "return django.core.mail.EmailMessage($SUBJ, request.$W, ...)"
            }
          ]
        }
      ]
    },
    {
      "id": "python.django.security.injection.email.xss-send-mail-html-message.xss-send-mail-html-message",
      "message": "Found request data in 'send_mail(...)' that uses 'html_message'. This is dangerous because HTML emails are susceptible to XSS. An attacker could inject data into this HTML email, causing XSS.",
      "metadata": {
        "cwe": [
          "CWE-74: Improper Neutralization of Special Elements in Output Used by a Downstream Component ('Injection')"
        ],
        "owasp": [
          "A03:2021 - Injection",
          "A05:2025 - Injection"
        ],
        "references": [
          "https://www.damonkohler.com/2008/12/email-injection.html"
        ],
        "category": "security",
        "technology": [
          "django"
        ],
        "subcategory": [
          "vuln"
        ],
        "likelihood": "MEDIUM",
        "impact": "MEDIUM",
        "confidence": "MEDIUM",
        "license": "Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license",
        "vulnerability_class": [
          "Other"
        ],
        "source": "https://semgrep.dev/r/python.django.security.injection.email.xss-send-mail-html-message.xss-send-mail-html-message",
        "shortlink": "https://sg.run/Avx8",
        "semgrep.dev": {
          "rule": {
            "r_id": 9506,
            "rv_id": 1263391,
            "rule_id": "lBU9Ll",
            "version_id": "gETB7Gn",
            "url": "https://semgrep.dev/playground/r/gETB7Gn/python.django.security.injection.email.xss-send-mail-html-message.xss-send-mail-html-message",
            "origin": "community"
          }
        }
      },
      "languages": [
        "python"
      ],
      "severity": "WARNING",
      "patterns": [
        {
          "pattern-inside": "def $FUNC(...):\n  ...\n"
        },
        {
          "pattern-either": [
            {
              "pattern": "django.core.mail.send_mail(..., html_message=request.$W.get(...), ...)"
            },
            {
              "pattern": "$DATA = request.$W.get(...)\n...\ndjango.core.mail.send_mail(..., html_message=$DATA, ...)\n"
            },
            {
              "pattern": "$DATA = request.$W.get(...)\n...\n$INTERM = $DATA\n...\ndjango.core.mail.send_mail(..., html_message=$INTERM, ...)\n"
            },
            {
              "pattern": "$DATA = request.$W.get(...)\n...\ndjango.core.mail.send_mail(..., html_message=$STR.format(..., $DATA, ...), ...)\n"
            },
            {
              "pattern": "$DATA = request.$W.get(...)\n...\n$INTERM = $STR.format(..., $DATA, ...)\n...\ndjango.core.mail.send_mail(..., html_message=$INTERM, ...)\n"
            },
            {
              "pattern": "$DATA = request.$W.get(...)\n...\ndjango.core.mail.send_mail(..., html_message=$STR % $DATA, ...)\n"
            },
            {
              "pattern": "$DATA = request.$W.get(...)\n...\n$INTERM = $STR % $DATA\n...\ndjango.core.mail.send_mail(..., html_message=$INTERM, ...)\n"
            },
            {
              "pattern": "$DATA = request.$W.get(...)\n...\ndjango.core.mail.send_mail(..., html_message=f\"...{$DATA}...\", ...)\n"
            },
            {
              "pattern": "$DATA = request.$W.get(...)\n...\n$INTERM = f\"...{$DATA}...\"\n...\ndjango.core.mail.send_mail(..., html_message=$INTERM, ...)\n"
            },
            {
              "pattern": "$DATA = request.$W.get(...)\n...\ndjango.core.mail.send_mail(..., html_message=$STR + $DATA, ...)\n"
            },
            {
              "pattern": "$DATA = request.$W.get(...)\n...\n$INTERM = $STR + $DATA\n...\ndjango.core.mail.send_mail(..., html_message=$INTERM, ...)\n"
            },
            {
              "pattern": "$A = django.core.mail.send_mail(..., html_message=request.$W.get(...), ...)"
            },
            {
              "pattern": "return django.core.mail.send_mail(..., html_message=request.$W.get(...), ...)"
            },
            {
              "pattern": "django.core.mail.send_mail(..., html_message=request.$W(...), ...)"
            },
            {
              "pattern": "$DATA = request.$W(...)\n...\ndjango.core.mail.send_mail(..., html_message=$DATA, ...)\n"
            },
            {
              "pattern": "$DATA = request.$W(...)\n...\n$INTERM = $DATA\n...\ndjango.core.mail.send_mail(..., html_message=$INTERM, ...)\n"
            },
            {
              "pattern": "$DATA = request.$W(...)\n...\ndjango.core.mail.send_mail(..., html_message=$STR.format(..., $DATA, ...), ...)\n"
            },
            {
              "pattern": "$DATA = request.$W(...)\n...\n$INTERM = $STR.format(..., $DATA, ...)\n...\ndjango.core.mail.send_mail(..., html_message=$INTERM, ...)\n"
            },
            {
              "pattern": "$DATA = request.$W(...)\n...\ndjango.core.mail.send_mail(..., html_message=$STR % $DATA, ...)\n"
            },
            {
              "pattern": "$DATA = request.$W(...)\n...\n$INTERM = $STR % $DATA\n...\ndjango.core.mail.send_mail(..., html_message=$INTERM, ...)\n"
            },
            {
              "pattern": "$DATA = request.$W(...)\n...\ndjango.core.mail.send_mail(..., html_message=f\"...{$DATA}...\", ...)\n"
            },
            {
              "pattern": "$DATA = request.$W(...)\n...\n$INTERM = f\"...{$DATA}...\"\n...\ndjango.core.mail.send_mail(..., html_message=$INTERM, ...)\n"
            },
            {
              "pattern": "$DATA = request.$W(...)\n...\ndjango.core.mail.send_mail(..., html_message=$STR + $DATA, ...)\n"
            },
            {
              "pattern": "$DATA = request.$W(...)\n...\n$INTERM = $STR + $DATA\n...\ndjango.core.mail.send_mail(..., html_message=$INTERM, ...)\n"
            },
            {
              "pattern": "$A = django.core.mail.send_mail(..., html_message=request.$W(...), ...)"
            },
            {
              "pattern": "return django.core.mail.send_mail(..., html_message=request.$W(...), ...)"
            },
            {
              "pattern": "django.core.mail.send_mail(..., html_message=request.$W[...], ...)"
            },
            {
              "pattern": "$DATA = request.$W[...]\n...\ndjango.core.mail.send_mail(..., html_message=$DATA, ...)\n"
            },
            {
              "pattern": "$DATA = request.$W[...]\n...\n$INTERM = $DATA\n...\ndjango.core.mail.send_mail(..., html_message=$INTERM, ...)\n"
            },
            {
              "pattern": "$DATA = request.$W[...]\n...\ndjango.core.mail.send_mail(..., html_message=$STR.format(..., $DATA, ...), ...)\n"
            },
            {
              "pattern": "$DATA = request.$W[...]\n...\n$INTERM = $STR.format(..., $DATA, ...)\n...\ndjango.core.mail.send_mail(..., html_message=$INTERM, ...)\n"
            },
            {
              "pattern": "$DATA = request.$W[...]\n...\ndjango.core.mail.send_mail(..., html_message=$STR % $DATA, ...)\n"
            },
            {
              "pattern": "$DATA = request.$W[...]\n...\n$INTERM = $STR % $DATA\n...\ndjango.core.mail.send_mail(..., html_message=$INTERM, ...)\n"
            },
            {
              "pattern": "$DATA = request.$W[...]\n...\ndjango.core.mail.send_mail(..., html_message=f\"...{$DATA}...\", ...)\n"
            },
            {
              "pattern": "$DATA = request.$W[...]\n...\n$INTERM = f\"...{$DATA}...\"\n...\ndjango.core.mail.send_mail(..., html_message=$INTERM, ...)\n"
            },
            {
              "pattern": "$DATA = request.$W[...]\n...\ndjango.core.mail.send_mail(..., html_message=$STR + $DATA, ...)\n"
            },
            {
              "pattern": "$DATA = request.$W[...]\n...\n$INTERM = $STR + $DATA\n...\ndjango.core.mail.send_mail(..., html_message=$INTERM, ...)\n"
            },
            {
              "pattern": "$A = django.core.mail.send_mail(..., html_message=request.$W[...], ...)"
            },
            {
              "pattern": "return django.core.mail.send_mail(..., html_message=request.$W[...], ...)"
            },
            {
              "pattern": "django.core.mail.send_mail(..., html_message=request.$W, ...)"
            },
            {
              "pattern": "$DATA = request.$W\n...\ndjango.core.mail.send_mail(..., html_message=$DATA, ...)\n"
            },
            {
              "pattern": "$DATA = request.$W\n...\n$INTERM = $DATA\n...\ndjango.core.mail.send_mail(..., html_message=$INTERM, ...)\n"
            },
            {
              "pattern": "$DATA = request.$W\n...\ndjango.core.mail.send_mail(..., html_message=$STR.format(..., $DATA, ...), ...)\n"
            },
            {
              "pattern": "$DATA = request.$W\n...\n$INTERM = $STR.format(..., $DATA, ...)\n...\ndjango.core.mail.send_mail(..., html_message=$INTERM, ...)\n"
            },
            {
              "pattern": "$DATA = request.$W\n...\ndjango.core.mail.send_mail(..., html_message=$STR % $DATA, ...)\n"
            },
            {
              "pattern": "$DATA = request.$W\n...\n$INTERM = $STR % $DATA\n...\ndjango.core.mail.send_mail(..., html_message=$INTERM, ...)\n"
            },
            {
              "pattern": "$DATA = request.$W\n...\ndjango.core.mail.send_mail(..., html_message=f\"...{$DATA}...\", ...)\n"
            },
            {
              "pattern": "$DATA = request.$W\n...\n$INTERM = f\"...{$DATA}...\"\n...\ndjango.core.mail.send_mail(..., html_message=$INTERM, ...)\n"
            },
            {
              "pattern": "$DATA = request.$W\n...\ndjango.core.mail.send_mail(..., html_message=$STR + $DATA, ...)\n"
            },
            {
              "pattern": "$DATA = request.$W\n...\n$INTERM = $STR + $DATA\n...\ndjango.core.mail.send_mail(..., html_message=$INTERM, ...)\n"
            },
            {
              "pattern": "$A = django.core.mail.send_mail(..., html_message=request.$W, ...)"
            },
            {
              "pattern": "return django.core.mail.send_mail(..., html_message=request.$W, ...)"
            }
          ]
        }
      ]
    },
    {
      "id": "python.django.security.injection.path-traversal.path-traversal-open.path-traversal-open",
      "message": "Found request data in a call to 'open'. Ensure the request data is validated or sanitized, otherwise it could result in path traversal attacks and therefore sensitive data being leaked. To mitigate, consider using os.path.abspath or os.path.realpath or the pathlib library.",
      "metadata": {
        "cwe": [
          "CWE-22: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')"
        ],
        "owasp": [
          "A05:2017 - Broken Access Control",
          "A01:2021 - Broken Access Control",
          "A01:2025 - Broken Access Control"
        ],
        "references": [
          "https://owasp.org/www-community/attacks/Path_Traversal"
        ],
        "category": "security",
        "technology": [
          "django"
        ],
        "cwe2022-top25": true,
        "cwe2021-top25": true,
        "subcategory": [
          "vuln"
        ],
        "likelihood": "MEDIUM",
        "impact": "MEDIUM",
        "confidence": "MEDIUM",
        "license": "Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license",
        "vulnerability_class": [
          "Path Traversal"
        ],
        "source": "https://semgrep.dev/r/python.django.security.injection.path-traversal.path-traversal-open.path-traversal-open",
        "shortlink": "https://sg.run/W8qg",
        "semgrep.dev": {
          "rule": {
            "r_id": 9509,
            "rv_id": 1263396,
            "rule_id": "oqUe7z",
            "version_id": "JdTzxAw",
            "url": "https://semgrep.dev/playground/r/JdTzxAw/python.django.security.injection.path-traversal.path-traversal-open.path-traversal-open",
            "origin": "community"
          }
        }
      },
      "languages": [
        "python"
      ],
      "severity": "WARNING",
      "patterns": [
        {
          "pattern-inside": "def $FUNC(...):\n  ...\n"
        },
        {
          "pattern-either": [
            {
              "pattern": "open(..., request.$W.get(...), ...)"
            },
            {
              "pattern": "open(..., $S.format(..., request.$W.get(...), ...), ...)"
            },
            {
              "pattern": "open(..., $S % request.$W.get(...), ...)"
            },
            {
              "pattern": "open(..., f\"...{request.$W.get(...)}...\", ...)"
            },
            {
              "pattern": "$DATA = request.$W.get(...)\n...\nopen(..., $DATA, ...)\n"
            },
            {
              "pattern": "$DATA = request.$W.get(...)\n...\n$INTERM = $DATA\n...\nopen(..., $INTERM, ...)\n"
            },
            {
              "pattern": "$DATA = request.$W.get(...)\n...\n$INTERM = $DATA\n...\nwith open(..., $INTERM, ...) as $FD:\n  ...\n"
            },
            {
              "pattern": "$DATA = request.$W.get(...)\n...\nopen(..., $STR.format(..., $DATA, ...), ...)\n"
            },
            {
              "pattern": "$DATA = request.$W.get(...)\n...\n$INTERM = $STR.format(..., $DATA, ...)\n...\nopen(..., $INTERM, ...)\n"
            },
            {
              "pattern": "$DATA = request.$W.get(...)\n...\n$INTERM = $STR.format(..., $DATA, ...)\n...\nwith open(..., $INTERM, ...) as $FD:\n  ...\n"
            },
            {
              "pattern": "$DATA = request.$W.get(...)\n...\nopen(..., $STR % $DATA, ...)\n"
            },
            {
              "pattern": "$DATA = request.$W.get(...)\n...\n$INTERM = $STR % $DATA\n...\nopen(..., $INTERM, ...)\n"
            },
            {
              "pattern": "$DATA = request.$W.get(...)\n...\n$INTERM = $STR % $DATA\n...\nwith open(..., $INTERM, ...) as $FD:\n  ...\n"
            },
            {
              "pattern": "$DATA = request.$W.get(...)\n...\nopen(..., f\"...{$DATA}...\", ...)\n"
            },
            {
              "pattern": "$DATA = request.$W.get(...)\n...\n$INTERM = f\"...{$DATA}...\"\n...\nopen(..., $INTERM, ...)\n"
            },
            {
              "pattern": "$DATA = request.$W.get(...)\n...\n$INTERM = f\"...{$DATA}...\"\n...\nwith open(..., $INTERM, ...) as $FD:\n  ...\n"
            },
            {
              "pattern": "$DATA = request.$W.get(...)\n...\nopen(..., $STR + $DATA, ...)\n"
            },
            {
              "pattern": "$DATA = request.$W.get(...)\n...\n$INTERM = $STR + $DATA\n...\nopen(..., $INTERM, ...)\n"
            },
            {
              "pattern": "$DATA = request.$W.get(...)\n...\n$INTERM = $STR + $DATA\n...\nwith open(..., $INTERM, ...) as $FD:\n  ...\n"
            },
            {
              "pattern": "$A = open(..., request.$W.get(...), ...)"
            },
            {
              "pattern": "$A = open(..., $S.format(..., request.$W.get(...), ...), ...)"
            },
            {
              "pattern": "$A = open(..., $S % request.$W.get(...), ...)"
            },
            {
              "pattern": "$A = open(..., f\"...{request.$W.get(...)}...\", ...)"
            },
            {
              "pattern": "return open(..., request.$W.get(...), ...)"
            },
            {
              "pattern": "return open(..., $S.format(..., request.$W.get(...), ...), ...)"
            },
            {
              "pattern": "return open(..., $S % request.$W.get(...), ...)"
            },
            {
              "pattern": "return open(..., f\"...{request.$W.get(...)}...\", ...)"
            },
            {
              "pattern": "$DATA = request.$W.get(...)\n...\nwith open(..., $DATA, ...) as $FD:\n  ...\n"
            },
            {
              "pattern": "open(..., request.$W(...), ...)"
            },
            {
              "pattern": "open(..., $S.format(..., request.$W(...), ...), ...)"
            },
            {
              "pattern": "open(..., $S % request.$W(...), ...)"
            },
            {
              "pattern": "open(..., f\"...{request.$W(...)}...\", ...)"
            },
            {
              "pattern": "$DATA = request.$W(...)\n...\nopen(..., $DATA, ...)\n"
            },
            {
              "pattern": "$DATA = request.$W(...)\n...\n$INTERM = $DATA\n...\nopen(..., $INTERM, ...)\n"
            },
            {
              "pattern": "$DATA = request.$W(...)\n...\n$INTERM = $DATA\n...\nwith open(..., $INTERM, ...) as $FD:\n  ...\n"
            },
            {
              "pattern": "$DATA = request.$W(...)\n...\nopen(..., $STR.format(..., $DATA, ...), ...)\n"
            },
            {
              "pattern": "$DATA = request.$W(...)\n...\n$INTERM = $STR.format(..., $DATA, ...)\n...\nopen(..., $INTERM, ...)\n"
            },
            {
              "pattern": "$DATA = request.$W(...)\n...\n$INTERM = $STR.format(..., $DATA, ...)\n...\nwith open(..., $INTERM, ...) as $FD:\n  ...\n"
            },
            {
              "pattern": "$DATA = request.$W(...)\n...\nopen(..., $STR % $DATA, ...)\n"
            },
            {
              "pattern": "$DATA = request.$W(...)\n...\n$INTERM = $STR % $DATA\n...\nopen(..., $INTERM, ...)\n"
            },
            {
              "pattern": "$DATA = request.$W(...)\n...\n$INTERM = $STR % $DATA\n...\nwith open(..., $INTERM, ...) as $FD:\n  ...\n"
            },
            {
              "pattern": "$DATA = request.$W(...)\n...\nopen(..., f\"...{$DATA}...\", ...)\n"
            },
            {
              "pattern": "$DATA = request.$W(...)\n...\n$INTERM = f\"...{$DATA}...\"\n...\nopen(..., $INTERM, ...)\n"
            },
            {
              "pattern": "$DATA = request.$W(...)\n...\n$INTERM = f\"...{$DATA}...\"\n...\nwith open(..., $INTERM, ...) as $FD:\n  ...\n"
            },
            {
              "pattern": "$DATA = request.$W(...)\n...\nopen(..., $STR + $DATA, ...)\n"
            },
            {
              "pattern": "$DATA = request.$W(...)\n...\n$INTERM = $STR + $DATA\n...\nopen(..., $INTERM, ...)\n"
            },
            {
              "pattern": "$DATA = request.$W(...)\n...\n$INTERM = $STR + $DATA\n...\nwith open(..., $INTERM, ...) as $FD:\n  ...\n"
            },
            {
              "pattern": "$A = open(..., request.$W(...), ...)"
            },
            {
              "pattern": "$A = open(..., $S.format(..., request.$W(...), ...), ...)"
            },
            {
              "pattern": "$A = open(..., $S % request.$W(...), ...)"
            },
            {
              "pattern": "$A = open(..., f\"...{request.$W(...)}...\", ...)"
            },
            {
              "pattern": "return open(..., request.$W(...), ...)"
            },
            {
              "pattern": "return open(..., $S.format(..., request.$W(...), ...), ...)"
            },
            {
              "pattern": "return open(..., $S % request.$W(...), ...)"
            },
            {
              "pattern": "return open(..., f\"...{request.$W(...)}...\", ...)"
            },
            {
              "pattern": "$DATA = request.$W(...)\n...\nwith open(..., $DATA, ...) as $FD:\n  ...\n"
            },
            {
              "pattern": "open(..., request.$W[...], ...)"
            },
            {
              "pattern": "open(..., $S.format(..., request.$W[...], ...), ...)"
            },
            {
              "pattern": "open(..., $S % request.$W[...], ...)"
            },
            {
              "pattern": "open(..., f\"...{request.$W[...]}...\", ...)"
            },
            {
              "pattern": "$DATA = request.$W[...]\n...\nopen(..., $DATA, ...)\n"
            },
            {
              "pattern": "$DATA = request.$W[...]\n...\n$INTERM = $DATA\n...\nopen(..., $INTERM, ...)\n"
            },
            {
              "pattern": "$DATA = request.$W[...]\n...\n$INTERM = $DATA\n...\nwith open(..., $INTERM, ...) as $FD:\n  ...\n"
            },
            {
              "pattern": "$DATA = request.$W[...]\n...\nopen(..., $STR.format(..., $DATA, ...), ...)\n"
            },
            {
              "pattern": "$DATA = request.$W[...]\n...\n$INTERM = $STR.format(..., $DATA, ...)\n...\nopen(..., $INTERM, ...)\n"
            },
            {
              "pattern": "$DATA = request.$W[...]\n...\n$INTERM = $STR.format(..., $DATA, ...)\n...\nwith open(..., $INTERM, ...) as $FD:\n  ...\n"
            },
            {
              "pattern": "$DATA = request.$W[...]\n...\nopen(..., $STR % $DATA, ...)\n"
            },
            {
              "pattern": "$DATA = request.$W[...]\n...\n$INTERM = $STR % $DATA\n...\nopen(..., $INTERM, ...)\n"
            },
            {
              "pattern": "$DATA = request.$W[...]\n...\n$INTERM = $STR % $DATA\n...\nwith open(..., $INTERM, ...) as $FD:\n  ...\n"
            },
            {
              "pattern": "$DATA = request.$W[...]\n...\nopen(..., f\"...{$DATA}...\", ...)\n"
            },
            {
              "pattern": "$DATA = request.$W[...]\n...\n$INTERM = f\"...{$DATA}...\"\n...\nopen(..., $INTERM, ...)\n"
            },
            {
              "pattern": "$DATA = request.$W[...]\n...\n$INTERM = f\"...{$DATA}...\"\n...\nwith open(..., $INTERM, ...) as $FD:\n  ...\n"
            },
            {
              "pattern": "$DATA = request.$W[...]\n...\nopen(..., $STR + $DATA, ...)\n"
            },
            {
              "pattern": "$DATA = request.$W[...]\n...\n$INTERM = $STR + $DATA\n...\nopen(..., $INTERM, ...)\n"
            },
            {
              "pattern": "$DATA = request.$W[...]\n...\n$INTERM = $STR + $DATA\n...\nwith open(..., $INTERM, ...) as $FD:\n  ...\n"
            },
            {
              "pattern": "$A = open(..., request.$W[...], ...)"
            },
            {
              "pattern": "$A = open(..., $S.format(..., request.$W[...], ...), ...)"
            },
            {
              "pattern": "$A = open(..., $S % request.$W[...], ...)"
            },
            {
              "pattern": "$A = open(..., f\"...{request.$W[...]}...\", ...)"
            },
            {
              "pattern": "return open(..., request.$W[...], ...)"
            },
            {
              "pattern": "return open(..., $S.format(..., request.$W[...], ...), ...)"
            },
            {
              "pattern": "return open(..., $S % request.$W[...], ...)"
            },
            {
              "pattern": "return open(..., f\"...{request.$W[...]}...\", ...)"
            },
            {
              "pattern": "$DATA = request.$W[...]\n...\nwith open(..., $DATA, ...) as $FD:\n  ...\n"
            },
            {
              "pattern": "open(..., request.$W, ...)"
            },
            {
              "pattern": "open(..., $S.format(..., request.$W, ...), ...)"
            },
            {
              "pattern": "open(..., $S % request.$W, ...)"
            },
            {
              "pattern": "open(..., f\"...{request.$W}...\", ...)"
            },
            {
              "pattern": "$DATA = request.$W\n...\nopen(..., $DATA, ...)\n"
            },
            {
              "pattern": "$DATA = request.$W\n...\n$INTERM = $DATA\n...\nopen(..., $INTERM, ...)\n"
            },
            {
              "pattern": "$DATA = request.$W\n...\n$INTERM = $DATA\n...\nwith open(..., $INTERM, ...) as $FD:\n  ...\n"
            },
            {
              "pattern": "$DATA = request.$W\n...\nopen(..., $STR.format(..., $DATA, ...), ...)\n"
            },
            {
              "pattern": "$DATA = request.$W\n...\n$INTERM = $STR.format(..., $DATA, ...)\n...\nopen(..., $INTERM, ...)\n"
            },
            {
              "pattern": "$DATA = request.$W\n...\n$INTERM = $STR.format(..., $DATA, ...)\n...\nwith open(..., $INTERM, ...) as $FD:\n  ...\n"
            },
            {
              "pattern": "$DATA = request.$W\n...\nopen(..., $STR % $DATA, ...)\n"
            },
            {
              "pattern": "$DATA = request.$W\n...\n$INTERM = $STR % $DATA\n...\nopen(..., $INTERM, ...)\n"
            },
            {
              "pattern": "$DATA = request.$W\n...\n$INTERM = $STR % $DATA\n...\nwith open(..., $INTERM, ...) as $FD:\n  ...\n"
            },
            {
              "pattern": "$DATA = request.$W\n...\nopen(..., f\"...{$DATA}...\", ...)\n"
            },
            {
              "pattern": "$DATA = request.$W\n...\n$INTERM = f\"...{$DATA}...\"\n...\nopen(..., $INTERM, ...)\n"
            },
            {
              "pattern": "$DATA = request.$W\n...\n$INTERM = f\"...{$DATA}...\"\n...\nwith open(..., $INTERM, ...) as $FD:\n  ...\n"
            },
            {
              "pattern": "$DATA = request.$W\n...\nopen(..., $STR + $DATA, ...)\n"
            },
            {
              "pattern": "$DATA = request.$W\n...\n$INTERM = $STR + $DATA\n...\nopen(..., $INTERM, ...)\n"
            },
            {
              "pattern": "$DATA = request.$W\n...\n$INTERM = $STR + $DATA\n...\nwith open(..., $INTERM, ...) as $FD:\n  ...\n"
            },
            {
              "pattern": "$A = open(..., request.$W, ...)"
            },
            {
              "pattern": "$A = open(..., $S.format(..., request.$W, ...), ...)"
            },
            {
              "pattern": "$A = open(..., $S % request.$W, ...)"
            },
            {
              "pattern": "$A = open(..., f\"...{request.$W}...\", ...)"
            },
            {
              "pattern": "return open(..., request.$W, ...)"
            },
            {
              "pattern": "return open(..., $S.format(..., request.$W, ...), ...)"
            },
            {
              "pattern": "return open(..., $S % request.$W, ...)"
            },
            {
              "pattern": "return open(..., f\"...{request.$W}...\", ...)"
            },
            {
              "pattern": "$DATA = request.$W\n...\nwith open(..., $DATA, ...) as $FD:\n  ...\n"
            }
          ]
        }
      ]
    },
    {
      "id": "python.django.security.injection.sql.sql-injection-extra.sql-injection-using-extra-where",
      "message": "User-controlled data from a request is passed to 'extra()'. This could lead to a SQL injection and therefore protected information could be leaked. Instead, use parameterized queries or escape the user-controlled data by using `params` and not using quote placeholders in the SQL string.",
      "metadata": {
        "cwe": [
          "CWE-89: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')"
        ],
        "owasp": [
          "A01:2017 - Injection",
          "A03:2021 - Injection",
          "A05:2025 - Injection"
        ],
        "references": [
          "https://docs.djangoproject.com/en/3.0/ref/models/expressions/#.objects.extra"
        ],
        "category": "security",
        "technology": [
          "django"
        ],
        "cwe2022-top25": true,
        "cwe2021-top25": true,
        "subcategory": [
          "vuln"
        ],
        "likelihood": "MEDIUM",
        "impact": "HIGH",
        "confidence": "MEDIUM",
        "license": "Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license",
        "vulnerability_class": [
          "SQL Injection"
        ],
        "source": "https://semgrep.dev/r/python.django.security.injection.sql.sql-injection-extra.sql-injection-using-extra-where",
        "shortlink": "https://sg.run/0Ql5",
        "semgrep.dev": {
          "rule": {
            "r_id": 9510,
            "rv_id": 1263402,
            "rule_id": "zdUkx1",
            "version_id": "DkTRb4l",
            "url": "https://semgrep.dev/playground/r/DkTRb4l/python.django.security.injection.sql.sql-injection-extra.sql-injection-using-extra-where",
            "origin": "community"
          }
        }
      },
      "languages": [
        "python"
      ],
      "severity": "WARNING",
      "patterns": [
        {
          "pattern-inside": "def $FUNC(...):\n  ...\n"
        },
        {
          "pattern-either": [
            {
              "pattern": "$MODEL.objects.extra(..., where=[..., $S.format(..., request.$W.get(...), ...), ...], ...)"
            },
            {
              "pattern": "$MODEL.objects.extra(..., where=[..., $S % request.$W.get(...), ...], ...)"
            },
            {
              "pattern": "$MODEL.objects.extra(..., where=[..., f\"...{request.$W.get(...)}...\", ...], ...)"
            },
            {
              "pattern": "$MODEL.objects.extra(..., where=[..., request.$W.get(...), ...], ...)"
            },
            {
              "pattern": "$DATA = request.$W.get(...)\n...\n$MODEL.objects.extra(..., where=[..., $DATA, ...], ...)\n"
            },
            {
              "pattern": "$DATA = request.$W.get(...)\n...\n$INTERM = $DATA\n...\n$MODEL.objects.extra(..., where=[..., $INTERM, ...], ...)\n"
            },
            {
              "pattern": "$DATA = request.$W.get(...)\n...\n$MODEL.objects.extra(..., where=[..., $STR.format(..., $DATA, ...), ...], ...)\n"
            },
            {
              "pattern": "$DATA = request.$W.get(...)\n...\n$INTERM = $STR.format(..., $DATA, ...)\n...\n$MODEL.objects.extra(..., where=[..., $INTERM, ...], ...)\n"
            },
            {
              "pattern": "$DATA = request.$W.get(...)\n...\n$MODEL.objects.extra(..., where=[..., $STR % $DATA, ...], ...)\n"
            },
            {
              "pattern": "$DATA = request.$W.get(...)\n...\n$INTERM = $STR % $DATA\n...\n$MODEL.objects.extra(..., where=[..., $INTERM, ...], ...)\n"
            },
            {
              "pattern": "$DATA = request.$W.get(...)\n...\n$MODEL.objects.extra(..., where=[..., f\"...{$DATA}...\", ...], ...)\n"
            },
            {
              "pattern": "$DATA = request.$W.get(...)\n...\n$INTERM = f\"...{$DATA}...\"\n...\n$MODEL.objects.extra(..., where=[..., $INTERM, ...], ...)\n"
            },
            {
              "pattern": "$DATA = request.$W.get(...)\n...\n$MODEL.objects.extra(..., where=[..., $STR + $DATA, ...], ...)\n"
            },
            {
              "pattern": "$DATA = request.$W.get(...)\n...\n$INTERM = $STR + $DATA\n...\n$MODEL.objects.extra(..., where=[..., $INTERM, ...], ...)\n"
            },
            {
              "pattern": "$A = $MODEL.objects.extra(..., where=[..., request.$W.get(...), ...], ...)"
            },
            {
              "pattern": "return $MODEL.objects.extra(..., where=[..., request.$W.get(...), ...], ...)"
            },
            {
              "pattern": "$MODEL.objects.extra(..., where=[..., $S.format(..., request.$W(...), ...), ...], ...)"
            },
            {
              "pattern": "$MODEL.objects.extra(..., where=[..., $S % request.$W(...), ...], ...)"
            },
            {
              "pattern": "$MODEL.objects.extra(..., where=[..., f\"...{request.$W(...)}...\", ...], ...)"
            },
            {
              "pattern": "$MODEL.objects.extra(..., where=[..., request.$W(...), ...], ...)"
            },
            {
              "pattern": "$DATA = request.$W(...)\n...\n$MODEL.objects.extra(..., where=[..., $DATA, ...], ...)\n"
            },
            {
              "pattern": "$DATA = request.$W(...)\n...\n$INTERM = $DATA\n...\n$MODEL.objects.extra(..., where=[..., $INTERM, ...], ...)\n"
            },
            {
              "pattern": "$DATA = request.$W(...)\n...\n$MODEL.objects.extra(..., where=[..., $STR.format(..., $DATA, ...), ...], ...)\n"
            },
            {
              "pattern": "$DATA = request.$W(...)\n...\n$INTERM = $STR.format(..., $DATA, ...)\n...\n$MODEL.objects.extra(..., where=[..., $INTERM, ...], ...)\n"
            },
            {
              "pattern": "$DATA = request.$W(...)\n...\n$MODEL.objects.extra(..., where=[..., $STR % $DATA, ...], ...)\n"
            },
            {
              "pattern": "$DATA = request.$W(...)\n...\n$INTERM = $STR % $DATA\n...\n$MODEL.objects.extra(..., where=[..., $INTERM, ...], ...)\n"
            },
            {
              "pattern": "$DATA = request.$W(...)\n...\n$MODEL.objects.extra(..., where=[..., f\"...{$DATA}...\", ...], ...)\n"
            },
            {
              "pattern": "$DATA = request.$W(...)\n...\n$INTERM = f\"...{$DATA}...\"\n...\n$MODEL.objects.extra(..., where=[..., $INTERM, ...], ...)\n"
            },
            {
              "pattern": "$DATA = request.$W(...)\n...\n$MODEL.objects.extra(..., where=[..., $STR + $DATA, ...], ...)\n"
            },
            {
              "pattern": "$DATA = request.$W(...)\n...\n$INTERM = $STR + $DATA\n...\n$MODEL.objects.extra(..., where=[..., $INTERM, ...], ...)\n"
            },
            {
              "pattern": "$A = $MODEL.objects.extra(..., where=[..., request.$W(...), ...], ...)"
            },
            {
              "pattern": "return $MODEL.objects.extra(..., where=[..., request.$W(...), ...], ...)"
            },
            {
              "pattern": "$MODEL.objects.extra(..., where=[..., $S.format(..., request.$W[...], ...), ...], ...)"
            },
            {
              "pattern": "$MODEL.objects.extra(..., where=[..., $S % request.$W[...], ...], ...)"
            },
            {
              "pattern": "$MODEL.objects.extra(..., where=[..., f\"...{request.$W[...]}...\", ...], ...)"
            },
            {
              "pattern": "$MODEL.objects.extra(..., where=[..., request.$W[...], ...], ...)"
            },
            {
              "pattern": "$DATA = request.$W[...]\n...\n$MODEL.objects.extra(..., where=[..., $DATA, ...], ...)\n"
            },
            {
              "pattern": "$DATA = request.$W[...]\n...\n$INTERM = $DATA\n...\n$MODEL.objects.extra(..., where=[..., $INTERM, ...], ...)\n"
            },
            {
              "pattern": "$DATA = request.$W[...]\n...\n$MODEL.objects.extra(..., where=[..., $STR.format(..., $DATA, ...), ...], ...)\n"
            },
            {
              "pattern": "$DATA = request.$W[...]\n...\n$INTERM = $STR.format(..., $DATA, ...)\n...\n$MODEL.objects.extra(..., where=[..., $INTERM, ...], ...)\n"
            },
            {
              "pattern": "$DATA = request.$W[...]\n...\n$MODEL.objects.extra(..., where=[..., $STR % $DATA, ...], ...)\n"
            },
            {
              "pattern": "$DATA = request.$W[...]\n...\n$INTERM = $STR % $DATA\n...\n$MODEL.objects.extra(..., where=[..., $INTERM, ...], ...)\n"
            },
            {
              "pattern": "$DATA = request.$W[...]\n...\n$MODEL.objects.extra(..., where=[..., f\"...{$DATA}...\", ...], ...)\n"
            },
            {
              "pattern": "$DATA = request.$W[...]\n...\n$INTERM = f\"...{$DATA}...\"\n...\n$MODEL.objects.extra(..., where=[..., $INTERM, ...], ...)\n"
            },
            {
              "pattern": "$DATA = request.$W[...]\n...\n$MODEL.objects.extra(..., where=[..., $STR + $DATA, ...], ...)\n"
            },
            {
              "pattern": "$DATA = request.$W[...]\n...\n$INTERM = $STR + $DATA\n...\n$MODEL.objects.extra(..., where=[..., $INTERM, ...], ...)\n"
            },
            {
              "pattern": "$A = $MODEL.objects.extra(..., where=[..., request.$W[...], ...], ...)"
            },
            {
              "pattern": "return $MODEL.objects.extra(..., where=[..., request.$W[...], ...], ...)"
            },
            {
              "pattern": "$MODEL.objects.extra(..., where=[..., $S.format(..., request.$W, ...), ...], ...)"
            },
            {
              "pattern": "$MODEL.objects.extra(..., where=[..., $S % request.$W, ...], ...)"
            },
            {
              "pattern": "$MODEL.objects.extra(..., where=[..., f\"...{request.$W}...\", ...], ...)"
            },
            {
              "pattern": "$MODEL.objects.extra(..., where=[..., request.$W, ...], ...)"
            },
            {
              "pattern": "$DATA = request.$W\n...\n$MODEL.objects.extra(..., where=[..., $DATA, ...], ...)\n"
            },
            {
              "pattern": "$DATA = request.$W\n...\n$INTERM = $DATA\n...\n$MODEL.objects.extra(..., where=[..., $INTERM, ...], ...)\n"
            },
            {
              "pattern": "$DATA = request.$W\n...\n$MODEL.objects.extra(..., where=[..., $STR.format(..., $DATA, ...), ...], ...)\n"
            },
            {
              "pattern": "$DATA = request.$W\n...\n$INTERM = $STR.format(..., $DATA, ...)\n...\n$MODEL.objects.extra(..., where=[..., $INTERM, ...], ...)\n"
            },
            {
              "pattern": "$DATA = request.$W\n...\n$MODEL.objects.extra(..., where=[..., $STR % $DATA, ...], ...)\n"
            },
            {
              "pattern": "$DATA = request.$W\n...\n$INTERM = $STR % $DATA\n...\n$MODEL.objects.extra(..., where=[..., $INTERM, ...], ...)\n"
            },
            {
              "pattern": "$DATA = request.$W\n...\n$MODEL.objects.extra(..., where=[..., f\"...{$DATA}...\", ...], ...)\n"
            },
            {
              "pattern": "$DATA = request.$W\n...\n$INTERM = f\"...{$DATA}...\"\n...\n$MODEL.objects.extra(..., where=[..., $INTERM, ...], ...)\n"
            },
            {
              "pattern": "$DATA = request.$W\n...\n$MODEL.objects.extra(..., where=[..., $STR + $DATA, ...], ...)\n"
            },
            {
              "pattern": "$DATA = request.$W\n...\n$INTERM = $STR + $DATA\n...\n$MODEL.objects.extra(..., where=[..., $INTERM, ...], ...)\n"
            },
            {
              "pattern": "$A = $MODEL.objects.extra(..., where=[..., request.$W, ...], ...)"
            },
            {
              "pattern": "return $MODEL.objects.extra(..., where=[..., request.$W, ...], ...)"
            },
            {
              "pattern": "$DATA = request.$W.get(...)\n...\n$MODEL.objects.extra(..., where=[..., $STR % (..., $DATA, ...), ...], ...)\n"
            },
            {
              "pattern": "$DATA = request.$W[...]\n...\n$MODEL.objects.extra(..., where=[..., $STR % (..., $DATA, ...), ...], ...)\n"
            },
            {
              "pattern": "$DATA = request.$W(...)\n...\n$MODEL.objects.extra(..., where=[..., $STR % (..., $DATA, ...), ...], ...)\n"
            },
            {
              "pattern": "$DATA = request.$W\n...\n$MODEL.objects.extra(..., where=[..., $STR % (..., $DATA, ...), ...], ...)\n"
            },
            {
              "pattern": "$DATA = request.$W.get(...)\n...\n$INTERM = $STR % (..., $DATA, ...)\n...\n$MODEL.objects.extra(..., where=[..., $INTERM, ...], ...)\n"
            },
            {
              "pattern": "$DATA = request.$W(...)\n...\n$INTERM = $STR % (..., $DATA, ...)\n...\n$MODEL.objects.extra(..., where=[..., $INTERM, ...], ...)\n"
            },
            {
              "pattern": "$DATA = request.$W[...]\n...\n$INTERM = $STR % (..., $DATA, ...)\n...\n$MODEL.objects.extra(..., where=[..., $INTERM, ...], ...)\n"
            },
            {
              "pattern": "$DATA = request.$W\n...\n$INTERM = $STR % (..., $DATA, ...)\n...\n$MODEL.objects.extra(..., where=[..., $INTERM, ...], ...)\n"
            }
          ]
        }
      ]
    },
    {
      "id": "python.django.security.injection.sql.sql-injection-rawsql.sql-injection-using-rawsql",
      "message": "User-controlled data from request is passed to 'RawSQL()'. This could lead to a SQL injection and therefore protected information could be leaked. Instead, use parameterized queries or escape the user-controlled data by using `params` and not using quote placeholders in the SQL string.",
      "metadata": {
        "cwe": [
          "CWE-89: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')"
        ],
        "owasp": [
          "A01:2017 - Injection",
          "A03:2021 - Injection",
          "A05:2025 - Injection"
        ],
        "references": [
          "https://docs.djangoproject.com/en/3.0/ref/models/expressions/#django.db.models.expressions.RawSQL"
        ],
        "category": "security",
        "technology": [
          "django"
        ],
        "cwe2022-top25": true,
        "cwe2021-top25": true,
        "subcategory": [
          "vuln"
        ],
        "likelihood": "MEDIUM",
        "impact": "HIGH",
        "confidence": "MEDIUM",
        "license": "Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license",
        "vulnerability_class": [
          "SQL Injection"
        ],
        "source": "https://semgrep.dev/r/python.django.security.injection.sql.sql-injection-rawsql.sql-injection-using-rawsql",
        "shortlink": "https://sg.run/Kl4X",
        "semgrep.dev": {
          "rule": {
            "r_id": 9511,
            "rv_id": 1263403,
            "rule_id": "pKUOBp",
            "version_id": "WrTqK2L",
            "url": "https://semgrep.dev/playground/r/WrTqK2L/python.django.security.injection.sql.sql-injection-rawsql.sql-injection-using-rawsql",
            "origin": "community"
          }
        }
      },
      "languages": [
        "python"
      ],
      "severity": "WARNING",
      "patterns": [
        {
          "pattern-inside": "def $FUNC(...):\n  ...\n"
        },
        {
          "pattern-either": [
            {
              "pattern": "django.db.models.expressions.RawSQL(..., $S.format(..., request.$W.get(...), ...), ...)"
            },
            {
              "pattern": "django.db.models.expressions.RawSQL(..., $S % request.$W.get(...), ...)"
            },
            {
              "pattern": "django.db.models.expressions.RawSQL(..., f\"...{request.$W.get(...)}...\", ...)"
            },
            {
              "pattern": "django.db.models.expressions.RawSQL(..., request.$W.get(...), ...)"
            },
            {
              "pattern": "$DATA = request.$W.get(...)\n...\ndjango.db.models.expressions.RawSQL(..., $DATA, ...)\n"
            },
            {
              "pattern": "$DATA = request.$W.get(...)\n...\n$INTERM = $DATA\n...\ndjango.db.models.expressions.RawSQL(..., $INTERM, ...)\n"
            },
            {
              "pattern": "$DATA = request.$W.get(...)\n...\ndjango.db.models.expressions.RawSQL(..., $STR.format(..., $DATA, ...), ...)\n"
            },
            {
              "pattern": "$DATA = request.$W.get(...)\n...\n$INTERM = $STR.format(..., $DATA, ...)\n...\ndjango.db.models.expressions.RawSQL(..., $INTERM, ...)\n"
            },
            {
              "pattern": "$DATA = request.$W.get(...)\n...\ndjango.db.models.expressions.RawSQL(..., $STR % $DATA, ...)\n"
            },
            {
              "pattern": "$DATA = request.$W.get(...)\n...\n$INTERM = $STR % $DATA\n...\ndjango.db.models.expressions.RawSQL(..., $INTERM, ...)\n"
            },
            {
              "pattern": "$DATA = request.$W.get(...)\n...\ndjango.db.models.expressions.RawSQL(..., f\"...{$DATA}...\", ...)\n"
            },
            {
              "pattern": "$DATA = request.$W.get(...)\n...\n$INTERM = f\"...{$DATA}...\"\n...\ndjango.db.models.expressions.RawSQL(..., $INTERM, ...)\n"
            },
            {
              "pattern": "$DATA = request.$W.get(...)\n...\ndjango.db.models.expressions.RawSQL(..., $STR + $DATA, ...)\n"
            },
            {
              "pattern": "$DATA = request.$W.get(...)\n...\n$INTERM = $STR + $DATA\n...\ndjango.db.models.expressions.RawSQL(..., $INTERM, ...)\n"
            },
            {
              "pattern": "$A = django.db.models.expressions.RawSQL(..., request.$W.get(...), ...)"
            },
            {
              "pattern": "return django.db.models.expressions.RawSQL(..., request.$W.get(...), ...)"
            },
            {
              "pattern": "django.db.models.expressions.RawSQL(..., $S.format(..., request.$W(...), ...), ...)"
            },
            {
              "pattern": "django.db.models.expressions.RawSQL(..., $S % request.$W(...), ...)"
            },
            {
              "pattern": "django.db.models.expressions.RawSQL(..., f\"...{request.$W(...)}...\", ...)"
            },
            {
              "pattern": "django.db.models.expressions.RawSQL(..., request.$W(...), ...)"
            },
            {
              "pattern": "$DATA = request.$W(...)\n...\ndjango.db.models.expressions.RawSQL(..., $DATA, ...)\n"
            },
            {
              "pattern": "$DATA = request.$W(...)\n...\n$INTERM = $DATA\n...\ndjango.db.models.expressions.RawSQL(..., $INTERM, ...)\n"
            },
            {
              "pattern": "$DATA = request.$W(...)\n...\ndjango.db.models.expressions.RawSQL(..., $STR.format(..., $DATA, ...), ...)\n"
            },
            {
              "pattern": "$DATA = request.$W(...)\n...\n$INTERM = $STR.format(..., $DATA, ...)\n...\ndjango.db.models.expressions.RawSQL(..., $INTERM, ...)\n"
            },
            {
              "pattern": "$DATA = request.$W(...)\n...\ndjango.db.models.expressions.RawSQL(..., $STR % $DATA, ...)\n"
            },
            {
              "pattern": "$DATA = request.$W(...)\n...\n$INTERM = $STR % $DATA\n...\ndjango.db.models.expressions.RawSQL(..., $INTERM, ...)\n"
            },
            {
              "pattern": "$DATA = request.$W(...)\n...\ndjango.db.models.expressions.RawSQL(..., f\"...{$DATA}...\", ...)\n"
            },
            {
              "pattern": "$DATA = request.$W(...)\n...\n$INTERM = f\"...{$DATA}...\"\n...\ndjango.db.models.expressions.RawSQL(..., $INTERM, ...)\n"
            },
            {
              "pattern": "$DATA = request.$W(...)\n...\ndjango.db.models.expressions.RawSQL(..., $STR + $DATA, ...)\n"
            },
            {
              "pattern": "$DATA = request.$W(...)\n...\n$INTERM = $STR + $DATA\n...\ndjango.db.models.expressions.RawSQL(..., $INTERM, ...)\n"
            },
            {
              "pattern": "$A = django.db.models.expressions.RawSQL(..., request.$W(...), ...)"
            },
            {
              "pattern": "return django.db.models.expressions.RawSQL(..., request.$W(...), ...)"
            },
            {
              "pattern": "django.db.models.expressions.RawSQL(..., $S.format(..., request.$W[...], ...), ...)"
            },
            {
              "pattern": "django.db.models.expressions.RawSQL(..., $S % request.$W[...], ...)"
            },
            {
              "pattern": "django.db.models.expressions.RawSQL(..., f\"...{request.$W[...]}...\", ...)"
            },
            {
              "pattern": "django.db.models.expressions.RawSQL(..., request.$W[...], ...)"
            },
            {
              "pattern": "$DATA = request.$W[...]\n...\ndjango.db.models.expressions.RawSQL(..., $DATA, ...)\n"
            },
            {
              "pattern": "$DATA = request.$W[...]\n...\n$INTERM = $DATA\n...\ndjango.db.models.expressions.RawSQL(..., $INTERM, ...)\n"
            },
            {
              "pattern": "$DATA = request.$W[...]\n...\ndjango.db.models.expressions.RawSQL(..., $STR.format(..., $DATA, ...), ...)\n"
            },
            {
              "pattern": "$DATA = request.$W[...]\n...\n$INTERM = $STR.format(..., $DATA, ...)\n...\ndjango.db.models.expressions.RawSQL(..., $INTERM, ...)\n"
            },
            {
              "pattern": "$DATA = request.$W[...]\n...\ndjango.db.models.expressions.RawSQL(..., $STR % $DATA, ...)\n"
            },
            {
              "pattern": "$DATA = request.$W[...]\n...\n$INTERM = $STR % $DATA\n...\ndjango.db.models.expressions.RawSQL(..., $INTERM, ...)\n"
            },
            {
              "pattern": "$DATA = request.$W[...]\n...\ndjango.db.models.expressions.RawSQL(..., f\"...{$DATA}...\", ...)\n"
            },
            {
              "pattern": "$DATA = request.$W[...]\n...\n$INTERM = f\"...{$DATA}...\"\n...\ndjango.db.models.expressions.RawSQL(..., $INTERM, ...)\n"
            },
            {
              "pattern": "$DATA = request.$W[...]\n...\ndjango.db.models.expressions.RawSQL(..., $STR + $DATA, ...)\n"
            },
            {
              "pattern": "$DATA = request.$W[...]\n...\n$INTERM = $STR + $DATA\n...\ndjango.db.models.expressions.RawSQL(..., $INTERM, ...)\n"
            },
            {
              "pattern": "$A = django.db.models.expressions.RawSQL(..., request.$W[...], ...)"
            },
            {
              "pattern": "return django.db.models.expressions.RawSQL(..., request.$W[...], ...)"
            },
            {
              "pattern": "django.db.models.expressions.RawSQL(..., $S.format(..., request.$W, ...), ...)"
            },
            {
              "pattern": "django.db.models.expressions.RawSQL(..., $S % request.$W, ...)"
            },
            {
              "pattern": "django.db.models.expressions.RawSQL(..., f\"...{request.$W}...\", ...)"
            },
            {
              "pattern": "django.db.models.expressions.RawSQL(..., request.$W, ...)"
            },
            {
              "pattern": "$DATA = request.$W\n...\ndjango.db.models.expressions.RawSQL(..., $DATA, ...)\n"
            },
            {
              "pattern": "$DATA = request.$W\n...\n$INTERM = $DATA\n...\ndjango.db.models.expressions.RawSQL(..., $INTERM, ...)\n"
            },
            {
              "pattern": "$DATA = request.$W\n...\ndjango.db.models.expressions.RawSQL(..., $STR.format(..., $DATA, ...), ...)\n"
            },
            {
              "pattern": "$DATA = request.$W\n...\n$INTERM = $STR.format(..., $DATA, ...)\n...\ndjango.db.models.expressions.RawSQL(..., $INTERM, ...)\n"
            },
            {
              "pattern": "$DATA = request.$W\n...\ndjango.db.models.expressions.RawSQL(..., $STR % $DATA, ...)\n"
            },
            {
              "pattern": "$DATA = request.$W\n...\n$INTERM = $STR % $DATA\n...\ndjango.db.models.expressions.RawSQL(..., $INTERM, ...)\n"
            },
            {
              "pattern": "$DATA = request.$W\n...\ndjango.db.models.expressions.RawSQL(..., f\"...{$DATA}...\", ...)\n"
            },
            {
              "pattern": "$DATA = request.$W\n...\n$INTERM = f\"...{$DATA}...\"\n...\ndjango.db.models.expressions.RawSQL(..., $INTERM, ...)\n"
            },
            {
              "pattern": "$DATA = request.$W\n...\ndjango.db.models.expressions.RawSQL(..., $STR + $DATA, ...)\n"
            },
            {
              "pattern": "$DATA = request.$W\n...\n$INTERM = $STR + $DATA\n...\ndjango.db.models.expressions.RawSQL(..., $INTERM, ...)\n"
            },
            {
              "pattern": "$A = django.db.models.expressions.RawSQL(..., request.$W, ...)"
            },
            {
              "pattern": "return django.db.models.expressions.RawSQL(..., request.$W, ...)"
            },
            {
              "pattern": "$DATA = request.$W.get(...)\n...\ndjango.db.models.expressions.RawSQL($STR % (..., $DATA, ...), ...)\n"
            },
            {
              "pattern": "$DATA = request.$W[...]\n...\ndjango.db.models.expressions.RawSQL($STR % (..., $DATA, ...), ...)\n"
            },
            {
              "pattern": "$DATA = request.$W(...)\n...\ndjango.db.models.expressions.RawSQL($STR % (..., $DATA, ...), ...)\n"
            },
            {
              "pattern": "$DATA = request.$W\n...\ndjango.db.models.expressions.RawSQL($STR % (..., $DATA, ...), ...)\n"
            },
            {
              "pattern": "$DATA = request.$W.get(...)\n...\n$INTERM = $STR % (..., $DATA, ...)\n...\ndjango.db.models.expressions.RawSQL($INTERM, ...)\n"
            },
            {
              "pattern": "$DATA = request.$W(...)\n...\n$INTERM = $STR % (..., $DATA, ...)\n...\ndjango.db.models.expressions.RawSQL($INTERM, ...)\n"
            },
            {
              "pattern": "$DATA = request.$W[...]\n...\n$INTERM = $STR % (..., $DATA, ...)\n...\ndjango.db.models.expressions.RawSQL($INTERM, ...)\n"
            },
            {
              "pattern": "$DATA = request.$W\n...\n$INTERM = $STR % (..., $DATA, ...)\n...\ndjango.db.models.expressions.RawSQL($INTERM, ...)\n"
            }
          ]
        }
      ]
    },
    {
      "id": "python.django.security.injection.sql.sql-injection-using-db-cursor-execute.sql-injection-db-cursor-execute",
      "message": "User-controlled data from a request is passed to 'execute()'. This could lead to a SQL injection and therefore protected information could be leaked. Instead, use django's QuerySets, which are built with query parameterization and therefore not vulnerable to sql injection. For example, you could use `Entry.objects.filter(date=2006)`.",
      "metadata": {
        "cwe": [
          "CWE-89: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')"
        ],
        "owasp": [
          "A01:2017 - Injection",
          "A03:2021 - Injection",
          "A05:2025 - Injection"
        ],
        "references": [
          "https://docs.djangoproject.com/en/3.0/topics/security/#sql-injection-protection"
        ],
        "category": "security",
        "technology": [
          "django"
        ],
        "cwe2022-top25": true,
        "cwe2021-top25": true,
        "subcategory": [
          "vuln"
        ],
        "likelihood": "MEDIUM",
        "impact": "HIGH",
        "confidence": "MEDIUM",
        "license": "Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license",
        "vulnerability_class": [
          "SQL Injection"
        ],
        "source": "https://semgrep.dev/r/python.django.security.injection.sql.sql-injection-using-db-cursor-execute.sql-injection-db-cursor-execute",
        "shortlink": "https://sg.run/qx7y",
        "semgrep.dev": {
          "rule": {
            "r_id": 9512,
            "rv_id": 1263404,
            "rule_id": "2ZUbDL",
            "version_id": "0bTKzRj",
            "url": "https://semgrep.dev/playground/r/0bTKzRj/python.django.security.injection.sql.sql-injection-using-db-cursor-execute.sql-injection-db-cursor-execute",
            "origin": "community"
          }
        }
      },
      "languages": [
        "python"
      ],
      "severity": "WARNING",
      "patterns": [
        {
          "pattern-inside": "def $FUNC(...):\n  ...\n"
        },
        {
          "pattern-either": [
            {
              "pattern": "$CURSOR.execute(..., $S.format(..., request.$W.get(...), ...), ...)"
            },
            {
              "pattern": "$CURSOR.execute(..., $S % request.$W.get(...), ...)"
            },
            {
              "pattern": "$CURSOR.execute(..., f\"...{request.$W.get(...)}...\", ...)"
            },
            {
              "pattern": "$CURSOR.execute(..., request.$W.get(...), ...)"
            },
            {
              "pattern": "$DATA = request.$W.get(...)\n...\n$CURSOR.execute(..., $DATA, ...)\n"
            },
            {
              "pattern": "$DATA = request.$W.get(...)\n...\n$INTERM = $DATA\n...\n$CURSOR.execute(..., $INTERM, ...)\n"
            },
            {
              "pattern": "$DATA = request.$W.get(...)\n...\n$CURSOR.execute(..., $STR.format(..., $DATA, ...), ...)\n"
            },
            {
              "pattern": "$DATA = request.$W.get(...)\n...\n$INTERM = $STR.format(..., $DATA, ...)\n...\n$CURSOR.execute(..., $INTERM, ...)\n"
            },
            {
              "pattern": "$DATA = request.$W.get(...)\n...\n$CURSOR.execute(..., $STR % $DATA, ...)\n"
            },
            {
              "pattern": "$DATA = request.$W.get(...)\n...\n$INTERM = $STR % $DATA\n...\n$CURSOR.execute(..., $INTERM, ...)\n"
            },
            {
              "pattern": "$DATA = request.$W.get(...)\n...\n$CURSOR.execute(..., f\"...{$DATA}...\", ...)\n"
            },
            {
              "pattern": "$DATA = request.$W.get(...)\n...\n$INTERM = f\"...{$DATA}...\"\n...\n$CURSOR.execute(..., $INTERM, ...)\n"
            },
            {
              "pattern": "$DATA = request.$W.get(...)\n...\n$CURSOR.execute(..., $STR + $DATA, ...)\n"
            },
            {
              "pattern": "$DATA = request.$W.get(...)\n...\n$INTERM = $STR + $DATA\n...\n$CURSOR.execute(..., $INTERM, ...)\n"
            },
            {
              "pattern": "$A = $CURSOR.execute(..., request.$W.get(...), ...)"
            },
            {
              "pattern": "return $CURSOR.execute(..., request.$W.get(...), ...)"
            },
            {
              "pattern": "$CURSOR.execute(..., $S.format(..., request.$W(...), ...), ...)"
            },
            {
              "pattern": "$CURSOR.execute(..., $S % request.$W(...), ...)"
            },
            {
              "pattern": "$CURSOR.execute(..., f\"...{request.$W(...)}...\", ...)"
            },
            {
              "pattern": "$CURSOR.execute(..., request.$W(...), ...)"
            },
            {
              "pattern": "$DATA = request.$W(...)\n...\n$CURSOR.execute(..., $DATA, ...)\n"
            },
            {
              "pattern": "$DATA = request.$W(...)\n...\n$INTERM = $DATA\n...\n$CURSOR.execute(..., $INTERM, ...)\n"
            },
            {
              "pattern": "$DATA = request.$W(...)\n...\n$CURSOR.execute(..., $STR.format(..., $DATA, ...), ...)\n"
            },
            {
              "pattern": "$DATA = request.$W(...)\n...\n$INTERM = $STR.format(..., $DATA, ...)\n...\n$CURSOR.execute(..., $INTERM, ...)\n"
            },
            {
              "pattern": "$DATA = request.$W(...)\n...\n$CURSOR.execute(..., $STR % $DATA, ...)\n"
            },
            {
              "pattern": "$DATA = request.$W(...)\n...\n$INTERM = $STR % $DATA\n...\n$CURSOR.execute(..., $INTERM, ...)\n"
            },
            {
              "pattern": "$DATA = request.$W(...)\n...\n$CURSOR.execute(..., f\"...{$DATA}...\", ...)\n"
            },
            {
              "pattern": "$DATA = request.$W(...)\n...\n$INTERM = f\"...{$DATA}...\"\n...\n$CURSOR.execute(..., $INTERM, ...)\n"
            },
            {
              "pattern": "$DATA = request.$W(...)\n...\n$CURSOR.execute(..., $STR + $DATA, ...)\n"
            },
            {
              "pattern": "$DATA = request.$W(...)\n...\n$INTERM = $STR + $DATA\n...\n$CURSOR.execute(..., $INTERM, ...)\n"
            },
            {
              "pattern": "$A = $CURSOR.execute(..., request.$W(...), ...)"
            },
            {
              "pattern": "return $CURSOR.execute(..., request.$W(...), ...)"
            },
            {
              "pattern": "$CURSOR.execute(..., $S.format(..., request.$W[...], ...), ...)"
            },
            {
              "pattern": "$CURSOR.execute(..., $S % request.$W[...], ...)"
            },
            {
              "pattern": "$CURSOR.execute(..., f\"...{request.$W[...]}...\", ...)"
            },
            {
              "pattern": "$CURSOR.execute(..., request.$W[...], ...)"
            },
            {
              "pattern": "$DATA = request.$W[...]\n...\n$CURSOR.execute(..., $DATA, ...)\n"
            },
            {
              "pattern": "$DATA = request.$W[...]\n...\n$INTERM = $DATA\n...\n$CURSOR.execute(..., $INTERM, ...)\n"
            },
            {
              "pattern": "$DATA = request.$W[...]\n...\n$CURSOR.execute(..., $STR.format(..., $DATA, ...), ...)\n"
            },
            {
              "pattern": "$DATA = request.$W[...]\n...\n$INTERM = $STR.format(..., $DATA, ...)\n...\n$CURSOR.execute(..., $INTERM, ...)\n"
            },
            {
              "pattern": "$DATA = request.$W[...]\n...\n$CURSOR.execute(..., $STR % $DATA, ...)\n"
            },
            {
              "pattern": "$DATA = request.$W[...]\n...\n$INTERM = $STR % $DATA\n...\n$CURSOR.execute(..., $INTERM, ...)\n"
            },
            {
              "pattern": "$DATA = request.$W[...]\n...\n$CURSOR.execute(..., f\"...{$DATA}...\", ...)\n"
            },
            {
              "pattern": "$DATA = request.$W[...]\n...\n$INTERM = f\"...{$DATA}...\"\n...\n$CURSOR.execute(..., $INTERM, ...)\n"
            },
            {
              "pattern": "$DATA = request.$W[...]\n...\n$CURSOR.execute(..., $STR + $DATA, ...)\n"
            },
            {
              "pattern": "$DATA = request.$W[...]\n...\n$INTERM = $STR + $DATA\n...\n$CURSOR.execute(..., $INTERM, ...)\n"
            },
            {
              "pattern": "$A = $CURSOR.execute(..., request.$W[...], ...)"
            },
            {
              "pattern": "return $CURSOR.execute(..., request.$W[...], ...)"
            },
            {
              "pattern": "$CURSOR.execute(..., $S.format(..., request.$W, ...), ...)"
            },
            {
              "pattern": "$CURSOR.execute(..., $S % request.$W, ...)"
            },
            {
              "pattern": "$CURSOR.execute(..., f\"...{request.$W}...\", ...)"
            },
            {
              "pattern": "$CURSOR.execute(..., request.$W, ...)"
            },
            {
              "pattern": "$DATA = request.$W\n...\n$CURSOR.execute(..., $DATA, ...)\n"
            },
            {
              "pattern": "$DATA = request.$W\n...\n$INTERM = $DATA\n...\n$CURSOR.execute(..., $INTERM, ...)\n"
            },
            {
              "pattern": "$DATA = request.$W\n...\n$CURSOR.execute(..., $STR.format(..., $DATA, ...), ...)\n"
            },
            {
              "pattern": "$DATA = request.$W\n...\n$INTERM = $STR.format(..., $DATA, ...)\n...\n$CURSOR.execute(..., $INTERM, ...)\n"
            },
            {
              "pattern": "$DATA = request.$W\n...\n$CURSOR.execute(..., $STR % $DATA, ...)\n"
            },
            {
              "pattern": "$DATA = request.$W\n...\n$INTERM = $STR % $DATA\n...\n$CURSOR.execute(..., $INTERM, ...)\n"
            },
            {
              "pattern": "$DATA = request.$W\n...\n$CURSOR.execute(..., f\"...{$DATA}...\", ...)\n"
            },
            {
              "pattern": "$DATA = request.$W\n...\n$INTERM = f\"...{$DATA}...\"\n...\n$CURSOR.execute(..., $INTERM, ...)\n"
            },
            {
              "pattern": "$DATA = request.$W\n...\n$CURSOR.execute(..., $STR + $DATA, ...)\n"
            },
            {
              "pattern": "$DATA = request.$W\n...\n$INTERM = $STR + $DATA\n...\n$CURSOR.execute(..., $INTERM, ...)\n"
            },
            {
              "pattern": "$A = $CURSOR.execute(..., request.$W, ...)"
            },
            {
              "pattern": "return $CURSOR.execute(..., request.$W, ...)"
            },
            {
              "pattern": "$DATA = request.$W.get(...)\n...\n$CURSOR.execute($STR % (..., $DATA, ...), ...)\n"
            },
            {
              "pattern": "$DATA = request.$W[...]\n...\n$CURSOR.execute($STR % (..., $DATA, ...), ...)\n"
            },
            {
              "pattern": "$DATA = request.$W(...)\n...\n$CURSOR.execute($STR % (..., $DATA, ...), ...)\n"
            },
            {
              "pattern": "$DATA = request.$W\n...\n$CURSOR.execute($STR % (..., $DATA, ...), ...)\n"
            },
            {
              "pattern": "$DATA = request.$W.get(...)\n...\n$INTERM = $STR % (..., $DATA, ...)\n...\n$CURSOR.execute($INTERM, ...)\n"
            },
            {
              "pattern": "$DATA = request.$W(...)\n...\n$INTERM = $STR % (..., $DATA, ...)\n...\n$CURSOR.execute($INTERM, ...)\n"
            },
            {
              "pattern": "$DATA = request.$W[...]\n...\n$INTERM = $STR % (..., $DATA, ...)\n...\n$CURSOR.execute($INTERM, ...)\n"
            },
            {
              "pattern": "$DATA = request.$W\n...\n$INTERM = $STR % (..., $DATA, ...)\n...\n$CURSOR.execute($INTERM, ...)"
            }
          ]
        }
      ]
    },
    {
      "id": "python.django.security.injection.sql.sql-injection-using-raw.sql-injection-using-raw",
      "message": "Data that is possible user-controlled from a python request is passed to `raw()`. This could lead to SQL injection and attackers gaining access to protected information. Instead, use django's QuerySets, which are built with query parameterization and therefore not vulnerable to sql injection. For example, you could use `Entry.objects.filter(date=2006)`.",
      "metadata": {
        "cwe": [
          "CWE-89: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')"
        ],
        "owasp": [
          "A01:2017 - Injection",
          "A03:2021 - Injection",
          "A05:2025 - Injection"
        ],
        "references": [
          "https://docs.djangoproject.com/en/3.0/topics/security/#sql-injection-protection"
        ],
        "category": "security",
        "technology": [
          "django"
        ],
        "cwe2022-top25": true,
        "cwe2021-top25": true,
        "subcategory": [
          "vuln"
        ],
        "likelihood": "MEDIUM",
        "impact": "HIGH",
        "confidence": "MEDIUM",
        "license": "Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license",
        "vulnerability_class": [
          "SQL Injection"
        ],
        "source": "https://semgrep.dev/r/python.django.security.injection.sql.sql-injection-using-raw.sql-injection-using-raw",
        "shortlink": "https://sg.run/l2v9",
        "semgrep.dev": {
          "rule": {
            "r_id": 9513,
            "rv_id": 1263405,
            "rule_id": "X5U8v5",
            "version_id": "K3TKkBW",
            "url": "https://semgrep.dev/playground/r/K3TKkBW/python.django.security.injection.sql.sql-injection-using-raw.sql-injection-using-raw",
            "origin": "community"
          }
        }
      },
      "languages": [
        "python"
      ],
      "severity": "WARNING",
      "patterns": [
        {
          "pattern-inside": "def $FUNC(...):\n  ...\n"
        },
        {
          "pattern-either": [
            {
              "pattern": "$MODEL.objects.raw(..., $S.format(..., request.$W.get(...), ...), ...)"
            },
            {
              "pattern": "$MODEL.objects.raw(..., $S % request.$W.get(...), ...)"
            },
            {
              "pattern": "$MODEL.objects.raw(..., f\"...{request.$W.get(...)}...\", ...)"
            },
            {
              "pattern": "$MODEL.objects.raw(..., request.$W.get(...), ...)"
            },
            {
              "pattern": "$DATA = request.$W.get(...)\n...\n$MODEL.objects.raw(..., $DATA, ...)\n"
            },
            {
              "pattern": "$DATA = request.$W.get(...)\n...\n$INTERM = $DATA\n...\n$MODEL.objects.raw(..., $INTERM, ...)\n"
            },
            {
              "pattern": "$DATA = request.$W.get(...)\n...\n$MODEL.objects.raw(..., $STR.format(..., $DATA, ...), ...)\n"
            },
            {
              "pattern": "$DATA = request.$W.get(...)\n...\n$INTERM = $STR.format(..., $DATA, ...)\n...\n$MODEL.objects.raw(..., $INTERM, ...)\n"
            },
            {
              "pattern": "$DATA = request.$W.get(...)\n...\n$MODEL.objects.raw(..., $STR % $DATA, ...)\n"
            },
            {
              "pattern": "$DATA = request.$W.get(...)\n...\n$INTERM = $STR % $DATA\n...\n$MODEL.objects.raw(..., $INTERM, ...)\n"
            },
            {
              "pattern": "$DATA = request.$W.get(...)\n...\n$MODEL.objects.raw(..., f\"...{$DATA}...\", ...)\n"
            },
            {
              "pattern": "$DATA = request.$W.get(...)\n...\n$INTERM = f\"...{$DATA}...\"\n...\n$MODEL.objects.raw(..., $INTERM, ...)\n"
            },
            {
              "pattern": "$DATA = request.$W.get(...)\n...\n$MODEL.objects.raw(..., $STR + $DATA, ...)\n"
            },
            {
              "pattern": "$DATA = request.$W.get(...)\n...\n$INTERM = $STR + $DATA\n...\n$MODEL.objects.raw(..., $INTERM, ...)\n"
            },
            {
              "pattern": "$A = $MODEL.objects.raw(..., request.$W.get(...), ...)"
            },
            {
              "pattern": "return $MODEL.objects.raw(..., request.$W.get(...), ...)"
            },
            {
              "pattern": "$MODEL.objects.raw(..., $S.format(..., request.$W(...), ...), ...)"
            },
            {
              "pattern": "$MODEL.objects.raw(..., $S % request.$W(...), ...)"
            },
            {
              "pattern": "$MODEL.objects.raw(..., f\"...{request.$W(...)}...\", ...)"
            },
            {
              "pattern": "$MODEL.objects.raw(..., request.$W(...), ...)"
            },
            {
              "pattern": "$DATA = request.$W(...)\n...\n$MODEL.objects.raw(..., $DATA, ...)\n"
            },
            {
              "pattern": "$DATA = request.$W(...)\n...\n$INTERM = $DATA\n...\n$MODEL.objects.raw(..., $INTERM, ...)\n"
            },
            {
              "pattern": "$DATA = request.$W(...)\n...\n$MODEL.objects.raw(..., $STR.format(..., $DATA, ...), ...)\n"
            },
            {
              "pattern": "$DATA = request.$W(...)\n...\n$INTERM = $STR.format(..., $DATA, ...)\n...\n$MODEL.objects.raw(..., $INTERM, ...)\n"
            },
            {
              "pattern": "$DATA = request.$W(...)\n...\n$MODEL.objects.raw(..., $STR % $DATA, ...)\n"
            },
            {
              "pattern": "$DATA = request.$W(...)\n...\n$INTERM = $STR % $DATA\n...\n$MODEL.objects.raw(..., $INTERM, ...)\n"
            },
            {
              "pattern": "$DATA = request.$W(...)\n...\n$MODEL.objects.raw(..., f\"...{$DATA}...\", ...)\n"
            },
            {
              "pattern": "$DATA = request.$W(...)\n...\n$INTERM = f\"...{$DATA}...\"\n...\n$MODEL.objects.raw(..., $INTERM, ...)\n"
            },
            {
              "pattern": "$DATA = request.$W(...)\n...\n$MODEL.objects.raw(..., $STR + $DATA, ...)\n"
            },
            {
              "pattern": "$DATA = request.$W(...)\n...\n$INTERM = $STR + $DATA\n...\n$MODEL.objects.raw(..., $INTERM, ...)\n"
            },
            {
              "pattern": "$A = $MODEL.objects.raw(..., request.$W(...), ...)"
            },
            {
              "pattern": "return $MODEL.objects.raw(..., request.$W(...), ...)"
            },
            {
              "pattern": "$MODEL.objects.raw(..., $S.format(..., request.$W[...], ...), ...)"
            },
            {
              "pattern": "$MODEL.objects.raw(..., $S % request.$W[...], ...)"
            },
            {
              "pattern": "$MODEL.objects.raw(..., f\"...{request.$W[...]}...\", ...)"
            },
            {
              "pattern": "$MODEL.objects.raw(..., request.$W[...], ...)"
            },
            {
              "pattern": "$DATA = request.$W[...]\n...\n$MODEL.objects.raw(..., $DATA, ...)\n"
            },
            {
              "pattern": "$DATA = request.$W[...]\n...\n$INTERM = $DATA\n...\n$MODEL.objects.raw(..., $INTERM, ...)\n"
            },
            {
              "pattern": "$DATA = request.$W[...]\n...\n$MODEL.objects.raw(..., $STR.format(..., $DATA, ...), ...)\n"
            },
            {
              "pattern": "$DATA = request.$W[...]\n...\n$INTERM = $STR.format(..., $DATA, ...)\n...\n$MODEL.objects.raw(..., $INTERM, ...)\n"
            },
            {
              "pattern": "$DATA = request.$W[...]\n...\n$MODEL.objects.raw(..., $STR % $DATA, ...)\n"
            },
            {
              "pattern": "$DATA = request.$W[...]\n...\n$INTERM = $STR % $DATA\n...\n$MODEL.objects.raw(..., $INTERM, ...)\n"
            },
            {
              "pattern": "$DATA = request.$W[...]\n...\n$MODEL.objects.raw(..., f\"...{$DATA}...\", ...)\n"
            },
            {
              "pattern": "$DATA = request.$W[...]\n...\n$INTERM = f\"...{$DATA}...\"\n...\n$MODEL.objects.raw(..., $INTERM, ...)\n"
            },
            {
              "pattern": "$DATA = request.$W[...]\n...\n$MODEL.objects.raw(..., $STR + $DATA, ...)\n"
            },
            {
              "pattern": "$DATA = request.$W[...]\n...\n$INTERM = $STR + $DATA\n...\n$MODEL.objects.raw(..., $INTERM, ...)\n"
            },
            {
              "pattern": "$A = $MODEL.objects.raw(..., request.$W[...], ...)"
            },
            {
              "pattern": "return $MODEL.objects.raw(..., request.$W[...], ...)"
            },
            {
              "pattern": "$MODEL.objects.raw(..., $S.format(..., request.$W, ...), ...)"
            },
            {
              "pattern": "$MODEL.objects.raw(..., $S % request.$W, ...)"
            },
            {
              "pattern": "$MODEL.objects.raw(..., f\"...{request.$W}...\", ...)"
            },
            {
              "pattern": "$MODEL.objects.raw(..., request.$W, ...)"
            },
            {
              "pattern": "$DATA = request.$W\n...\n$MODEL.objects.raw(..., $DATA, ...)\n"
            },
            {
              "pattern": "$DATA = request.$W\n...\n$INTERM = $DATA\n...\n$MODEL.objects.raw(..., $INTERM, ...)\n"
            },
            {
              "pattern": "$DATA = request.$W\n...\n$MODEL.objects.raw(..., $STR.format(..., $DATA, ...), ...)\n"
            },
            {
              "pattern": "$DATA = request.$W\n...\n$INTERM = $STR.format(..., $DATA, ...)\n...\n$MODEL.objects.raw(..., $INTERM, ...)\n"
            },
            {
              "pattern": "$DATA = request.$W\n...\n$MODEL.objects.raw(..., $STR % $DATA, ...)\n"
            },
            {
              "pattern": "$DATA = request.$W\n...\n$INTERM = $STR % $DATA\n...\n$MODEL.objects.raw(..., $INTERM, ...)\n"
            },
            {
              "pattern": "$DATA = request.$W\n...\n$MODEL.objects.raw(..., f\"...{$DATA}...\", ...)\n"
            },
            {
              "pattern": "$DATA = request.$W\n...\n$INTERM = f\"...{$DATA}...\"\n...\n$MODEL.objects.raw(..., $INTERM, ...)\n"
            },
            {
              "pattern": "$DATA = request.$W\n...\n$MODEL.objects.raw(..., $STR + $DATA, ...)\n"
            },
            {
              "pattern": "$DATA = request.$W\n...\n$INTERM = $STR + $DATA\n...\n$MODEL.objects.raw(..., $INTERM, ...)\n"
            },
            {
              "pattern": "$A = $MODEL.objects.raw(..., request.$W, ...)"
            },
            {
              "pattern": "return $MODEL.objects.raw(..., request.$W, ...)"
            },
            {
              "pattern": "$DATA = request.$W.get(...)\n...\n$MODEL.objects.raw($STR % (..., $DATA, ...), ...)\n"
            },
            {
              "pattern": "$DATA = request.$W[...]\n...\n$MODEL.objects.raw($STR % (..., $DATA, ...), ...)\n"
            },
            {
              "pattern": "$DATA = request.$W(...)\n...\n$MODEL.objects.raw($STR % (..., $DATA, ...), ...)\n"
            },
            {
              "pattern": "$DATA = request.$W\n...\n$MODEL.objects.raw($STR % (..., $DATA, ...), ...)\n"
            },
            {
              "pattern": "$DATA = request.$W.get(...)\n...\n$INTERM = $STR % (..., $DATA, ...)\n...\n$MODEL.objects.raw($INTERM, ...)\n"
            },
            {
              "pattern": "$DATA = request.$W(...)\n...\n$INTERM = $STR % (..., $DATA, ...)\n...\n$MODEL.objects.raw($INTERM, ...)\n"
            },
            {
              "pattern": "$DATA = request.$W[...]\n...\n$INTERM = $STR % (..., $DATA, ...)\n...\n$MODEL.objects.raw($INTERM, ...)\n"
            },
            {
              "pattern": "$DATA = request.$W\n...\n$INTERM = $STR % (..., $DATA, ...)\n...\n$MODEL.objects.raw($INTERM, ...)\n"
            }
          ]
        }
      ]
    },
    {
      "id": "python.django.security.injection.ssrf.ssrf-injection-requests.ssrf-injection-requests",
      "message": "Data from request object is passed to a new server-side request. This could lead to a server-side request forgery (SSRF). To mitigate, ensure that schemes and hosts are validated against an allowlist, do not forward the response to the user, and ensure proper authentication and transport-layer security in the proxied request. See https://owasp.org/www-community/attacks/Server_Side_Request_Forgery to learn more about SSRF vulnerabilities.",
      "metadata": {
        "cwe": [
          "CWE-918: Server-Side Request Forgery (SSRF)"
        ],
        "owasp": [
          "A10:2021 - Server-Side Request Forgery (SSRF)",
          "A01:2025 - Broken Access Control"
        ],
        "references": [
          "https://owasp.org/www-community/attacks/Server_Side_Request_Forgery"
        ],
        "category": "security",
        "technology": [
          "django"
        ],
        "cwe2022-top25": true,
        "cwe2021-top25": true,
        "subcategory": [
          "vuln"
        ],
        "likelihood": "MEDIUM",
        "impact": "HIGH",
        "confidence": "MEDIUM",
        "license": "Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license",
        "vulnerability_class": [
          "Server-Side Request Forgery (SSRF)"
        ],
        "source": "https://semgrep.dev/r/python.django.security.injection.ssrf.ssrf-injection-requests.ssrf-injection-requests",
        "shortlink": "https://sg.run/YvY4",
        "semgrep.dev": {
          "rule": {
            "r_id": 9514,
            "rv_id": 1263406,
            "rule_id": "j2UvEw",
            "version_id": "qkTR7zn",
            "url": "https://semgrep.dev/playground/r/qkTR7zn/python.django.security.injection.ssrf.ssrf-injection-requests.ssrf-injection-requests",
            "origin": "community"
          }
        }
      },
      "languages": [
        "python"
      ],
      "severity": "ERROR",
      "patterns": [
        {
          "pattern-inside": "def $FUNC(...):\n  ...\n"
        },
        {
          "pattern-either": [
            {
              "pattern": "requests.$METHOD(..., $S.format(..., request.$W.get(...), ...), ...)"
            },
            {
              "pattern": "requests.$METHOD(..., $S % request.$W.get(...), ...)"
            },
            {
              "pattern": "requests.$METHOD(..., f\"...{request.$W.get(...)}...\", ...)"
            },
            {
              "pattern": "requests.$METHOD(..., request.$W.get(...), ...)"
            },
            {
              "pattern": "$DATA = request.$W.get(...)\n...\nrequests.$METHOD(..., $DATA, ...)\n"
            },
            {
              "pattern": "$DATA = request.$W.get(...)\n...\n$INTERM = $DATA\n...\nrequests.$METHOD(..., $INTERM, ...)\n"
            },
            {
              "pattern": "$DATA = request.$W.get(...)\n...\nrequests.$METHOD(..., $STR.format(..., $DATA, ...), ...)\n"
            },
            {
              "pattern": "$DATA = request.$W.get(...)\n...\n$INTERM = $STR.format(..., $DATA, ...)\n...\nrequests.$METHOD(..., $INTERM, ...)\n"
            },
            {
              "pattern": "$DATA = request.$W.get(...)\n...\nrequests.$METHOD(..., $STR % $DATA, ...)\n"
            },
            {
              "pattern": "$DATA = request.$W.get(...)\n...\n$INTERM = $STR % $DATA\n...\nrequests.$METHOD(..., $INTERM, ...)\n"
            },
            {
              "pattern": "$DATA = request.$W.get(...)\n...\nrequests.$METHOD(..., f\"...{$DATA}...\", ...)\n"
            },
            {
              "pattern": "$DATA = request.$W.get(...)\n...\n$INTERM = f\"...{$DATA}...\"\n...\nrequests.$METHOD(..., $INTERM, ...)\n"
            },
            {
              "pattern": "$DATA = request.$W.get(...)\n...\nrequests.$METHOD(..., $STR + $DATA, ...)\n"
            },
            {
              "pattern": "$DATA = request.$W.get(...)\n...\n$INTERM = $STR + $DATA\n...\nrequests.$METHOD(..., $INTERM, ...)\n"
            },
            {
              "pattern": "$A = requests.$METHOD(..., request.$W.get(...), ...)"
            },
            {
              "pattern": "return requests.$METHOD(..., request.$W.get(...), ...)"
            },
            {
              "pattern": "requests.$METHOD(..., $S.format(..., request.$W(...), ...), ...)"
            },
            {
              "pattern": "requests.$METHOD(..., $S % request.$W(...), ...)"
            },
            {
              "pattern": "requests.$METHOD(..., f\"...{request.$W(...)}...\", ...)"
            },
            {
              "pattern": "requests.$METHOD(..., request.$W(...), ...)"
            },
            {
              "pattern": "$DATA = request.$W(...)\n...\nrequests.$METHOD(..., $DATA, ...)\n"
            },
            {
              "pattern": "$DATA = request.$W(...)\n...\n$INTERM = $DATA\n...\nrequests.$METHOD(..., $INTERM, ...)\n"
            },
            {
              "pattern": "$DATA = request.$W(...)\n...\nrequests.$METHOD(..., $STR.format(..., $DATA, ...), ...)\n"
            },
            {
              "pattern": "$DATA = request.$W(...)\n...\n$INTERM = $STR.format(..., $DATA, ...)\n...\nrequests.$METHOD(..., $INTERM, ...)\n"
            },
            {
              "pattern": "$DATA = request.$W(...)\n...\nrequests.$METHOD(..., $STR % $DATA, ...)\n"
            },
            {
              "pattern": "$DATA = request.$W(...)\n...\n$INTERM = $STR % $DATA\n...\nrequests.$METHOD(..., $INTERM, ...)\n"
            },
            {
              "pattern": "$DATA = request.$W(...)\n...\nrequests.$METHOD(..., f\"...{$DATA}...\", ...)\n"
            },
            {
              "pattern": "$DATA = request.$W(...)\n...\n$INTERM = f\"...{$DATA}...\"\n...\nrequests.$METHOD(..., $INTERM, ...)\n"
            },
            {
              "pattern": "$DATA = request.$W(...)\n...\nrequests.$METHOD(..., $STR + $DATA, ...)\n"
            },
            {
              "pattern": "$DATA = request.$W(...)\n...\n$INTERM = $STR + $DATA\n...\nrequests.$METHOD(..., $INTERM, ...)\n"
            },
            {
              "pattern": "$A = requests.$METHOD(..., request.$W(...), ...)"
            },
            {
              "pattern": "return requests.$METHOD(..., request.$W(...), ...)"
            },
            {
              "pattern": "requests.$METHOD(..., $S.format(..., request.$W[...], ...), ...)"
            },
            {
              "pattern": "requests.$METHOD(..., $S % request.$W[...], ...)"
            },
            {
              "pattern": "requests.$METHOD(..., f\"...{request.$W[...]}...\", ...)"
            },
            {
              "pattern": "requests.$METHOD(..., request.$W[...], ...)"
            },
            {
              "pattern": "$DATA = request.$W[...]\n...\nrequests.$METHOD(..., $DATA, ...)\n"
            },
            {
              "pattern": "$DATA = request.$W[...]\n...\n$INTERM = $DATA\n...\nrequests.$METHOD(..., $INTERM, ...)\n"
            },
            {
              "pattern": "$DATA = request.$W[...]\n...\nrequests.$METHOD(..., $STR.format(..., $DATA, ...), ...)\n"
            },
            {
              "pattern": "$DATA = request.$W[...]\n...\n$INTERM = $STR.format(..., $DATA, ...)\n...\nrequests.$METHOD(..., $INTERM, ...)\n"
            },
            {
              "pattern": "$DATA = request.$W[...]\n...\nrequests.$METHOD(..., $STR % $DATA, ...)\n"
            },
            {
              "pattern": "$DATA = request.$W[...]\n...\n$INTERM = $STR % $DATA\n...\nrequests.$METHOD(..., $INTERM, ...)\n"
            },
            {
              "pattern": "$DATA = request.$W[...]\n...\nrequests.$METHOD(..., f\"...{$DATA}...\", ...)\n"
            },
            {
              "pattern": "$DATA = request.$W[...]\n...\n$INTERM = f\"...{$DATA}...\"\n...\nrequests.$METHOD(..., $INTERM, ...)\n"
            },
            {
              "pattern": "$DATA = request.$W[...]\n...\nrequests.$METHOD(..., $STR + $DATA, ...)\n"
            },
            {
              "pattern": "$DATA = request.$W[...]\n...\n$INTERM = $STR + $DATA\n...\nrequests.$METHOD(..., $INTERM, ...)\n"
            },
            {
              "pattern": "$A = requests.$METHOD(..., request.$W[...], ...)"
            },
            {
              "pattern": "return requests.$METHOD(..., request.$W[...], ...)"
            },
            {
              "pattern": "requests.$METHOD(..., $S.format(..., request.$W, ...), ...)"
            },
            {
              "pattern": "requests.$METHOD(..., $S % request.$W, ...)"
            },
            {
              "pattern": "requests.$METHOD(..., f\"...{request.$W}...\", ...)"
            },
            {
              "pattern": "requests.$METHOD(..., request.$W, ...)"
            },
            {
              "pattern": "$DATA = request.$W\n...\nrequests.$METHOD(..., $DATA, ...)\n"
            },
            {
              "pattern": "$DATA = request.$W\n...\n$INTERM = $DATA\n...\nrequests.$METHOD(..., $INTERM, ...)\n"
            },
            {
              "pattern": "$DATA = request.$W\n...\nrequests.$METHOD(..., $STR.format(..., $DATA, ...), ...)\n"
            },
            {
              "pattern": "$DATA = request.$W\n...\n$INTERM = $STR.format(..., $DATA, ...)\n...\nrequests.$METHOD(..., $INTERM, ...)\n"
            },
            {
              "pattern": "$DATA = request.$W\n...\nrequests.$METHOD(..., $STR % $DATA, ...)\n"
            },
            {
              "pattern": "$DATA = request.$W\n...\n$INTERM = $STR % $DATA\n...\nrequests.$METHOD(..., $INTERM, ...)\n"
            },
            {
              "pattern": "$DATA = request.$W\n...\nrequests.$METHOD(..., f\"...{$DATA}...\", ...)\n"
            },
            {
              "pattern": "$DATA = request.$W\n...\n$INTERM = f\"...{$DATA}...\"\n...\nrequests.$METHOD(..., $INTERM, ...)\n"
            },
            {
              "pattern": "$DATA = request.$W\n...\nrequests.$METHOD(..., $STR + $DATA, ...)\n"
            },
            {
              "pattern": "$DATA = request.$W\n...\n$INTERM = $STR + $DATA\n...\nrequests.$METHOD(..., $INTERM, ...)\n"
            },
            {
              "pattern": "$A = requests.$METHOD(..., request.$W, ...)"
            },
            {
              "pattern": "return requests.$METHOD(..., request.$W, ...)"
            }
          ]
        }
      ]
    },
    {
      "id": "python.django.security.injection.ssrf.ssrf-injection-urllib.ssrf-injection-urllib",
      "message": "Data from request object is passed to a new server-side request. This could lead to a server-side request forgery (SSRF), which could result in attackers gaining access to private organization data. To mitigate, ensure that schemes and hosts are validated against an allowlist, do not forward the response to the user, and ensure proper authentication and transport-layer security in the proxied request.",
      "metadata": {
        "cwe": [
          "CWE-918: Server-Side Request Forgery (SSRF)"
        ],
        "owasp": [
          "A10:2021 - Server-Side Request Forgery (SSRF)",
          "A01:2025 - Broken Access Control"
        ],
        "references": [
          "https://owasp.org/www-community/attacks/Server_Side_Request_Forgery"
        ],
        "category": "security",
        "technology": [
          "django"
        ],
        "cwe2022-top25": true,
        "cwe2021-top25": true,
        "subcategory": [
          "vuln"
        ],
        "likelihood": "MEDIUM",
        "impact": "HIGH",
        "confidence": "MEDIUM",
        "license": "Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license",
        "vulnerability_class": [
          "Server-Side Request Forgery (SSRF)"
        ],
        "source": "https://semgrep.dev/r/python.django.security.injection.ssrf.ssrf-injection-urllib.ssrf-injection-urllib",
        "shortlink": "https://sg.run/6n2B",
        "semgrep.dev": {
          "rule": {
            "r_id": 9515,
            "rv_id": 1263407,
            "rule_id": "10UKDo",
            "version_id": "l4TJRwD",
            "url": "https://semgrep.dev/playground/r/l4TJRwD/python.django.security.injection.ssrf.ssrf-injection-urllib.ssrf-injection-urllib",
            "origin": "community"
          }
        }
      },
      "languages": [
        "python"
      ],
      "severity": "ERROR",
      "patterns": [
        {
          "pattern-inside": "def $FUNC(...):\n  ...\n"
        },
        {
          "pattern-either": [
            {
              "pattern": "urllib.request.urlopen(..., $S.format(..., request.$W.get(...), ...), ...)"
            },
            {
              "pattern": "urllib.request.urlopen(..., $S % request.$W.get(...), ...)"
            },
            {
              "pattern": "urllib.request.urlopen(..., f\"...{request.$W.get(...)}...\", ...)"
            },
            {
              "pattern": "urllib.request.urlopen(..., request.$W.get(...), ...)"
            },
            {
              "pattern": "$DATA = request.$W.get(...)\n...\nurllib.request.urlopen(..., $DATA, ...)\n"
            },
            {
              "pattern": "$DATA = request.$W.get(...)\n...\n$INTERM = $DATA\n...\nurllib.request.urlopen(..., $INTERM, ...)\n"
            },
            {
              "pattern": "$DATA = request.$W.get(...)\n...\nurllib.request.urlopen(..., $STR.format(..., $DATA, ...), ...)\n"
            },
            {
              "pattern": "$DATA = request.$W.get(...)\n...\n$INTERM = $STR.format(..., $DATA, ...)\n...\nurllib.request.urlopen(..., $INTERM, ...)\n"
            },
            {
              "pattern": "$DATA = request.$W.get(...)\n...\nurllib.request.urlopen(..., $STR % $DATA, ...)\n"
            },
            {
              "pattern": "$DATA = request.$W.get(...)\n...\n$INTERM = $STR % $DATA\n...\nurllib.request.urlopen(..., $INTERM, ...)\n"
            },
            {
              "pattern": "$DATA = request.$W.get(...)\n...\nurllib.request.urlopen(..., f\"...{$DATA}...\", ...)\n"
            },
            {
              "pattern": "$DATA = request.$W.get(...)\n...\n$INTERM = f\"...{$DATA}...\"\n...\nurllib.request.urlopen(..., $INTERM, ...)\n"
            },
            {
              "pattern": "$DATA = request.$W.get(...)\n...\nurllib.request.urlopen(..., $STR + $DATA, ...)\n"
            },
            {
              "pattern": "$DATA = request.$W.get(...)\n...\n$INTERM = $STR + $DATA\n...\nurllib.request.urlopen(..., $INTERM, ...)\n"
            },
            {
              "pattern": "$A = urllib.request.urlopen(..., request.$W.get(...), ...)"
            },
            {
              "pattern": "return urllib.request.urlopen(..., request.$W.get(...), ...)"
            },
            {
              "pattern": "urllib.request.urlopen(..., $S.format(..., request.$W(...), ...), ...)"
            },
            {
              "pattern": "urllib.request.urlopen(..., $S % request.$W(...), ...)"
            },
            {
              "pattern": "urllib.request.urlopen(..., f\"...{request.$W(...)}...\", ...)"
            },
            {
              "pattern": "urllib.request.urlopen(..., request.$W(...), ...)"
            },
            {
              "pattern": "$DATA = request.$W(...)\n...\nurllib.request.urlopen(..., $DATA, ...)\n"
            },
            {
              "pattern": "$DATA = request.$W(...)\n...\n$INTERM = $DATA\n...\nurllib.request.urlopen(..., $INTERM, ...)\n"
            },
            {
              "pattern": "$DATA = request.$W(...)\n...\nurllib.request.urlopen(..., $STR.format(..., $DATA, ...), ...)\n"
            },
            {
              "pattern": "$DATA = request.$W(...)\n...\n$INTERM = $STR.format(..., $DATA, ...)\n...\nurllib.request.urlopen(..., $INTERM, ...)\n"
            },
            {
              "pattern": "$DATA = request.$W(...)\n...\nurllib.request.urlopen(..., $STR % $DATA, ...)\n"
            },
            {
              "pattern": "$DATA = request.$W(...)\n...\n$INTERM = $STR % $DATA\n...\nurllib.request.urlopen(..., $INTERM, ...)\n"
            },
            {
              "pattern": "$DATA = request.$W(...)\n...\nurllib.request.urlopen(..., f\"...{$DATA}...\", ...)\n"
            },
            {
              "pattern": "$DATA = request.$W(...)\n...\n$INTERM = f\"...{$DATA}...\"\n...\nurllib.request.urlopen(..., $INTERM, ...)\n"
            },
            {
              "pattern": "$DATA = request.$W(...)\n...\nurllib.request.urlopen(..., $STR + $DATA, ...)\n"
            },
            {
              "pattern": "$DATA = request.$W(...)\n...\n$INTERM = $STR + $DATA\n...\nurllib.request.urlopen(..., $INTERM, ...)\n"
            },
            {
              "pattern": "$A = urllib.request.urlopen(..., request.$W(...), ...)"
            },
            {
              "pattern": "return urllib.request.urlopen(..., request.$W(...), ...)"
            },
            {
              "pattern": "urllib.request.urlopen(..., $S.format(..., request.$W[...], ...), ...)"
            },
            {
              "pattern": "urllib.request.urlopen(..., $S % request.$W[...], ...)"
            },
            {
              "pattern": "urllib.request.urlopen(..., f\"...{request.$W[...]}...\", ...)"
            },
            {
              "pattern": "urllib.request.urlopen(..., request.$W[...], ...)"
            },
            {
              "pattern": "$DATA = request.$W[...]\n...\nurllib.request.urlopen(..., $DATA, ...)\n"
            },
            {
              "pattern": "$DATA = request.$W[...]\n...\n$INTERM = $DATA\n...\nurllib.request.urlopen(..., $INTERM, ...)\n"
            },
            {
              "pattern": "$DATA = request.$W[...]\n...\nurllib.request.urlopen(..., $STR.format(..., $DATA, ...), ...)\n"
            },
            {
              "pattern": "$DATA = request.$W[...]\n...\n$INTERM = $STR.format(..., $DATA, ...)\n...\nurllib.request.urlopen(..., $INTERM, ...)\n"
            },
            {
              "pattern": "$DATA = request.$W[...]\n...\nurllib.request.urlopen(..., $STR % $DATA, ...)\n"
            },
            {
              "pattern": "$DATA = request.$W[...]\n...\n$INTERM = $STR % $DATA\n...\nurllib.request.urlopen(..., $INTERM, ...)\n"
            },
            {
              "pattern": "$DATA = request.$W[...]\n...\nurllib.request.urlopen(..., f\"...{$DATA}...\", ...)\n"
            },
            {
              "pattern": "$DATA = request.$W[...]\n...\n$INTERM = f\"...{$DATA}...\"\n...\nurllib.request.urlopen(..., $INTERM, ...)\n"
            },
            {
              "pattern": "$DATA = request.$W[...]\n...\nurllib.request.urlopen(..., $STR + $DATA, ...)\n"
            },
            {
              "pattern": "$DATA = request.$W[...]\n...\n$INTERM = $STR + $DATA\n...\nurllib.request.urlopen(..., $INTERM, ...)\n"
            },
            {
              "pattern": "$A = urllib.request.urlopen(..., request.$W[...], ...)"
            },
            {
              "pattern": "return urllib.request.urlopen(..., request.$W[...], ...)"
            },
            {
              "pattern": "urllib.request.urlopen(..., $S.format(..., request.$W, ...), ...)"
            },
            {
              "pattern": "urllib.request.urlopen(..., $S % request.$W, ...)"
            },
            {
              "pattern": "urllib.request.urlopen(..., f\"...{request.$W}...\", ...)"
            },
            {
              "pattern": "urllib.request.urlopen(..., request.$W, ...)"
            },
            {
              "pattern": "$DATA = request.$W\n...\nurllib.request.urlopen(..., $DATA, ...)\n"
            },
            {
              "pattern": "$DATA = request.$W\n...\n$INTERM = $DATA\n...\nurllib.request.urlopen(..., $INTERM, ...)\n"
            },
            {
              "pattern": "$DATA = request.$W\n...\nurllib.request.urlopen(..., $STR.format(..., $DATA, ...), ...)\n"
            },
            {
              "pattern": "$DATA = request.$W\n...\n$INTERM = $STR.format(..., $DATA, ...)\n...\nurllib.request.urlopen(..., $INTERM, ...)\n"
            },
            {
              "pattern": "$DATA = request.$W\n...\nurllib.request.urlopen(..., $STR % $DATA, ...)\n"
            },
            {
              "pattern": "$DATA = request.$W\n...\n$INTERM = $STR % $DATA\n...\nurllib.request.urlopen(..., $INTERM, ...)\n"
            },
            {
              "pattern": "$DATA = request.$W\n...\nurllib.request.urlopen(..., f\"...{$DATA}...\", ...)\n"
            },
            {
              "pattern": "$DATA = request.$W\n...\n$INTERM = f\"...{$DATA}...\"\n...\nurllib.request.urlopen(..., $INTERM, ...)\n"
            },
            {
              "pattern": "$DATA = request.$W\n...\nurllib.request.urlopen(..., $STR + $DATA, ...)\n"
            },
            {
              "pattern": "$DATA = request.$W\n...\n$INTERM = $STR + $DATA\n...\nurllib.request.urlopen(..., $INTERM, ...)\n"
            },
            {
              "pattern": "$A = urllib.request.urlopen(..., request.$W, ...)"
            },
            {
              "pattern": "return urllib.request.urlopen(..., request.$W, ...)"
            }
          ]
        }
      ]
    },
    {
      "id": "python.django.security.passwords.password-empty-string.password-empty-string",
      "message": "'$VAR' is the empty string and is being used to set the password on '$MODEL'. If you meant to set an unusable password, set the password to None or call 'set_unusable_password()'.",
      "metadata": {
        "cwe": [
          "CWE-521: Weak Password Requirements"
        ],
        "owasp": [
          "A07:2021 - Identification and Authentication Failures",
          "A07:2025 - Authentication Failures"
        ],
        "references": [
          "https://docs.djangoproject.com/en/3.0/ref/contrib/auth/#django.contrib.auth.models.User.set_password"
        ],
        "category": "security",
        "technology": [
          "django"
        ],
        "subcategory": [
          "vuln"
        ],
        "likelihood": "LOW",
        "impact": "MEDIUM",
        "confidence": "MEDIUM",
        "license": "Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license",
        "vulnerability_class": [
          "Improper Authentication"
        ],
        "source": "https://semgrep.dev/r/python.django.security.passwords.password-empty-string.password-empty-string",
        "shortlink": "https://sg.run/oxnR",
        "semgrep.dev": {
          "rule": {
            "r_id": 9516,
            "rv_id": 1263411,
            "rule_id": "9AU1jW",
            "version_id": "GxTke5Q",
            "url": "https://semgrep.dev/playground/r/GxTke5Q/python.django.security.passwords.password-empty-string.password-empty-string",
            "origin": "community"
          }
        }
      },
      "patterns": [
        {
          "pattern-either": [
            {
              "pattern": "$MODEL.set_password($EMPTY)\n...\n$MODEL.save()\n"
            },
            {
              "pattern": "$VAR = $EMPTY\n...\n$MODEL.set_password($VAR)\n...\n$MODEL.save()\n"
            }
          ]
        },
        {
          "metavariable-regex": {
            "metavariable": "$EMPTY",
            "regex": "(\\'\\'|\\\"\\\")"
          }
        }
      ],
      "languages": [
        "python"
      ],
      "severity": "ERROR"
    },
    {
      "id": "python.django.security.passwords.use-none-for-password-default.use-none-for-password-default",
      "message": "'$VAR' is using the empty string as its default and is being used to set the password on '$MODEL'. If you meant to set an unusable password, set the default value to 'None' or call 'set_unusable_password()'.",
      "metadata": {
        "cwe": [
          "CWE-521: Weak Password Requirements"
        ],
        "owasp": [
          "A07:2021 - Identification and Authentication Failures",
          "A07:2025 - Authentication Failures"
        ],
        "references": [
          "https://docs.djangoproject.com/en/3.0/ref/contrib/auth/#django.contrib.auth.models.User.set_password"
        ],
        "category": "security",
        "technology": [
          "django"
        ],
        "subcategory": [
          "vuln"
        ],
        "likelihood": "MEDIUM",
        "impact": "MEDIUM",
        "confidence": "MEDIUM",
        "license": "Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license",
        "vulnerability_class": [
          "Improper Authentication"
        ],
        "source": "https://semgrep.dev/r/python.django.security.passwords.use-none-for-password-default.use-none-for-password-default",
        "shortlink": "https://sg.run/zvBW",
        "semgrep.dev": {
          "rule": {
            "r_id": 9517,
            "rv_id": 1263412,
            "rule_id": "yyUn6Z",
            "version_id": "RGT0LYX",
            "url": "https://semgrep.dev/playground/r/RGT0LYX/python.django.security.passwords.use-none-for-password-default.use-none-for-password-default",
            "origin": "community"
          }
        }
      },
      "languages": [
        "python"
      ],
      "severity": "ERROR",
      "patterns": [
        {
          "pattern-either": [
            {
              "pattern": "$VAR = request.$W.get($X, $EMPTY)\n...\n$MODEL.set_password($VAR)\n...\n$MODEL.save(...)\n"
            },
            {
              "pattern": "def $F(..., $VAR=$EMPTY, ...):\n  ...\n  $MODEL.set_password($VAR)\n"
            }
          ]
        },
        {
          "metavariable-pattern": {
            "metavariable": "$EMPTY",
            "pattern": "\"\""
          }
        },
        {
          "focus-metavariable": "$EMPTY"
        }
      ],
      "fix": "None\n"
    },
    {
      "id": "python.flask.security.audit.app-run-param-config.avoid_app_run_with_bad_host",
      "message": "Running flask app with host 0.0.0.0 could expose the server publicly.",
      "metadata": {
        "cwe": [
          "CWE-668: Exposure of Resource to Wrong Sphere"
        ],
        "owasp": [
          "A01:2021 - Broken Access Control",
          "A01:2025 - Broken Access Control"
        ],
        "category": "security",
        "technology": [
          "flask"
        ],
        "references": [
          "https://owasp.org/Top10/A01_2021-Broken_Access_Control"
        ],
        "subcategory": [
          "vuln"
        ],
        "likelihood": "HIGH",
        "impact": "MEDIUM",
        "confidence": "HIGH",
        "license": "Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license",
        "vulnerability_class": [
          "Other"
        ],
        "source": "https://semgrep.dev/r/python.flask.security.audit.app-run-param-config.avoid_app_run_with_bad_host",
        "shortlink": "https://sg.run/eLby",
        "semgrep.dev": {
          "rule": {
            "r_id": 9532,
            "rv_id": 1263414,
            "rule_id": "L1Uy1n",
            "version_id": "BjTkZOY",
            "url": "https://semgrep.dev/playground/r/BjTkZOY/python.flask.security.audit.app-run-param-config.avoid_app_run_with_bad_host",
            "origin": "community"
          }
        }
      },
      "languages": [
        "python"
      ],
      "severity": "WARNING",
      "pattern-either": [
        {
          "pattern": "app.run(..., host=\"0.0.0.0\", ...)"
        },
        {
          "pattern": "app.run(..., \"0.0.0.0\", ...)"
        }
      ]
    },
    {
      "id": "python.flask.security.audit.app-run-security-config.avoid_using_app_run_directly",
      "patterns": [
        {
          "pattern-not-inside": "if __name__ == '__main__':\n  ...\n"
        },
        {
          "pattern-not-inside": "def $X(...):\n  ...\n"
        },
        {
          "pattern": "app.run(...)"
        }
      ],
      "message": "top-level app.run(...) is ignored by flask. Consider putting app.run(...) behind a guard, like inside a function",
      "metadata": {
        "cwe": [
          "CWE-668: Exposure of Resource to Wrong Sphere"
        ],
        "owasp": [
          "A01:2021 - Broken Access Control",
          "A01:2025 - Broken Access Control"
        ],
        "category": "security",
        "technology": [
          "flask"
        ],
        "references": [
          "https://owasp.org/Top10/A01_2021-Broken_Access_Control"
        ],
        "subcategory": [
          "vuln"
        ],
        "likelihood": "LOW",
        "impact": "MEDIUM",
        "confidence": "MEDIUM",
        "license": "Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license",
        "vulnerability_class": [
          "Other"
        ],
        "source": "https://semgrep.dev/r/python.flask.security.audit.app-run-security-config.avoid_using_app_run_directly",
        "shortlink": "https://sg.run/vz5b",
        "semgrep.dev": {
          "rule": {
            "r_id": 9533,
            "rv_id": 1263415,
            "rule_id": "8GUjdX",
            "version_id": "DkTRb4z",
            "url": "https://semgrep.dev/playground/r/DkTRb4z/python.flask.security.audit.app-run-security-config.avoid_using_app_run_directly",
            "origin": "community"
          }
        }
      },
      "languages": [
        "python"
      ],
      "severity": "WARNING"
    },
    {
      "id": "python.flask.security.audit.debug-enabled.debug-enabled",
      "patterns": [
        {
          "pattern-inside": "import flask\n...\n"
        },
        {
          "pattern": "$APP.run(..., debug=True, ...)"
        }
      ],
      "message": "Detected Flask app with debug=True. Do not deploy to production with this flag enabled as it will leak sensitive information. Instead, consider using Flask configuration variables or setting 'debug' using system environment variables.",
      "metadata": {
        "cwe": [
          "CWE-489: Active Debug Code"
        ],
        "owasp": "A06:2017 - Security Misconfiguration",
        "references": [
          "https://labs.detectify.com/2015/10/02/how-patreon-got-hacked-publicly-exposed-werkzeug-debugger/"
        ],
        "category": "security",
        "technology": [
          "flask"
        ],
        "subcategory": [
          "vuln"
        ],
        "likelihood": "HIGH",
        "impact": "MEDIUM",
        "confidence": "HIGH",
        "license": "Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license",
        "vulnerability_class": [
          "Active Debug Code"
        ],
        "source": "https://semgrep.dev/r/python.flask.security.audit.debug-enabled.debug-enabled",
        "shortlink": "https://sg.run/dKrd",
        "semgrep.dev": {
          "rule": {
            "r_id": 9534,
            "rv_id": 946206,
            "rule_id": "gxU1bd",
            "version_id": "8KTKjwR",
            "url": "https://semgrep.dev/playground/r/8KTKjwR/python.flask.security.audit.debug-enabled.debug-enabled",
            "origin": "community"
          }
        }
      },
      "severity": "WARNING",
      "languages": [
        "python"
      ]
    },
    {
      "id": "python.flask.security.audit.directly-returned-format-string.directly-returned-format-string",
      "message": "Detected Flask route directly returning a formatted string. This is subject to cross-site scripting if user input can reach the string. Consider using the template engine instead and rendering pages with 'render_template()'.",
      "metadata": {
        "cwe": [
          "CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')"
        ],
        "owasp": [
          "A07:2017 - Cross-Site Scripting (XSS)",
          "A03:2021 - Injection",
          "A05:2025 - Injection"
        ],
        "category": "security",
        "technology": [
          "flask"
        ],
        "references": [
          "https://owasp.org/Top10/A03_2021-Injection"
        ],
        "cwe2022-top25": true,
        "cwe2021-top25": true,
        "subcategory": [
          "vuln"
        ],
        "likelihood": "HIGH",
        "impact": "MEDIUM",
        "confidence": "MEDIUM",
        "license": "Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license",
        "vulnerability_class": [
          "Cross-Site-Scripting (XSS)"
        ],
        "source": "https://semgrep.dev/r/python.flask.security.audit.directly-returned-format-string.directly-returned-format-string",
        "shortlink": "https://sg.run/Zv6o",
        "semgrep.dev": {
          "rule": {
            "r_id": 9535,
            "rv_id": 1263416,
            "rule_id": "QrUz49",
            "version_id": "WrTqKAz",
            "url": "https://semgrep.dev/playground/r/WrTqKAz/python.flask.security.audit.directly-returned-format-string.directly-returned-format-string",
            "origin": "community"
          }
        }
      },
      "languages": [
        "python"
      ],
      "severity": "WARNING",
      "mode": "taint",
      "pattern-sources": [
        {
          "pattern-either": [
            {
              "patterns": [
                {
                  "pattern-inside": "@$APP.route(...)\ndef $FUNC(..., $PARAM, ...):\n  ...\n"
                },
                {
                  "pattern": "$PARAM"
                }
              ]
            },
            {
              "pattern": "request.$FUNC.get(...)\n"
            },
            {
              "pattern": "request.$FUNC(...)\n"
            },
            {
              "pattern": "request.$FUNC[...]"
            }
          ]
        }
      ],
      "pattern-sinks": [
        {
          "patterns": [
            {
              "pattern-not-inside": "return \"...\""
            },
            {
              "pattern-either": [
                {
                  "pattern": "return \"...\".format(...)"
                },
                {
                  "pattern": "return \"...\" % ..."
                },
                {
                  "pattern": "return \"...\" + ..."
                },
                {
                  "pattern": "return ... + \"...\""
                },
                {
                  "pattern": "return f\"...{...}...\""
                },
                {
                  "patterns": [
                    {
                      "pattern": "return $X"
                    },
                    {
                      "pattern-either": [
                        {
                          "pattern-inside": "$X = \"...\".format(...)\n...\n"
                        },
                        {
                          "pattern-inside": "$X = \"...\" % ...\n...\n"
                        },
                        {
                          "pattern-inside": "$X = \"...\" + ...\n...\n"
                        },
                        {
                          "pattern-inside": "$X = ... + \"...\"\n...\n"
                        },
                        {
                          "pattern-inside": "$X = f\"...{...}...\"\n...\n"
                        }
                      ]
                    },
                    {
                      "pattern-not-inside": "$X = \"...\"\n...\n"
                    }
                  ]
                }
              ]
            }
          ]
        }
      ]
    },
    {
      "id": "python.flask.security.injection.os-system-injection.os-system-injection",
      "languages": [
        "python"
      ],
      "severity": "ERROR",
      "message": "User data detected in os.system. This could be vulnerable to a command injection and should be avoided. If this must be done, use the 'subprocess' module instead and pass the arguments as a list.",
      "metadata": {
        "cwe": [
          "CWE-78: Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')"
        ],
        "owasp": [
          "A01:2017 - Injection",
          "A03:2021 - Injection",
          "A05:2025 - Injection"
        ],
        "references": [
          "https://owasp.org/www-community/attacks/Command_Injection"
        ],
        "category": "security",
        "technology": [
          "flask"
        ],
        "cwe2022-top25": true,
        "cwe2021-top25": true,
        "subcategory": [
          "audit"
        ],
        "likelihood": "MEDIUM",
        "impact": "HIGH",
        "confidence": "MEDIUM",
        "license": "Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license",
        "vulnerability_class": [
          "Command Injection"
        ],
        "source": "https://semgrep.dev/r/python.flask.security.injection.os-system-injection.os-system-injection",
        "shortlink": "https://sg.run/4xzz",
        "semgrep.dev": {
          "rule": {
            "r_id": 9544,
            "rv_id": 1263429,
            "rule_id": "BYUN99",
            "version_id": "1QTypw7",
            "url": "https://semgrep.dev/playground/r/1QTypw7/python.flask.security.injection.os-system-injection.os-system-injection",
            "origin": "community"
          }
        }
      },
      "pattern-either": [
        {
          "patterns": [
            {
              "pattern": "os.system(...)"
            },
            {
              "pattern-either": [
                {
                  "pattern-inside": "@$APP.route($ROUTE, ...)\ndef $FUNC(..., $ROUTEVAR, ...):\n  ...\n  os.system(..., <... $ROUTEVAR ...>, ...)\n"
                },
                {
                  "pattern-inside": "@$APP.route($ROUTE, ...)\ndef $FUNC(..., $ROUTEVAR, ...):\n  ...\n  $INTERM = <... $ROUTEVAR ...>\n  ...\n  os.system(..., <... $INTERM ...>, ...)\n"
                }
              ]
            }
          ]
        },
        {
          "pattern": "os.system(..., <... flask.request.$W.get(...) ...>, ...)"
        },
        {
          "pattern": "os.system(..., <... flask.request.$W[...] ...>, ...)"
        },
        {
          "pattern": "os.system(..., <... flask.request.$W(...) ...>, ...)"
        },
        {
          "pattern": "os.system(..., <... flask.request.$W ...>, ...)"
        },
        {
          "patterns": [
            {
              "pattern-inside": "$INTERM = <... flask.request.$W.get(...) ...>\n...\nos.system(<... $INTERM ...>)\n"
            },
            {
              "pattern": "os.system(...)"
            }
          ]
        },
        {
          "patterns": [
            {
              "pattern-inside": "$INTERM = <... flask.request.$W[...] ...>\n...\nos.system(<... $INTERM ...>)\n"
            },
            {
              "pattern": "os.system(...)"
            }
          ]
        },
        {
          "patterns": [
            {
              "pattern-inside": "$INTERM = <... flask.request.$W(...) ...>\n...\nos.system(<... $INTERM ...>)\n"
            },
            {
              "pattern": "os.system(...)"
            }
          ]
        },
        {
          "patterns": [
            {
              "pattern-inside": "$INTERM = <... flask.request.$W ...>\n...\nos.system(<... $INTERM ...>)\n"
            },
            {
              "pattern": "os.system(...)"
            }
          ]
        }
      ]
    },
    {
      "id": "python.flask.security.injection.path-traversal-open.path-traversal-open",
      "languages": [
        "python"
      ],
      "severity": "ERROR",
      "message": "Found request data in a call to 'open'. Ensure the request data is validated or sanitized, otherwise it could result in path traversal attacks.",
      "metadata": {
        "cwe": [
          "CWE-22: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')"
        ],
        "owasp": [
          "A05:2017 - Broken Access Control",
          "A01:2021 - Broken Access Control",
          "A01:2025 - Broken Access Control"
        ],
        "references": [
          "https://owasp.org/www-community/attacks/Path_Traversal"
        ],
        "category": "security",
        "technology": [
          "flask"
        ],
        "cwe2022-top25": true,
        "cwe2021-top25": true,
        "subcategory": [
          "audit"
        ],
        "likelihood": "MEDIUM",
        "impact": "HIGH",
        "confidence": "MEDIUM",
        "license": "Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license",
        "vulnerability_class": [
          "Path Traversal"
        ],
        "source": "https://semgrep.dev/r/python.flask.security.injection.path-traversal-open.path-traversal-open",
        "shortlink": "https://sg.run/PJRW",
        "semgrep.dev": {
          "rule": {
            "r_id": 9545,
            "rv_id": 1263430,
            "rule_id": "DbUpOQ",
            "version_id": "9lT4b94",
            "url": "https://semgrep.dev/playground/r/9lT4b94/python.flask.security.injection.path-traversal-open.path-traversal-open",
            "origin": "community"
          }
        }
      },
      "pattern-either": [
        {
          "patterns": [
            {
              "pattern": "open(...)"
            },
            {
              "pattern-either": [
                {
                  "pattern-inside": "@$APP.route($ROUTE, ...)\ndef $FUNC(..., $ROUTEVAR, ...):\n  ...\n  open(..., <... $ROUTEVAR ...>, ...)\n"
                },
                {
                  "pattern-inside": "@$APP.route($ROUTE, ...)\ndef $FUNC(..., $ROUTEVAR, ...):\n  ...\n  with open(..., <... $ROUTEVAR ...>, ...) as $FD:\n    ...\n"
                },
                {
                  "pattern-inside": "@$APP.route($ROUTE, ...)\ndef $FUNC(..., $ROUTEVAR, ...):\n  ...\n  $INTERM = <... $ROUTEVAR ...>\n  ...\n  open(..., <... $INTERM ...>, ...)\n"
                }
              ]
            }
          ]
        },
        {
          "pattern": "open(..., <... flask.request.$W.get(...) ...>, ...)"
        },
        {
          "pattern": "open(..., <... flask.request.$W[...] ...>, ...)"
        },
        {
          "pattern": "open(..., <... flask.request.$W(...) ...>, ...)"
        },
        {
          "pattern": "open(..., <... flask.request.$W ...>, ...)"
        },
        {
          "patterns": [
            {
              "pattern-inside": "$INTERM = <... flask.request.$W.get(...) ...>\n...\nopen(<... $INTERM ...>, ...)\n"
            },
            {
              "pattern": "open(...)"
            }
          ]
        },
        {
          "patterns": [
            {
              "pattern-inside": "$INTERM = <... flask.request.$W[...] ...>\n...\nopen(<... $INTERM ...>, ...)\n"
            },
            {
              "pattern": "open(...)"
            }
          ]
        },
        {
          "patterns": [
            {
              "pattern-inside": "$INTERM = <... flask.request.$W(...) ...>\n...\nopen(<... $INTERM ...>, ...)\n"
            },
            {
              "pattern": "open(...)"
            }
          ]
        },
        {
          "patterns": [
            {
              "pattern-inside": "$INTERM = <... flask.request.$W ...>\n...\nopen(<... $INTERM ...>, ...)\n"
            },
            {
              "pattern": "open(...)"
            }
          ]
        },
        {
          "patterns": [
            {
              "pattern-inside": "$INTERM = <... flask.request.$W.get(...) ...>\n...\nwith open(<... $INTERM ...>, ...) as $F:\n  ...\n"
            },
            {
              "pattern": "open(...)"
            }
          ]
        },
        {
          "patterns": [
            {
              "pattern-inside": "$INTERM = <... flask.request.$W[...] ...>\n...\nwith open(<... $INTERM ...>, ...) as $F:\n  ...\n"
            },
            {
              "pattern": "open(...)"
            }
          ]
        },
        {
          "patterns": [
            {
              "pattern-inside": "$INTERM = <... flask.request.$W(...) ...>\n...\nwith open(<... $INTERM ...>, ...) as $F:\n  ...\n"
            },
            {
              "pattern": "open(...)"
            }
          ]
        },
        {
          "patterns": [
            {
              "pattern-inside": "$INTERM = <... flask.request.$W ...>\n...\nwith open(<... $INTERM ...>, ...) as $F:\n  ...\n"
            },
            {
              "pattern": "open(...)"
            }
          ]
        }
      ]
    },
    {
      "id": "python.flask.security.injection.ssrf-requests.ssrf-requests",
      "languages": [
        "python"
      ],
      "severity": "ERROR",
      "message": "Data from request object is passed to a new server-side request. This could lead to a server-side request forgery (SSRF). To mitigate, ensure that schemes and hosts are validated against an allowlist, do not forward the response to the user, and ensure proper authentication and transport-layer security in the proxied request.",
      "metadata": {
        "cwe": [
          "CWE-918: Server-Side Request Forgery (SSRF)"
        ],
        "owasp": [
          "A10:2021 - Server-Side Request Forgery (SSRF)",
          "A01:2025 - Broken Access Control"
        ],
        "references": [
          "https://owasp.org/www-community/attacks/Server_Side_Request_Forgery"
        ],
        "category": "security",
        "technology": [
          "flask"
        ],
        "cwe2022-top25": true,
        "cwe2021-top25": true,
        "subcategory": [
          "vuln"
        ],
        "likelihood": "MEDIUM",
        "impact": "HIGH",
        "confidence": "MEDIUM",
        "license": "Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license",
        "vulnerability_class": [
          "Server-Side Request Forgery (SSRF)"
        ],
        "source": "https://semgrep.dev/r/python.flask.security.injection.ssrf-requests.ssrf-requests",
        "shortlink": "https://sg.run/J9LW",
        "semgrep.dev": {
          "rule": {
            "r_id": 9546,
            "rv_id": 1263432,
            "rule_id": "WAUoRx",
            "version_id": "rxTAKJn",
            "url": "https://semgrep.dev/playground/r/rxTAKJn/python.flask.security.injection.ssrf-requests.ssrf-requests",
            "origin": "community"
          }
        }
      },
      "pattern-either": [
        {
          "patterns": [
            {
              "pattern": "requests.$FUNC(...)"
            },
            {
              "pattern-either": [
                {
                  "pattern-inside": "@$APP.$ROUTE_METHOD($ROUTE, ...)\ndef $ROUTE_FUNC(..., $ROUTEVAR, ...):\n  ...\n  requests.$FUNC(..., <... $ROUTEVAR ...>, ...)\n"
                },
                {
                  "pattern-inside": "@$APP.$ROUTE_METHOD($ROUTE, ...)\ndef $ROUTE_FUNC(..., $ROUTEVAR, ...):\n  ...\n  $INTERM = <... $ROUTEVAR ...>\n  ...\n  requests.$FUNC(..., <... $INTERM ...>, ...)\n"
                }
              ]
            },
            {
              "metavariable-regex": {
                "metavariable": "$ROUTE_METHOD",
                "regex": "^(route|get|post|put|delete|patch)$"
              }
            }
          ]
        },
        {
          "pattern": "requests.$FUNC(..., <... flask.request.$W.get(...) ...>, ...)"
        },
        {
          "pattern": "requests.$FUNC(..., <... flask.request.$W[...] ...>, ...)"
        },
        {
          "pattern": "requests.$FUNC(..., <... flask.request.$W(...) ...>, ...)"
        },
        {
          "pattern": "requests.$FUNC(..., <... flask.request.$W ...>, ...)"
        },
        {
          "patterns": [
            {
              "pattern-inside": "$INTERM = <... flask.request.$W.get(...) ...>\n...\nrequests.$FUNC(<... $INTERM ...>, ...)\n"
            },
            {
              "pattern": "requests.$FUNC(...)"
            }
          ]
        },
        {
          "patterns": [
            {
              "pattern-inside": "$INTERM = <... flask.request.$W[...] ...>\n...\nrequests.$FUNC(<... $INTERM ...>, ...)\n"
            },
            {
              "pattern": "requests.$FUNC(...)"
            }
          ]
        },
        {
          "patterns": [
            {
              "pattern-inside": "$INTERM = <... flask.request.$W(...) ...>\n...\nrequests.$FUNC(<... $INTERM ...>, ...)\n"
            },
            {
              "pattern": "requests.$FUNC(...)"
            }
          ]
        },
        {
          "patterns": [
            {
              "pattern-inside": "$INTERM = <... flask.request.$W ...>\n...\nrequests.$FUNC(<... $INTERM ...>, ...)\n"
            },
            {
              "pattern": "requests.$FUNC(...)"
            }
          ]
        }
      ]
    },
    {
      "id": "python.flask.security.injection.user-eval.eval-injection",
      "languages": [
        "python"
      ],
      "severity": "ERROR",
      "message": "Detected user data flowing into eval. This is code injection and should be avoided.",
      "metadata": {
        "cwe": [
          "CWE-95: Improper Neutralization of Directives in Dynamically Evaluated Code ('Eval Injection')"
        ],
        "owasp": [
          "A03:2021 - Injection",
          "A05:2025 - Injection"
        ],
        "references": [
          "https://nedbatchelder.com/blog/201206/eval_really_is_dangerous.html"
        ],
        "category": "security",
        "technology": [
          "flask"
        ],
        "subcategory": [
          "vuln"
        ],
        "likelihood": "MEDIUM",
        "impact": "MEDIUM",
        "confidence": "MEDIUM",
        "license": "Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license",
        "vulnerability_class": [
          "Code Injection"
        ],
        "source": "https://semgrep.dev/r/python.flask.security.injection.user-eval.eval-injection",
        "shortlink": "https://sg.run/5QpX",
        "semgrep.dev": {
          "rule": {
            "r_id": 9547,
            "rv_id": 1263436,
            "rule_id": "0oU54W",
            "version_id": "w8TRoB0",
            "url": "https://semgrep.dev/playground/r/w8TRoB0/python.flask.security.injection.user-eval.eval-injection",
            "origin": "community"
          }
        }
      },
      "pattern-either": [
        {
          "patterns": [
            {
              "pattern": "eval(...)"
            },
            {
              "pattern-either": [
                {
                  "pattern-inside": "@$APP.route($ROUTE, ...)\ndef $FUNC(..., $ROUTEVAR, ...):\n  ...\n  eval(..., <... $ROUTEVAR ...>, ...)\n"
                },
                {
                  "pattern-inside": "@$APP.route($ROUTE, ...)\ndef $FUNC(..., $ROUTEVAR, ...):\n  ...\n  $INTERM = <... $ROUTEVAR ...>\n  ...\n  eval(..., <... $INTERM ...>, ...)\n"
                }
              ]
            }
          ]
        },
        {
          "pattern": "eval(..., <... flask.request.$W.get(...) ...>, ...)"
        },
        {
          "pattern": "eval(..., <... flask.request.$W[...] ...>, ...)"
        },
        {
          "pattern": "eval(..., <... flask.request.$W(...) ...>, ...)"
        },
        {
          "pattern": "eval(..., <... flask.request.$W ...>, ...)"
        },
        {
          "patterns": [
            {
              "pattern-inside": "$INTERM = <... flask.request.$W.get(...) ...>\n...\neval(..., <... $INTERM ...>, ...)\n"
            },
            {
              "pattern": "eval(...)"
            }
          ]
        },
        {
          "patterns": [
            {
              "pattern-inside": "$INTERM = <... flask.request.$W[...] ...>\n...\neval(..., <... $INTERM ...>, ...)\n"
            },
            {
              "pattern": "eval(...)"
            }
          ]
        },
        {
          "patterns": [
            {
              "pattern-inside": "$INTERM = <... flask.request.$W(...) ...>\n...\neval(..., <... $INTERM ...>, ...)\n"
            },
            {
              "pattern": "eval(...)"
            }
          ]
        },
        {
          "patterns": [
            {
              "pattern-inside": "$INTERM = <... flask.request.$W ...>\n...\neval(..., <... $INTERM ...>, ...)\n"
            },
            {
              "pattern": "eval(...)"
            }
          ]
        }
      ]
    },
    {
      "id": "python.flask.security.injection.user-exec.exec-injection",
      "languages": [
        "python"
      ],
      "severity": "ERROR",
      "message": "Detected user data flowing into exec. This is code injection and should be avoided.",
      "metadata": {
        "cwe": [
          "CWE-95: Improper Neutralization of Directives in Dynamically Evaluated Code ('Eval Injection')"
        ],
        "owasp": [
          "A03:2021 - Injection",
          "A05:2025 - Injection"
        ],
        "references": [
          "https://nedbatchelder.com/blog/201206/exec_really_is_dangerous.html"
        ],
        "category": "security",
        "technology": [
          "flask"
        ],
        "subcategory": [
          "vuln"
        ],
        "likelihood": "MEDIUM",
        "impact": "HIGH",
        "confidence": "MEDIUM",
        "license": "Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license",
        "vulnerability_class": [
          "Code Injection"
        ],
        "source": "https://semgrep.dev/r/python.flask.security.injection.user-exec.exec-injection",
        "shortlink": "https://sg.run/Ge42",
        "semgrep.dev": {
          "rule": {
            "r_id": 9548,
            "rv_id": 1263437,
            "rule_id": "KxUbl2",
            "version_id": "xyTjzD9",
            "url": "https://semgrep.dev/playground/r/xyTjzD9/python.flask.security.injection.user-exec.exec-injection",
            "origin": "community"
          }
        }
      },
      "pattern-either": [
        {
          "patterns": [
            {
              "pattern": "exec(...)"
            },
            {
              "pattern-either": [
                {
                  "pattern-inside": "@$APP.route($ROUTE, ...)\ndef $FUNC(..., $ROUTEVAR, ...):\n  ...\n  exec(..., <... $ROUTEVAR ...>, ...)\n"
                },
                {
                  "pattern-inside": "@$APP.route($ROUTE, ...)\ndef $FUNC(..., $ROUTEVAR, ...):\n  ...\n  $INTERM = <... $ROUTEVAR ...>\n  ...\n  exec(..., <... $INTERM ...>, ...)\n"
                }
              ]
            }
          ]
        },
        {
          "pattern": "exec(..., <... flask.request.$W.get(...) ...>, ...)"
        },
        {
          "pattern": "exec(..., <... flask.request.$W[...] ...>, ...)"
        },
        {
          "pattern": "exec(..., <... flask.request.$W(...) ...>, ...)"
        },
        {
          "pattern": "exec(..., <... flask.request.$W ...>, ...)"
        },
        {
          "patterns": [
            {
              "pattern-inside": "$INTERM = <... flask.request.$W.get(...) ...>\n...\nexec(..., <... $INTERM ...>, ...)\n"
            },
            {
              "pattern": "exec(...)"
            }
          ]
        },
        {
          "patterns": [
            {
              "pattern-inside": "$INTERM = <... flask.request.$W[...] ...>\n...\nexec(..., <... $INTERM ...>, ...)\n"
            },
            {
              "pattern": "exec(...)"
            }
          ]
        },
        {
          "patterns": [
            {
              "pattern-inside": "$INTERM = <... flask.request.$W(...) ...>\n...\nexec(..., <... $INTERM ...>, ...)\n"
            },
            {
              "pattern": "exec(...)"
            }
          ]
        },
        {
          "patterns": [
            {
              "pattern-inside": "$INTERM = <... flask.request.$W ...>\n...\nexec(..., <... $INTERM ...>, ...)\n"
            },
            {
              "pattern": "exec(...)"
            }
          ]
        }
      ]
    },
    {
      "id": "python.jwt.security.jwt-hardcode.jwt-python-hardcoded-secret",
      "message": "Hardcoded JWT secret or private key is used. This is a Insufficiently Protected Credentials weakness: https://cwe.mitre.org/data/definitions/522.html Consider using an appropriate security mechanism to protect the credentials (e.g. keeping secrets in environment variables)",
      "metadata": {
        "cwe": [
          "CWE-522: Insufficiently Protected Credentials"
        ],
        "owasp": [
          "A02:2017 - Broken Authentication",
          "A04:2021 - Insecure Design",
          "A06:2025 - Insecure Design"
        ],
        "references": [
          "https://semgrep.dev/blog/2020/hardcoded-secrets-unverified-tokens-and-other-common-jwt-mistakes/"
        ],
        "category": "security",
        "technology": [
          "jwt"
        ],
        "cwe2021-top25": true,
        "subcategory": [
          "vuln"
        ],
        "likelihood": "HIGH",
        "impact": "MEDIUM",
        "confidence": "HIGH",
        "license": "Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license",
        "vulnerability_class": [
          "Cryptographic Issues"
        ],
        "source": "https://semgrep.dev/r/python.jwt.security.jwt-hardcode.jwt-python-hardcoded-secret",
        "shortlink": "https://sg.run/l2E9",
        "semgrep.dev": {
          "rule": {
            "r_id": 9557,
            "rv_id": 1263452,
            "rule_id": "X5U8P5",
            "version_id": "PkTR3X3",
            "url": "https://semgrep.dev/playground/r/PkTR3X3/python.jwt.security.jwt-hardcode.jwt-python-hardcoded-secret",
            "origin": "community"
          }
        }
      },
      "patterns": [
        {
          "pattern": "jwt.encode($_, \"...\", ...)\n"
        }
      ],
      "languages": [
        "python"
      ],
      "severity": "ERROR"
    },
    {
      "id": "python.jwt.security.jwt-none-alg.jwt-python-none-alg",
      "message": "Detected use of the 'none' algorithm in a JWT token. The 'none' algorithm assumes the integrity of the token has already been verified. This would allow a malicious actor to forge a JWT token that will automatically be verified. Do not explicitly use the 'none' algorithm. Instead, use an algorithm such as 'HS256'.",
      "metadata": {
        "cwe": [
          "CWE-327: Use of a Broken or Risky Cryptographic Algorithm"
        ],
        "owasp": [
          "A03:2017 - Sensitive Data Exposure",
          "A02:2021 - Cryptographic Failures",
          "A04:2025 - Cryptographic Failures"
        ],
        "source-rule-url": "https://semgrep.dev/blog/2020/hardcoded-secrets-unverified-tokens-and-other-common-jwt-mistakes/",
        "category": "security",
        "technology": [
          "jwt"
        ],
        "references": [
          "https://owasp.org/Top10/A02_2021-Cryptographic_Failures"
        ],
        "subcategory": [
          "vuln"
        ],
        "likelihood": "MEDIUM",
        "impact": "MEDIUM",
        "confidence": "MEDIUM",
        "license": "Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license",
        "vulnerability_class": [
          "Cryptographic Issues"
        ],
        "source": "https://semgrep.dev/r/python.jwt.security.jwt-none-alg.jwt-python-none-alg",
        "shortlink": "https://sg.run/Yvp4",
        "semgrep.dev": {
          "rule": {
            "r_id": 9558,
            "rv_id": 1263453,
            "rule_id": "j2UvKw",
            "version_id": "JdTzxYj",
            "url": "https://semgrep.dev/playground/r/JdTzxYj/python.jwt.security.jwt-none-alg.jwt-python-none-alg",
            "origin": "community"
          }
        }
      },
      "languages": [
        "python"
      ],
      "severity": "ERROR",
      "pattern-either": [
        {
          "pattern": "jwt.encode(...,algorithm=\"none\",...)\n"
        },
        {
          "pattern": "jwt.decode(...,algorithms=[...,\"none\",...],...)"
        }
      ]
    },
    {
      "id": "python.jwt.security.unverified-jwt-decode.unverified-jwt-decode",
      "patterns": [
        {
          "pattern-either": [
            {
              "patterns": [
                {
                  "pattern": "jwt.decode(..., options={..., \"verify_signature\": $BOOL, ...}, ...)\n"
                },
                {
                  "metavariable-pattern": {
                    "metavariable": "$BOOL",
                    "pattern": "False\n"
                  }
                },
                {
                  "focus-metavariable": "$BOOL"
                }
              ]
            },
            {
              "patterns": [
                {
                  "pattern": "$OPTS = {..., \"verify_signature\": $BOOL, ...}\n...\njwt.decode(..., options=$OPTS, ...)\n"
                },
                {
                  "metavariable-pattern": {
                    "metavariable": "$BOOL",
                    "pattern": "False\n"
                  }
                },
                {
                  "focus-metavariable": "$BOOL"
                }
              ]
            }
          ]
        }
      ],
      "message": "Detected JWT token decoded with 'verify=False'. This bypasses any integrity checks for the token which means the token could be tampered with by malicious actors. Ensure that the JWT token is verified.",
      "metadata": {
        "owasp": [
          "A02:2017 - Broken Authentication",
          "A07:2021 - Identification and Authentication Failures",
          "A07:2025 - Authentication Failures"
        ],
        "cwe": [
          "CWE-287: Improper Authentication"
        ],
        "references": [
          "https://github.com/we45/Vulnerable-Flask-App/blob/752ee16087c0bfb79073f68802d907569a1f0df7/app/app.py#L96"
        ],
        "category": "security",
        "technology": [
          "jwt"
        ],
        "cwe2022-top25": true,
        "cwe2021-top25": true,
        "subcategory": [
          "audit"
        ],
        "likelihood": "MEDIUM",
        "impact": "MEDIUM",
        "confidence": "MEDIUM",
        "license": "Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license",
        "vulnerability_class": [
          "Improper Authentication"
        ],
        "source": "https://semgrep.dev/r/python.jwt.security.unverified-jwt-decode.unverified-jwt-decode",
        "shortlink": "https://sg.run/6nyB",
        "semgrep.dev": {
          "rule": {
            "r_id": 9559,
            "rv_id": 1263454,
            "rule_id": "10UKjo",
            "version_id": "5PTo12w",
            "url": "https://semgrep.dev/playground/r/5PTo12w/python.jwt.security.unverified-jwt-decode.unverified-jwt-decode",
            "origin": "community"
          }
        }
      },
      "fix": "True\n",
      "severity": "ERROR",
      "languages": [
        "python"
      ]
    },
    {
      "id": "python.lang.security.insecure-hash-algorithms.insecure-hash-algorithm-sha1",
      "pattern": "hashlib.sha1(...)",
      "fix-regex": {
        "regex": "sha1",
        "replacement": "sha256"
      },
      "message": "Detected SHA1 hash algorithm which is considered insecure. SHA1 is not collision resistant and is therefore not suitable as a cryptographic signature. Use SHA256 or SHA3 instead.",
      "metadata": {
        "source-rule-url": "https://github.com/PyCQA/bandit/blob/d5f8fa0d89d7b11442fc6ec80ca42953974354c8/bandit/blacklists/calls.py#L59",
        "cwe": [
          "CWE-327: Use of a Broken or Risky Cryptographic Algorithm"
        ],
        "owasp": [
          "A03:2017 - Sensitive Data Exposure",
          "A02:2021 - Cryptographic Failures",
          "A04:2025 - Cryptographic Failures"
        ],
        "bandit-code": "B303",
        "asvs": {
          "section": "V6 Stored Cryptography Verification Requirements",
          "control_id": "6.2.2 Insecure Custom Algorithm",
          "control_url": "https://github.com/OWASP/ASVS/blob/master/4.0/en/0x14-V6-Cryptography.md#v62-algorithms",
          "version": "4"
        },
        "references": [
          "https://www.schneier.com/blog/archives/2012/10/when_will_we_se.html",
          "https://www.trendmicro.com/vinfo/us/security/news/vulnerabilities-and-exploits/sha-1-collision-signals-the-end-of-the-algorithm-s-viability",
          "http://2012.sharcs.org/slides/stevens.pdf",
          "https://pycryptodome.readthedocs.io/en/latest/src/hash/sha3_256.html"
        ],
        "category": "security",
        "technology": [
          "python"
        ],
        "subcategory": [
          "vuln"
        ],
        "likelihood": "LOW",
        "impact": "MEDIUM",
        "confidence": "MEDIUM",
        "license": "Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license",
        "vulnerability_class": [
          "Cryptographic Issues"
        ],
        "source": "https://semgrep.dev/r/python.lang.security.insecure-hash-algorithms.insecure-hash-algorithm-sha1",
        "shortlink": "https://sg.run/ydYx",
        "semgrep.dev": {
          "rule": {
            "r_id": 9624,
            "rv_id": 1263537,
            "rule_id": "x8UnBk",
            "version_id": "w8TRoE7",
            "url": "https://semgrep.dev/playground/r/w8TRoE7/python.lang.security.insecure-hash-algorithms.insecure-hash-algorithm-sha1",
            "origin": "community"
          }
        }
      },
      "severity": "WARNING",
      "languages": [
        "python"
      ]
    },
    {
      "id": "python.lang.security.insecure-hash-function.insecure-hash-function",
      "message": "Detected use of an insecure MD4 or MD5 hash function. These functions have known vulnerabilities and are considered deprecated. Consider using 'SHA256' or a similar function instead.",
      "metadata": {
        "cwe": [
          "CWE-327: Use of a Broken or Risky Cryptographic Algorithm"
        ],
        "owasp": [
          "A03:2017 - Sensitive Data Exposure",
          "A02:2021 - Cryptographic Failures",
          "A04:2025 - Cryptographic Failures"
        ],
        "source-rule-url": "https://github.com/PyCQA/bandit/blob/b1411bfb43795d3ffd268bef17a839dee954c2b1/bandit/plugins/hashlib_new_insecure_functions.py",
        "asvs": {
          "section": "V6 Stored Cryptography Verification Requirements",
          "control_id": "6.2.2 Insecure Custom Algorithm",
          "control_url": "https://github.com/OWASP/ASVS/blob/master/4.0/en/0x14-V6-Cryptography.md#v62-algorithms",
          "version": "4"
        },
        "references": [
          "https://tools.ietf.org/html/rfc6151",
          "https://crypto.stackexchange.com/questions/44151/how-does-the-flame-malware-take-advantage-of-md5-collision",
          "https://pycryptodome.readthedocs.io/en/latest/src/hash/sha3_256.html"
        ],
        "category": "security",
        "technology": [
          "python"
        ],
        "subcategory": [
          "audit"
        ],
        "likelihood": "LOW",
        "impact": "MEDIUM",
        "confidence": "MEDIUM",
        "license": "Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license",
        "vulnerability_class": [
          "Cryptographic Issues"
        ],
        "source": "https://semgrep.dev/r/python.lang.security.insecure-hash-function.insecure-hash-function",
        "shortlink": "https://sg.run/rdBn",
        "semgrep.dev": {
          "rule": {
            "r_id": 9625,
            "rv_id": 1263538,
            "rule_id": "OrU30g",
            "version_id": "xyTjzEe",
            "url": "https://semgrep.dev/playground/r/xyTjzEe/python.lang.security.insecure-hash-function.insecure-hash-function",
            "origin": "community"
          }
        }
      },
      "languages": [
        "python"
      ],
      "severity": "WARNING",
      "pattern-either": [
        {
          "pattern": "hashlib.new(\"=~/[M|m][D|d][4|5]/\", ...)"
        },
        {
          "pattern": "hashlib.new(..., name=\"=~/[M|m][D|d][4|5]/\", ...)"
        }
      ]
    },
    {
      "id": "python.lang.security.unverified-ssl-context.unverified-ssl-context",
      "patterns": [
        {
          "pattern-either": [
            {
              "pattern": "ssl._create_unverified_context(...)"
            },
            {
              "pattern": "ssl._create_default_https_context = ssl._create_unverified_context"
            }
          ]
        }
      ],
      "fix-regex": {
        "regex": "_create_unverified_context",
        "replacement": "create_default_context"
      },
      "message": "Unverified SSL context detected. This will permit insecure connections without verifying SSL certificates. Use 'ssl.create_default_context' instead.",
      "metadata": {
        "owasp": [
          "A03:2017 - Sensitive Data Exposure",
          "A07:2021 - Identification and Authentication Failures",
          "A07:2025 - Authentication Failures"
        ],
        "cwe": [
          "CWE-295: Improper Certificate Validation"
        ],
        "references": [
          "https://docs.python.org/3/library/ssl.html#ssl-security",
          "https://docs.python.org/3/library/http.client.html#http.client.HTTPSConnection"
        ],
        "category": "security",
        "technology": [
          "python"
        ],
        "subcategory": [
          "audit"
        ],
        "likelihood": "LOW",
        "impact": "MEDIUM",
        "confidence": "MEDIUM",
        "license": "Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license",
        "vulnerability_class": [
          "Improper Authentication"
        ],
        "source": "https://semgrep.dev/r/python.lang.security.unverified-ssl-context.unverified-ssl-context",
        "shortlink": "https://sg.run/N4lp",
        "semgrep.dev": {
          "rule": {
            "r_id": 9627,
            "rv_id": 1263540,
            "rule_id": "v8UnkQ",
            "version_id": "e1Tyjlj",
            "url": "https://semgrep.dev/playground/r/e1Tyjlj/python.lang.security.unverified-ssl-context.unverified-ssl-context",
            "origin": "community"
          }
        }
      },
      "severity": "ERROR",
      "languages": [
        "python"
      ]
    },
    {
      "id": "python.lang.security.audit.ssl-wrap-socket-is-deprecated.ssl-wrap-socket-is-deprecated",
      "pattern": "ssl.wrap_socket(...)",
      "message": "'ssl.wrap_socket()' is deprecated. This function creates an insecure socket without server name indication or hostname matching. Instead, create an SSL context using 'ssl.SSLContext()' and use that to wrap a socket.",
      "metadata": {
        "cwe": [
          "CWE-326: Inadequate Encryption Strength"
        ],
        "owasp": [
          "A03:2017 - Sensitive Data Exposure",
          "A02:2021 - Cryptographic Failures",
          "A04:2025 - Cryptographic Failures"
        ],
        "references": [
          "https://docs.python.org/3/library/ssl.html#ssl.wrap_socket",
          "https://docs.python.org/3/library/ssl.html#ssl.SSLContext.wrap_socket"
        ],
        "category": "security",
        "technology": [
          "python"
        ],
        "subcategory": [
          "vuln"
        ],
        "likelihood": "LOW",
        "impact": "MEDIUM",
        "confidence": "MEDIUM",
        "license": "Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license",
        "vulnerability_class": [
          "Cryptographic Issues"
        ],
        "source": "https://semgrep.dev/r/python.lang.security.audit.ssl-wrap-socket-is-deprecated.ssl-wrap-socket-is-deprecated",
        "shortlink": "https://sg.run/PJOY",
        "semgrep.dev": {
          "rule": {
            "r_id": 9645,
            "rv_id": 1263516,
            "rule_id": "BYUN2e",
            "version_id": "DkTRbgn",
            "url": "https://semgrep.dev/playground/r/DkTRbgn/python.lang.security.audit.ssl-wrap-socket-is-deprecated.ssl-wrap-socket-is-deprecated",
            "origin": "community"
          }
        }
      },
      "languages": [
        "python"
      ],
      "severity": "WARNING"
    },
    {
      "id": "python.lang.security.audit.subprocess-shell-true.subprocess-shell-true",
      "patterns": [
        {
          "pattern": "subprocess.$FUNC(..., shell=$TRUE, ...)"
        },
        {
          "metavariable-pattern": {
            "metavariable": "$TRUE",
            "pattern": "True \n"
          }
        },
        {
          "pattern-not": "subprocess.$FUNC(\"...\", shell=True, ...)"
        },
        {
          "focus-metavariable": "$TRUE"
        }
      ],
      "message": "Found 'subprocess' function '$FUNC' with 'shell=True'. This is dangerous because this call will spawn the command using a shell process. Doing so propagates current shell settings and variables, which makes it much easier for a malicious actor to execute commands. Use 'shell=False' instead.",
      "fix": "False\n",
      "metadata": {
        "source-rule-url": "https://bandit.readthedocs.io/en/latest/plugins/b602_subprocess_popen_with_shell_equals_true.html",
        "owasp": [
          "A01:2017 - Injection",
          "A03:2021 - Injection",
          "A05:2025 - Injection"
        ],
        "cwe": [
          "CWE-78: Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')"
        ],
        "references": [
          "https://stackoverflow.com/questions/3172470/actual-meaning-of-shell-true-in-subprocess",
          "https://docs.python.org/3/library/subprocess.html"
        ],
        "category": "security",
        "technology": [
          "python"
        ],
        "cwe2022-top25": true,
        "cwe2021-top25": true,
        "subcategory": [
          "secure default"
        ],
        "likelihood": "HIGH",
        "impact": "LOW",
        "confidence": "MEDIUM",
        "license": "Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license",
        "vulnerability_class": [
          "Command Injection"
        ],
        "source": "https://semgrep.dev/r/python.lang.security.audit.subprocess-shell-true.subprocess-shell-true",
        "shortlink": "https://sg.run/J92w",
        "semgrep.dev": {
          "rule": {
            "r_id": 9646,
            "rv_id": 1263518,
            "rule_id": "DbUpz2",
            "version_id": "0bTKzDK",
            "url": "https://semgrep.dev/playground/r/0bTKzDK/python.lang.security.audit.subprocess-shell-true.subprocess-shell-true",
            "origin": "community"
          }
        }
      },
      "languages": [
        "python"
      ],
      "severity": "ERROR"
    },
    {
      "id": "python.lang.security.audit.weak-ssl-version.weak-ssl-version",
      "message": "An insecure SSL version was detected. TLS versions 1.0, 1.1, and all SSL versions are considered weak encryption and are deprecated. Use 'ssl.PROTOCOL_TLSv1_2' or higher.",
      "metadata": {
        "cwe": [
          "CWE-326: Inadequate Encryption Strength"
        ],
        "owasp": [
          "A03:2017 - Sensitive Data Exposure",
          "A02:2021 - Cryptographic Failures",
          "A04:2025 - Cryptographic Failures"
        ],
        "source-rule-url": "https://github.com/PyCQA/bandit/blob/b1411bfb43795d3ffd268bef17a839dee954c2b1/bandit/plugins/insecure_ssl_tls.py#L30",
        "asvs": {
          "section": "V9 Communications Verification Requirements",
          "control_id": "9.1.3 Weak TLS",
          "control_url": "https://github.com/OWASP/ASVS/blob/master/4.0/en/0x17-V9-Communications.md#v91-client-communications-security-requirements",
          "version": "4"
        },
        "references": [
          "https://tools.ietf.org/html/rfc7568",
          "https://tools.ietf.org/id/draft-ietf-tls-oldversions-deprecate-02.html",
          "https://docs.python.org/3/library/ssl.html#ssl.PROTOCOL_TLSv1_2"
        ],
        "category": "security",
        "technology": [
          "python"
        ],
        "subcategory": [
          "audit"
        ],
        "likelihood": "LOW",
        "impact": "MEDIUM",
        "confidence": "MEDIUM",
        "license": "Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license",
        "vulnerability_class": [
          "Cryptographic Issues"
        ],
        "source": "https://semgrep.dev/r/python.lang.security.audit.weak-ssl-version.weak-ssl-version",
        "shortlink": "https://sg.run/RoZO",
        "semgrep.dev": {
          "rule": {
            "r_id": 9649,
            "rv_id": 1263520,
            "rule_id": "KxUbNG",
            "version_id": "qkTR7Ev",
            "url": "https://semgrep.dev/playground/r/qkTR7Ev/python.lang.security.audit.weak-ssl-version.weak-ssl-version",
            "origin": "community"
          }
        }
      },
      "languages": [
        "python"
      ],
      "severity": "WARNING",
      "pattern-either": [
        {
          "pattern": "ssl.PROTOCOL_SSLv2"
        },
        {
          "pattern": "ssl.PROTOCOL_SSLv3"
        },
        {
          "pattern": "ssl.PROTOCOL_TLSv1"
        },
        {
          "pattern": "ssl.PROTOCOL_TLSv1_1"
        },
        {
          "pattern": "pyOpenSSL.SSL.SSLv2_METHOD"
        },
        {
          "pattern": "pyOpenSSL.SSL.SSLv23_METHOD"
        },
        {
          "pattern": "pyOpenSSL.SSL.SSLv3_METHOD"
        },
        {
          "pattern": "pyOpenSSL.SSL.TLSv1_METHOD"
        },
        {
          "pattern": "pyOpenSSL.SSL.TLSv1_1_METHOD"
        }
      ]
    },
    {
      "id": "python.lang.security.audit.insecure-transport.requests.request-session-http-in-with-context.request-session-http-in-with-context",
      "options": {
        "symbolic_propagation": true
      },
      "mode": "taint",
      "pattern-sources": [
        {
          "patterns": [
            {
              "pattern": "\"$URL\"\n"
            },
            {
              "metavariable-pattern": {
                "metavariable": "$URL",
                "language": "regex",
                "patterns": [
                  {
                    "pattern-regex": "http://"
                  },
                  {
                    "pattern-not-regex": ".*://localhost"
                  },
                  {
                    "pattern-not-regex": ".*://127\\.0\\.0\\.1"
                  }
                ]
              }
            }
          ]
        }
      ],
      "pattern-sinks": [
        {
          "patterns": [
            {
              "pattern-inside": "with requests.Session(...) as $SESSION:\n  ...\n"
            },
            {
              "pattern-either": [
                {
                  "pattern": "$SESSION.$W($SINK, ...)"
                },
                {
                  "pattern": "$SESSION.request($METHOD, $SINK, ...)"
                }
              ]
            },
            {
              "focus-metavariable": "$SINK"
            }
          ]
        }
      ],
      "fix-regex": {
        "regex": "[Hh][Tt][Tt][Pp]://",
        "replacement": "https://",
        "count": 1
      },
      "message": "Detected a request using 'http://'. This request will be unencrypted. Use 'https://' instead.",
      "metadata": {
        "owasp": [
          "A03:2017 - Sensitive Data Exposure",
          "A02:2021 - Cryptographic Failures",
          "A04:2025 - Cryptographic Failures"
        ],
        "cwe": [
          "CWE-319: Cleartext Transmission of Sensitive Information"
        ],
        "asvs": {
          "section": "V9 Communications Verification Requirements",
          "control_id": "9.2.1 Weak TLS",
          "control_url": "https://github.com/OWASP/ASVS/blob/master/4.0/en/0x17-V9-Communications.md#v92-server-communications-security-requirements",
          "version": "4"
        },
        "category": "security",
        "technology": [
          "requests"
        ],
        "references": [
          "https://owasp.org/Top10/A02_2021-Cryptographic_Failures"
        ],
        "subcategory": [
          "audit"
        ],
        "likelihood": "LOW",
        "impact": "LOW",
        "confidence": "MEDIUM",
        "license": "Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license",
        "vulnerability_class": [
          "Mishandled Sensitive Information"
        ],
        "source": "https://semgrep.dev/r/python.lang.security.audit.insecure-transport.requests.request-session-http-in-with-context.request-session-http-in-with-context",
        "shortlink": "https://sg.run/Bk5W",
        "semgrep.dev": {
          "rule": {
            "r_id": 9651,
            "rv_id": 1263484,
            "rule_id": "lBU9BZ",
            "version_id": "vdT06wb",
            "url": "https://semgrep.dev/playground/r/vdT06wb/python.lang.security.audit.insecure-transport.requests.request-session-http-in-with-context.request-session-http-in-with-context",
            "origin": "community"
          }
        }
      },
      "languages": [
        "python"
      ],
      "severity": "INFO"
    },
    {
      "id": "python.lang.security.audit.insecure-transport.requests.request-session-with-http.request-session-with-http",
      "options": {
        "symbolic_propagation": true
      },
      "mode": "taint",
      "pattern-sources": [
        {
          "patterns": [
            {
              "pattern": "\"$URL\"\n"
            },
            {
              "metavariable-pattern": {
                "metavariable": "$URL",
                "language": "regex",
                "patterns": [
                  {
                    "pattern-regex": "http://"
                  },
                  {
                    "pattern-not-regex": ".*://localhost"
                  },
                  {
                    "pattern-not-regex": ".*://127\\.0\\.0\\.1"
                  }
                ]
              }
            }
          ]
        }
      ],
      "pattern-sinks": [
        {
          "patterns": [
            {
              "pattern-either": [
                {
                  "pattern": "requests.Session(...).$W($SINK, ...)"
                },
                {
                  "pattern": "requests.Session(...).request($METHOD, $SINK, ...)"
                }
              ]
            },
            {
              "focus-metavariable": "$SINK"
            }
          ]
        }
      ],
      "fix-regex": {
        "regex": "[Hh][Tt][Tt][Pp]://",
        "replacement": "https://",
        "count": 1
      },
      "message": "Detected a request using 'http://'. This request will be unencrypted. Use 'https://' instead.",
      "languages": [
        "python"
      ],
      "severity": "INFO",
      "metadata": {
        "owasp": [
          "A03:2017 - Sensitive Data Exposure",
          "A02:2021 - Cryptographic Failures",
          "A04:2025 - Cryptographic Failures"
        ],
        "cwe": [
          "CWE-319: Cleartext Transmission of Sensitive Information"
        ],
        "asvs": {
          "section": "V9 Communications Verification Requirements",
          "control_id": "9.1.1 Weak TLS",
          "control_url": "https://github.com/OWASP/ASVS/blob/master/4.0/en/0x17-V9-Communications.md#v92-server-communications-security-requirements",
          "version": "4"
        },
        "category": "security",
        "technology": [
          "requests"
        ],
        "references": [
          "https://owasp.org/Top10/A02_2021-Cryptographic_Failures"
        ],
        "subcategory": [
          "audit"
        ],
        "likelihood": "LOW",
        "impact": "LOW",
        "confidence": "MEDIUM",
        "license": "Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license",
        "vulnerability_class": [
          "Mishandled Sensitive Information"
        ],
        "source": "https://semgrep.dev/r/python.lang.security.audit.insecure-transport.requests.request-session-with-http.request-session-with-http",
        "shortlink": "https://sg.run/DoBY",
        "semgrep.dev": {
          "rule": {
            "r_id": 9652,
            "rv_id": 1263485,
            "rule_id": "YGURXw",
            "version_id": "d6Tyx02",
            "url": "https://semgrep.dev/playground/r/d6Tyx02/python.lang.security.audit.insecure-transport.requests.request-session-with-http.request-session-with-http",
            "origin": "community"
          }
        }
      }
    },
    {
      "id": "python.lang.security.audit.insecure-transport.requests.request-with-http.request-with-http",
      "fix-regex": {
        "regex": "[Hh][Tt][Tt][Pp]://",
        "replacement": "https://",
        "count": 1
      },
      "message": "Detected a request using 'http://'. This request will be unencrypted, and attackers could listen into traffic on the network and be able to obtain sensitive information. Use 'https://' instead.",
      "metadata": {
        "owasp": [
          "A03:2017 - Sensitive Data Exposure",
          "A02:2021 - Cryptographic Failures",
          "A04:2025 - Cryptographic Failures"
        ],
        "cwe": [
          "CWE-319: Cleartext Transmission of Sensitive Information"
        ],
        "asvs": {
          "section": "V9 Communications Verification Requirements",
          "control_id": "9.1.1 Weak TLS",
          "control_url": "https://github.com/OWASP/ASVS/blob/master/4.0/en/0x17-V9-Communications.md#v92-server-communications-security-requirements",
          "version": "4"
        },
        "category": "security",
        "technology": [
          "requests"
        ],
        "references": [
          "https://owasp.org/Top10/A02_2021-Cryptographic_Failures"
        ],
        "subcategory": [
          "audit"
        ],
        "likelihood": "LOW",
        "impact": "LOW",
        "confidence": "MEDIUM",
        "license": "Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license",
        "vulnerability_class": [
          "Mishandled Sensitive Information"
        ],
        "source": "https://semgrep.dev/r/python.lang.security.audit.insecure-transport.requests.request-with-http.request-with-http",
        "shortlink": "https://sg.run/W8J4",
        "semgrep.dev": {
          "rule": {
            "r_id": 9653,
            "rv_id": 1263486,
            "rule_id": "6JUjpG",
            "version_id": "ZRTKA9v",
            "url": "https://semgrep.dev/playground/r/ZRTKA9v/python.lang.security.audit.insecure-transport.requests.request-with-http.request-with-http",
            "origin": "community"
          }
        }
      },
      "languages": [
        "python"
      ],
      "severity": "INFO",
      "options": {
        "symbolic_propagation": true
      },
      "mode": "taint",
      "pattern-sources": [
        {
          "patterns": [
            {
              "pattern": "\"$URL\"\n"
            },
            {
              "metavariable-pattern": {
                "metavariable": "$URL",
                "language": "regex",
                "patterns": [
                  {
                    "pattern-regex": "http://"
                  },
                  {
                    "pattern-not-regex": ".*://localhost"
                  },
                  {
                    "pattern-not-regex": ".*://127\\.0\\.0\\.1"
                  }
                ]
              }
            }
          ]
        }
      ],
      "pattern-sinks": [
        {
          "patterns": [
            {
              "pattern-either": [
                {
                  "pattern": "requests.$W($SINK, ...)"
                },
                {
                  "pattern": "requests.request($METHOD, $SINK, ...)"
                },
                {
                  "pattern": "requests.Request($METHOD, $SINK, ...)"
                }
              ]
            },
            {
              "focus-metavariable": "$SINK"
            }
          ]
        }
      ]
    },
    {
      "id": "python.lang.security.audit.logging.logger-credential-leak.python-logger-credential-disclosure",
      "patterns": [
        {
          "pattern": "$LOGGER_OBJ.$LOGGER_CALL($FORMAT_STRING,...)\n"
        },
        {
          "metavariable-regex": {
            "metavariable": "$LOGGER_OBJ",
            "regex": "(?i)(_logger|logger|self.logger|log)"
          }
        },
        {
          "metavariable-regex": {
            "metavariable": "$LOGGER_CALL",
            "regex": "(debug|info|warn|warning|error|exception|critical)"
          }
        },
        {
          "metavariable-regex": {
            "metavariable": "$FORMAT_STRING",
            "regex": "(?i).*(api.key|secret|credential|token|password).*\\%s.*"
          }
        }
      ],
      "message": "Detected a python logger call with a potential hardcoded secret $FORMAT_STRING being logged. This may lead to secret credentials being exposed. Make sure that the logger is not logging  sensitive information.",
      "severity": "WARNING",
      "languages": [
        "python"
      ],
      "metadata": {
        "cwe": [
          "CWE-532: Insertion of Sensitive Information into Log File"
        ],
        "category": "security",
        "technology": [
          "python"
        ],
        "owasp": [
          "A09:2021 - Security Logging and Monitoring Failures",
          "A09:2025 - Security Logging & Alerting Failures"
        ],
        "references": [
          "https://owasp.org/Top10/A09_2021-Security_Logging_and_Monitoring_Failures"
        ],
        "subcategory": [
          "vuln"
        ],
        "likelihood": "LOW",
        "impact": "MEDIUM",
        "confidence": "MEDIUM",
        "license": "Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license",
        "vulnerability_class": [
          "Mishandled Sensitive Information"
        ],
        "source": "https://semgrep.dev/r/python.lang.security.audit.logging.logger-credential-leak.python-logger-credential-disclosure",
        "shortlink": "https://sg.run/ydNx",
        "semgrep.dev": {
          "rule": {
            "r_id": 9668,
            "rv_id": 1263501,
            "rule_id": "x8UnJk",
            "version_id": "A8TgdOR",
            "url": "https://semgrep.dev/playground/r/A8TgdOR/python.lang.security.audit.logging.logger-credential-leak.python-logger-credential-disclosure",
            "origin": "community"
          }
        }
      }
    },
    {
      "id": "python.lang.security.audit.network.bind.avoid-bind-to-all-interfaces",
      "message": "Running `socket.bind` to 0.0.0.0, or empty string could unexpectedly expose the server publicly as it binds to all available interfaces. Consider instead getting correct address from an environment variable or configuration file.",
      "metadata": {
        "cwe": [
          "CWE-200: Exposure of Sensitive Information to an Unauthorized Actor"
        ],
        "owasp": [
          "A01:2021 - Broken Access Control",
          "A01:2025 - Broken Access Control"
        ],
        "category": "security",
        "technology": [
          "python"
        ],
        "references": [
          "https://owasp.org/Top10/A01_2021-Broken_Access_Control"
        ],
        "cwe2021-top25": true,
        "subcategory": [
          "vuln"
        ],
        "likelihood": "HIGH",
        "impact": "MEDIUM",
        "confidence": "HIGH",
        "license": "Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license",
        "vulnerability_class": [
          "Mishandled Sensitive Information"
        ],
        "source": "https://semgrep.dev/r/python.lang.security.audit.network.bind.avoid-bind-to-all-interfaces",
        "shortlink": "https://sg.run/rdln",
        "semgrep.dev": {
          "rule": {
            "r_id": 9669,
            "rv_id": 1263505,
            "rule_id": "OrU3og",
            "version_id": "0bTKzDL",
            "url": "https://semgrep.dev/playground/r/0bTKzDL/python.lang.security.audit.network.bind.avoid-bind-to-all-interfaces",
            "origin": "community"
          }
        }
      },
      "languages": [
        "python"
      ],
      "severity": "INFO",
      "pattern-either": [
        {
          "pattern": "$S = socket.socket(...)\n...\n$S.bind((\"0.0.0.0\", ...))\n"
        },
        {
          "pattern": "$S = socket.socket(...)\n...\n$S.bind((\"::\", ...))\n"
        },
        {
          "pattern": "$S = socket.socket(...)\n...\n$S.bind((\"\", ...))\n"
        }
      ]
    },
    {
      "id": "python.lang.security.audit.network.disabled-cert-validation.disabled-cert-validation",
      "patterns": [
        {
          "pattern-either": [
            {
              "pattern": "urllib3.PoolManager(..., cert_reqs=$REQS, ...)"
            },
            {
              "pattern": "urllib3.ProxyManager(..., cert_reqs=$REQS, ...)"
            },
            {
              "pattern": "urllib3.HTTPSConnectionPool(..., cert_reqs=$REQS, ...)"
            },
            {
              "pattern": "urllib3.connectionpool.HTTPSConnectionPool(..., cert_reqs=$REQS, ...)"
            },
            {
              "pattern": "urllib3.connection_from_url(..., cert_reqs=$REQS, ...)"
            },
            {
              "pattern": "urllib3.proxy_from_url(..., cert_reqs=$REQS, ...)"
            },
            {
              "pattern": "$CONTEXT.wrap_socket(..., cert_reqs=$REQS, ...)"
            },
            {
              "pattern": "ssl.wrap_socket(..., cert_reqs=$REQS, ...)"
            }
          ]
        },
        {
          "metavariable-regex": {
            "metavariable": "$REQS",
            "regex": "(NONE|CERT_NONE|CERT_OPTIONAL|ssl\\.CERT_NONE|ssl\\.CERT_OPTIONAL|\\'NONE\\'|\\\"NONE\\\"|\\'OPTIONAL\\'|\\\"OPTIONAL\\\")"
          }
        }
      ],
      "message": "certificate verification explicitly disabled, insecure connections possible",
      "metadata": {
        "cwe": [
          "CWE-295: Improper Certificate Validation"
        ],
        "owasp": [
          "A03:2017 - Sensitive Data Exposure",
          "A07:2021 - Identification and Authentication Failures",
          "A07:2025 - Authentication Failures"
        ],
        "category": "security",
        "technology": [
          "python"
        ],
        "references": [
          "https://owasp.org/Top10/A07_2021-Identification_and_Authentication_Failures"
        ],
        "subcategory": [
          "vuln"
        ],
        "likelihood": "HIGH",
        "impact": "MEDIUM",
        "confidence": "MEDIUM",
        "license": "Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license",
        "vulnerability_class": [
          "Improper Authentication"
        ],
        "source": "https://semgrep.dev/r/python.lang.security.audit.network.disabled-cert-validation.disabled-cert-validation",
        "shortlink": "https://sg.run/b7yp",
        "semgrep.dev": {
          "rule": {
            "r_id": 9670,
            "rv_id": 1263506,
            "rule_id": "eqU87k",
            "version_id": "K3TKkZn",
            "url": "https://semgrep.dev/playground/r/K3TKkZn/python.lang.security.audit.network.disabled-cert-validation.disabled-cert-validation",
            "origin": "community"
          }
        }
      },
      "languages": [
        "python"
      ],
      "severity": "ERROR"
    },
    {
      "id": "python.lang.security.audit.network.http-not-https-connection.http-not-https-connection",
      "message": "Detected HTTPConnectionPool. This will transmit data in cleartext. It is recommended to use HTTPSConnectionPool instead for to encrypt communications.",
      "metadata": {
        "cwe": [
          "CWE-319: Cleartext Transmission of Sensitive Information"
        ],
        "owasp": [
          "A03:2017 - Sensitive Data Exposure",
          "A02:2021 - Cryptographic Failures",
          "A04:2025 - Cryptographic Failures"
        ],
        "references": [
          "https://urllib3.readthedocs.io/en/1.2.1/pools.html#urllib3.connectionpool.HTTPSConnectionPool"
        ],
        "category": "security",
        "technology": [
          "python"
        ],
        "subcategory": [
          "audit"
        ],
        "likelihood": "MEDIUM",
        "impact": "MEDIUM",
        "confidence": "MEDIUM",
        "license": "Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license",
        "vulnerability_class": [
          "Mishandled Sensitive Information"
        ],
        "source": "https://semgrep.dev/r/python.lang.security.audit.network.http-not-https-connection.http-not-https-connection",
        "shortlink": "https://sg.run/N4Np",
        "semgrep.dev": {
          "rule": {
            "r_id": 9671,
            "rv_id": 1263507,
            "rule_id": "v8UnWQ",
            "version_id": "qkTR7E1",
            "url": "https://semgrep.dev/playground/r/qkTR7E1/python.lang.security.audit.network.http-not-https-connection.http-not-https-connection",
            "origin": "community"
          }
        }
      },
      "languages": [
        "python"
      ],
      "severity": "ERROR",
      "pattern-either": [
        {
          "pattern": "urllib3.HTTPConnectionPool(...)"
        },
        {
          "pattern": "urllib3.connectionpool.HTTPConnectionPool(...)"
        }
      ]
    },
    {
      "id": "python.lang.security.deserialization.avoid-pyyaml-load.avoid-pyyaml-load",
      "metadata": {
        "owasp": [
          "A08:2017 - Insecure Deserialization",
          "A08:2021 - Software and Data Integrity Failures",
          "A08:2025 - Software or Data Integrity Failures"
        ],
        "cwe": [
          "CWE-502: Deserialization of Untrusted Data"
        ],
        "references": [
          "https://github.com/yaml/pyyaml/wiki/PyYAML-yaml.load(input)-Deprecation",
          "https://nvd.nist.gov/vuln/detail/CVE-2017-18342"
        ],
        "category": "security",
        "technology": [
          "pyyaml"
        ],
        "cwe2022-top25": true,
        "cwe2021-top25": true,
        "subcategory": [
          "audit"
        ],
        "likelihood": "LOW",
        "impact": "MEDIUM",
        "confidence": "MEDIUM",
        "license": "Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license",
        "vulnerability_class": [
          "Insecure Deserialization "
        ],
        "source": "https://semgrep.dev/r/python.lang.security.deserialization.avoid-pyyaml-load.avoid-pyyaml-load",
        "shortlink": "https://sg.run/we9Y",
        "semgrep.dev": {
          "rule": {
            "r_id": 9673,
            "rv_id": 1263530,
            "rule_id": "ZqU5jZ",
            "version_id": "1QTyprw",
            "url": "https://semgrep.dev/playground/r/1QTyprw/python.lang.security.deserialization.avoid-pyyaml-load.avoid-pyyaml-load",
            "origin": "community"
          }
        }
      },
      "languages": [
        "python"
      ],
      "message": "Detected a possible YAML deserialization vulnerability. `yaml.unsafe_load`, `yaml.Loader`, `yaml.CLoader`, and `yaml.UnsafeLoader` are all known to be unsafe methods of deserializing YAML. An attacker with control over the YAML input could create special YAML input that allows the attacker to run arbitrary Python code. This would allow the attacker to steal files, download and install malware, or otherwise take over the machine. Use `yaml.safe_load` or `yaml.SafeLoader` instead.",
      "fix-regex": {
        "regex": "unsafe_load",
        "replacement": "safe_load",
        "count": 1
      },
      "severity": "ERROR",
      "patterns": [
        {
          "pattern-inside": "import yaml\n...\n"
        },
        {
          "pattern-not-inside": "$YAML = ruamel.yaml.YAML(...)\n...\n"
        },
        {
          "pattern-either": [
            {
              "pattern": "yaml.unsafe_load(...)"
            },
            {
              "pattern": "yaml.load(..., Loader=yaml.Loader, ...)"
            },
            {
              "pattern": "yaml.load(..., Loader=yaml.UnsafeLoader, ...)"
            },
            {
              "pattern": "yaml.load(..., Loader=yaml.CLoader, ...)"
            },
            {
              "pattern": "yaml.load_all(..., Loader=yaml.Loader, ...)"
            },
            {
              "pattern": "yaml.load_all(..., Loader=yaml.UnsafeLoader, ...)"
            },
            {
              "pattern": "yaml.load_all(..., Loader=yaml.CLoader, ...)"
            }
          ]
        }
      ]
    },
    {
      "id": "python.lang.security.deserialization.avoid-unsafe-ruamel.avoid-unsafe-ruamel",
      "metadata": {
        "owasp": [
          "A08:2017 - Insecure Deserialization",
          "A08:2021 - Software and Data Integrity Failures",
          "A08:2025 - Software or Data Integrity Failures"
        ],
        "cwe": [
          "CWE-502: Deserialization of Untrusted Data"
        ],
        "references": [
          "https://yaml.readthedocs.io/en/latest/basicuse.html?highlight=typ"
        ],
        "category": "security",
        "technology": [
          "ruamel.yaml"
        ],
        "cwe2022-top25": true,
        "cwe2021-top25": true,
        "subcategory": [
          "audit"
        ],
        "likelihood": "LOW",
        "impact": "MEDIUM",
        "confidence": "MEDIUM",
        "license": "Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license",
        "vulnerability_class": [
          "Insecure Deserialization "
        ],
        "source": "https://semgrep.dev/r/python.lang.security.deserialization.avoid-unsafe-ruamel.avoid-unsafe-ruamel",
        "shortlink": "https://sg.run/x1rz",
        "semgrep.dev": {
          "rule": {
            "r_id": 9674,
            "rv_id": 1263531,
            "rule_id": "nJUzqK",
            "version_id": "9lT4bvG",
            "url": "https://semgrep.dev/playground/r/9lT4bvG/python.lang.security.deserialization.avoid-unsafe-ruamel.avoid-unsafe-ruamel",
            "origin": "community"
          }
        }
      },
      "languages": [
        "python"
      ],
      "message": "Avoid using unsafe `ruamel.yaml.YAML()`. `ruamel.yaml.YAML` can create arbitrary Python objects. A malicious actor could exploit this to run arbitrary code. Use `YAML(typ='rt')` or `YAML(typ='safe')` instead.",
      "severity": "ERROR",
      "pattern-either": [
        {
          "pattern": "ruamel.yaml.YAML(..., typ='unsafe', ...)"
        },
        {
          "pattern": "ruamel.yaml.YAML(..., typ='base', ...)"
        }
      ]
    },
    {
      "id": "python.lang.security.deserialization.pickle.avoid-shelve",
      "metadata": {
        "owasp": [
          "A08:2017 - Insecure Deserialization",
          "A08:2021 - Software and Data Integrity Failures",
          "A08:2025 - Software or Data Integrity Failures"
        ],
        "cwe": [
          "CWE-502: Deserialization of Untrusted Data"
        ],
        "references": [
          "https://docs.python.org/3/library/pickle.html"
        ],
        "category": "security",
        "technology": [
          "python"
        ],
        "cwe2022-top25": true,
        "cwe2021-top25": true,
        "subcategory": [
          "audit"
        ],
        "likelihood": "LOW",
        "impact": "MEDIUM",
        "confidence": "MEDIUM",
        "license": "Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license",
        "vulnerability_class": [
          "Insecure Deserialization "
        ],
        "source": "https://semgrep.dev/r/python.lang.security.deserialization.pickle.avoid-shelve",
        "shortlink": "https://sg.run/dKkZ",
        "semgrep.dev": {
          "rule": {
            "r_id": 9678,
            "rv_id": 1263535,
            "rule_id": "8GUje2",
            "version_id": "NdTzyb4",
            "url": "https://semgrep.dev/playground/r/NdTzyb4/python.lang.security.deserialization.pickle.avoid-shelve",
            "origin": "community"
          }
        }
      },
      "languages": [
        "python"
      ],
      "message": "Avoid using `shelve`, which uses `pickle`, which is known to lead to code execution vulnerabilities. When unpickling, the serialized data could be manipulated to run arbitrary code. Instead, consider serializing the relevant data as JSON or a similar text-based serialization format.",
      "severity": "WARNING",
      "pattern": "shelve.$FUNC(...)"
    },
    {
      "id": "python.pycryptodome.security.insecure-cipher-algorithm.insecure-cipher-algorithm-xor",
      "message": "Detected XOR cipher algorithm which is considered insecure. This algorithm is not cryptographically secure and can be reversed easily. Use AES instead.",
      "metadata": {
        "source-rule-url": "https://github.com/PyCQA/bandit/blob/d5f8fa0d89d7b11442fc6ec80ca42953974354c8/bandit/blacklists/calls.py#L84",
        "cwe": [
          "CWE-327: Use of a Broken or Risky Cryptographic Algorithm"
        ],
        "owasp": [
          "A03:2017 - Sensitive Data Exposure",
          "A02:2021 - Cryptographic Failures",
          "A04:2025 - Cryptographic Failures"
        ],
        "bandit-code": "B304",
        "references": [
          "https://stackoverflow.com/questions/1135186/whats-wrong-with-xor-encryption"
        ],
        "category": "security",
        "technology": [
          "pycryptodome"
        ],
        "subcategory": [
          "vuln"
        ],
        "likelihood": "LOW",
        "impact": "MEDIUM",
        "confidence": "MEDIUM",
        "license": "Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license",
        "vulnerability_class": [
          "Cryptographic Issues"
        ],
        "source": "https://semgrep.dev/r/python.pycryptodome.security.insecure-cipher-algorithm.insecure-cipher-algorithm-xor",
        "shortlink": "https://sg.run/L0yr",
        "semgrep.dev": {
          "rule": {
            "r_id": 9683,
            "rv_id": 1263549,
            "rule_id": "PeUk5W",
            "version_id": "gETB7j3",
            "url": "https://semgrep.dev/playground/r/gETB7j3/python.pycryptodome.security.insecure-cipher-algorithm.insecure-cipher-algorithm-xor",
            "origin": "community"
          }
        }
      },
      "severity": "WARNING",
      "languages": [
        "python"
      ],
      "pattern-either": [
        {
          "pattern": "Cryptodome.Cipher.XOR.new(...)"
        },
        {
          "pattern": "Crypto.Cipher.XOR.new(...)"
        }
      ]
    },
    {
      "id": "python.pycryptodome.security.insecure-hash-algorithm.insecure-hash-algorithm-sha1",
      "message": "Detected SHA1 hash algorithm which is considered insecure. SHA1 is not collision resistant and is therefore not suitable as a cryptographic signature. Use SHA256 or SHA3 instead.",
      "metadata": {
        "source-rule-url": "https://github.com/PyCQA/bandit/blob/d5f8fa0d89d7b11442fc6ec80ca42953974354c8/bandit/blacklists/calls.py#L59",
        "cwe": [
          "CWE-327: Use of a Broken or Risky Cryptographic Algorithm"
        ],
        "owasp": [
          "A03:2017 - Sensitive Data Exposure",
          "A02:2021 - Cryptographic Failures",
          "A04:2025 - Cryptographic Failures"
        ],
        "references": [
          "https://www.schneier.com/blog/archives/2012/10/when_will_we_se.html",
          "https://www.trendmicro.com/vinfo/us/security/news/vulnerabilities-and-exploits/sha-1-collision-signals-the-end-of-the-algorithm-s-viability",
          "http://2012.sharcs.org/slides/stevens.pdf",
          "https://pycryptodome.readthedocs.io/en/latest/src/hash/sha3_256.html"
        ],
        "category": "security",
        "technology": [
          "pycryptodome"
        ],
        "subcategory": [
          "vuln"
        ],
        "likelihood": "LOW",
        "impact": "MEDIUM",
        "confidence": "MEDIUM",
        "license": "Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license",
        "vulnerability_class": [
          "Cryptographic Issues"
        ],
        "source": "https://semgrep.dev/r/python.pycryptodome.security.insecure-hash-algorithm.insecure-hash-algorithm-sha1",
        "shortlink": "https://sg.run/3ALr",
        "semgrep.dev": {
          "rule": {
            "r_id": 9687,
            "rv_id": 1263553,
            "rule_id": "ReUPO3",
            "version_id": "PkTR3vk",
            "url": "https://semgrep.dev/playground/r/PkTR3vk/python.pycryptodome.security.insecure-hash-algorithm.insecure-hash-algorithm-sha1",
            "origin": "community"
          }
        }
      },
      "severity": "WARNING",
      "languages": [
        "python"
      ],
      "pattern-either": [
        {
          "pattern": "Crypto.Hash.SHA.new(...)"
        },
        {
          "pattern": "Cryptodome.Hash.SHA.new (...)"
        }
      ]
    },
    {
      "id": "python.pycryptodome.security.insufficient-dsa-key-size.insufficient-dsa-key-size",
      "message": "Detected an insufficient key size for DSA. NIST recommends a key size of 2048 or higher.",
      "metadata": {
        "cwe": [
          "CWE-326: Inadequate Encryption Strength"
        ],
        "owasp": [
          "A03:2017 - Sensitive Data Exposure",
          "A02:2021 - Cryptographic Failures",
          "A04:2025 - Cryptographic Failures"
        ],
        "source-rule-url": "https://github.com/PyCQA/bandit/blob/b1411bfb43795d3ffd268bef17a839dee954c2b1/bandit/plugins/weak_cryptographic_key.py",
        "references": [
          "https://www.pycryptodome.org/src/public_key/dsa",
          "https://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-57pt1r5.pdf"
        ],
        "category": "security",
        "technology": [
          "pycryptodome"
        ],
        "subcategory": [
          "vuln"
        ],
        "likelihood": "LOW",
        "impact": "MEDIUM",
        "confidence": "HIGH",
        "functional-categories": [
          "crypto::search::key-length::pycryptodome",
          "crypto::search::key-length::pycryptodomex"
        ],
        "license": "Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license",
        "vulnerability_class": [
          "Cryptographic Issues"
        ],
        "source": "https://semgrep.dev/r/python.pycryptodome.security.insufficient-dsa-key-size.insufficient-dsa-key-size",
        "shortlink": "https://sg.run/4y8l",
        "semgrep.dev": {
          "rule": {
            "r_id": 9688,
            "rv_id": 1263554,
            "rule_id": "AbUWje",
            "version_id": "JdTzxbQ",
            "url": "https://semgrep.dev/playground/r/JdTzxbQ/python.pycryptodome.security.insufficient-dsa-key-size.insufficient-dsa-key-size",
            "origin": "community"
          }
        }
      },
      "options": {
        "symbolic_propagation": true
      },
      "languages": [
        "python"
      ],
      "severity": "WARNING",
      "patterns": [
        {
          "pattern-either": [
            {
              "pattern": "Crypto.PublicKey.DSA.generate(..., bits=$SIZE, ...)"
            },
            {
              "pattern": "Crypto.PublicKey.DSA.generate($SIZE, ...)"
            },
            {
              "pattern": "Cryptodome.PublicKey.DSA.generate(..., bits=$SIZE, ...)"
            },
            {
              "pattern": "Cryptodome.PublicKey.DSA.generate($SIZE, ...)"
            }
          ]
        },
        {
          "metavariable-comparison": {
            "metavariable": "$SIZE",
            "comparison": "$SIZE < 2048"
          }
        }
      ]
    },
    {
      "id": "python.pycryptodome.security.insufficient-rsa-key-size.insufficient-rsa-key-size",
      "message": "Detected an insufficient key size for RSA. NIST recommends a key size of 3072 or higher.",
      "metadata": {
        "cwe": [
          "CWE-326: Inadequate Encryption Strength"
        ],
        "owasp": [
          "A03:2017 - Sensitive Data Exposure",
          "A02:2021 - Cryptographic Failures",
          "A04:2025 - Cryptographic Failures"
        ],
        "source-rule-url": "https://github.com/PyCQA/bandit/blob/b1411bfb43795d3ffd268bef17a839dee954c2b1/bandit/plugins/weak_cryptographic_key.py",
        "references": [
          "https://www.pycryptodome.org/src/public_key/rsa#rsa",
          "https://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-57pt1r5.pdf"
        ],
        "category": "security",
        "technology": [
          "pycryptodome"
        ],
        "subcategory": [
          "vuln"
        ],
        "likelihood": "LOW",
        "impact": "MEDIUM",
        "confidence": "HIGH",
        "functional-categories": [
          "crypto::search::key-length::pycryptodome",
          "crypto::search::key-length::pycryptodomex"
        ],
        "license": "Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license",
        "vulnerability_class": [
          "Cryptographic Issues"
        ],
        "source": "https://semgrep.dev/r/python.pycryptodome.security.insufficient-rsa-key-size.insufficient-rsa-key-size",
        "shortlink": "https://sg.run/PprY",
        "semgrep.dev": {
          "rule": {
            "r_id": 9689,
            "rv_id": 1263555,
            "rule_id": "BYUBWe",
            "version_id": "5PTo1jL",
            "url": "https://semgrep.dev/playground/r/5PTo1jL/python.pycryptodome.security.insufficient-rsa-key-size.insufficient-rsa-key-size",
            "origin": "community"
          }
        }
      },
      "options": {
        "symbolic_propagation": true
      },
      "languages": [
        "python"
      ],
      "severity": "WARNING",
      "patterns": [
        {
          "pattern-either": [
            {
              "pattern": "Crypto.PublicKey.RSA.generate(..., bits=$SIZE, ...)"
            },
            {
              "pattern": "Crypto.PublicKey.RSA.generate($SIZE, ...)"
            },
            {
              "pattern": "Cryptodome.PublicKey.RSA.generate(..., bits=$SIZE, ...)"
            },
            {
              "pattern": "Cryptodome.PublicKey.RSA.generate($SIZE, ...)"
            }
          ]
        },
        {
          "metavariable-comparison": {
            "metavariable": "$SIZE",
            "comparison": "$SIZE < 3072"
          }
        }
      ]
    },
    {
      "id": "python.sqlalchemy.security.sqlalchemy-sql-injection.sqlalchemy-sql-injection",
      "patterns": [
        {
          "pattern-either": [
            {
              "pattern": "def $FUNC(...,$VAR,...):\n  ...\n  $SESSION.query(...).$SQLFUNC(\"...\".$FORMATFUNC(...,$VAR,...))\n"
            },
            {
              "pattern": "def $FUNC(...,$VAR,...):\n  ...\n  $SESSION.query.join(...).$SQLFUNC(\"...\".$FORMATFUNC(...,$VAR,...))\n"
            },
            {
              "pattern": "def $FUNC(...,$VAR,...):\n  ...\n  $SESSION.query.$SQLFUNC(\"...\".$FORMATFUNC(...,$VAR,...))\n"
            },
            {
              "pattern": "def $FUNC(...,$VAR,...):\n  ...\n  query.$SQLFUNC(\"...\".$FORMATFUNC(...,$VAR,...))\n"
            }
          ]
        },
        {
          "metavariable-regex": {
            "metavariable": "$SQLFUNC",
            "regex": "(group_by|order_by|distinct|having|filter)"
          }
        },
        {
          "metavariable-regex": {
            "metavariable": "$FORMATFUNC",
            "regex": "(?!bindparams)"
          }
        }
      ],
      "message": "Distinct, Having, Group_by, Order_by, and Filter in SQLAlchemy can cause sql injections if the developer inputs raw SQL into the before-mentioned clauses. This pattern captures relevant cases in which the developer inputs raw SQL into the distinct, having, group_by, order_by or filter clauses and injects user-input into the raw SQL with any function besides \"bindparams\". Use bindParams to securely bind user-input to SQL statements.",
      "fix-regex": {
        "regex": "format",
        "replacement": "bindparams"
      },
      "languages": [
        "python"
      ],
      "severity": "WARNING",
      "metadata": {
        "cwe": [
          "CWE-89: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')"
        ],
        "category": "security",
        "technology": [
          "sqlalchemy"
        ],
        "owasp": [
          "A01:2017 - Injection",
          "A03:2021 - Injection",
          "A05:2025 - Injection"
        ],
        "references": [
          "https://owasp.org/Top10/A03_2021-Injection"
        ],
        "cwe2022-top25": true,
        "cwe2021-top25": true,
        "subcategory": [
          "vuln"
        ],
        "likelihood": "LOW",
        "impact": "HIGH",
        "confidence": "MEDIUM",
        "license": "Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license",
        "vulnerability_class": [
          "SQL Injection"
        ],
        "source": "https://semgrep.dev/r/python.sqlalchemy.security.sqlalchemy-sql-injection.sqlalchemy-sql-injection",
        "shortlink": "https://sg.run/J3Xo",
        "semgrep.dev": {
          "rule": {
            "r_id": 9702,
            "rv_id": 1263579,
            "rule_id": "BYUBWo",
            "version_id": "NdTzyL4",
            "url": "https://semgrep.dev/playground/r/NdTzyL4/python.sqlalchemy.security.sqlalchemy-sql-injection.sqlalchemy-sql-injection",
            "origin": "community"
          }
        }
      }
    },
    {
      "id": "python.pymongo.security.mongodb.mongo-client-bad-auth",
      "pattern": "pymongo.MongoClient(..., authMechanism='MONGODB-CR')\n",
      "message": "Warning MONGODB-CR was deprecated with the release of MongoDB 3.6 and is no longer supported by MongoDB 4.0 (see https://api.mongodb.com/python/current/examples/authentication.html for details).",
      "fix-regex": {
        "regex": "MONGODB-CR",
        "replacement": "SCRAM-SHA-256"
      },
      "severity": "WARNING",
      "languages": [
        "python"
      ],
      "metadata": {
        "cwe": [
          "CWE-477: Use of Obsolete Function"
        ],
        "category": "security",
        "technology": [
          "pymongo"
        ],
        "references": [
          "https://cwe.mitre.org/data/definitions/477.html"
        ],
        "subcategory": [
          "vuln"
        ],
        "likelihood": "LOW",
        "impact": "LOW",
        "confidence": "MEDIUM",
        "license": "Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license",
        "vulnerability_class": [
          "Dangerous Method or Function"
        ],
        "source": "https://semgrep.dev/r/python.pymongo.security.mongodb.mongo-client-bad-auth",
        "shortlink": "https://sg.run/YXRd",
        "semgrep.dev": {
          "rule": {
            "r_id": 12658,
            "rv_id": 946422,
            "rule_id": "d8UlOX",
            "version_id": "0bT15XY",
            "url": "https://semgrep.dev/playground/r/0bT15XY/python.pymongo.security.mongodb.mongo-client-bad-auth",
            "origin": "community"
          }
        }
      }
    },
    {
      "id": "python.lang.security.audit.insecure-file-permissions.insecure-file-permissions",
      "languages": [
        "python"
      ],
      "severity": "WARNING",
      "metadata": {
        "category": "security",
        "owasp": [
          "A01:2021 - Broken Access Control",
          "A01:2025 - Broken Access Control"
        ],
        "cwe": [
          "CWE-276: Incorrect Default Permissions"
        ],
        "technology": [
          "python"
        ],
        "references": [
          "https://owasp.org/Top10/A01_2021-Broken_Access_Control"
        ],
        "cwe2022-top25": true,
        "cwe2021-top25": true,
        "subcategory": [
          "vuln"
        ],
        "likelihood": "LOW",
        "impact": "MEDIUM",
        "confidence": "MEDIUM",
        "license": "Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license",
        "vulnerability_class": [
          "Improper Authorization"
        ],
        "source": "https://semgrep.dev/r/python.lang.security.audit.insecure-file-permissions.insecure-file-permissions",
        "shortlink": "https://sg.run/AXY4",
        "semgrep.dev": {
          "rule": {
            "r_id": 13594,
            "rv_id": 1263482,
            "rule_id": "zdUYqR",
            "version_id": "O9Tpxqr",
            "url": "https://semgrep.dev/playground/r/O9Tpxqr/python.lang.security.audit.insecure-file-permissions.insecure-file-permissions",
            "origin": "community"
          }
        }
      },
      "message": "These permissions `$BITS` are widely permissive and grant access to more people than may be necessary. A good default is `0o644` which gives read and write access to yourself and read access to everyone else.",
      "patterns": [
        {
          "pattern-inside": "os.$METHOD(...)"
        },
        {
          "metavariable-pattern": {
            "metavariable": "$METHOD",
            "patterns": [
              {
                "pattern-either": [
                  {
                    "pattern": "chmod"
                  },
                  {
                    "pattern": "lchmod"
                  },
                  {
                    "pattern": "fchmod"
                  }
                ]
              }
            ]
          }
        },
        {
          "pattern-either": [
            {
              "patterns": [
                {
                  "pattern": "os.$METHOD($FILE, $BITS, ...)"
                },
                {
                  "metavariable-comparison": {
                    "metavariable": "$BITS",
                    "comparison": "$BITS >= 0o650 and $BITS < 0o100000"
                  }
                }
              ]
            },
            {
              "patterns": [
                {
                  "pattern": "os.$METHOD($FILE, $BITS)"
                },
                {
                  "metavariable-comparison": {
                    "metavariable": "$BITS",
                    "comparison": "$BITS >= 0o100650"
                  }
                }
              ]
            },
            {
              "patterns": [
                {
                  "pattern": "os.$METHOD($FILE, $BITS, ...)"
                },
                {
                  "metavariable-pattern": {
                    "metavariable": "$BITS",
                    "patterns": [
                      {
                        "pattern-either": [
                          {
                            "pattern": "<... stat.S_IWGRP ...>"
                          },
                          {
                            "pattern": "<... stat.S_IXGRP ...>"
                          },
                          {
                            "pattern": "<... stat.S_IWOTH ...>"
                          },
                          {
                            "pattern": "<... stat.S_IXOTH ...>"
                          },
                          {
                            "pattern": "<... stat.S_IRWXO ...>"
                          },
                          {
                            "pattern": "<... stat.S_IRWXG ...>"
                          }
                        ]
                      }
                    ]
                  }
                }
              ]
            },
            {
              "patterns": [
                {
                  "pattern": "os.$METHOD($FILE, $EXPR | $MOD, ...)"
                },
                {
                  "metavariable-comparison": {
                    "metavariable": "$MOD",
                    "comparison": "$MOD == 0o111"
                  }
                }
              ]
            }
          ]
        }
      ]
    },
    {
      "id": "python.django.security.injection.raw-html-format.raw-html-format",
      "languages": [
        "python"
      ],
      "severity": "WARNING",
      "message": "Detected user input flowing into a manually constructed HTML string. You may be accidentally bypassing secure methods of rendering HTML by manually constructing HTML and this could create a cross-site scripting vulnerability, which could let attackers steal sensitive user data. To be sure this is safe, check that the HTML is rendered safely. Otherwise, use templates (`django.shortcuts.render`) which will safely render HTML instead.",
      "metadata": {
        "cwe": [
          "CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')"
        ],
        "owasp": [
          "A07:2017 - Cross-Site Scripting (XSS)",
          "A03:2021 - Injection",
          "A05:2025 - Injection"
        ],
        "category": "security",
        "technology": [
          "django"
        ],
        "references": [
          "https://docs.djangoproject.com/en/3.2/topics/http/shortcuts/#render",
          "https://docs.djangoproject.com/en/3.2/topics/security/#cross-site-scripting-xss-protection"
        ],
        "cwe2022-top25": true,
        "cwe2021-top25": true,
        "subcategory": [
          "vuln"
        ],
        "likelihood": "HIGH",
        "impact": "MEDIUM",
        "confidence": "MEDIUM",
        "license": "Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license",
        "vulnerability_class": [
          "Cross-Site-Scripting (XSS)"
        ],
        "source": "https://semgrep.dev/r/python.django.security.injection.raw-html-format.raw-html-format",
        "shortlink": "https://sg.run/oYj1",
        "semgrep.dev": {
          "rule": {
            "r_id": 14360,
            "rv_id": 1263397,
            "rule_id": "2ZUPER",
            "version_id": "5PTo100",
            "url": "https://semgrep.dev/playground/r/5PTo100/python.django.security.injection.raw-html-format.raw-html-format",
            "origin": "community"
          }
        }
      },
      "mode": "taint",
      "pattern-sanitizers": [
        {
          "pattern": "django.utils.html.escape(...)"
        }
      ],
      "pattern-sources": [
        {
          "patterns": [
            {
              "pattern": "request.$ANYTHING"
            },
            {
              "pattern-not": "request.build_absolute_uri"
            }
          ]
        }
      ],
      "pattern-sinks": [
        {
          "patterns": [
            {
              "pattern-either": [
                {
                  "patterns": [
                    {
                      "pattern-either": [
                        {
                          "pattern": "\"$HTMLSTR\" % ..."
                        },
                        {
                          "pattern": "\"$HTMLSTR\".format(...)"
                        },
                        {
                          "pattern": "\"$HTMLSTR\" + ..."
                        },
                        {
                          "pattern": "f\"$HTMLSTR{...}...\""
                        }
                      ]
                    }
                  ]
                },
                {
                  "patterns": [
                    {
                      "pattern-inside": "$HTML = \"$HTMLSTR\"\n...\n"
                    },
                    {
                      "pattern-either": [
                        {
                          "pattern": "$HTML % ..."
                        },
                        {
                          "pattern": "$HTML.format(...)"
                        },
                        {
                          "pattern": "$HTML + ..."
                        }
                      ]
                    }
                  ]
                }
              ]
            },
            {
              "metavariable-pattern": {
                "metavariable": "$HTMLSTR",
                "language": "generic",
                "pattern": "<$TAG ..."
              }
            }
          ]
        }
      ]
    },
    {
      "id": "python.flask.security.injection.raw-html-concat.raw-html-format",
      "languages": [
        "python"
      ],
      "severity": "WARNING",
      "message": "Detected user input flowing into a manually constructed HTML string. You may be accidentally bypassing secure methods of rendering HTML by manually constructing HTML and this could create a cross-site scripting vulnerability, which could let attackers steal sensitive user data. To be sure this is safe, check that the HTML is rendered safely. Otherwise, use templates (`flask.render_template`) which will safely render HTML instead.",
      "metadata": {
        "cwe": [
          "CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')"
        ],
        "owasp": [
          "A07:2017 - Cross-Site Scripting (XSS)",
          "A03:2021 - Injection",
          "A05:2025 - Injection"
        ],
        "category": "security",
        "technology": [
          "flask"
        ],
        "references": [
          "https://flask.palletsprojects.com/en/2.0.x/security/#cross-site-scripting-xss"
        ],
        "cwe2022-top25": true,
        "cwe2021-top25": true,
        "subcategory": [
          "vuln"
        ],
        "likelihood": "MEDIUM",
        "impact": "MEDIUM",
        "confidence": "MEDIUM",
        "license": "Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license",
        "vulnerability_class": [
          "Cross-Site-Scripting (XSS)"
        ],
        "source": "https://semgrep.dev/r/python.flask.security.injection.raw-html-concat.raw-html-format",
        "shortlink": "https://sg.run/Pb7e",
        "semgrep.dev": {
          "rule": {
            "r_id": 14389,
            "rv_id": 1409401,
            "rule_id": "GdUrJv",
            "version_id": "RGTEN1l",
            "url": "https://semgrep.dev/playground/r/RGTEN1l/python.flask.security.injection.raw-html-concat.raw-html-format",
            "origin": "community"
          }
        }
      },
      "mode": "taint",
      "pattern-sanitizers": [
        {
          "pattern": "jinja2.escape(...)"
        },
        {
          "pattern": "flask.escape(...)"
        },
        {
          "patterns": [
            {
              "pattern": "flask.render_template($TPL, ...)"
            },
            {
              "metavariable-regex": {
                "metavariable": "$TPL",
                "regex": ".*\\.html"
              }
            }
          ]
        }
      ],
      "pattern-sources": [
        {
          "patterns": [
            {
              "pattern-either": [
                {
                  "pattern": "flask.request.$ANYTHING"
                },
                {
                  "patterns": [
                    {
                      "pattern-inside": "@$APP.route(...)\ndef $FUNC(..., $ROUTEVAR, ...):\n  ...\n"
                    },
                    {
                      "pattern": "$ROUTEVAR"
                    }
                  ]
                }
              ]
            }
          ]
        }
      ],
      "pattern-sinks": [
        {
          "patterns": [
            {
              "pattern-either": [
                {
                  "patterns": [
                    {
                      "pattern-either": [
                        {
                          "pattern": "\"$HTMLSTR\" % ..."
                        },
                        {
                          "pattern": "\"$HTMLSTR\".format(...)"
                        },
                        {
                          "pattern": "\"$HTMLSTR\" + ..."
                        },
                        {
                          "pattern": "f\"$HTMLSTR{...}...\""
                        }
                      ]
                    }
                  ]
                },
                {
                  "patterns": [
                    {
                      "pattern-inside": "$HTML = \"$HTMLSTR\"\n...\n"
                    },
                    {
                      "pattern-either": [
                        {
                          "pattern": "$HTML % ..."
                        },
                        {
                          "pattern": "$HTML.format(...)"
                        },
                        {
                          "pattern": "$HTML + ..."
                        }
                      ]
                    }
                  ]
                }
              ]
            },
            {
              "metavariable-pattern": {
                "metavariable": "$HTMLSTR",
                "language": "generic",
                "pattern": "<$TAG ..."
              }
            }
          ]
        }
      ]
    },
    {
      "id": "python.flask.security.injection.tainted-url-host.tainted-url-host",
      "languages": [
        "python"
      ],
      "message": "User data flows into the host portion of this manually-constructed URL. This could allow an attacker to send data to their own server, potentially exposing sensitive data such as cookies or authorization information sent with this request. They could also probe internal servers or other resources that the server running this code can access. (This is called server-side request forgery, or SSRF.) Do not allow arbitrary hosts. Instead, create an allowlist for approved hosts, or hardcode the correct host.",
      "metadata": {
        "cwe": [
          "CWE-918: Server-Side Request Forgery (SSRF)"
        ],
        "owasp": [
          "A10:2021 - Server-Side Request Forgery (SSRF)",
          "A01:2025 - Broken Access Control"
        ],
        "references": [
          "https://cheatsheetseries.owasp.org/cheatsheets/Server_Side_Request_Forgery_Prevention_Cheat_Sheet.html"
        ],
        "category": "security",
        "technology": [
          "flask"
        ],
        "cwe2022-top25": true,
        "cwe2021-top25": true,
        "subcategory": [
          "vuln"
        ],
        "impact": "MEDIUM",
        "likelihood": "MEDIUM",
        "confidence": "MEDIUM",
        "license": "Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license",
        "vulnerability_class": [
          "Server-Side Request Forgery (SSRF)"
        ],
        "source": "https://semgrep.dev/r/python.flask.security.injection.tainted-url-host.tainted-url-host",
        "shortlink": "https://sg.run/RXpK",
        "semgrep.dev": {
          "rule": {
            "r_id": 14649,
            "rv_id": 1409403,
            "rule_id": "ReU3Wb",
            "version_id": "BjTy42w",
            "url": "https://semgrep.dev/playground/r/BjTy42w/python.flask.security.injection.tainted-url-host.tainted-url-host",
            "origin": "community"
          }
        }
      },
      "mode": "taint",
      "pattern-sinks": [
        {
          "patterns": [
            {
              "pattern-either": [
                {
                  "patterns": [
                    {
                      "pattern": "\"$URLSTR\" % ..."
                    },
                    {
                      "metavariable-pattern": {
                        "metavariable": "$URLSTR",
                        "language": "generic",
                        "patterns": [
                          {
                            "pattern-either": [
                              {
                                "pattern": "$SCHEME://%s"
                              },
                              {
                                "pattern": "$SCHEME://%r"
                              }
                            ]
                          }
                        ]
                      }
                    }
                  ]
                },
                {
                  "patterns": [
                    {
                      "pattern": "\"$URLSTR\".format(...)"
                    },
                    {
                      "metavariable-pattern": {
                        "metavariable": "$URLSTR",
                        "language": "generic",
                        "pattern": "$SCHEME:// { ... }"
                      }
                    }
                  ]
                },
                {
                  "patterns": [
                    {
                      "pattern": "\"$URLSTR\" + ..."
                    },
                    {
                      "metavariable-regex": {
                        "metavariable": "$URLSTR",
                        "regex": ".*://$"
                      }
                    }
                  ]
                },
                {
                  "patterns": [
                    {
                      "pattern": "f\"$URLSTR{...}...\""
                    },
                    {
                      "metavariable-regex": {
                        "metavariable": "$URLSTR",
                        "regex": ".*://$"
                      }
                    }
                  ]
                },
                {
                  "patterns": [
                    {
                      "pattern-inside": "$URL = \"$URLSTR\"\n...\n"
                    },
                    {
                      "pattern": "$URL += ..."
                    },
                    {
                      "metavariable-regex": {
                        "metavariable": "$URLSTR",
                        "regex": ".*://$"
                      }
                    }
                  ]
                }
              ]
            }
          ]
        }
      ],
      "pattern-sources": [
        {
          "patterns": [
            {
              "pattern-either": [
                {
                  "pattern": "flask.request.$ANYTHING"
                },
                {
                  "patterns": [
                    {
                      "pattern-inside": "@$APP.route(...)\ndef $FUNC(..., $ROUTEVAR, ...):\n  ...\n"
                    },
                    {
                      "pattern": "$ROUTEVAR"
                    }
                  ]
                }
              ]
            }
          ]
        }
      ],
      "severity": "WARNING"
    },
    {
      "id": "python.flask.security.injection.tainted-sql-string.tainted-sql-string",
      "message": "Detected user input used to manually construct a SQL string. This is usually bad practice because manual construction could accidentally result in a SQL injection. An attacker could use a SQL injection to steal or modify contents of the database. Instead, use a parameterized query which is available by default in most database engines. Alternatively, consider using an object-relational mapper (ORM) such as SQLAlchemy which will protect your queries.",
      "metadata": {
        "cwe": [
          "CWE-704: Incorrect Type Conversion or Cast"
        ],
        "owasp": [
          "A01:2017 - Injection",
          "A03:2021 - Injection",
          "A05:2025 - Injection"
        ],
        "references": [
          "https://docs.sqlalchemy.org/en/14/core/tutorial.html#using-textual-sql",
          "https://www.tutorialspoint.com/sqlalchemy/sqlalchemy_quick_guide.htm",
          "https://docs.sqlalchemy.org/en/14/core/tutorial.html#using-more-specific-text-with-table-expression-literal-column-and-expression-column"
        ],
        "category": "security",
        "technology": [
          "sqlalchemy",
          "flask"
        ],
        "subcategory": [
          "vuln"
        ],
        "impact": "MEDIUM",
        "likelihood": "MEDIUM",
        "confidence": "MEDIUM",
        "license": "Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license",
        "vulnerability_class": [
          "Improper Validation"
        ],
        "source": "https://semgrep.dev/r/python.flask.security.injection.tainted-sql-string.tainted-sql-string",
        "shortlink": "https://sg.run/JxZj",
        "semgrep.dev": {
          "rule": {
            "r_id": 14702,
            "rv_id": 1409402,
            "rule_id": "YGUDKQ",
            "version_id": "A8TEvb4",
            "url": "https://semgrep.dev/playground/r/A8TEvb4/python.flask.security.injection.tainted-sql-string.tainted-sql-string",
            "origin": "community"
          }
        }
      },
      "severity": "ERROR",
      "languages": [
        "python"
      ],
      "mode": "taint",
      "pattern-sources": [
        {
          "patterns": [
            {
              "pattern-either": [
                {
                  "pattern": "flask.request.$ANYTHING"
                },
                {
                  "patterns": [
                    {
                      "pattern-inside": "@$APP.route(...)\ndef $FUNC(..., $ROUTEVAR, ...):\n  ...\n"
                    },
                    {
                      "pattern": "$ROUTEVAR"
                    }
                  ]
                }
              ]
            }
          ]
        }
      ],
      "pattern-sinks": [
        {
          "patterns": [
            {
              "pattern-either": [
                {
                  "pattern": "\"$SQLSTR\" + ...\n"
                },
                {
                  "pattern": "\"$SQLSTR\" % ...\n"
                },
                {
                  "pattern": "\"$SQLSTR\".format(...)\n"
                },
                {
                  "pattern": "f\"$SQLSTR{...}...\"\n"
                }
              ]
            },
            {
              "metavariable-regex": {
                "metavariable": "$SQLSTR",
                "regex": "\\s*(?i)(select|delete|insert|create|update|alter|drop)\\b.*"
              }
            }
          ]
        }
      ]
    },
    {
      "id": "python.lang.security.audit.md5-used-as-password.md5-used-as-password",
      "severity": "WARNING",
      "message": "It looks like MD5 is used as a password hash. MD5 is not considered a secure password hash because it can be cracked by an attacker in a short amount of time. Use a suitable password hashing function such as scrypt. You can use `hashlib.scrypt`.",
      "languages": [
        "python"
      ],
      "metadata": {
        "cwe": [
          "CWE-327: Use of a Broken or Risky Cryptographic Algorithm"
        ],
        "owasp": [
          "A03:2017 - Sensitive Data Exposure",
          "A02:2021 - Cryptographic Failures",
          "A04:2025 - Cryptographic Failures"
        ],
        "references": [
          "https://tools.ietf.org/html/rfc6151",
          "https://crypto.stackexchange.com/questions/44151/how-does-the-flame-malware-take-advantage-of-md5-collision",
          "https://pycryptodome.readthedocs.io/en/latest/src/hash/sha3_256.html",
          "https://security.stackexchange.com/questions/211/how-to-securely-hash-passwords",
          "https://github.com/returntocorp/semgrep-rules/issues/1609",
          "https://docs.python.org/3/library/hashlib.html#hashlib.scrypt"
        ],
        "category": "security",
        "technology": [
          "pycryptodome",
          "hashlib",
          "md5"
        ],
        "subcategory": [
          "vuln"
        ],
        "likelihood": "HIGH",
        "impact": "LOW",
        "confidence": "MEDIUM",
        "license": "Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license",
        "vulnerability_class": [
          "Cryptographic Issues"
        ],
        "source": "https://semgrep.dev/r/python.lang.security.audit.md5-used-as-password.md5-used-as-password",
        "shortlink": "https://sg.run/5DwD",
        "semgrep.dev": {
          "rule": {
            "r_id": 14703,
            "rv_id": 1263504,
            "rule_id": "6JU1w1",
            "version_id": "WrTqKDz",
            "url": "https://semgrep.dev/playground/r/WrTqKDz/python.lang.security.audit.md5-used-as-password.md5-used-as-password",
            "origin": "community"
          }
        }
      },
      "mode": "taint",
      "pattern-sources": [
        {
          "patterns": [
            {
              "pattern-either": [
                {
                  "pattern": "hashlib.md5"
                },
                {
                  "pattern": "hashlib.new(..., name=\"MD5\", ...)"
                },
                {
                  "pattern": "Cryptodome.Hash.MD5"
                },
                {
                  "pattern": "Crypto.Hash.MD5"
                },
                {
                  "pattern": "cryptography.hazmat.primitives.hashes.MD5"
                }
              ]
            }
          ]
        }
      ],
      "pattern-sinks": [
        {
          "patterns": [
            {
              "pattern": "$FUNCTION(...)"
            },
            {
              "metavariable-regex": {
                "metavariable": "$FUNCTION",
                "regex": "(?i)(.*password.*)"
              }
            }
          ]
        }
      ]
    },
    {
      "id": "python.sqlalchemy.security.audit.avoid-sqlalchemy-text.avoid-sqlalchemy-text",
      "mode": "taint",
      "pattern-sinks": [
        {
          "pattern": "sqlalchemy.text(...)\n"
        }
      ],
      "pattern-sources": [
        {
          "patterns": [
            {
              "pattern": "$X + $Y\n"
            },
            {
              "metavariable-type": {
                "metavariable": "$X",
                "type": "string"
              }
            }
          ]
        },
        {
          "patterns": [
            {
              "pattern": "$X + $Y\n"
            },
            {
              "metavariable-type": {
                "metavariable": "$Y",
                "type": "string"
              }
            }
          ]
        },
        {
          "patterns": [
            {
              "pattern": "f\"...\"\n"
            }
          ]
        },
        {
          "patterns": [
            {
              "pattern": "$X.format(...)\n"
            },
            {
              "metavariable-type": {
                "metavariable": "$X",
                "type": "string"
              }
            }
          ]
        },
        {
          "patterns": [
            {
              "pattern": "$X % $Y\n"
            },
            {
              "metavariable-type": {
                "metavariable": "$X",
                "type": "string"
              }
            }
          ]
        }
      ],
      "message": "sqlalchemy.text passes the constructed SQL statement to the database mostly unchanged. This means that the usual SQL injection protections are not applied and this function is vulnerable to SQL injection if user input can reach here. Use normal SQLAlchemy operators (such as `or_()`, `and_()`, etc.) to construct SQL.",
      "metadata": {
        "owasp": [
          "A01:2017 - Injection",
          "A03:2021 - Injection",
          "A05:2025 - Injection"
        ],
        "cwe": [
          "CWE-89: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')"
        ],
        "category": "security",
        "technology": [
          "sqlalchemy"
        ],
        "confidence": "MEDIUM",
        "references": [
          "https://docs.sqlalchemy.org/en/14/core/tutorial.html#using-textual-sql"
        ],
        "cwe2022-top25": true,
        "cwe2021-top25": true,
        "subcategory": [
          "audit"
        ],
        "likelihood": "LOW",
        "impact": "LOW",
        "license": "Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license",
        "vulnerability_class": [
          "SQL Injection"
        ],
        "source": "https://semgrep.dev/r/python.sqlalchemy.security.audit.avoid-sqlalchemy-text.avoid-sqlalchemy-text",
        "shortlink": "https://sg.run/yP1O",
        "semgrep.dev": {
          "rule": {
            "r_id": 15824,
            "rv_id": 1263577,
            "rule_id": "r6U2wE",
            "version_id": "rxTAKqq",
            "url": "https://semgrep.dev/playground/r/rxTAKqq/python.sqlalchemy.security.audit.avoid-sqlalchemy-text.avoid-sqlalchemy-text",
            "origin": "community"
          }
        }
      },
      "languages": [
        "python"
      ],
      "severity": "ERROR"
    },
    {
      "id": "python.aws-lambda.security.dangerous-asyncio-create-exec.dangerous-asyncio-create-exec",
      "mode": "taint",
      "pattern-sources": [
        {
          "patterns": [
            {
              "pattern": "event"
            },
            {
              "pattern-inside": "def $HANDLER(event, context):\n  ...\n"
            }
          ]
        }
      ],
      "pattern-sinks": [
        {
          "patterns": [
            {
              "focus-metavariable": "$CMD"
            },
            {
              "pattern-either": [
                {
                  "pattern": "asyncio.create_subprocess_exec($PROG, $CMD, ...)"
                },
                {
                  "pattern": "asyncio.create_subprocess_exec($PROG, [$CMD, ...], ...)"
                },
                {
                  "pattern": "asyncio.subprocess.create_subprocess_exec($PROG, $CMD, ...)"
                },
                {
                  "pattern": "asyncio.subprocess.create_subprocess_exec($PROG, [$CMD, ...], ...)"
                },
                {
                  "pattern": "asyncio.create_subprocess_exec($PROG, \"=~/(sh|bash|ksh|csh|tcsh|zsh)/\", \"-c\", $CMD, ...)"
                },
                {
                  "pattern": "asyncio.create_subprocess_exec($PROG, [\"=~/(sh|bash|ksh|csh|tcsh|zsh)/\", \"-c\", $CMD, ...], ...)"
                },
                {
                  "pattern": "asyncio.subprocess.create_subprocess_exec($PROG, \"=~/(sh|bash|ksh|csh|tcsh|zsh)/\", \"-c\", $CMD, ...)"
                },
                {
                  "pattern": "asyncio.subprocess.create_subprocess_exec($PROG, [\"=~/(sh|bash|ksh|csh|tcsh|zsh)/\", \"-c\", $CMD, ...], ...)"
                }
              ]
            }
          ]
        }
      ],
      "message": "Detected 'create_subprocess_exec' function with argument tainted by `event` object. If this data can be controlled by a malicious actor, it may be an instance of command injection. Audit the use of this call to ensure it is not controllable by an external resource. You may consider using 'shlex.escape()'.",
      "metadata": {
        "owasp": [
          "A01:2017 - Injection",
          "A03:2021 - Injection",
          "A05:2025 - Injection"
        ],
        "cwe": [
          "CWE-78: Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')"
        ],
        "asvs": {
          "section": "V5: Validation, Sanitization and Encoding Verification Requirements",
          "control_id": "5.3.8 OS Command Injection",
          "control_url": "https://github.com/OWASP/ASVS/blob/master/4.0/en/0x13-V5-Validation-Sanitization-Encoding.md#v53-output-encoding-and-injection-prevention-requirements",
          "version": "4"
        },
        "references": [
          "https://docs.python.org/3/library/asyncio-subprocess.html#asyncio.create_subprocess_exec",
          "https://docs.python.org/3/library/shlex.html"
        ],
        "category": "security",
        "technology": [
          "python"
        ],
        "cwe2022-top25": true,
        "cwe2021-top25": true,
        "subcategory": [
          "vuln"
        ],
        "likelihood": "HIGH",
        "impact": "MEDIUM",
        "confidence": "MEDIUM",
        "license": "Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license",
        "vulnerability_class": [
          "Command Injection"
        ],
        "source": "https://semgrep.dev/r/python.aws-lambda.security.dangerous-asyncio-create-exec.dangerous-asyncio-create-exec",
        "shortlink": "https://sg.run/oyv0",
        "semgrep.dev": {
          "rule": {
            "r_id": 18260,
            "rv_id": 1263331,
            "rule_id": "EwUrX8",
            "version_id": "rxTAKgo",
            "url": "https://semgrep.dev/playground/r/rxTAKgo/python.aws-lambda.security.dangerous-asyncio-create-exec.dangerous-asyncio-create-exec",
            "origin": "community"
          }
        }
      },
      "languages": [
        "python"
      ],
      "severity": "ERROR"
    },
    {
      "id": "python.aws-lambda.security.dangerous-asyncio-exec.dangerous-asyncio-exec",
      "mode": "taint",
      "pattern-sources": [
        {
          "patterns": [
            {
              "pattern": "event"
            },
            {
              "pattern-inside": "def $HANDLER(event, context):\n  ...\n"
            }
          ]
        }
      ],
      "pattern-sinks": [
        {
          "patterns": [
            {
              "focus-metavariable": "$CMD"
            },
            {
              "pattern-either": [
                {
                  "pattern": "$LOOP.subprocess_exec($PROTOCOL, $CMD, ...)"
                },
                {
                  "pattern": "$LOOP.subprocess_exec($PROTOCOL, [$CMD, ...], ...)"
                },
                {
                  "pattern": "$LOOP.subprocess_exec($PROTOCOL, \"=~/(sh|bash|ksh|csh|tcsh|zsh)/\", \"-c\", $CMD, ...)"
                },
                {
                  "pattern": "$LOOP.subprocess_exec($PROTOCOL, [\"=~/(sh|bash|ksh|csh|tcsh|zsh)/\", \"-c\", $CMD, ...], ...)"
                }
              ]
            }
          ]
        }
      ],
      "message": "Detected subprocess function '$LOOP.subprocess_exec' with argument tainted by `event` object. If this data can be controlled by a malicious actor, it may be an instance of command injection. Audit the use of this call to ensure it is not controllable by an external resource. You may consider using 'shlex.escape()'.",
      "metadata": {
        "owasp": [
          "A01:2017 - Injection",
          "A03:2021 - Injection",
          "A05:2025 - Injection"
        ],
        "cwe": [
          "CWE-78: Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')"
        ],
        "asvs": {
          "section": "V5: Validation, Sanitization and Encoding Verification Requirements",
          "control_id": "5.3.8 OS Command Injection",
          "control_url": "https://github.com/OWASP/ASVS/blob/master/4.0/en/0x13-V5-Validation-Sanitization-Encoding.md#v53-output-encoding-and-injection-prevention-requirements",
          "version": "4"
        },
        "references": [
          "https://docs.python.org/3/library/asyncio-eventloop.html#asyncio.loop.subprocess_exec",
          "https://docs.python.org/3/library/shlex.html"
        ],
        "category": "security",
        "technology": [
          "python",
          "aws-lambda"
        ],
        "cwe2022-top25": true,
        "cwe2021-top25": true,
        "subcategory": [
          "vuln"
        ],
        "likelihood": "HIGH",
        "impact": "MEDIUM",
        "confidence": "MEDIUM",
        "license": "Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license",
        "vulnerability_class": [
          "Command Injection"
        ],
        "source": "https://semgrep.dev/r/python.aws-lambda.security.dangerous-asyncio-exec.dangerous-asyncio-exec",
        "shortlink": "https://sg.run/z14d",
        "semgrep.dev": {
          "rule": {
            "r_id": 18261,
            "rv_id": 1263332,
            "rule_id": "7KUxXg",
            "version_id": "bZT53Ww",
            "url": "https://semgrep.dev/playground/r/bZT53Ww/python.aws-lambda.security.dangerous-asyncio-exec.dangerous-asyncio-exec",
            "origin": "community"
          }
        }
      },
      "languages": [
        "python"
      ],
      "severity": "ERROR"
    },
    {
      "id": "python.aws-lambda.security.dangerous-asyncio-shell.dangerous-asyncio-shell",
      "mode": "taint",
      "pattern-sources": [
        {
          "patterns": [
            {
              "pattern": "event"
            },
            {
              "pattern-inside": "def $HANDLER(event, context):\n  ...\n"
            }
          ]
        }
      ],
      "pattern-sinks": [
        {
          "patterns": [
            {
              "focus-metavariable": "$CMD"
            },
            {
              "pattern-either": [
                {
                  "pattern": "$LOOP.subprocess_shell($PROTOCOL, $CMD)"
                },
                {
                  "pattern": "asyncio.subprocess.create_subprocess_shell($CMD, ...)"
                },
                {
                  "pattern": "asyncio.create_subprocess_shell($CMD, ...)"
                }
              ]
            }
          ]
        }
      ],
      "message": "Detected asyncio subprocess function with argument tainted by `event` object. If this data can be controlled by a malicious actor, it may be an instance of command injection. Audit the use of this call to ensure it is not controllable by an external resource. You may consider using 'shlex.escape()'.",
      "metadata": {
        "owasp": [
          "A01:2017 - Injection",
          "A03:2021 - Injection",
          "A05:2025 - Injection"
        ],
        "cwe": [
          "CWE-78: Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')"
        ],
        "asvs": {
          "section": "V5: Validation, Sanitization and Encoding Verification Requirements",
          "control_id": "5.3.8 OS Command Injection",
          "control_url": "https://github.com/OWASP/ASVS/blob/master/4.0/en/0x13-V5-Validation-Sanitization-Encoding.md#v53-output-encoding-and-injection-prevention-requirements",
          "version": "4"
        },
        "references": [
          "https://docs.python.org/3/library/asyncio-subprocess.html",
          "https://docs.python.org/3/library/shlex.html"
        ],
        "category": "security",
        "technology": [
          "python",
          "aws-lambda"
        ],
        "cwe2022-top25": true,
        "cwe2021-top25": true,
        "subcategory": [
          "vuln"
        ],
        "likelihood": "HIGH",
        "impact": "MEDIUM",
        "confidence": "MEDIUM",
        "license": "Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license",
        "vulnerability_class": [
          "Command Injection"
        ],
        "source": "https://semgrep.dev/r/python.aws-lambda.security.dangerous-asyncio-shell.dangerous-asyncio-shell",
        "shortlink": "https://sg.run/p9vZ",
        "semgrep.dev": {
          "rule": {
            "r_id": 18262,
            "rv_id": 1263333,
            "rule_id": "L1UEl7",
            "version_id": "NdTzyWA",
            "url": "https://semgrep.dev/playground/r/NdTzyWA/python.aws-lambda.security.dangerous-asyncio-shell.dangerous-asyncio-shell",
            "origin": "community"
          }
        }
      },
      "languages": [
        "python"
      ],
      "severity": "ERROR"
    },
    {
      "id": "python.aws-lambda.security.dangerous-spawn-process.dangerous-spawn-process",
      "mode": "taint",
      "message": "Detected `os` function with argument tainted by `event` object. This is dangerous if external data can reach this function call because it allows a malicious actor to execute commands. Ensure no external data reaches here.",
      "metadata": {
        "source-rule-url": "https://bandit.readthedocs.io/en/latest/plugins/b605_start_process_with_a_shell.html",
        "cwe": [
          "CWE-78: Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')"
        ],
        "owasp": [
          "A01:2017 - Injection",
          "A03:2021 - Injection",
          "A05:2025 - Injection"
        ],
        "asvs": {
          "section": "V5: Validation, Sanitization and Encoding Verification Requirements",
          "control_id": "5.3.8 OS Command Injection",
          "control_url": "https://github.com/OWASP/ASVS/blob/master/4.0/en/0x13-V5-Validation-Sanitization-Encoding.md#v53-output-encoding-and-injection-prevention-requirements",
          "version": "4"
        },
        "category": "security",
        "technology": [
          "python",
          "aws-lambda"
        ],
        "references": [
          "https://owasp.org/Top10/A03_2021-Injection"
        ],
        "cwe2022-top25": true,
        "cwe2021-top25": true,
        "subcategory": [
          "vuln"
        ],
        "likelihood": "HIGH",
        "impact": "MEDIUM",
        "confidence": "MEDIUM",
        "license": "Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license",
        "vulnerability_class": [
          "Command Injection"
        ],
        "source": "https://semgrep.dev/r/python.aws-lambda.security.dangerous-spawn-process.dangerous-spawn-process",
        "shortlink": "https://sg.run/2AjL",
        "semgrep.dev": {
          "rule": {
            "r_id": 18263,
            "rv_id": 1263334,
            "rule_id": "8GUGBq",
            "version_id": "kbTzGv8",
            "url": "https://semgrep.dev/playground/r/kbTzGv8/python.aws-lambda.security.dangerous-spawn-process.dangerous-spawn-process",
            "origin": "community"
          }
        }
      },
      "languages": [
        "python"
      ],
      "severity": "ERROR",
      "pattern-sources": [
        {
          "patterns": [
            {
              "pattern": "event"
            },
            {
              "pattern-inside": "def $HANDLER(event, context):\n  ...\n"
            }
          ]
        }
      ],
      "pattern-sinks": [
        {
          "patterns": [
            {
              "focus-metavariable": "$CMD"
            },
            {
              "pattern-either": [
                {
                  "patterns": [
                    {
                      "pattern": "os.$METHOD($MODE, $CMD, ...)"
                    },
                    {
                      "metavariable-regex": {
                        "metavariable": "$METHOD",
                        "regex": "(spawnl|spawnle|spawnlp|spawnlpe|spawnv|spawnve|spawnvp|spawnvp|spawnvpe|posix_spawn|posix_spawnp|startfile)"
                      }
                    }
                  ]
                },
                {
                  "patterns": [
                    {
                      "pattern-inside": "os.$METHOD($MODE, $BASH, [\"-c\", $CMD,...],...)"
                    },
                    {
                      "metavariable-regex": {
                        "metavariable": "$METHOD",
                        "regex": "(spawnv|spawnve|spawnvp|spawnvp|spawnvpe|posix_spawn|posix_spawnp)"
                      }
                    },
                    {
                      "metavariable-regex": {
                        "metavariable": "$BASH",
                        "regex": "(.*)(sh|bash|ksh|csh|tcsh|zsh)"
                      }
                    }
                  ]
                },
                {
                  "patterns": [
                    {
                      "pattern-inside": "os.$METHOD($MODE, $BASH, \"-c\", $CMD,...)"
                    },
                    {
                      "metavariable-regex": {
                        "metavariable": "$METHOD",
                        "regex": "(spawnl|spawnle|spawnlp|spawnlpe)"
                      }
                    },
                    {
                      "metavariable-regex": {
                        "metavariable": "$BASH",
                        "regex": "(.*)(sh|bash|ksh|csh|tcsh|zsh)"
                      }
                    }
                  ]
                }
              ]
            }
          ]
        }
      ]
    },
    {
      "id": "python.aws-lambda.security.dangerous-subprocess-use.dangerous-subprocess-use",
      "mode": "taint",
      "message": "Detected subprocess function with argument tainted by an `event` object.  If this data can be controlled by a malicious actor, it may be an instance of command injection. The default option for `shell` is False, and this is secure by default. Consider removing the `shell=True` or setting it to False explicitely. Using `shell=False` means you have to split the command string into an array of strings for the command and its arguments. You may consider using 'shlex.split()' for this purpose.",
      "metadata": {
        "owasp": [
          "A01:2017 - Injection",
          "A03:2021 - Injection",
          "A05:2025 - Injection"
        ],
        "cwe": [
          "CWE-78: Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')"
        ],
        "asvs": {
          "section": "V5: Validation, Sanitization and Encoding Verification Requirements",
          "control_id": "5.3.8 OS Command Injection",
          "control_url": "https://github.com/OWASP/ASVS/blob/master/4.0/en/0x13-V5-Validation-Sanitization-Encoding.md#v53-output-encoding-and-injection-prevention-requirements",
          "version": "4"
        },
        "references": [
          "https://docs.python.org/3/library/subprocess.html",
          "https://docs.python.org/3/library/shlex.html"
        ],
        "category": "security",
        "technology": [
          "python",
          "aws-lambda"
        ],
        "cwe2022-top25": true,
        "cwe2021-top25": true,
        "subcategory": [
          "vuln"
        ],
        "likelihood": "HIGH",
        "impact": "MEDIUM",
        "confidence": "MEDIUM",
        "license": "Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license",
        "vulnerability_class": [
          "Command Injection"
        ],
        "source": "https://semgrep.dev/r/python.aws-lambda.security.dangerous-subprocess-use.dangerous-subprocess-use",
        "shortlink": "https://sg.run/XZ7B",
        "semgrep.dev": {
          "rule": {
            "r_id": 18264,
            "rv_id": 1263335,
            "rule_id": "gxUyn1",
            "version_id": "w8TRogj",
            "url": "https://semgrep.dev/playground/r/w8TRogj/python.aws-lambda.security.dangerous-subprocess-use.dangerous-subprocess-use",
            "origin": "community"
          }
        }
      },
      "languages": [
        "python"
      ],
      "severity": "ERROR",
      "pattern-sources": [
        {
          "patterns": [
            {
              "pattern": "event"
            },
            {
              "pattern-inside": "def $HANDLER(event, context):\n  ...\n"
            }
          ]
        }
      ],
      "pattern-sinks": [
        {
          "patterns": [
            {
              "pattern": "subprocess.$FUNC(..., shell=True, ...)"
            }
          ]
        }
      ],
      "pattern-sanitizers": [
        {
          "pattern": "shlex.split(...)"
        },
        {
          "pattern": "pipes.quote(...)"
        },
        {
          "pattern": "shlex.quote(...)"
        }
      ]
    },
    {
      "id": "python.aws-lambda.security.dangerous-system-call.dangerous-system-call",
      "mode": "taint",
      "message": "Detected `os` function with argument tainted by `event` object. This is dangerous if external data can reach this function call because it allows a malicious actor to execute commands. Use the 'subprocess' module instead, which is easier to use without accidentally exposing a command injection vulnerability.",
      "metadata": {
        "source-rule-url": "https://bandit.readthedocs.io/en/latest/plugins/b605_start_process_with_a_shell.html",
        "cwe": [
          "CWE-78: Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')"
        ],
        "owasp": [
          "A01:2017 - Injection",
          "A03:2021 - Injection",
          "A05:2025 - Injection"
        ],
        "asvs": {
          "section": "V5: Validation, Sanitization and Encoding Verification Requirements",
          "control_id": "5.2.4 Dyanmic Code Execution Features",
          "control_url": "https://github.com/OWASP/ASVS/blob/master/4.0/en/0x13-V5-Validation-Sanitization-Encoding.md#v52-sanitization-and-sandboxing-requirements",
          "version": "4"
        },
        "category": "security",
        "technology": [
          "python"
        ],
        "references": [
          "https://owasp.org/Top10/A03_2021-Injection"
        ],
        "cwe2022-top25": true,
        "cwe2021-top25": true,
        "subcategory": [
          "vuln"
        ],
        "likelihood": "HIGH",
        "impact": "MEDIUM",
        "confidence": "MEDIUM",
        "license": "Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license",
        "vulnerability_class": [
          "Command Injection"
        ],
        "source": "https://semgrep.dev/r/python.aws-lambda.security.dangerous-system-call.dangerous-system-call",
        "shortlink": "https://sg.run/jDvN",
        "semgrep.dev": {
          "rule": {
            "r_id": 18265,
            "rv_id": 1263336,
            "rule_id": "QrUkg6",
            "version_id": "xyTjzbG",
            "url": "https://semgrep.dev/playground/r/xyTjzbG/python.aws-lambda.security.dangerous-system-call.dangerous-system-call",
            "origin": "community"
          }
        }
      },
      "languages": [
        "python"
      ],
      "severity": "ERROR",
      "pattern-sources": [
        {
          "patterns": [
            {
              "pattern": "event"
            },
            {
              "pattern-inside": "def $HANDLER(event, context):\n  ...\n"
            }
          ]
        }
      ],
      "pattern-sinks": [
        {
          "patterns": [
            {
              "focus-metavariable": "$CMD"
            },
            {
              "pattern-either": [
                {
                  "pattern": "os.system($CMD,...)"
                },
                {
                  "pattern": "os.popen($CMD,...)"
                },
                {
                  "pattern": "os.popen2($CMD,...)"
                },
                {
                  "pattern": "os.popen3($CMD,...)"
                },
                {
                  "pattern": "os.popen4($CMD,...)"
                }
              ]
            }
          ]
        }
      ]
    },
    {
      "id": "python.aws-lambda.security.mysql-sqli.mysql-sqli",
      "languages": [
        "python"
      ],
      "message": "Detected SQL statement that is tainted by `event` object. This could lead to SQL injection if the variable is user-controlled and not properly sanitized. In order to prevent SQL injection, use parameterized queries or prepared statements instead. You can use parameterized statements like so: `cursor.execute('SELECT * FROM projects WHERE status = %s', ('active'))`",
      "mode": "taint",
      "metadata": {
        "references": [
          "https://dev.mysql.com/doc/connector-python/en/connector-python-api-mysqlcursor-execute.html",
          "https://dev.mysql.com/doc/connector-python/en/connector-python-api-mysqlcursor-executemany.html"
        ],
        "category": "security",
        "owasp": [
          "A01:2017 - Injection",
          "A03:2021 - Injection",
          "A05:2025 - Injection"
        ],
        "cwe": [
          "CWE-89: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')"
        ],
        "technology": [
          "aws-lambda",
          "mysql"
        ],
        "cwe2022-top25": true,
        "cwe2021-top25": true,
        "subcategory": [
          "vuln"
        ],
        "likelihood": "HIGH",
        "impact": "MEDIUM",
        "confidence": "MEDIUM",
        "license": "Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license",
        "vulnerability_class": [
          "SQL Injection"
        ],
        "source": "https://semgrep.dev/r/python.aws-lambda.security.mysql-sqli.mysql-sqli",
        "shortlink": "https://sg.run/1RjG",
        "semgrep.dev": {
          "rule": {
            "r_id": 18266,
            "rv_id": 1263337,
            "rule_id": "3qU3eE",
            "version_id": "O9TpxLJ",
            "url": "https://semgrep.dev/playground/r/O9TpxLJ/python.aws-lambda.security.mysql-sqli.mysql-sqli",
            "origin": "community"
          }
        }
      },
      "pattern-sinks": [
        {
          "patterns": [
            {
              "focus-metavariable": "$QUERY"
            },
            {
              "pattern-either": [
                {
                  "pattern": "$CURSOR.execute($QUERY,...)"
                },
                {
                  "pattern": "$CURSOR.executemany($QUERY,...)"
                }
              ]
            },
            {
              "pattern-either": [
                {
                  "pattern-inside": "import mysql\n...\n"
                },
                {
                  "pattern-inside": "import mysql.cursors\n...\n"
                }
              ]
            }
          ]
        }
      ],
      "pattern-sources": [
        {
          "patterns": [
            {
              "pattern": "event"
            },
            {
              "pattern-inside": "def $HANDLER(event, context):\n  ...\n"
            }
          ]
        }
      ],
      "severity": "WARNING"
    },
    {
      "id": "python.aws-lambda.security.psycopg-sqli.psycopg-sqli",
      "languages": [
        "python"
      ],
      "message": "Detected SQL statement that is tainted by `event` object. This could lead to SQL injection if the variable is user-controlled and not properly sanitized. In order to prevent SQL injection, use parameterized queries or prepared statements instead. You can use parameterized statements like so: `cursor.execute('SELECT * FROM projects WHERE status = %s', 'active')`",
      "mode": "taint",
      "metadata": {
        "references": [
          "https://www.psycopg.org/docs/cursor.html#cursor.execute",
          "https://www.psycopg.org/docs/cursor.html#cursor.executemany",
          "https://www.psycopg.org/docs/cursor.html#cursor.mogrify"
        ],
        "category": "security",
        "owasp": [
          "A01:2017 - Injection",
          "A03:2021 - Injection",
          "A05:2025 - Injection"
        ],
        "cwe": [
          "CWE-89: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')"
        ],
        "technology": [
          "aws-lambda",
          "psycopg",
          "psycopg2"
        ],
        "cwe2022-top25": true,
        "cwe2021-top25": true,
        "subcategory": [
          "vuln"
        ],
        "likelihood": "HIGH",
        "impact": "MEDIUM",
        "confidence": "MEDIUM",
        "license": "Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license",
        "vulnerability_class": [
          "SQL Injection"
        ],
        "source": "https://semgrep.dev/r/python.aws-lambda.security.psycopg-sqli.psycopg-sqli",
        "shortlink": "https://sg.run/9L8r",
        "semgrep.dev": {
          "rule": {
            "r_id": 18267,
            "rv_id": 1263338,
            "rule_id": "4bUQG1",
            "version_id": "e1TyjPZ",
            "url": "https://semgrep.dev/playground/r/e1TyjPZ/python.aws-lambda.security.psycopg-sqli.psycopg-sqli",
            "origin": "community"
          }
        }
      },
      "pattern-sinks": [
        {
          "patterns": [
            {
              "focus-metavariable": "$QUERY"
            },
            {
              "pattern-either": [
                {
                  "pattern": "$CURSOR.execute($QUERY,...)"
                },
                {
                  "pattern": "$CURSOR.executemany($QUERY,...)"
                },
                {
                  "pattern": "$CURSOR.mogrify($QUERY,...)"
                }
              ]
            },
            {
              "pattern-inside": "import psycopg2\n...\n"
            }
          ]
        }
      ],
      "pattern-sources": [
        {
          "patterns": [
            {
              "pattern": "event"
            },
            {
              "pattern-inside": "def $HANDLER(event, context):\n  ...\n"
            }
          ]
        }
      ],
      "severity": "WARNING"
    },
    {
      "id": "python.aws-lambda.security.pymssql-sqli.pymssql-sqli",
      "languages": [
        "python"
      ],
      "message": "Detected SQL statement that is tainted by `event` object. This could lead to SQL injection if the variable is user-controlled and not properly sanitized. In order to prevent SQL injection, use parameterized queries or prepared statements instead. You can use parameterized statements like so: `cursor.execute('SELECT * FROM projects WHERE status = %s', 'active')`",
      "mode": "taint",
      "metadata": {
        "references": [
          "https://pypi.org/project/pymssql/"
        ],
        "category": "security",
        "owasp": [
          "A01:2017 - Injection",
          "A03:2021 - Injection",
          "A05:2025 - Injection"
        ],
        "cwe": [
          "CWE-89: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')"
        ],
        "technology": [
          "aws-lambda",
          "pymssql"
        ],
        "cwe2022-top25": true,
        "cwe2021-top25": true,
        "subcategory": [
          "vuln"
        ],
        "likelihood": "HIGH",
        "impact": "MEDIUM",
        "confidence": "MEDIUM",
        "license": "Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license",
        "vulnerability_class": [
          "SQL Injection"
        ],
        "source": "https://semgrep.dev/r/python.aws-lambda.security.pymssql-sqli.pymssql-sqli",
        "shortlink": "https://sg.run/yXvP",
        "semgrep.dev": {
          "rule": {
            "r_id": 18268,
            "rv_id": 1263339,
            "rule_id": "PeUxO0",
            "version_id": "vdT06bG",
            "url": "https://semgrep.dev/playground/r/vdT06bG/python.aws-lambda.security.pymssql-sqli.pymssql-sqli",
            "origin": "community"
          }
        }
      },
      "pattern-sinks": [
        {
          "patterns": [
            {
              "focus-metavariable": "$QUERY"
            },
            {
              "pattern": "$CURSOR.execute($QUERY,...)"
            },
            {
              "pattern-inside": "import pymssql\n...\n"
            }
          ]
        }
      ],
      "pattern-sources": [
        {
          "patterns": [
            {
              "pattern": "event"
            },
            {
              "pattern-inside": "def $HANDLER(event, context):\n  ...\n"
            }
          ]
        }
      ],
      "severity": "WARNING"
    },
    {
      "id": "python.aws-lambda.security.pymysql-sqli.pymysql-sqli",
      "languages": [
        "python"
      ],
      "message": "Detected SQL statement that is tainted by `event` object. This could lead to SQL injection if the variable is user-controlled and not properly sanitized. In order to prevent SQL injection, use parameterized queries or prepared statements instead. You can use parameterized statements like so: `cursor.execute('SELECT * FROM projects WHERE status = %s', ('active'))`",
      "mode": "taint",
      "metadata": {
        "references": [
          "https://pypi.org/project/PyMySQL/#id4"
        ],
        "category": "security",
        "owasp": [
          "A01:2017 - Injection",
          "A03:2021 - Injection",
          "A05:2025 - Injection"
        ],
        "cwe": [
          "CWE-89: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')"
        ],
        "technology": [
          "aws-lambda",
          "pymysql"
        ],
        "cwe2022-top25": true,
        "cwe2021-top25": true,
        "subcategory": [
          "vuln"
        ],
        "likelihood": "HIGH",
        "impact": "MEDIUM",
        "confidence": "MEDIUM",
        "license": "Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license",
        "vulnerability_class": [
          "SQL Injection"
        ],
        "source": "https://semgrep.dev/r/python.aws-lambda.security.pymysql-sqli.pymysql-sqli",
        "shortlink": "https://sg.run/reve",
        "semgrep.dev": {
          "rule": {
            "r_id": 18269,
            "rv_id": 1263340,
            "rule_id": "JDUlel",
            "version_id": "d6TyxNA",
            "url": "https://semgrep.dev/playground/r/d6TyxNA/python.aws-lambda.security.pymysql-sqli.pymysql-sqli",
            "origin": "community"
          }
        }
      },
      "pattern-sinks": [
        {
          "patterns": [
            {
              "focus-metavariable": "$QUERY"
            },
            {
              "pattern": "$CURSOR.execute($QUERY,...)"
            },
            {
              "pattern-either": [
                {
                  "pattern-inside": "import pymysql\n...\n"
                },
                {
                  "pattern-inside": "import pymysql.cursors\n...\n"
                }
              ]
            }
          ]
        }
      ],
      "pattern-sources": [
        {
          "patterns": [
            {
              "pattern": "event"
            },
            {
              "pattern-inside": "def $HANDLER(event, context):\n  ...\n"
            }
          ]
        }
      ],
      "severity": "WARNING"
    },
    {
      "id": "python.aws-lambda.security.sqlalchemy-sqli.sqlalchemy-sqli",
      "languages": [
        "python"
      ],
      "message": "Detected SQL statement that is tainted by `event` object. This could lead to SQL injection if the variable is user-controlled and not properly sanitized. In order to prevent SQL injection, use parameterized queries or prepared statements instead. You can use parameterized statements like so: `cursor.execute('SELECT * FROM projects WHERE status = ?', 'active')`",
      "mode": "taint",
      "metadata": {
        "references": [
          "https://docs.sqlalchemy.org/en/14/core/connections.html#sqlalchemy.engine.Connection.execute"
        ],
        "category": "security",
        "owasp": [
          "A01:2017 - Injection",
          "A03:2021 - Injection",
          "A05:2025 - Injection"
        ],
        "cwe": [
          "CWE-89: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')"
        ],
        "technology": [
          "aws-lambda",
          "sqlalchemy"
        ],
        "cwe2022-top25": true,
        "cwe2021-top25": true,
        "subcategory": [
          "vuln"
        ],
        "likelihood": "HIGH",
        "impact": "MEDIUM",
        "confidence": "MEDIUM",
        "license": "Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license",
        "vulnerability_class": [
          "SQL Injection"
        ],
        "source": "https://semgrep.dev/r/python.aws-lambda.security.sqlalchemy-sqli.sqlalchemy-sqli",
        "shortlink": "https://sg.run/b48W",
        "semgrep.dev": {
          "rule": {
            "r_id": 18270,
            "rv_id": 1263341,
            "rule_id": "5rUy3N",
            "version_id": "ZRTKARp",
            "url": "https://semgrep.dev/playground/r/ZRTKARp/python.aws-lambda.security.sqlalchemy-sqli.sqlalchemy-sqli",
            "origin": "community"
          }
        }
      },
      "pattern-sinks": [
        {
          "patterns": [
            {
              "focus-metavariable": "$QUERY"
            },
            {
              "pattern": "$CURSOR.execute($QUERY,...)"
            },
            {
              "pattern-inside": "import sqlalchemy\n...\n"
            }
          ]
        }
      ],
      "pattern-sources": [
        {
          "patterns": [
            {
              "pattern": "event"
            },
            {
              "pattern-inside": "def $HANDLER(event, context):\n  ...\n"
            }
          ]
        }
      ],
      "severity": "WARNING"
    },
    {
      "id": "python.aws-lambda.security.tainted-code-exec.tainted-code-exec",
      "mode": "taint",
      "pattern-sources": [
        {
          "patterns": [
            {
              "pattern": "event"
            },
            {
              "pattern-inside": "def $HANDLER(event, context):\n  ...\n"
            }
          ]
        }
      ],
      "pattern-sinks": [
        {
          "patterns": [
            {
              "pattern-either": [
                {
                  "pattern": "eval($CODE, ...)"
                },
                {
                  "pattern": "exec($CODE, ...)"
                }
              ]
            }
          ]
        }
      ],
      "message": "Detected the use of `exec/eval`.This can be dangerous if used to evaluate dynamic content. If this content can be input from outside the program, this may be a code injection vulnerability. Ensure evaluated content is not definable by external sources.",
      "metadata": {
        "cwe": [
          "CWE-95: Improper Neutralization of Directives in Dynamically Evaluated Code ('Eval Injection')"
        ],
        "owasp": [
          "A03:2021 - Injection",
          "A05:2025 - Injection"
        ],
        "asvs": {
          "section": "V5: Validation, Sanitization and Encoding Verification Requirements",
          "control_id": "5.2.4 Dyanmic Code Execution Features",
          "control_url": "https://github.com/OWASP/ASVS/blob/master/4.0/en/0x13-V5-Validation-Sanitization-Encoding.md#v52-sanitization-and-sandboxing-requirements",
          "version": "4"
        },
        "category": "security",
        "technology": [
          "python"
        ],
        "references": [
          "https://owasp.org/Top10/A03_2021-Injection"
        ],
        "subcategory": [
          "vuln"
        ],
        "likelihood": "MEDIUM",
        "impact": "MEDIUM",
        "confidence": "MEDIUM",
        "license": "Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license",
        "vulnerability_class": [
          "Code Injection"
        ],
        "source": "https://semgrep.dev/r/python.aws-lambda.security.tainted-code-exec.tainted-code-exec",
        "shortlink": "https://sg.run/Ng7y",
        "semgrep.dev": {
          "rule": {
            "r_id": 18271,
            "rv_id": 1263342,
            "rule_id": "GdUDJP",
            "version_id": "nWT2LD2",
            "url": "https://semgrep.dev/playground/r/nWT2LD2/python.aws-lambda.security.tainted-code-exec.tainted-code-exec",
            "origin": "community"
          }
        }
      },
      "languages": [
        "python"
      ],
      "severity": "WARNING"
    },
    {
      "id": "python.aws-lambda.security.tainted-html-response.tainted-html-response",
      "mode": "taint",
      "pattern-sources": [
        {
          "patterns": [
            {
              "pattern": "event"
            },
            {
              "pattern-inside": "def $HANDLER(event, context):\n  ...\n"
            }
          ]
        }
      ],
      "pattern-sinks": [
        {
          "patterns": [
            {
              "pattern": "$BODY"
            },
            {
              "pattern-inside": "{..., \"headers\": {..., \"Content-Type\": \"text/html\", ...}, \"body\": $BODY, ... }\n"
            }
          ]
        }
      ],
      "message": "Detected user input flowing into an HTML response. You may be accidentally bypassing secure methods of rendering HTML by manually constructing HTML and this could create a cross-site scripting vulnerability, which could let attackers steal sensitive user data.",
      "metadata": {
        "cwe": [
          "CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')"
        ],
        "owasp": [
          "A07:2017 - Cross-Site Scripting (XSS)",
          "A03:2021 - Injection",
          "A05:2025 - Injection"
        ],
        "category": "security",
        "technology": [
          "aws-lambda"
        ],
        "references": [
          "https://owasp.org/Top10/A03_2021-Injection"
        ],
        "cwe2022-top25": true,
        "cwe2021-top25": true,
        "subcategory": [
          "vuln"
        ],
        "likelihood": "HIGH",
        "impact": "MEDIUM",
        "confidence": "MEDIUM",
        "license": "Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license",
        "vulnerability_class": [
          "Cross-Site-Scripting (XSS)"
        ],
        "source": "https://semgrep.dev/r/python.aws-lambda.security.tainted-html-response.tainted-html-response",
        "shortlink": "https://sg.run/k9vP",
        "semgrep.dev": {
          "rule": {
            "r_id": 18272,
            "rv_id": 1263343,
            "rule_id": "ReUKrk",
            "version_id": "ExTEx5o",
            "url": "https://semgrep.dev/playground/r/ExTEx5o/python.aws-lambda.security.tainted-html-response.tainted-html-response",
            "origin": "community"
          }
        }
      },
      "languages": [
        "python"
      ],
      "severity": "WARNING"
    },
    {
      "id": "python.aws-lambda.security.tainted-sql-string.tainted-sql-string",
      "languages": [
        "python"
      ],
      "message": "Detected user input used to manually construct a SQL string. This is usually bad practice because manual construction could accidentally result in a SQL injection. An attacker could use a SQL injection to steal or modify contents of the database. Instead, use a parameterized query which is available by default in most database engines. Alternatively, consider using an object-relational mapper (ORM) such as Sequelize which will protect your queries.",
      "metadata": {
        "references": [
          "https://owasp.org/www-community/attacks/SQL_Injection"
        ],
        "category": "security",
        "owasp": [
          "A01:2017 - Injection",
          "A03:2021 - Injection",
          "A05:2025 - Injection"
        ],
        "cwe": [
          "CWE-89: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')"
        ],
        "technology": [
          "aws-lambda"
        ],
        "cwe2022-top25": true,
        "cwe2021-top25": true,
        "subcategory": [
          "vuln"
        ],
        "likelihood": "HIGH",
        "impact": "MEDIUM",
        "confidence": "MEDIUM",
        "license": "Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license",
        "vulnerability_class": [
          "SQL Injection"
        ],
        "source": "https://semgrep.dev/r/python.aws-lambda.security.tainted-sql-string.tainted-sql-string",
        "shortlink": "https://sg.run/wXvA",
        "semgrep.dev": {
          "rule": {
            "r_id": 18273,
            "rv_id": 1263346,
            "rule_id": "AbU3LX",
            "version_id": "8KT5ron",
            "url": "https://semgrep.dev/playground/r/8KT5ron/python.aws-lambda.security.tainted-sql-string.tainted-sql-string",
            "origin": "community"
          }
        }
      },
      "mode": "taint",
      "pattern-sinks": [
        {
          "patterns": [
            {
              "pattern-either": [
                {
                  "pattern": "\"$SQLSTR\" + ...\n"
                },
                {
                  "pattern": "\"$SQLSTR\" % ...\n"
                },
                {
                  "pattern": "\"$SQLSTR\".format(...)\n"
                },
                {
                  "pattern": "f\"$SQLSTR{...}...\"\n"
                }
              ]
            },
            {
              "metavariable-regex": {
                "metavariable": "$SQLSTR",
                "regex": "\\s*(?i)(select|delete|insert|create|update|alter|drop)\\b.*="
              }
            },
            {
              "pattern-not-inside": "print(...)\n"
            }
          ]
        }
      ],
      "pattern-sources": [
        {
          "patterns": [
            {
              "pattern": "event"
            },
            {
              "pattern-inside": "def $HANDLER(event, context):\n  ...\n"
            }
          ]
        }
      ],
      "severity": "ERROR"
    },
    {
      "id": "python.django.security.nan-injection.nan-injection",
      "message": "Found user input going directly into typecast for bool(), float(), or complex(). This allows an attacker to inject Python's not-a-number (NaN) into the typecast. This results in undefind behavior, particularly when doing comparisons. Either cast to a different type, or add a guard checking for all capitalizations of the string 'nan'.",
      "languages": [
        "python"
      ],
      "severity": "ERROR",
      "mode": "taint",
      "pattern-sources": [
        {
          "patterns": [
            {
              "pattern-inside": "def $FUNC(request, ...):\n  ...\n"
            },
            {
              "pattern-either": [
                {
                  "pattern": "request.$PROPERTY.get(...)"
                },
                {
                  "pattern": "request.$PROPERTY[...]"
                }
              ]
            }
          ]
        }
      ],
      "pattern-sinks": [
        {
          "patterns": [
            {
              "pattern-either": [
                {
                  "pattern": "float(...)"
                },
                {
                  "pattern": "bool(...)"
                },
                {
                  "pattern": "complex(...)"
                }
              ]
            },
            {
              "pattern-not-inside": "if $COND:\n  ...\n...\n"
            }
          ]
        }
      ],
      "pattern-sanitizers": [
        {
          "pattern": "$ANYTHING(...)",
          "not_conflicting": true
        }
      ],
      "metadata": {
        "references": [
          "https://discuss.python.org/t/nan-breaks-min-max-and-sorting-functions-a-solution/2868",
          "https://blog.bitdiscovery.com/2021/12/python-nan-injection/"
        ],
        "category": "security",
        "cwe": [
          "CWE-704: Incorrect Type Conversion or Cast"
        ],
        "technology": [
          "django"
        ],
        "subcategory": [
          "vuln"
        ],
        "impact": "MEDIUM",
        "likelihood": "MEDIUM",
        "confidence": "MEDIUM",
        "license": "Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license",
        "vulnerability_class": [
          "Improper Validation"
        ],
        "source": "https://semgrep.dev/r/python.django.security.nan-injection.nan-injection",
        "shortlink": "https://sg.run/Og7L",
        "semgrep.dev": {
          "rule": {
            "r_id": 18275,
            "rv_id": 946193,
            "rule_id": "DbUGvk",
            "version_id": "NdTqk7G",
            "url": "https://semgrep.dev/playground/r/NdTqk7G/python.django.security.nan-injection.nan-injection",
            "origin": "community"
          }
        }
      }
    },
    {
      "id": "python.flask.security.injection.nan-injection.nan-injection",
      "message": "Found user input going directly into typecast for bool(), float(), or complex(). This allows an attacker to inject Python's not-a-number (NaN) into the typecast. This results in undefind behavior, particularly when doing comparisons. Either cast to a different type, or add a guard checking for all capitalizations of the string 'nan'.",
      "languages": [
        "python"
      ],
      "severity": "ERROR",
      "mode": "taint",
      "pattern-sources": [
        {
          "pattern-either": [
            {
              "pattern": "flask.request.$SOMETHING.get(...)"
            },
            {
              "pattern": "flask.request.$SOMETHING[...]"
            },
            {
              "patterns": [
                {
                  "pattern-inside": "@$APP.route(...)\ndef $FUNC(..., $ROUTEVAR, ...):\n  ...\n"
                },
                {
                  "pattern": "$ROUTEVAR"
                }
              ]
            }
          ]
        }
      ],
      "pattern-sinks": [
        {
          "pattern-either": [
            {
              "pattern": "float(...)"
            },
            {
              "pattern": "bool(...)"
            },
            {
              "pattern": "complex(...)"
            }
          ]
        }
      ],
      "pattern-sanitizers": [
        {
          "not_conflicting": true,
          "pattern": "$ANYTHING(...)"
        }
      ],
      "metadata": {
        "references": [
          "https://discuss.python.org/t/nan-breaks-min-max-and-sorting-functions-a-solution/2868",
          "https://blog.bitdiscovery.com/2021/12/python-nan-injection/"
        ],
        "category": "security",
        "cwe": [
          "CWE-704: Incorrect Type Conversion or Cast"
        ],
        "technology": [
          "flask"
        ],
        "subcategory": [
          "vuln"
        ],
        "impact": "MEDIUM",
        "likelihood": "MEDIUM",
        "confidence": "MEDIUM",
        "license": "Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license",
        "vulnerability_class": [
          "Improper Validation"
        ],
        "source": "https://semgrep.dev/r/python.flask.security.injection.nan-injection.nan-injection",
        "shortlink": "https://sg.run/e598",
        "semgrep.dev": {
          "rule": {
            "r_id": 18276,
            "rv_id": 946222,
            "rule_id": "WAUdj7",
            "version_id": "qkT4j85",
            "url": "https://semgrep.dev/playground/r/qkT4j85/python.flask.security.injection.nan-injection.nan-injection",
            "origin": "community"
          }
        }
      }
    },
    {
      "id": "python.aws-lambda.security.tainted-html-string.tainted-html-string",
      "languages": [
        "python"
      ],
      "severity": "WARNING",
      "message": "Detected user input flowing into a manually constructed HTML string. You may be accidentally bypassing secure methods of rendering HTML by manually constructing HTML and this could create a cross-site scripting vulnerability, which could let attackers steal sensitive user data. To be sure this is safe, check that the HTML is rendered safely. Otherwise, use templates which will safely render HTML instead.",
      "metadata": {
        "cwe": [
          "CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')"
        ],
        "owasp": [
          "A07:2017 - Cross-Site Scripting (XSS)",
          "A03:2021 - Injection",
          "A05:2025 - Injection"
        ],
        "category": "security",
        "technology": [
          "aws-lambda"
        ],
        "references": [
          "https://owasp.org/Top10/A03_2021-Injection"
        ],
        "cwe2022-top25": true,
        "cwe2021-top25": true,
        "subcategory": [
          "vuln"
        ],
        "likelihood": "HIGH",
        "impact": "MEDIUM",
        "confidence": "MEDIUM",
        "license": "Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license",
        "vulnerability_class": [
          "Cross-Site-Scripting (XSS)"
        ],
        "source": "https://semgrep.dev/r/python.aws-lambda.security.tainted-html-string.tainted-html-string",
        "shortlink": "https://sg.run/8zNy",
        "semgrep.dev": {
          "rule": {
            "r_id": 18484,
            "rv_id": 1263344,
            "rule_id": "JDUlwy",
            "version_id": "7ZTE36K",
            "url": "https://semgrep.dev/playground/r/7ZTE36K/python.aws-lambda.security.tainted-html-string.tainted-html-string",
            "origin": "community"
          }
        }
      },
      "mode": "taint",
      "pattern-sources": [
        {
          "patterns": [
            {
              "pattern": "event"
            },
            {
              "pattern-inside": "def $HANDLER(event, context):\n  ...\n"
            }
          ]
        }
      ],
      "pattern-sinks": [
        {
          "patterns": [
            {
              "pattern-either": [
                {
                  "patterns": [
                    {
                      "pattern-either": [
                        {
                          "pattern": "\"$HTMLSTR\" % ..."
                        },
                        {
                          "pattern": "\"$HTMLSTR\".format(...)"
                        },
                        {
                          "pattern": "\"$HTMLSTR\" + ..."
                        },
                        {
                          "pattern": "f\"$HTMLSTR{...}...\""
                        }
                      ]
                    }
                  ]
                },
                {
                  "patterns": [
                    {
                      "pattern-inside": "$HTML = \"$HTMLSTR\"\n...\n"
                    },
                    {
                      "pattern-either": [
                        {
                          "pattern": "$HTML % ..."
                        },
                        {
                          "pattern": "$HTML.format(...)"
                        },
                        {
                          "pattern": "$HTML + ..."
                        }
                      ]
                    }
                  ]
                }
              ]
            },
            {
              "metavariable-pattern": {
                "metavariable": "$HTMLSTR",
                "language": "generic",
                "pattern": "<$TAG ..."
              }
            },
            {
              "pattern-not-inside": "print(...)\n"
            }
          ]
        }
      ]
    },
    {
      "id": "python.jinja2.security.audit.autoescape-disabled-false.incorrect-autoescape-disabled",
      "patterns": [
        {
          "pattern": "jinja2.Environment(... , autoescape=$VAL, ...)"
        },
        {
          "pattern-not": "jinja2.Environment(... , autoescape=True, ...)"
        },
        {
          "pattern-not": "jinja2.Environment(... , autoescape=jinja2.select_autoescape(...), ...)"
        },
        {
          "focus-metavariable": "$VAL"
        }
      ],
      "fix": "True\n",
      "message": "Detected a Jinja2 environment with 'autoescaping' disabled. This is dangerous if you are rendering to a browser because this allows for cross-site scripting (XSS) attacks. If you are in a web context, enable 'autoescaping' by setting 'autoescape=True.' You may also consider using 'jinja2.select_autoescape()' to only enable automatic escaping for certain file extensions.",
      "metadata": {
        "source-rule-url": "https://bandit.readthedocs.io/en/latest/plugins/b701_jinja2_autoescape_false.html",
        "cwe": [
          "CWE-116: Improper Encoding or Escaping of Output"
        ],
        "owasp": [
          "A03:2021 - Injection",
          "A05:2025 - Injection"
        ],
        "references": [
          "https://jinja.palletsprojects.com/en/2.11.x/api/#basics"
        ],
        "category": "security",
        "technology": [
          "jinja2"
        ],
        "subcategory": [
          "vuln"
        ],
        "likelihood": "LOW",
        "impact": "MEDIUM",
        "confidence": "MEDIUM",
        "license": "Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license",
        "vulnerability_class": [
          "Improper Encoding"
        ],
        "source": "https://semgrep.dev/r/python.jinja2.security.audit.autoescape-disabled-false.incorrect-autoescape-disabled",
        "shortlink": "https://sg.run/L2L7",
        "semgrep.dev": {
          "rule": {
            "r_id": 20039,
            "rv_id": 1263448,
            "rule_id": "QrU1Xg",
            "version_id": "gETB7oN",
            "url": "https://semgrep.dev/playground/r/gETB7oN/python.jinja2.security.audit.autoescape-disabled-false.incorrect-autoescape-disabled",
            "origin": "community"
          }
        }
      },
      "languages": [
        "python"
      ],
      "severity": "WARNING"
    },
    {
      "id": "python.jinja2.security.audit.missing-autoescape-disabled.missing-autoescape-disabled",
      "patterns": [
        {
          "pattern-not": "jinja2.Environment(..., autoescape=$VAL, ...)"
        },
        {
          "pattern": "jinja2.Environment(...)"
        }
      ],
      "fix-regex": {
        "regex": "(.*)\\)",
        "replacement": "\\1, autoescape=True)"
      },
      "message": "Detected a Jinja2 environment without autoescaping. Jinja2 does not autoescape by default. This is dangerous if you are rendering to a browser because this allows for cross-site scripting (XSS) attacks. If you are in a web context, enable autoescaping by setting 'autoescape=True.' You may also consider using 'jinja2.select_autoescape()' to only enable automatic escaping for certain file extensions.",
      "metadata": {
        "source-rule-url": "https://bandit.readthedocs.io/en/latest/plugins/b701_jinja2_autoescape_false.html",
        "cwe": [
          "CWE-116: Improper Encoding or Escaping of Output"
        ],
        "owasp": [
          "A03:2021 - Injection",
          "A05:2025 - Injection"
        ],
        "references": [
          "https://jinja.palletsprojects.com/en/2.11.x/api/#basics"
        ],
        "category": "security",
        "technology": [
          "jinja2"
        ],
        "subcategory": [
          "vuln"
        ],
        "likelihood": "LOW",
        "impact": "MEDIUM",
        "confidence": "MEDIUM",
        "license": "Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license",
        "vulnerability_class": [
          "Improper Encoding"
        ],
        "source": "https://semgrep.dev/r/python.jinja2.security.audit.missing-autoescape-disabled.missing-autoescape-disabled",
        "shortlink": "https://sg.run/8kY4",
        "semgrep.dev": {
          "rule": {
            "r_id": 20040,
            "rv_id": 1263449,
            "rule_id": "3qULRx",
            "version_id": "QkTGqje",
            "url": "https://semgrep.dev/playground/r/QkTGqje/python.jinja2.security.audit.missing-autoescape-disabled.missing-autoescape-disabled",
            "origin": "community"
          }
        }
      },
      "languages": [
        "python"
      ],
      "severity": "WARNING"
    },
    {
      "id": "python.aws-lambda.security.dynamodb-filter-injection.dynamodb-filter-injection",
      "mode": "taint",
      "metadata": {
        "cwe": [
          "CWE-943: Improper Neutralization of Special Elements in Data Query Logic"
        ],
        "owasp": [
          "A01:2017 - Injection"
        ],
        "category": "security",
        "technology": [
          "python",
          "boto3",
          "aws-lambda",
          "dynamodb"
        ],
        "references": [
          "https://medium.com/appsecengineer/dynamodb-injection-1db99c2454ac"
        ],
        "subcategory": [
          "vuln"
        ],
        "impact": "MEDIUM",
        "likelihood": "MEDIUM",
        "confidence": "MEDIUM",
        "license": "Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license",
        "vulnerability_class": [
          "Improper Validation"
        ],
        "source": "https://semgrep.dev/r/python.aws-lambda.security.dynamodb-filter-injection.dynamodb-filter-injection",
        "shortlink": "https://sg.run/jjrl",
        "semgrep.dev": {
          "rule": {
            "r_id": 21321,
            "rv_id": 946088,
            "rule_id": "KxUJ2B",
            "version_id": "9lTy1rQ",
            "url": "https://semgrep.dev/playground/r/9lTy1rQ/python.aws-lambda.security.dynamodb-filter-injection.dynamodb-filter-injection",
            "origin": "community"
          }
        }
      },
      "message": "Detected DynamoDB query filter that is tainted by `$EVENT` object. This could lead to NoSQL injection if the variable is user-controlled and not properly sanitized. Explicitly assign query params instead of passing data from `$EVENT` directly to DynamoDB client.",
      "pattern-sources": [
        {
          "patterns": [
            {
              "pattern": "event"
            },
            {
              "pattern-inside": "def $HANDLER(event, context):\n  ...\n"
            }
          ]
        }
      ],
      "pattern-sanitizers": [
        {
          "patterns": [
            {
              "pattern": "{...}\n"
            }
          ]
        }
      ],
      "pattern-sinks": [
        {
          "patterns": [
            {
              "focus-metavariable": "$SINK"
            },
            {
              "pattern-either": [
                {
                  "pattern": "$TABLE.scan(..., ScanFilter = $SINK, ...)"
                },
                {
                  "pattern": "$TABLE.query(..., QueryFilter = $SINK, ...)"
                }
              ]
            },
            {
              "pattern-either": [
                {
                  "patterns": [
                    {
                      "pattern-inside": "$TABLE = $DB.Table(...)\n...\n"
                    },
                    {
                      "pattern-inside": "$DB = boto3.resource('dynamodb', ...)\n...\n"
                    }
                  ]
                },
                {
                  "pattern-inside": "$TABLE = boto3.client('dynamodb', ...)\n...\n"
                }
              ]
            }
          ]
        }
      ],
      "severity": "ERROR",
      "languages": [
        "python"
      ]
    },
    {
      "id": "python.pyramid.audit.authtkt-cookie-httponly-unsafe-default.pyramid-authtkt-cookie-httponly-unsafe-default",
      "patterns": [
        {
          "pattern": "pyramid.authentication.$FUNC($...PARAMS)"
        },
        {
          "metavariable-pattern": {
            "metavariable": "$FUNC",
            "pattern-either": [
              {
                "pattern": "AuthTktCookieHelper"
              },
              {
                "pattern": "AuthTktAuthenticationPolicy"
              }
            ]
          }
        },
        {
          "pattern-not": "pyramid.authentication.$FUNC(..., httponly=$HTTPONLY, ...)"
        },
        {
          "pattern-not": "pyramid.authentication.$FUNC(..., **$PARAMS, ...)"
        },
        {
          "focus-metavariable": "$...PARAMS"
        }
      ],
      "fix": "$...PARAMS, httponly=True\n",
      "message": "Found a Pyramid Authentication Ticket cookie without the httponly option correctly set. Pyramid cookies should be handled securely by setting httponly=True. If this parameter is not properly set, your cookies are not properly protected and are at risk of being stolen by an attacker.",
      "metadata": {
        "cwe": [
          "CWE-1004: Sensitive Cookie Without 'HttpOnly' Flag"
        ],
        "owasp": [
          "A05:2021 - Security Misconfiguration",
          "A02:2025 - Security Misconfiguration"
        ],
        "category": "security",
        "technology": [
          "pyramid"
        ],
        "references": [
          "https://owasp.org/Top10/A05_2021-Security_Misconfiguration"
        ],
        "subcategory": [
          "vuln"
        ],
        "likelihood": "LOW",
        "impact": "LOW",
        "confidence": "MEDIUM",
        "license": "Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license",
        "vulnerability_class": [
          "Cookie Security"
        ],
        "source": "https://semgrep.dev/r/python.pyramid.audit.authtkt-cookie-httponly-unsafe-default.pyramid-authtkt-cookie-httponly-unsafe-default",
        "shortlink": "https://sg.run/EprB",
        "semgrep.dev": {
          "rule": {
            "r_id": 21437,
            "rv_id": 1263557,
            "rule_id": "bwUXKB",
            "version_id": "RGT0L7K",
            "url": "https://semgrep.dev/playground/r/RGT0L7K/python.pyramid.audit.authtkt-cookie-httponly-unsafe-default.pyramid-authtkt-cookie-httponly-unsafe-default",
            "origin": "community"
          }
        }
      },
      "languages": [
        "python"
      ],
      "severity": "WARNING"
    },
    {
      "id": "python.pyramid.audit.authtkt-cookie-httponly-unsafe-value.pyramid-authtkt-cookie-httponly-unsafe-value",
      "patterns": [
        {
          "pattern-either": [
            {
              "patterns": [
                {
                  "pattern-not": "pyramid.authentication.AuthTktCookieHelper(..., **$PARAMS)"
                },
                {
                  "pattern": "pyramid.authentication.AuthTktCookieHelper(..., httponly=$HTTPONLY, ...)"
                }
              ]
            },
            {
              "patterns": [
                {
                  "pattern-not": "pyramid.authentication.AuthTktAuthenticationPolicy(..., **$PARAMS)"
                },
                {
                  "pattern": "pyramid.authentication.AuthTktAuthenticationPolicy(..., httponly=$HTTPONLY, ...)"
                }
              ]
            }
          ]
        },
        {
          "pattern": "$HTTPONLY"
        },
        {
          "metavariable-pattern": {
            "metavariable": "$HTTPONLY",
            "pattern": "False\n"
          }
        }
      ],
      "fix": "True\n",
      "message": "Found a Pyramid Authentication Ticket cookie without the httponly option correctly set. Pyramid cookies should be handled securely by setting httponly=True. If this parameter is not properly set, your cookies are not properly protected and are at risk of being stolen by an attacker.",
      "metadata": {
        "cwe": [
          "CWE-1004: Sensitive Cookie Without 'HttpOnly' Flag"
        ],
        "owasp": [
          "A05:2021 - Security Misconfiguration",
          "A02:2025 - Security Misconfiguration"
        ],
        "category": "security",
        "technology": [
          "pyramid"
        ],
        "references": [
          "https://owasp.org/Top10/A05_2021-Security_Misconfiguration"
        ],
        "subcategory": [
          "vuln"
        ],
        "likelihood": "LOW",
        "impact": "LOW",
        "confidence": "MEDIUM",
        "license": "Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license",
        "vulnerability_class": [
          "Cookie Security"
        ],
        "source": "https://semgrep.dev/r/python.pyramid.audit.authtkt-cookie-httponly-unsafe-value.pyramid-authtkt-cookie-httponly-unsafe-value",
        "shortlink": "https://sg.run/7DgQ",
        "semgrep.dev": {
          "rule": {
            "r_id": 21438,
            "rv_id": 1263558,
            "rule_id": "NbUq9e",
            "version_id": "A8Tgd8N",
            "url": "https://semgrep.dev/playground/r/A8Tgd8N/python.pyramid.audit.authtkt-cookie-httponly-unsafe-value.pyramid-authtkt-cookie-httponly-unsafe-value",
            "origin": "community"
          }
        }
      },
      "languages": [
        "python"
      ],
      "severity": "WARNING"
    },
    {
      "id": "python.pyramid.audit.authtkt-cookie-samesite.pyramid-authtkt-cookie-samesite",
      "patterns": [
        {
          "pattern-either": [
            {
              "pattern": "pyramid.authentication.AuthTktCookieHelper(..., samesite=$SAMESITE, ...)"
            },
            {
              "pattern": "pyramid.authentication.AuthTktAuthenticationPolicy(..., samesite=$SAMESITE, ...)"
            }
          ]
        },
        {
          "pattern": "$SAMESITE"
        },
        {
          "metavariable-regex": {
            "metavariable": "$SAMESITE",
            "regex": "(?!'Lax')"
          }
        }
      ],
      "fix": "'Lax'\n",
      "message": "Found a Pyramid Authentication Ticket without the samesite option correctly set. Pyramid cookies should be handled securely by setting samesite='Lax'. If this parameter is not properly set, your cookies are not properly protected and are at risk of being stolen by an attacker.",
      "metadata": {
        "cwe": [
          "CWE-1275: Sensitive Cookie with Improper SameSite Attribute"
        ],
        "owasp": [
          "A01:2021 - Broken Access Control",
          "A01:2025 - Broken Access Control"
        ],
        "category": "security",
        "technology": [
          "pyramid"
        ],
        "references": [
          "https://owasp.org/Top10/A01_2021-Broken_Access_Control"
        ],
        "subcategory": [
          "vuln"
        ],
        "likelihood": "LOW",
        "impact": "LOW",
        "confidence": "MEDIUM",
        "license": "Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license",
        "vulnerability_class": [
          "Cookie Security"
        ],
        "source": "https://semgrep.dev/r/python.pyramid.audit.authtkt-cookie-samesite.pyramid-authtkt-cookie-samesite",
        "shortlink": "https://sg.run/LYrY",
        "semgrep.dev": {
          "rule": {
            "r_id": 21439,
            "rv_id": 1263559,
            "rule_id": "kxUYjY",
            "version_id": "BjTkZ51",
            "url": "https://semgrep.dev/playground/r/BjTkZ51/python.pyramid.audit.authtkt-cookie-samesite.pyramid-authtkt-cookie-samesite",
            "origin": "community"
          }
        }
      },
      "languages": [
        "python"
      ],
      "severity": "WARNING"
    },
    {
      "id": "python.pyramid.audit.authtkt-cookie-secure-unsafe-default.pyramid-authtkt-cookie-secure-unsafe-default",
      "patterns": [
        {
          "pattern-either": [
            {
              "patterns": [
                {
                  "pattern-not": "pyramid.authentication.AuthTktCookieHelper(..., secure=$SECURE, ...)"
                },
                {
                  "pattern-not": "pyramid.authentication.AuthTktCookieHelper(..., **$PARAMS)"
                },
                {
                  "pattern": "pyramid.authentication.AuthTktCookieHelper(...)"
                }
              ]
            },
            {
              "patterns": [
                {
                  "pattern-not": "pyramid.authentication.AuthTktAuthenticationPolicy(..., secure=$SECURE, ...)"
                },
                {
                  "pattern-not": "pyramid.authentication.AuthTktAuthenticationPolicy(..., **$PARAMS)"
                },
                {
                  "pattern": "pyramid.authentication.AuthTktAuthenticationPolicy(...)"
                }
              ]
            }
          ]
        }
      ],
      "fix-regex": {
        "regex": "(.*)\\)",
        "replacement": "\\1, secure=True)"
      },
      "message": "Found a Pyramid Authentication Ticket cookie using an unsafe default for the secure option. Pyramid cookies should be handled securely by setting secure=True. If this parameter is not properly set, your cookies are not properly protected and are at risk of being stolen by an attacker.",
      "metadata": {
        "cwe": [
          "CWE-614: Sensitive Cookie in HTTPS Session Without 'Secure' Attribute"
        ],
        "owasp": [
          "A05:2021 - Security Misconfiguration",
          "A02:2025 - Security Misconfiguration"
        ],
        "category": "security",
        "technology": [
          "pyramid"
        ],
        "references": [
          "https://owasp.org/Top10/A05_2021-Security_Misconfiguration"
        ],
        "subcategory": [
          "vuln"
        ],
        "likelihood": "LOW",
        "impact": "LOW",
        "confidence": "MEDIUM",
        "license": "Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license",
        "vulnerability_class": [
          "Cookie Security"
        ],
        "source": "https://semgrep.dev/r/python.pyramid.audit.authtkt-cookie-secure-unsafe-default.pyramid-authtkt-cookie-secure-unsafe-default",
        "shortlink": "https://sg.run/8WxQ",
        "semgrep.dev": {
          "rule": {
            "r_id": 21440,
            "rv_id": 1263560,
            "rule_id": "wdUKzn",
            "version_id": "DkTRbJn",
            "url": "https://semgrep.dev/playground/r/DkTRbJn/python.pyramid.audit.authtkt-cookie-secure-unsafe-default.pyramid-authtkt-cookie-secure-unsafe-default",
            "origin": "community"
          }
        }
      },
      "languages": [
        "python"
      ],
      "severity": "WARNING"
    },
    {
      "id": "python.pyramid.audit.authtkt-cookie-secure-unsafe-value.pyramid-authtkt-cookie-secure-unsafe-value",
      "patterns": [
        {
          "pattern-either": [
            {
              "patterns": [
                {
                  "pattern-not": "pyramid.authentication.AuthTktCookieHelper(..., **$PARAMS)"
                },
                {
                  "pattern": "pyramid.authentication.AuthTktCookieHelper(..., secure=$SECURE, ...)"
                }
              ]
            },
            {
              "patterns": [
                {
                  "pattern-not": "pyramid.authentication.AuthTktAuthenticationPolicy(..., **$PARAMS)"
                },
                {
                  "pattern": "pyramid.authentication.AuthTktAuthenticationPolicy(..., secure=$SECURE, ...)"
                }
              ]
            }
          ]
        },
        {
          "pattern": "$SECURE"
        },
        {
          "metavariable-pattern": {
            "metavariable": "$SECURE",
            "pattern": "False\n"
          }
        }
      ],
      "fix": "True\n",
      "message": "Found a Pyramid Authentication Ticket cookie without the secure option correctly set. Pyramid cookies should be handled securely by setting secure=True. If this parameter is not properly set, your cookies are not properly protected and are at risk of being stolen by an attacker.",
      "metadata": {
        "cwe": [
          "CWE-614: Sensitive Cookie in HTTPS Session Without 'Secure' Attribute"
        ],
        "owasp": [
          "A05:2021 - Security Misconfiguration",
          "A02:2025 - Security Misconfiguration"
        ],
        "category": "security",
        "technology": [
          "pyramid"
        ],
        "references": [
          "https://owasp.org/Top10/A05_2021-Security_Misconfiguration"
        ],
        "subcategory": [
          "vuln"
        ],
        "likelihood": "LOW",
        "impact": "LOW",
        "confidence": "MEDIUM",
        "license": "Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license",
        "vulnerability_class": [
          "Cookie Security"
        ],
        "source": "https://semgrep.dev/r/python.pyramid.audit.authtkt-cookie-secure-unsafe-value.pyramid-authtkt-cookie-secure-unsafe-value",
        "shortlink": "https://sg.run/gjp5",
        "semgrep.dev": {
          "rule": {
            "r_id": 21441,
            "rv_id": 1263561,
            "rule_id": "x8UqAp",
            "version_id": "WrTqK93",
            "url": "https://semgrep.dev/playground/r/WrTqK93/python.pyramid.audit.authtkt-cookie-secure-unsafe-value.pyramid-authtkt-cookie-secure-unsafe-value",
            "origin": "community"
          }
        }
      },
      "languages": [
        "python"
      ],
      "severity": "WARNING"
    },
    {
      "id": "python.pyramid.audit.csrf-origin-check-disabled-globally.pyramid-csrf-origin-check-disabled-globally",
      "patterns": [
        {
          "pattern-inside": "$CONFIG.set_default_csrf_options(..., check_origin=$CHECK_ORIGIN, ...)\n"
        },
        {
          "pattern": "$CHECK_ORIGIN"
        },
        {
          "metavariable-comparison": {
            "metavariable": "$CHECK_ORIGIN",
            "comparison": "$CHECK_ORIGIN == False"
          }
        }
      ],
      "message": "Automatic check of the referrer for cross-site request forgery tokens has been explicitly disabled globally, which might leave views unprotected when an unsafe CSRF storage policy is used. Use 'pyramid.config.Configurator.set_default_csrf_options(check_origin=True)' to turn the automatic check for all unsafe methods (per RFC2616).",
      "languages": [
        "python"
      ],
      "severity": "ERROR",
      "fix": "True\n",
      "metadata": {
        "cwe": [
          "CWE-352: Cross-Site Request Forgery (CSRF)"
        ],
        "owasp": [
          "A01:2021 - Broken Access Control",
          "A01:2025 - Broken Access Control"
        ],
        "category": "security",
        "technology": [
          "pyramid"
        ],
        "references": [
          "https://owasp.org/Top10/A01_2021-Broken_Access_Control"
        ],
        "cwe2022-top25": true,
        "cwe2021-top25": true,
        "subcategory": [
          "vuln"
        ],
        "likelihood": "LOW",
        "impact": "LOW",
        "confidence": "MEDIUM",
        "license": "Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license",
        "vulnerability_class": [
          "Cross-Site Request Forgery (CSRF)"
        ],
        "source": "https://semgrep.dev/r/python.pyramid.audit.csrf-origin-check-disabled-globally.pyramid-csrf-origin-check-disabled-globally",
        "shortlink": "https://sg.run/3GeW",
        "semgrep.dev": {
          "rule": {
            "r_id": 21443,
            "rv_id": 1263563,
            "rule_id": "eqU9Le",
            "version_id": "K3TKkeo",
            "url": "https://semgrep.dev/playground/r/K3TKkeo/python.pyramid.audit.csrf-origin-check-disabled-globally.pyramid-csrf-origin-check-disabled-globally",
            "origin": "community"
          }
        }
      }
    },
    {
      "id": "python.pyramid.audit.csrf-origin-check-disabled.pyramid-csrf-origin-check-disabled",
      "message": "Origin check for the CSRF token is disabled for this view. This might represent a security risk if the CSRF storage policy is not known to be secure.",
      "metadata": {
        "cwe": [
          "CWE-352: Cross-Site Request Forgery (CSRF)"
        ],
        "owasp": [
          "A01:2021 - Broken Access Control",
          "A01:2025 - Broken Access Control"
        ],
        "asvs": {
          "section": "V4 Access Control",
          "control_id": "4.2.2 CSRF",
          "control_url": "https://github.com/OWASP/ASVS/blob/master/4.0/en/0x12-V4-Access-Control.md#v42-operation-level-access-control",
          "version": "4"
        },
        "category": "security",
        "technology": [
          "pyramid"
        ],
        "references": [
          "https://owasp.org/Top10/A01_2021-Broken_Access_Control"
        ],
        "cwe2022-top25": true,
        "cwe2021-top25": true,
        "subcategory": [
          "vuln"
        ],
        "likelihood": "LOW",
        "impact": "LOW",
        "confidence": "MEDIUM",
        "license": "Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license",
        "vulnerability_class": [
          "Cross-Site Request Forgery (CSRF)"
        ],
        "source": "https://semgrep.dev/r/python.pyramid.audit.csrf-origin-check-disabled.pyramid-csrf-origin-check-disabled",
        "shortlink": "https://sg.run/4RB9",
        "semgrep.dev": {
          "rule": {
            "r_id": 21444,
            "rv_id": 1263564,
            "rule_id": "v8UGpL",
            "version_id": "qkTR7Gv",
            "url": "https://semgrep.dev/playground/r/qkTR7Gv/python.pyramid.audit.csrf-origin-check-disabled.pyramid-csrf-origin-check-disabled",
            "origin": "community"
          }
        }
      },
      "severity": "WARNING",
      "languages": [
        "python"
      ],
      "patterns": [
        {
          "pattern-inside": "from pyramid.view import view_config\n...\n@view_config(..., check_origin=$CHECK_ORIGIN, ...)\ndef $VIEW(...):\n  ...\n"
        },
        {
          "pattern": "$CHECK_ORIGIN"
        },
        {
          "metavariable-comparison": {
            "metavariable": "$CHECK_ORIGIN",
            "comparison": "$CHECK_ORIGIN == False"
          }
        }
      ],
      "fix": "True\n"
    },
    {
      "id": "python.pyramid.audit.set-cookie-httponly-unsafe-default.pyramid-set-cookie-httponly-unsafe-default",
      "patterns": [
        {
          "pattern-either": [
            {
              "pattern-inside": "@pyramid.view.view_config(...)\ndef $VIEW($REQUEST):\n    ...\n    $RESPONSE = $REQUEST.response\n    ...\n"
            },
            {
              "pattern-inside": "def $VIEW(...):\n    ...\n    $RESPONSE = pyramid.httpexceptions.HTTPFound(...)\n    ...\n"
            }
          ]
        },
        {
          "pattern-not": "$RESPONSE.set_cookie(..., httponly=$HTTPONLY, ...)"
        },
        {
          "pattern-not": "$RESPONSE.set_cookie(..., **$PARAMS)"
        },
        {
          "pattern": "$RESPONSE.set_cookie(...)"
        }
      ],
      "fix-regex": {
        "regex": "(.*)\\)",
        "replacement": "\\1, httponly=True)"
      },
      "message": "Found a Pyramid cookie using an unsafe default for the httponly option. Pyramid cookies should be handled securely by setting httponly=True in response.set_cookie(...). If this parameter is not properly set, your cookies are not properly protected and are at risk of being stolen by an attacker.",
      "metadata": {
        "cwe": [
          "CWE-1004: Sensitive Cookie Without 'HttpOnly' Flag"
        ],
        "owasp": [
          "A05:2021 - Security Misconfiguration",
          "A02:2025 - Security Misconfiguration"
        ],
        "category": "security",
        "technology": [
          "pyramid"
        ],
        "references": [
          "https://owasp.org/Top10/A05_2021-Security_Misconfiguration"
        ],
        "subcategory": [
          "vuln"
        ],
        "likelihood": "LOW",
        "impact": "LOW",
        "confidence": "MEDIUM",
        "license": "Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license",
        "vulnerability_class": [
          "Cookie Security"
        ],
        "source": "https://semgrep.dev/r/python.pyramid.audit.set-cookie-httponly-unsafe-default.pyramid-set-cookie-httponly-unsafe-default",
        "shortlink": "https://sg.run/P19v",
        "semgrep.dev": {
          "rule": {
            "r_id": 21445,
            "rv_id": 1263565,
            "rule_id": "d8UPQ7",
            "version_id": "l4TJRbo",
            "url": "https://semgrep.dev/playground/r/l4TJRbo/python.pyramid.audit.set-cookie-httponly-unsafe-default.pyramid-set-cookie-httponly-unsafe-default",
            "origin": "community"
          }
        }
      },
      "languages": [
        "python"
      ],
      "severity": "WARNING"
    },
    {
      "id": "python.pyramid.audit.set-cookie-httponly-unsafe-value.pyramid-set-cookie-httponly-unsafe-value",
      "patterns": [
        {
          "pattern-either": [
            {
              "pattern-inside": "@pyramid.view.view_config(...)\ndef $VIEW($REQUEST):\n    ...\n    $RESPONSE = $REQUEST.response\n    ...\n"
            },
            {
              "pattern-inside": "def $VIEW(...):\n    ...\n    $RESPONSE = pyramid.httpexceptions.HTTPFound(...)\n    ...\n"
            }
          ]
        },
        {
          "pattern-not": "$RESPONSE.set_cookie(..., **$PARAMS)"
        },
        {
          "pattern": "$RESPONSE.set_cookie(..., httponly=$HTTPONLY, ...)"
        },
        {
          "pattern": "$HTTPONLY"
        },
        {
          "metavariable-pattern": {
            "metavariable": "$HTTPONLY",
            "pattern": "False\n"
          }
        }
      ],
      "fix": "True\n",
      "message": "Found a Pyramid cookie without the httponly option correctly set. Pyramid cookies should be handled securely by setting httponly=True in response.set_cookie(...). If this parameter is not properly set, your cookies are not properly protected and are at risk of being stolen by an attacker.",
      "metadata": {
        "cwe": [
          "CWE-1004: Sensitive Cookie Without 'HttpOnly' Flag"
        ],
        "owasp": [
          "A05:2021 - Security Misconfiguration",
          "A02:2025 - Security Misconfiguration"
        ],
        "references": [
          "https://owasp.org/www-community/controls/SecureCookieAttribute",
          "https://owasp.org/www-community/HttpOnly",
          "https://cheatsheetseries.owasp.org/cheatsheets/Session_Management_Cheat_Sheet.html#httponly-attribute"
        ],
        "category": "security",
        "technology": [
          "pyramid"
        ],
        "subcategory": [
          "vuln"
        ],
        "likelihood": "LOW",
        "impact": "LOW",
        "confidence": "MEDIUM",
        "license": "Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license",
        "vulnerability_class": [
          "Cookie Security"
        ],
        "source": "https://semgrep.dev/r/python.pyramid.audit.set-cookie-httponly-unsafe-value.pyramid-set-cookie-httponly-unsafe-value",
        "shortlink": "https://sg.run/JbqP",
        "semgrep.dev": {
          "rule": {
            "r_id": 21446,
            "rv_id": 1263566,
            "rule_id": "ZqU37W",
            "version_id": "YDTZe54",
            "url": "https://semgrep.dev/playground/r/YDTZe54/python.pyramid.audit.set-cookie-httponly-unsafe-value.pyramid-set-cookie-httponly-unsafe-value",
            "origin": "community"
          }
        }
      },
      "languages": [
        "python"
      ],
      "severity": "WARNING"
    },
    {
      "id": "python.pyramid.audit.set-cookie-samesite-unsafe-default.pyramid-set-cookie-samesite-unsafe-default",
      "patterns": [
        {
          "pattern-either": [
            {
              "pattern-inside": "@pyramid.view.view_config(...)\ndef $VIEW($REQUEST):\n    ...\n    $RESPONSE = $REQUEST.response\n    ...\n"
            },
            {
              "pattern-inside": "def $VIEW(...):\n    ...\n    $RESPONSE = pyramid.httpexceptions.HTTPFound(...)\n    ...\n"
            }
          ]
        },
        {
          "pattern-not": "$RESPONSE.set_cookie(..., samesite=$SAMESITE, ...)"
        },
        {
          "pattern-not": "$RESPONSE.set_cookie(..., **$PARAMS)"
        },
        {
          "pattern": "$RESPONSE.set_cookie(...)"
        }
      ],
      "fix-regex": {
        "regex": "(.*)\\)",
        "replacement": "\\1, samesite='Lax')"
      },
      "message": "Found a Pyramid cookie using an unsafe value for the samesite option. Pyramid cookies should be handled securely by setting samesite='Lax' in response.set_cookie(...). If this parameter is not properly set, your cookies are not properly protected and are at risk of being stolen by an attacker.",
      "metadata": {
        "cwe": [
          "CWE-1275: Sensitive Cookie with Improper SameSite Attribute"
        ],
        "owasp": [
          "A01:2021 - Broken Access Control",
          "A01:2025 - Broken Access Control"
        ],
        "category": "security",
        "technology": [
          "pyramid"
        ],
        "references": [
          "https://owasp.org/Top10/A01_2021-Broken_Access_Control"
        ],
        "subcategory": [
          "vuln"
        ],
        "likelihood": "LOW",
        "impact": "LOW",
        "confidence": "MEDIUM",
        "license": "Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license",
        "vulnerability_class": [
          "Cookie Security"
        ],
        "source": "https://semgrep.dev/r/python.pyramid.audit.set-cookie-samesite-unsafe-default.pyramid-set-cookie-samesite-unsafe-default",
        "shortlink": "https://sg.run/5AWj",
        "semgrep.dev": {
          "rule": {
            "r_id": 21447,
            "rv_id": 1263567,
            "rule_id": "nJUp80",
            "version_id": "6xT293z",
            "url": "https://semgrep.dev/playground/r/6xT293z/python.pyramid.audit.set-cookie-samesite-unsafe-default.pyramid-set-cookie-samesite-unsafe-default",
            "origin": "community"
          }
        }
      },
      "languages": [
        "python"
      ],
      "severity": "WARNING"
    },
    {
      "id": "python.pyramid.audit.set-cookie-samesite-unsafe-value.pyramid-set-cookie-samesite-unsafe-value",
      "patterns": [
        {
          "pattern-either": [
            {
              "pattern-inside": "@pyramid.view.view_config(...)\ndef $VIEW($REQUEST):\n    ...\n    $RESPONSE = $REQUEST.response\n    ...\n"
            },
            {
              "pattern-inside": "def $VIEW(...):\n    ...\n    $RESPONSE = pyramid.httpexceptions.HTTPFound(...)\n    ...\n"
            }
          ]
        },
        {
          "pattern-not": "$RESPONSE.set_cookie(..., **$PARAMS)"
        },
        {
          "pattern": "$RESPONSE.set_cookie(..., samesite=$SAMESITE, ...)"
        },
        {
          "pattern": "$SAMESITE"
        },
        {
          "metavariable-regex": {
            "metavariable": "$SAMESITE",
            "regex": "(?!'Lax')"
          }
        }
      ],
      "fix": "'Lax'\n",
      "message": "Found a Pyramid cookie without the samesite option correctly set. Pyramid cookies should be handled securely by setting samesite='Lax' in response.set_cookie(...). If this parameter is not properly set, your cookies are not properly protected and are at risk of being stolen by an attacker.",
      "metadata": {
        "cwe": [
          "CWE-1275: Sensitive Cookie with Improper SameSite Attribute"
        ],
        "owasp": [
          "A01:2021 - Broken Access Control",
          "A01:2025 - Broken Access Control"
        ],
        "category": "security",
        "technology": [
          "pyramid"
        ],
        "references": [
          "https://owasp.org/Top10/A01_2021-Broken_Access_Control"
        ],
        "subcategory": [
          "vuln"
        ],
        "likelihood": "LOW",
        "impact": "LOW",
        "confidence": "MEDIUM",
        "license": "Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license",
        "vulnerability_class": [
          "Cookie Security"
        ],
        "source": "https://semgrep.dev/r/python.pyramid.audit.set-cookie-samesite-unsafe-value.pyramid-set-cookie-samesite-unsafe-value",
        "shortlink": "https://sg.run/GXR6",
        "semgrep.dev": {
          "rule": {
            "r_id": 21448,
            "rv_id": 1263568,
            "rule_id": "EwUgpY",
            "version_id": "o5TbDv5",
            "url": "https://semgrep.dev/playground/r/o5TbDv5/python.pyramid.audit.set-cookie-samesite-unsafe-value.pyramid-set-cookie-samesite-unsafe-value",
            "origin": "community"
          }
        }
      },
      "languages": [
        "python"
      ],
      "severity": "WARNING"
    },
    {
      "id": "python.pyramid.audit.set-cookie-secure-unsafe-default.pyramid-set-cookie-secure-unsafe-default",
      "patterns": [
        {
          "pattern-either": [
            {
              "pattern-inside": "@pyramid.view.view_config(...)\ndef $VIEW($REQUEST):\n    ...\n    $RESPONSE = $REQUEST.response\n    ...\n"
            },
            {
              "pattern-inside": "def $VIEW(...):\n    ...\n    $RESPONSE = pyramid.httpexceptions.HTTPFound(...)\n    ...\n"
            }
          ]
        },
        {
          "pattern-not": "$RESPONSE.set_cookie(..., secure=$SECURE, ...)"
        },
        {
          "pattern-not": "$RESPONSE.set_cookie(..., **$PARAMS)"
        },
        {
          "pattern": "$RESPONSE.set_cookie(...)"
        }
      ],
      "fix-regex": {
        "regex": "(.*)\\)",
        "replacement": "\\1, secure=True)"
      },
      "message": "Found a Pyramid cookie using an unsafe default for the secure option. Pyramid cookies should be handled securely by setting secure=True in response.set_cookie(...). If this parameter is not properly set, your cookies are not properly protected and are at risk of being stolen by an attacker.",
      "metadata": {
        "cwe": [
          "CWE-614: Sensitive Cookie in HTTPS Session Without 'Secure' Attribute"
        ],
        "owasp": [
          "A05:2021 - Security Misconfiguration",
          "A02:2025 - Security Misconfiguration"
        ],
        "category": "security",
        "technology": [
          "pyramid"
        ],
        "references": [
          "https://owasp.org/Top10/A05_2021-Security_Misconfiguration"
        ],
        "subcategory": [
          "vuln"
        ],
        "likelihood": "LOW",
        "impact": "LOW",
        "confidence": "MEDIUM",
        "license": "Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license",
        "vulnerability_class": [
          "Cookie Security"
        ],
        "source": "https://semgrep.dev/r/python.pyramid.audit.set-cookie-secure-unsafe-default.pyramid-set-cookie-secure-unsafe-default",
        "shortlink": "https://sg.run/RbrN",
        "semgrep.dev": {
          "rule": {
            "r_id": 21449,
            "rv_id": 1263569,
            "rule_id": "7KUr15",
            "version_id": "zyTb2dX",
            "url": "https://semgrep.dev/playground/r/zyTb2dX/python.pyramid.audit.set-cookie-secure-unsafe-default.pyramid-set-cookie-secure-unsafe-default",
            "origin": "community"
          }
        }
      },
      "languages": [
        "python"
      ],
      "severity": "WARNING"
    },
    {
      "id": "python.pyramid.audit.set-cookie-secure-unsafe-value.pyramid-set-cookie-secure-unsafe-value",
      "patterns": [
        {
          "pattern-either": [
            {
              "pattern-inside": "@pyramid.view.view_config(...)\ndef $VIEW($REQUEST):\n    ...\n    $RESPONSE = $REQUEST.response\n    ...\n"
            },
            {
              "pattern-inside": "def $VIEW(...):\n    ...\n    $RESPONSE = pyramid.httpexceptions.HTTPFound(...)\n    ...\n"
            }
          ]
        },
        {
          "pattern-not": "$RESPONSE.set_cookie(..., **$PARAMS)"
        },
        {
          "pattern": "$RESPONSE.set_cookie(..., secure=$SECURE, ...)"
        },
        {
          "pattern": "$SECURE"
        },
        {
          "metavariable-pattern": {
            "metavariable": "$SECURE",
            "pattern": "False\n"
          }
        }
      ],
      "fix": "True\n",
      "message": "Found a Pyramid cookie without the secure option correctly set. Pyramid cookies should be handled securely by setting secure=True in response.set_cookie(...). If this parameter is not properly set, your cookies are not properly protected and are at risk of being stolen by an attacker.",
      "metadata": {
        "cwe": [
          "CWE-614: Sensitive Cookie in HTTPS Session Without 'Secure' Attribute"
        ],
        "owasp": [
          "A05:2021 - Security Misconfiguration",
          "A02:2025 - Security Misconfiguration"
        ],
        "category": "security",
        "technology": [
          "pyramid"
        ],
        "references": [
          "https://owasp.org/Top10/A05_2021-Security_Misconfiguration"
        ],
        "subcategory": [
          "vuln"
        ],
        "likelihood": "LOW",
        "impact": "LOW",
        "confidence": "MEDIUM",
        "license": "Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license",
        "vulnerability_class": [
          "Cookie Security"
        ],
        "source": "https://semgrep.dev/r/python.pyramid.audit.set-cookie-secure-unsafe-value.pyramid-set-cookie-secure-unsafe-value",
        "shortlink": "https://sg.run/AzjB",
        "semgrep.dev": {
          "rule": {
            "r_id": 21450,
            "rv_id": 1263570,
            "rule_id": "L1UX2J",
            "version_id": "pZT03oJ",
            "url": "https://semgrep.dev/playground/r/pZT03oJ/python.pyramid.audit.set-cookie-secure-unsafe-value.pyramid-set-cookie-secure-unsafe-value",
            "origin": "community"
          }
        }
      },
      "languages": [
        "python"
      ],
      "severity": "WARNING"
    },
    {
      "id": "python.pyramid.security.csrf-check-disabled-globally.pyramid-csrf-check-disabled-globally",
      "patterns": [
        {
          "pattern-inside": "$CONFIG.set_default_csrf_options(..., require_csrf=$REQUIRE_CSRF, ...)\n"
        },
        {
          "pattern": "$REQUIRE_CSRF"
        },
        {
          "metavariable-comparison": {
            "metavariable": "$REQUIRE_CSRF",
            "comparison": "$REQUIRE_CSRF == False"
          }
        }
      ],
      "message": "Automatic check of cross-site request forgery tokens has been explicitly disabled globally, which might leave views unprotected. Use 'pyramid.config.Configurator.set_default_csrf_options(require_csrf=True)' to turn the automatic check for all unsafe methods (per RFC2616).",
      "languages": [
        "python"
      ],
      "severity": "ERROR",
      "fix": "True\n",
      "metadata": {
        "cwe": [
          "CWE-352: Cross-Site Request Forgery (CSRF)"
        ],
        "owasp": [
          "A01:2021 - Broken Access Control",
          "A01:2025 - Broken Access Control"
        ],
        "category": "security",
        "technology": [
          "pyramid"
        ],
        "references": [
          "https://owasp.org/Top10/A01_2021-Broken_Access_Control"
        ],
        "cwe2022-top25": true,
        "cwe2021-top25": true,
        "subcategory": [
          "vuln"
        ],
        "likelihood": "LOW",
        "impact": "LOW",
        "confidence": "MEDIUM",
        "license": "Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license",
        "vulnerability_class": [
          "Cross-Site Request Forgery (CSRF)"
        ],
        "source": "https://semgrep.dev/r/python.pyramid.security.csrf-check-disabled-globally.pyramid-csrf-check-disabled-globally",
        "shortlink": "https://sg.run/Bx2R",
        "semgrep.dev": {
          "rule": {
            "r_id": 21451,
            "rv_id": 1263571,
            "rule_id": "8GUKqP",
            "version_id": "2KTv2en",
            "url": "https://semgrep.dev/playground/r/2KTv2en/python.pyramid.security.csrf-check-disabled-globally.pyramid-csrf-check-disabled-globally",
            "origin": "community"
          }
        }
      }
    },
    {
      "id": "python.pyramid.security.direct-use-of-response.pyramid-direct-use-of-response",
      "message": "Detected data rendered directly to the end user via 'Response'. This bypasses Pyramid's built-in cross-site scripting (XSS) defenses and could result in an XSS vulnerability. Use Pyramid's template engines to safely render HTML.",
      "metadata": {
        "cwe": [
          "CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')"
        ],
        "owasp": [
          "A07:2017 - Cross-Site Scripting (XSS)",
          "A03:2021 - Injection",
          "A05:2025 - Injection"
        ],
        "category": "security",
        "technology": [
          "pyramid"
        ],
        "references": [
          "https://owasp.org/Top10/A03_2021-Injection"
        ],
        "cwe2022-top25": true,
        "cwe2021-top25": true,
        "subcategory": [
          "vuln"
        ],
        "likelihood": "LOW",
        "impact": "MEDIUM",
        "confidence": "MEDIUM",
        "license": "Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license",
        "vulnerability_class": [
          "Cross-Site-Scripting (XSS)"
        ],
        "source": "https://semgrep.dev/r/python.pyramid.security.direct-use-of-response.pyramid-direct-use-of-response",
        "shortlink": "https://sg.run/DX8G",
        "semgrep.dev": {
          "rule": {
            "r_id": 21452,
            "rv_id": 1263572,
            "rule_id": "gxUeA8",
            "version_id": "X0TzyEe",
            "url": "https://semgrep.dev/playground/r/X0TzyEe/python.pyramid.security.direct-use-of-response.pyramid-direct-use-of-response",
            "origin": "community"
          }
        }
      },
      "languages": [
        "python"
      ],
      "severity": "ERROR",
      "mode": "taint",
      "pattern-sources": [
        {
          "patterns": [
            {
              "pattern-inside": "@pyramid.view.view_config( ... )\ndef $VIEW($REQ):\n  ...\n"
            },
            {
              "pattern": "$REQ.$ANYTHING"
            },
            {
              "pattern-not": "$REQ.dbsession"
            }
          ]
        }
      ],
      "pattern-sinks": [
        {
          "patterns": [
            {
              "pattern-either": [
                {
                  "pattern": "pyramid.request.Response.text($SINK)\n"
                },
                {
                  "pattern": "pyramid.request.Response($SINK)\n"
                },
                {
                  "pattern": "$REQ.response.body = $SINK\n"
                },
                {
                  "pattern": "$REQ.response.text = $SINK\n"
                },
                {
                  "pattern": "$REQ.response.ubody = $SINK\n"
                },
                {
                  "pattern": "$REQ.response.unicode_body = $SINK\n"
                }
              ]
            },
            {
              "pattern": "$SINK"
            }
          ]
        }
      ]
    },
    {
      "id": "python.pyramid.security.sqlalchemy-sql-injection.pyramid-sqlalchemy-sql-injection",
      "message": "Distinct, Having, Group_by, Order_by, and Filter in SQLAlchemy can cause sql injections if the developer inputs raw SQL into the before-mentioned clauses. This pattern captures relevant cases in which the developer inputs raw SQL into the distinct, having, group_by, order_by or filter clauses and injects user-input into the raw SQL with any function besides \"bindparams\". Use bindParams to securely bind user-input to SQL statements.",
      "languages": [
        "python"
      ],
      "severity": "ERROR",
      "metadata": {
        "category": "security",
        "cwe": [
          "CWE-89: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')"
        ],
        "owasp": [
          "A01:2017 - Injection",
          "A03:2021 - Injection",
          "A05:2025 - Injection"
        ],
        "references": [
          "https://docs.sqlalchemy.org/en/14/tutorial/data_select.html#tutorial-selecting-data"
        ],
        "technology": [
          "pyramid"
        ],
        "cwe2022-top25": true,
        "cwe2021-top25": true,
        "subcategory": [
          "vuln"
        ],
        "likelihood": "MEDIUM",
        "impact": "HIGH",
        "confidence": "MEDIUM",
        "license": "Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license",
        "vulnerability_class": [
          "SQL Injection"
        ],
        "source": "https://semgrep.dev/r/python.pyramid.security.sqlalchemy-sql-injection.pyramid-sqlalchemy-sql-injection",
        "shortlink": "https://sg.run/W7eE",
        "semgrep.dev": {
          "rule": {
            "r_id": 21453,
            "rv_id": 1263573,
            "rule_id": "QrUZ7l",
            "version_id": "jQTn5WA",
            "url": "https://semgrep.dev/playground/r/jQTn5WA/python.pyramid.security.sqlalchemy-sql-injection.pyramid-sqlalchemy-sql-injection",
            "origin": "community"
          }
        }
      },
      "mode": "taint",
      "pattern-sources": [
        {
          "patterns": [
            {
              "pattern-inside": "from pyramid.view import view_config\n...\n@view_config( ... )\ndef $VIEW($REQ):\n  ...\n"
            },
            {
              "pattern": "$REQ.$ANYTHING"
            },
            {
              "pattern-not": "$REQ.dbsession"
            }
          ]
        }
      ],
      "pattern-sinks": [
        {
          "patterns": [
            {
              "pattern-inside": "$QUERY = $REQ.dbsession.query(...)\n...\n"
            },
            {
              "pattern-either": [
                {
                  "pattern": "$QUERY.$SQLFUNC(\"...\".$FORMATFUNC(..., $SINK, ...))\n"
                },
                {
                  "pattern": "$QUERY.join(...).$SQLFUNC(\"...\".$FORMATFUNC(..., $SINK, ...))\n"
                }
              ]
            },
            {
              "pattern": "$SINK"
            },
            {
              "metavariable-regex": {
                "metavariable": "$SQLFUNC",
                "regex": "(group_by|order_by|distinct|having|filter)"
              }
            },
            {
              "metavariable-regex": {
                "metavariable": "$FORMATFUNC",
                "regex": "(?!bindparams)"
              }
            }
          ]
        }
      ],
      "fix-regex": {
        "regex": "format",
        "replacement": "bindparams"
      }
    },
    {
      "id": "python.aws-lambda.security.tainted-pickle-deserialization.tainted-pickle-deserialization",
      "mode": "taint",
      "pattern-sources": [
        {
          "patterns": [
            {
              "pattern": "event"
            },
            {
              "pattern-inside": "def $HANDLER(event, context):\n  ...\n"
            }
          ]
        }
      ],
      "pattern-sinks": [
        {
          "patterns": [
            {
              "focus-metavariable": "$SINK"
            },
            {
              "pattern-either": [
                {
                  "pattern": "pickle.load($SINK,...)"
                },
                {
                  "pattern": "pickle.loads($SINK,...)"
                },
                {
                  "pattern": "_pickle.load($SINK,...)"
                },
                {
                  "pattern": "_pickle.loads($SINK,...)"
                },
                {
                  "pattern": "cPickle.load($SINK,...)"
                },
                {
                  "pattern": "cPickle.loads($SINK,...)"
                },
                {
                  "pattern": "dill.load($SINK,...)"
                },
                {
                  "pattern": "dill.loads($SINK,...)"
                },
                {
                  "pattern": "shelve.open($SINK,...)"
                }
              ]
            }
          ]
        }
      ],
      "message": "Avoid using `pickle`, which is known to lead to code execution vulnerabilities. When unpickling, the serialized data could be manipulated to run arbitrary code. Instead, consider serializing the relevant data as JSON or a similar text-based serialization format.",
      "metadata": {
        "owasp": [
          "A08:2017 - Insecure Deserialization",
          "A08:2021 - Software and Data Integrity Failures",
          "A08:2025 - Software or Data Integrity Failures"
        ],
        "cwe": [
          "CWE-502: Deserialization of Untrusted Data"
        ],
        "references": [
          "https://docs.python.org/3/library/pickle.html",
          "https://davidhamann.de/2020/04/05/exploiting-python-pickle/"
        ],
        "category": "security",
        "technology": [
          "python",
          "aws-lambda"
        ],
        "cwe2022-top25": true,
        "cwe2021-top25": true,
        "subcategory": [
          "vuln"
        ],
        "likelihood": "MEDIUM",
        "impact": "MEDIUM",
        "confidence": "MEDIUM",
        "license": "Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license",
        "vulnerability_class": [
          "Insecure Deserialization "
        ],
        "source": "https://semgrep.dev/r/python.aws-lambda.security.tainted-pickle-deserialization.tainted-pickle-deserialization",
        "shortlink": "https://sg.run/JbjW",
        "semgrep.dev": {
          "rule": {
            "r_id": 21602,
            "rv_id": 1263345,
            "rule_id": "JDUDQg",
            "version_id": "LjTkgd9",
            "url": "https://semgrep.dev/playground/r/LjTkgd9/python.aws-lambda.security.tainted-pickle-deserialization.tainted-pickle-deserialization",
            "origin": "community"
          }
        }
      },
      "languages": [
        "python"
      ],
      "severity": "WARNING"
    },
    {
      "id": "python.lang.security.audit.dangerous-asyncio-exec-tainted-env-args.dangerous-asyncio-exec-tainted-env-args",
      "mode": "taint",
      "options": {
        "symbolic_propagation": true
      },
      "pattern-sources": [
        {
          "patterns": [
            {
              "pattern-either": [
                {
                  "patterns": [
                    {
                      "pattern-either": [
                        {
                          "pattern": "os.environ"
                        },
                        {
                          "pattern": "os.environ.get('$FOO', ...)"
                        },
                        {
                          "pattern": "os.environb"
                        },
                        {
                          "pattern": "os.environb.get('$FOO', ...)"
                        },
                        {
                          "pattern": "os.getenv('$ANYTHING', ...)"
                        },
                        {
                          "pattern": "os.getenvb('$ANYTHING', ...)"
                        }
                      ]
                    }
                  ]
                },
                {
                  "patterns": [
                    {
                      "pattern-either": [
                        {
                          "patterns": [
                            {
                              "pattern-either": [
                                {
                                  "pattern": "sys.argv"
                                },
                                {
                                  "pattern": "sys.orig_argv"
                                }
                              ]
                            }
                          ]
                        },
                        {
                          "patterns": [
                            {
                              "pattern-inside": "$PARSER = argparse.ArgumentParser(...)\n...\n"
                            },
                            {
                              "pattern-inside": "$ARGS = $PARSER.parse_args()\n"
                            },
                            {
                              "pattern": "<... $ARGS ...>"
                            }
                          ]
                        },
                        {
                          "patterns": [
                            {
                              "pattern-inside": "$PARSER = optparse.OptionParser(...)\n...\n"
                            },
                            {
                              "pattern-inside": "$ARGS = $PARSER.parse_args()\n"
                            },
                            {
                              "pattern": "<... $ARGS ...>"
                            }
                          ]
                        },
                        {
                          "patterns": [
                            {
                              "pattern-either": [
                                {
                                  "pattern-inside": "$OPTS, $ARGS = getopt.getopt(...)\n...\n"
                                },
                                {
                                  "pattern-inside": "$OPTS, $ARGS = getopt.gnu_getopt(...)\n...\n"
                                }
                              ]
                            },
                            {
                              "pattern-either": [
                                {
                                  "patterns": [
                                    {
                                      "pattern-inside": "for $O, $A in $OPTS:\n  ...\n"
                                    },
                                    {
                                      "pattern": "$A"
                                    }
                                  ]
                                },
                                {
                                  "pattern": "$ARGS"
                                }
                              ]
                            }
                          ]
                        }
                      ]
                    }
                  ]
                }
              ]
            }
          ]
        }
      ],
      "pattern-sinks": [
        {
          "pattern-either": [
            {
              "patterns": [
                {
                  "pattern-not": "$LOOP.subprocess_exec($PROTOCOL, \"...\", ...)"
                },
                {
                  "pattern-not": "$LOOP.subprocess_exec($PROTOCOL, [\"...\",...], ...)"
                },
                {
                  "pattern": "$LOOP.subprocess_exec(...)"
                }
              ]
            },
            {
              "patterns": [
                {
                  "pattern-not": "$LOOP.subprocess_exec($PROTOCOL, \"=~/(sh|bash|ksh|csh|tcsh|zsh)/\", \"-c\", \"...\", ...)"
                },
                {
                  "pattern": "$LOOP.subprocess_exec($PROTOCOL, \"=~/(sh|bash|ksh|csh|tcsh|zsh)/\", \"-c\",...)"
                }
              ]
            },
            {
              "patterns": [
                {
                  "pattern-not": "$LOOP.subprocess_exec($PROTOCOL, [\"=~/(sh|bash|ksh|csh|tcsh|zsh)/\", \"-c\", \"...\", ...], ...)"
                },
                {
                  "pattern": "$LOOP.subprocess_exec($PROTOCOL, [\"=~/(sh|bash|ksh|csh|tcsh|zsh)/\", \"-c\", ...], ...)"
                }
              ]
            }
          ]
        }
      ],
      "message": "Detected subprocess function '$LOOP.subprocess_exec' with user controlled data. You may consider using 'shlex.escape()'.",
      "metadata": {
        "owasp": [
          "A01:2017 - Injection",
          "A03:2021 - Injection",
          "A05:2025 - Injection"
        ],
        "cwe": [
          "CWE-78: Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')"
        ],
        "asvs": {
          "section": "V5: Validation, Sanitization and Encoding Verification Requirements",
          "control_id": "5.3.8 OS Command Injection",
          "control_url": "https://github.com/OWASP/ASVS/blob/master/4.0/en/0x13-V5-Validation-Sanitization-Encoding.md#v53-output-encoding-and-injection-prevention-requirements",
          "version": "4"
        },
        "references": [
          "https://docs.python.org/3/library/asyncio-eventloop.html#asyncio.loop.subprocess_exec",
          "https://docs.python.org/3/library/shlex.html",
          "https://semgrep.dev/docs/cheat-sheets/python-command-injection/"
        ],
        "category": "security",
        "technology": [
          "python"
        ],
        "confidence": "MEDIUM",
        "cwe2022-top25": true,
        "cwe2021-top25": true,
        "subcategory": [
          "vuln"
        ],
        "likelihood": "MEDIUM",
        "impact": "HIGH",
        "license": "Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license",
        "vulnerability_class": [
          "Command Injection"
        ],
        "source": "https://semgrep.dev/r/python.lang.security.audit.dangerous-asyncio-exec-tainted-env-args.dangerous-asyncio-exec-tainted-env-args",
        "shortlink": "https://sg.run/Apjp",
        "semgrep.dev": {
          "rule": {
            "r_id": 27250,
            "rv_id": 1263460,
            "rule_id": "7KUE1E",
            "version_id": "WrTqKXz",
            "url": "https://semgrep.dev/playground/r/WrTqKXz/python.lang.security.audit.dangerous-asyncio-exec-tainted-env-args.dangerous-asyncio-exec-tainted-env-args",
            "origin": "community"
          }
        }
      },
      "languages": [
        "python"
      ],
      "severity": "ERROR"
    },
    {
      "id": "python.lang.security.audit.dangerous-asyncio-shell-tainted-env-args.dangerous-asyncio-shell-tainted-env-args",
      "mode": "taint",
      "options": {
        "symbolic_propagation": true
      },
      "pattern-sources": [
        {
          "patterns": [
            {
              "pattern-either": [
                {
                  "patterns": [
                    {
                      "pattern-either": [
                        {
                          "pattern": "os.environ"
                        },
                        {
                          "pattern": "os.environ.get('$FOO', ...)"
                        },
                        {
                          "pattern": "os.environb"
                        },
                        {
                          "pattern": "os.environb.get('$FOO', ...)"
                        },
                        {
                          "pattern": "os.getenv('$ANYTHING', ...)"
                        },
                        {
                          "pattern": "os.getenvb('$ANYTHING', ...)"
                        }
                      ]
                    }
                  ]
                },
                {
                  "patterns": [
                    {
                      "pattern-either": [
                        {
                          "patterns": [
                            {
                              "pattern-either": [
                                {
                                  "pattern": "sys.argv"
                                },
                                {
                                  "pattern": "sys.orig_argv"
                                }
                              ]
                            }
                          ]
                        },
                        {
                          "patterns": [
                            {
                              "pattern-inside": "$PARSER = argparse.ArgumentParser(...)\n...\n"
                            },
                            {
                              "pattern-inside": "$ARGS = $PARSER.parse_args()\n"
                            },
                            {
                              "pattern": "<... $ARGS ...>"
                            }
                          ]
                        },
                        {
                          "patterns": [
                            {
                              "pattern-inside": "$PARSER = optparse.OptionParser(...)\n...\n"
                            },
                            {
                              "pattern-inside": "$ARGS = $PARSER.parse_args()\n"
                            },
                            {
                              "pattern": "<... $ARGS ...>"
                            }
                          ]
                        },
                        {
                          "patterns": [
                            {
                              "pattern-either": [
                                {
                                  "pattern-inside": "$OPTS, $ARGS = getopt.getopt(...)\n...\n"
                                },
                                {
                                  "pattern-inside": "$OPTS, $ARGS = getopt.gnu_getopt(...)\n...\n"
                                }
                              ]
                            },
                            {
                              "pattern-either": [
                                {
                                  "patterns": [
                                    {
                                      "pattern-inside": "for $O, $A in $OPTS:\n  ...\n"
                                    },
                                    {
                                      "pattern": "$A"
                                    }
                                  ]
                                },
                                {
                                  "pattern": "$ARGS"
                                }
                              ]
                            }
                          ]
                        }
                      ]
                    }
                  ]
                }
              ]
            }
          ]
        }
      ],
      "pattern-sinks": [
        {
          "patterns": [
            {
              "pattern-either": [
                {
                  "pattern-inside": "$LOOP.subprocess_shell($PROTOCOL, $CMD)"
                },
                {
                  "pattern-inside": "asyncio.subprocess.create_subprocess_shell($CMD, ...)"
                },
                {
                  "pattern-inside": "asyncio.create_subprocess_shell($CMD, ...)"
                }
              ]
            },
            {
              "focus-metavariable": "$CMD"
            },
            {
              "pattern-not-inside": "$CMD = \"...\"\n...\n"
            },
            {
              "pattern-not": "$LOOP.subprocess_shell($PROTOCOL, \"...\")"
            },
            {
              "pattern-not": "asyncio.subprocess.create_subprocess_shell(\"...\", ...)"
            },
            {
              "pattern-not": "asyncio.create_subprocess_shell(\"...\", ...)"
            }
          ]
        }
      ],
      "message": "Detected asyncio subprocess function with user controlled data. You may consider using 'shlex.escape()'.",
      "metadata": {
        "owasp": [
          "A01:2017 - Injection",
          "A03:2021 - Injection",
          "A05:2025 - Injection"
        ],
        "cwe": [
          "CWE-78: Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')"
        ],
        "asvs": {
          "section": "V5: Validation, Sanitization and Encoding Verification Requirements",
          "control_id": "5.3.8 OS Command Injection",
          "control_url": "https://github.com/OWASP/ASVS/blob/master/4.0/en/0x13-V5-Validation-Sanitization-Encoding.md#v53-output-encoding-and-injection-prevention-requirements",
          "version": "4"
        },
        "references": [
          "https://docs.python.org/3/library/asyncio-subprocess.html",
          "https://docs.python.org/3/library/shlex.html",
          "https://semgrep.dev/docs/cheat-sheets/python-command-injection/"
        ],
        "category": "security",
        "technology": [
          "python"
        ],
        "confidence": "MEDIUM",
        "cwe2022-top25": true,
        "cwe2021-top25": true,
        "subcategory": [
          "vuln"
        ],
        "likelihood": "MEDIUM",
        "impact": "HIGH",
        "license": "Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license",
        "vulnerability_class": [
          "Command Injection"
        ],
        "source": "https://semgrep.dev/r/python.lang.security.audit.dangerous-asyncio-shell-tainted-env-args.dangerous-asyncio-shell-tainted-env-args",
        "shortlink": "https://sg.run/Dx8Y",
        "semgrep.dev": {
          "rule": {
            "r_id": 27252,
            "rv_id": 1263462,
            "rule_id": "8GU5q3",
            "version_id": "K3TKkDn",
            "url": "https://semgrep.dev/playground/r/K3TKkDn/python.lang.security.audit.dangerous-asyncio-shell-tainted-env-args.dangerous-asyncio-shell-tainted-env-args",
            "origin": "community"
          }
        }
      },
      "languages": [
        "python"
      ],
      "severity": "ERROR"
    },
    {
      "id": "python.lang.security.audit.dangerous-code-run-tainted-env-args.dangerous-interactive-code-run-tainted-env-args",
      "mode": "taint",
      "options": {
        "symbolic_propagation": true
      },
      "pattern-sources": [
        {
          "patterns": [
            {
              "pattern-either": [
                {
                  "patterns": [
                    {
                      "pattern-either": [
                        {
                          "pattern": "os.environ"
                        },
                        {
                          "pattern": "os.environ.get('$FOO', ...)"
                        },
                        {
                          "pattern": "os.environb"
                        },
                        {
                          "pattern": "os.environb.get('$FOO', ...)"
                        },
                        {
                          "pattern": "os.getenv('$ANYTHING', ...)"
                        },
                        {
                          "pattern": "os.getenvb('$ANYTHING', ...)"
                        }
                      ]
                    }
                  ]
                },
                {
                  "patterns": [
                    {
                      "pattern-either": [
                        {
                          "patterns": [
                            {
                              "pattern-either": [
                                {
                                  "pattern": "sys.argv"
                                },
                                {
                                  "pattern": "sys.orig_argv"
                                }
                              ]
                            }
                          ]
                        },
                        {
                          "patterns": [
                            {
                              "pattern-inside": "$PARSER = argparse.ArgumentParser(...)\n...\n"
                            },
                            {
                              "pattern-inside": "$ARGS = $PARSER.parse_args()\n"
                            },
                            {
                              "pattern": "<... $ARGS ...>"
                            }
                          ]
                        },
                        {
                          "patterns": [
                            {
                              "pattern-inside": "$PARSER = optparse.OptionParser(...)\n...\n"
                            },
                            {
                              "pattern-inside": "$ARGS = $PARSER.parse_args()\n"
                            },
                            {
                              "pattern": "<... $ARGS ...>"
                            }
                          ]
                        },
                        {
                          "patterns": [
                            {
                              "pattern-either": [
                                {
                                  "pattern-inside": "$OPTS, $ARGS = getopt.getopt(...)\n...\n"
                                },
                                {
                                  "pattern-inside": "$OPTS, $ARGS = getopt.gnu_getopt(...)\n...\n"
                                }
                              ]
                            },
                            {
                              "pattern-either": [
                                {
                                  "patterns": [
                                    {
                                      "pattern-inside": "for $O, $A in $OPTS:\n  ...\n"
                                    },
                                    {
                                      "pattern": "$A"
                                    }
                                  ]
                                },
                                {
                                  "pattern": "$ARGS"
                                }
                              ]
                            }
                          ]
                        }
                      ]
                    }
                  ]
                }
              ]
            }
          ]
        }
      ],
      "pattern-sinks": [
        {
          "patterns": [
            {
              "pattern-either": [
                {
                  "pattern-inside": "$X = code.InteractiveConsole(...)\n...\n"
                },
                {
                  "pattern-inside": "$X = code.InteractiveInterpreter(...)\n...\n"
                }
              ]
            },
            {
              "pattern-either": [
                {
                  "pattern-inside": "$X.push($PAYLOAD,...)\n"
                },
                {
                  "pattern-inside": "$X.runsource($PAYLOAD,...)\n"
                },
                {
                  "pattern-inside": "$X.runcode(code.compile_command($PAYLOAD),...)\n"
                },
                {
                  "pattern-inside": "$PL = code.compile_command($PAYLOAD,...)\n...\n$X.runcode($PL,...)\n"
                }
              ]
            },
            {
              "pattern": "$PAYLOAD"
            },
            {
              "pattern-not": "$X.push(\"...\",...)\n"
            },
            {
              "pattern-not": "$X.runsource(\"...\",...)\n"
            },
            {
              "pattern-not": "$X.runcode(code.compile_command(\"...\"),...)\n"
            },
            {
              "pattern-not": "$PL = code.compile_command(\"...\",...)\n...\n$X.runcode($PL,...)\n"
            }
          ]
        }
      ],
      "message": "Found user controlled data inside InteractiveConsole/InteractiveInterpreter method. This is dangerous if external data can reach this function call because it allows a malicious actor to run arbitrary Python code.",
      "metadata": {
        "cwe": [
          "CWE-95: Improper Neutralization of Directives in Dynamically Evaluated Code ('Eval Injection')"
        ],
        "owasp": [
          "A03:2021 - Injection",
          "A05:2025 - Injection"
        ],
        "references": [
          "https://semgrep.dev/docs/cheat-sheets/python-command-injection/"
        ],
        "category": "security",
        "technology": [
          "python"
        ],
        "confidence": "MEDIUM",
        "subcategory": [
          "vuln"
        ],
        "likelihood": "MEDIUM",
        "impact": "HIGH",
        "license": "Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license",
        "vulnerability_class": [
          "Code Injection"
        ],
        "source": "https://semgrep.dev/r/python.lang.security.audit.dangerous-code-run-tainted-env-args.dangerous-interactive-code-run-tainted-env-args",
        "shortlink": "https://sg.run/0Bgv",
        "semgrep.dev": {
          "rule": {
            "r_id": 27254,
            "rv_id": 1263464,
            "rule_id": "QrUG72",
            "version_id": "l4TJRK9",
            "url": "https://semgrep.dev/playground/r/l4TJRK9/python.lang.security.audit.dangerous-code-run-tainted-env-args.dangerous-interactive-code-run-tainted-env-args",
            "origin": "community"
          }
        }
      },
      "severity": "WARNING",
      "languages": [
        "python"
      ]
    },
    {
      "id": "python.lang.security.audit.dangerous-os-exec-tainted-env-args.dangerous-os-exec-tainted-env-args",
      "mode": "taint",
      "options": {
        "symbolic_propagation": true
      },
      "pattern-sources": [
        {
          "patterns": [
            {
              "pattern-either": [
                {
                  "patterns": [
                    {
                      "pattern-either": [
                        {
                          "pattern": "os.environ"
                        },
                        {
                          "pattern": "os.environ.get('$FOO', ...)"
                        },
                        {
                          "pattern": "os.environb"
                        },
                        {
                          "pattern": "os.environb.get('$FOO', ...)"
                        },
                        {
                          "pattern": "os.getenv('$ANYTHING', ...)"
                        },
                        {
                          "pattern": "os.getenvb('$ANYTHING', ...)"
                        }
                      ]
                    }
                  ]
                },
                {
                  "patterns": [
                    {
                      "pattern-either": [
                        {
                          "patterns": [
                            {
                              "pattern-either": [
                                {
                                  "pattern": "sys.argv"
                                },
                                {
                                  "pattern": "sys.orig_argv"
                                }
                              ]
                            }
                          ]
                        },
                        {
                          "patterns": [
                            {
                              "pattern-inside": "$PARSER = argparse.ArgumentParser(...)\n...\n"
                            },
                            {
                              "pattern-inside": "$ARGS = $PARSER.parse_args()\n"
                            },
                            {
                              "pattern": "<... $ARGS ...>"
                            }
                          ]
                        },
                        {
                          "patterns": [
                            {
                              "pattern-inside": "$PARSER = optparse.OptionParser(...)\n...\n"
                            },
                            {
                              "pattern-inside": "$ARGS = $PARSER.parse_args()\n"
                            },
                            {
                              "pattern": "<... $ARGS ...>"
                            }
                          ]
                        },
                        {
                          "patterns": [
                            {
                              "pattern-either": [
                                {
                                  "pattern-inside": "$OPTS, $ARGS = getopt.getopt(...)\n...\n"
                                },
                                {
                                  "pattern-inside": "$OPTS, $ARGS = getopt.gnu_getopt(...)\n...\n"
                                }
                              ]
                            },
                            {
                              "pattern-either": [
                                {
                                  "patterns": [
                                    {
                                      "pattern-inside": "for $O, $A in $OPTS:\n  ...\n"
                                    },
                                    {
                                      "pattern": "$A"
                                    }
                                  ]
                                },
                                {
                                  "pattern": "$ARGS"
                                }
                              ]
                            }
                          ]
                        }
                      ]
                    }
                  ]
                }
              ]
            }
          ]
        }
      ],
      "pattern-sinks": [
        {
          "patterns": [
            {
              "pattern-either": [
                {
                  "patterns": [
                    {
                      "pattern-not": "os.$METHOD(\"...\", ...)"
                    },
                    {
                      "pattern": "os.$METHOD(...)"
                    },
                    {
                      "metavariable-regex": {
                        "metavariable": "$METHOD",
                        "regex": "(execl|execle|execlp|execlpe|execv|execve|execvp|execvpe)"
                      }
                    }
                  ]
                },
                {
                  "patterns": [
                    {
                      "pattern-not": "os.$METHOD(\"...\", [$PATH,\"...\",\"...\",...],...)"
                    },
                    {
                      "pattern-inside": "os.$METHOD($BASH,[$PATH,\"-c\",$CMD,...],...)"
                    },
                    {
                      "pattern": "$CMD"
                    },
                    {
                      "metavariable-regex": {
                        "metavariable": "$METHOD",
                        "regex": "(execv|execve|execvp|execvpe)"
                      }
                    },
                    {
                      "metavariable-regex": {
                        "metavariable": "$BASH",
                        "regex": "(.*)(sh|bash|ksh|csh|tcsh|zsh)"
                      }
                    }
                  ]
                },
                {
                  "patterns": [
                    {
                      "pattern-not": "os.$METHOD(\"...\", $PATH, \"...\", \"...\",...)"
                    },
                    {
                      "pattern-inside": "os.$METHOD($BASH, $PATH, \"-c\", $CMD,...)"
                    },
                    {
                      "pattern": "$CMD"
                    },
                    {
                      "metavariable-regex": {
                        "metavariable": "$METHOD",
                        "regex": "(execl|execle|execlp|execlpe)"
                      }
                    },
                    {
                      "metavariable-regex": {
                        "metavariable": "$BASH",
                        "regex": "(.*)(sh|bash|ksh|csh|tcsh|zsh)"
                      }
                    }
                  ]
                }
              ]
            }
          ]
        }
      ],
      "message": "Found user controlled content when spawning a process. This is dangerous because it allows a malicious actor to execute commands.",
      "metadata": {
        "cwe": [
          "CWE-78: Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')"
        ],
        "owasp": [
          "A01:2017 - Injection",
          "A03:2021 - Injection",
          "A05:2025 - Injection"
        ],
        "references": [
          "https://semgrep.dev/docs/cheat-sheets/python-command-injection/"
        ],
        "asvs": {
          "section": "V5: Validation, Sanitization and Encoding Verification Requirements",
          "control_id": "5.3.8 OS Command Injection",
          "control_url": "https://github.com/OWASP/ASVS/blob/master/4.0/en/0x13-V5-Validation-Sanitization-Encoding.md#v53-output-encoding-and-injection-prevention-requirements",
          "version": "4"
        },
        "confidence": "MEDIUM",
        "category": "security",
        "technology": [
          "python"
        ],
        "cwe2022-top25": true,
        "cwe2021-top25": true,
        "subcategory": [
          "vuln"
        ],
        "likelihood": "MEDIUM",
        "impact": "HIGH",
        "license": "Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license",
        "vulnerability_class": [
          "Command Injection"
        ],
        "source": "https://semgrep.dev/r/python.lang.security.audit.dangerous-os-exec-tainted-env-args.dangerous-os-exec-tainted-env-args",
        "shortlink": "https://sg.run/qL6z",
        "semgrep.dev": {
          "rule": {
            "r_id": 27256,
            "rv_id": 1263466,
            "rule_id": "4bUEAY",
            "version_id": "6xT29l6",
            "url": "https://semgrep.dev/playground/r/6xT29l6/python.lang.security.audit.dangerous-os-exec-tainted-env-args.dangerous-os-exec-tainted-env-args",
            "origin": "community"
          }
        }
      },
      "languages": [
        "python"
      ],
      "severity": "ERROR"
    },
    {
      "id": "python.lang.security.audit.dangerous-spawn-process-tainted-env-args.dangerous-spawn-process-tainted-env-args",
      "mode": "taint",
      "options": {
        "symbolic_propagation": true
      },
      "pattern-sources": [
        {
          "patterns": [
            {
              "pattern-either": [
                {
                  "patterns": [
                    {
                      "pattern-either": [
                        {
                          "pattern": "os.environ"
                        },
                        {
                          "pattern": "os.environ.get('$FOO', ...)"
                        },
                        {
                          "pattern": "os.environb"
                        },
                        {
                          "pattern": "os.environb.get('$FOO', ...)"
                        },
                        {
                          "pattern": "os.getenv('$ANYTHING', ...)"
                        },
                        {
                          "pattern": "os.getenvb('$ANYTHING', ...)"
                        }
                      ]
                    }
                  ]
                },
                {
                  "patterns": [
                    {
                      "pattern-either": [
                        {
                          "patterns": [
                            {
                              "pattern-either": [
                                {
                                  "pattern": "sys.argv"
                                },
                                {
                                  "pattern": "sys.orig_argv"
                                }
                              ]
                            }
                          ]
                        },
                        {
                          "patterns": [
                            {
                              "pattern-inside": "$PARSER = argparse.ArgumentParser(...)\n...\n"
                            },
                            {
                              "pattern-inside": "$ARGS = $PARSER.parse_args()\n"
                            },
                            {
                              "pattern": "<... $ARGS ...>"
                            }
                          ]
                        },
                        {
                          "patterns": [
                            {
                              "pattern-inside": "$PARSER = optparse.OptionParser(...)\n...\n"
                            },
                            {
                              "pattern-inside": "$ARGS = $PARSER.parse_args()\n"
                            },
                            {
                              "pattern": "<... $ARGS ...>"
                            }
                          ]
                        },
                        {
                          "patterns": [
                            {
                              "pattern-either": [
                                {
                                  "pattern-inside": "$OPTS, $ARGS = getopt.getopt(...)\n...\n"
                                },
                                {
                                  "pattern-inside": "$OPTS, $ARGS = getopt.gnu_getopt(...)\n...\n"
                                }
                              ]
                            },
                            {
                              "pattern-either": [
                                {
                                  "patterns": [
                                    {
                                      "pattern-inside": "for $O, $A in $OPTS:\n  ...\n"
                                    },
                                    {
                                      "pattern": "$A"
                                    }
                                  ]
                                },
                                {
                                  "pattern": "$ARGS"
                                }
                              ]
                            }
                          ]
                        }
                      ]
                    }
                  ]
                }
              ]
            }
          ]
        }
      ],
      "pattern-sinks": [
        {
          "patterns": [
            {
              "pattern-either": [
                {
                  "patterns": [
                    {
                      "pattern-not": "os.$METHOD($MODE, \"...\", ...)"
                    },
                    {
                      "pattern-inside": "os.$METHOD($MODE, $CMD, ...)"
                    },
                    {
                      "pattern": "$CMD"
                    },
                    {
                      "metavariable-regex": {
                        "metavariable": "$METHOD",
                        "regex": "(spawnl|spawnle|spawnlp|spawnlpe|spawnv|spawnve|spawnvp|spawnvp|spawnvpe|posix_spawn|posix_spawnp|startfile)"
                      }
                    }
                  ]
                },
                {
                  "patterns": [
                    {
                      "pattern-not": "os.$METHOD($MODE, \"...\", [\"...\",\"...\",...], ...)"
                    },
                    {
                      "pattern-inside": "os.$METHOD($MODE, $BASH, [\"-c\",$CMD,...],...)"
                    },
                    {
                      "pattern": "$CMD"
                    },
                    {
                      "metavariable-regex": {
                        "metavariable": "$METHOD",
                        "regex": "(spawnv|spawnve|spawnvp|spawnvp|spawnvpe|posix_spawn|posix_spawnp)"
                      }
                    },
                    {
                      "metavariable-regex": {
                        "metavariable": "$BASH",
                        "regex": "(.*)(sh|bash|ksh|csh|tcsh|zsh)"
                      }
                    }
                  ]
                },
                {
                  "patterns": [
                    {
                      "pattern-not": "os.$METHOD($MODE, \"...\", \"...\", \"...\", ...)"
                    },
                    {
                      "pattern-inside": "os.$METHOD($MODE, $BASH, \"-c\", $CMD,...)"
                    },
                    {
                      "pattern": "$CMD"
                    },
                    {
                      "metavariable-regex": {
                        "metavariable": "$METHOD",
                        "regex": "(spawnl|spawnle|spawnlp|spawnlpe)"
                      }
                    },
                    {
                      "metavariable-regex": {
                        "metavariable": "$BASH",
                        "regex": "(.*)(sh|bash|ksh|csh|tcsh|zsh)"
                      }
                    }
                  ]
                }
              ]
            }
          ]
        }
      ],
      "message": "Found user controlled content when spawning a process. This is dangerous because it allows a malicious actor to execute commands.",
      "metadata": {
        "source-rule-url": "https://bandit.readthedocs.io/en/latest/plugins/b605_start_process_with_a_shell.html",
        "cwe": [
          "CWE-78: Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')"
        ],
        "owasp": [
          "A01:2017 - Injection",
          "A03:2021 - Injection",
          "A05:2025 - Injection"
        ],
        "references": [
          "https://semgrep.dev/docs/cheat-sheets/python-command-injection/"
        ],
        "asvs": {
          "section": "V5: Validation, Sanitization and Encoding Verification Requirements",
          "control_id": "5.3.8 OS Command Injection",
          "control_url": "https://github.com/OWASP/ASVS/blob/master/4.0/en/0x13-V5-Validation-Sanitization-Encoding.md#v53-output-encoding-and-injection-prevention-requirements",
          "version": "4"
        },
        "category": "security",
        "technology": [
          "python"
        ],
        "confidence": "MEDIUM",
        "cwe2022-top25": true,
        "cwe2021-top25": true,
        "subcategory": [
          "vuln"
        ],
        "likelihood": "MEDIUM",
        "impact": "HIGH",
        "license": "Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license",
        "vulnerability_class": [
          "Command Injection"
        ],
        "source": "https://semgrep.dev/r/python.lang.security.audit.dangerous-spawn-process-tainted-env-args.dangerous-spawn-process-tainted-env-args",
        "shortlink": "https://sg.run/Y3Ke",
        "semgrep.dev": {
          "rule": {
            "r_id": 27258,
            "rv_id": 1263468,
            "rule_id": "JDUz34",
            "version_id": "zyTb2wn",
            "url": "https://semgrep.dev/playground/r/zyTb2wn/python.lang.security.audit.dangerous-spawn-process-tainted-env-args.dangerous-spawn-process-tainted-env-args",
            "origin": "community"
          }
        }
      },
      "languages": [
        "python"
      ],
      "severity": "ERROR"
    },
    {
      "id": "python.lang.security.audit.dangerous-subinterpreters-run-string-tainted-env-args.dangerous-subinterpreters-run-string-tainted-env-args",
      "mode": "taint",
      "options": {
        "symbolic_propagation": true
      },
      "pattern-sources": [
        {
          "patterns": [
            {
              "pattern-either": [
                {
                  "patterns": [
                    {
                      "pattern-either": [
                        {
                          "pattern": "os.environ"
                        },
                        {
                          "pattern": "os.environ.get('$FOO', ...)"
                        },
                        {
                          "pattern": "os.environb"
                        },
                        {
                          "pattern": "os.environb.get('$FOO', ...)"
                        },
                        {
                          "pattern": "os.getenv('$ANYTHING', ...)"
                        },
                        {
                          "pattern": "os.getenvb('$ANYTHING', ...)"
                        }
                      ]
                    }
                  ]
                },
                {
                  "patterns": [
                    {
                      "pattern-either": [
                        {
                          "patterns": [
                            {
                              "pattern-either": [
                                {
                                  "pattern": "sys.argv"
                                },
                                {
                                  "pattern": "sys.orig_argv"
                                }
                              ]
                            }
                          ]
                        },
                        {
                          "patterns": [
                            {
                              "pattern-inside": "$PARSER = argparse.ArgumentParser(...)\n...\n"
                            },
                            {
                              "pattern-inside": "$ARGS = $PARSER.parse_args()\n"
                            },
                            {
                              "pattern": "<... $ARGS ...>"
                            }
                          ]
                        },
                        {
                          "patterns": [
                            {
                              "pattern-inside": "$PARSER = optparse.OptionParser(...)\n...\n"
                            },
                            {
                              "pattern-inside": "$ARGS = $PARSER.parse_args()\n"
                            },
                            {
                              "pattern": "<... $ARGS ...>"
                            }
                          ]
                        },
                        {
                          "patterns": [
                            {
                              "pattern-either": [
                                {
                                  "pattern-inside": "$OPTS, $ARGS = getopt.getopt(...)\n...\n"
                                },
                                {
                                  "pattern-inside": "$OPTS, $ARGS = getopt.gnu_getopt(...)\n...\n"
                                }
                              ]
                            },
                            {
                              "pattern-either": [
                                {
                                  "patterns": [
                                    {
                                      "pattern-inside": "for $O, $A in $OPTS:\n  ...\n"
                                    },
                                    {
                                      "pattern": "$A"
                                    }
                                  ]
                                },
                                {
                                  "pattern": "$ARGS"
                                }
                              ]
                            }
                          ]
                        }
                      ]
                    }
                  ]
                }
              ]
            }
          ]
        }
      ],
      "pattern-sinks": [
        {
          "patterns": [
            {
              "pattern-inside": "_xxsubinterpreters.run_string($ID, $PAYLOAD, ...)\n"
            },
            {
              "pattern-not": "_xxsubinterpreters.run_string($ID, \"...\", ...)\n"
            },
            {
              "pattern": "$PAYLOAD"
            }
          ]
        }
      ],
      "message": "Found user controlled content in `run_string`. This is dangerous because it allows a malicious actor to run arbitrary Python code.",
      "metadata": {
        "cwe": [
          "CWE-95: Improper Neutralization of Directives in Dynamically Evaluated Code ('Eval Injection')"
        ],
        "owasp": [
          "A03:2021 - Injection",
          "A05:2025 - Injection"
        ],
        "references": [
          "https://bugs.python.org/issue43472",
          "https://semgrep.dev/docs/cheat-sheets/python-command-injection/"
        ],
        "category": "security",
        "technology": [
          "python"
        ],
        "confidence": "MEDIUM",
        "subcategory": [
          "vuln"
        ],
        "likelihood": "MEDIUM",
        "impact": "HIGH",
        "license": "Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license",
        "vulnerability_class": [
          "Code Injection"
        ],
        "source": "https://semgrep.dev/r/python.lang.security.audit.dangerous-subinterpreters-run-string-tainted-env-args.dangerous-subinterpreters-run-string-tainted-env-args",
        "shortlink": "https://sg.run/oLl9",
        "semgrep.dev": {
          "rule": {
            "r_id": 27260,
            "rv_id": 1409404,
            "rule_id": "GdUkxO",
            "version_id": "DkTwBzO",
            "url": "https://semgrep.dev/playground/r/DkTwBzO/python.lang.security.audit.dangerous-subinterpreters-run-string-tainted-env-args.dangerous-subinterpreters-run-string-tainted-env-args",
            "origin": "community"
          }
        }
      },
      "severity": "WARNING",
      "languages": [
        "python"
      ]
    },
    {
      "id": "python.lang.security.audit.dangerous-subprocess-use-tainted-env-args.dangerous-subprocess-use-tainted-env-args",
      "mode": "taint",
      "options": {
        "symbolic_propagation": true
      },
      "pattern-sanitizers": [
        {
          "pattern": "shlex.quote(...)"
        }
      ],
      "pattern-sources": [
        {
          "patterns": [
            {
              "pattern-either": [
                {
                  "patterns": [
                    {
                      "pattern-either": [
                        {
                          "pattern": "os.environ"
                        },
                        {
                          "pattern": "os.environ.get('$FOO', ...)"
                        },
                        {
                          "pattern": "os.environb"
                        },
                        {
                          "pattern": "os.environb.get('$FOO', ...)"
                        },
                        {
                          "pattern": "os.getenv('$ANYTHING', ...)"
                        },
                        {
                          "pattern": "os.getenvb('$ANYTHING', ...)"
                        }
                      ]
                    }
                  ]
                },
                {
                  "patterns": [
                    {
                      "pattern-either": [
                        {
                          "patterns": [
                            {
                              "pattern-either": [
                                {
                                  "pattern": "sys.argv"
                                },
                                {
                                  "pattern": "sys.orig_argv"
                                }
                              ]
                            }
                          ]
                        },
                        {
                          "patterns": [
                            {
                              "pattern-inside": "$PARSER = argparse.ArgumentParser(...)\n...\n"
                            },
                            {
                              "pattern-inside": "$ARGS = $PARSER.parse_args()\n"
                            },
                            {
                              "pattern": "<... $ARGS ...>"
                            }
                          ]
                        },
                        {
                          "patterns": [
                            {
                              "pattern-inside": "$PARSER = optparse.OptionParser(...)\n...\n"
                            },
                            {
                              "pattern-inside": "$ARGS = $PARSER.parse_args()\n"
                            },
                            {
                              "pattern": "<... $ARGS ...>"
                            }
                          ]
                        },
                        {
                          "patterns": [
                            {
                              "pattern-either": [
                                {
                                  "pattern-inside": "$OPTS, $ARGS = getopt.getopt(...)\n...\n"
                                },
                                {
                                  "pattern-inside": "$OPTS, $ARGS = getopt.gnu_getopt(...)\n...\n"
                                }
                              ]
                            },
                            {
                              "pattern-either": [
                                {
                                  "patterns": [
                                    {
                                      "pattern-inside": "for $O, $A in $OPTS:\n  ...\n"
                                    },
                                    {
                                      "pattern": "$A"
                                    }
                                  ]
                                },
                                {
                                  "pattern": "$ARGS"
                                }
                              ]
                            }
                          ]
                        }
                      ]
                    }
                  ]
                }
              ]
            }
          ]
        }
      ],
      "pattern-sinks": [
        {
          "patterns": [
            {
              "pattern-either": [
                {
                  "patterns": [
                    {
                      "pattern-not": "subprocess.$FUNC(\"...\", ...)"
                    },
                    {
                      "pattern-not": "subprocess.$FUNC([\"...\",...], ...)"
                    },
                    {
                      "pattern-not": "subprocess.$FUNC((\"...\",...), ...)"
                    },
                    {
                      "pattern-not": "subprocess.CalledProcessError(...)"
                    },
                    {
                      "pattern-not": "subprocess.SubprocessError(...)"
                    },
                    {
                      "pattern": "subprocess.$FUNC($CMD, ...)"
                    }
                  ]
                },
                {
                  "patterns": [
                    {
                      "pattern-not": "subprocess.$FUNC(\"=~/(sh|bash|ksh|csh|tcsh|zsh)/\",\"-c\",\"...\",...)"
                    },
                    {
                      "pattern": "subprocess.$FUNC(\"=~/(sh|bash|ksh|csh|tcsh|zsh)/\",\"-c\", $CMD)"
                    }
                  ]
                },
                {
                  "patterns": [
                    {
                      "pattern-not": "subprocess.$FUNC([\"=~/(sh|bash|ksh|csh|tcsh|zsh)/\",\"-c\",\"...\",...],...)"
                    },
                    {
                      "pattern-not": "subprocess.$FUNC((\"=~/(sh|bash|ksh|csh|tcsh|zsh)/\",\"-c\",\"...\",...),...)"
                    },
                    {
                      "pattern-either": [
                        {
                          "pattern": "subprocess.$FUNC([\"=~/(sh|bash|ksh|csh|tcsh|zsh)/\",\"-c\", $CMD], ...)"
                        },
                        {
                          "pattern": "subprocess.$FUNC((\"=~/(sh|bash|ksh|csh|tcsh|zsh)/\",\"-c\", $CMD), ...)"
                        }
                      ]
                    }
                  ]
                },
                {
                  "patterns": [
                    {
                      "pattern-not": "subprocess.$FUNC(\"=~/(python)/\",\"...\",...)"
                    },
                    {
                      "pattern": "subprocess.$FUNC(\"=~/(python)/\", $CMD)"
                    }
                  ]
                },
                {
                  "patterns": [
                    {
                      "pattern-not": "subprocess.$FUNC([\"=~/(python)/\",\"...\",...],...)"
                    },
                    {
                      "pattern-not": "subprocess.$FUNC((\"=~/(python)/\",\"...\",...),...)"
                    },
                    {
                      "pattern-either": [
                        {
                          "pattern": "subprocess.$FUNC([\"=~/(python)/\", $CMD],...)"
                        },
                        {
                          "pattern": "subprocess.$FUNC((\"=~/(python)/\", $CMD),...)"
                        }
                      ]
                    }
                  ]
                }
              ]
            },
            {
              "focus-metavariable": "$CMD"
            }
          ]
        }
      ],
      "message": "Detected subprocess function '$FUNC' with user controlled data. A malicious actor could leverage this to perform command injection. You may consider using 'shlex.quote()'.",
      "metadata": {
        "owasp": [
          "A01:2017 - Injection",
          "A03:2021 - Injection",
          "A05:2025 - Injection"
        ],
        "cwe": [
          "CWE-78: Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')"
        ],
        "asvs": {
          "section": "V5: Validation, Sanitization and Encoding Verification Requirements",
          "control_id": "5.3.8 OS Command Injection",
          "control_url": "https://github.com/OWASP/ASVS/blob/master/4.0/en/0x13-V5-Validation-Sanitization-Encoding.md#v53-output-encoding-and-injection-prevention-requirements",
          "version": "4"
        },
        "references": [
          "https://stackoverflow.com/questions/3172470/actual-meaning-of-shell-true-in-subprocess",
          "https://docs.python.org/3/library/subprocess.html",
          "https://docs.python.org/3/library/shlex.html",
          "https://semgrep.dev/docs/cheat-sheets/python-command-injection/"
        ],
        "category": "security",
        "technology": [
          "python"
        ],
        "confidence": "MEDIUM",
        "cwe2022-top25": true,
        "cwe2021-top25": true,
        "subcategory": [
          "vuln"
        ],
        "likelihood": "MEDIUM",
        "impact": "MEDIUM",
        "license": "Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license",
        "vulnerability_class": [
          "Command Injection"
        ],
        "source": "https://semgrep.dev/r/python.lang.security.audit.dangerous-subprocess-use-tainted-env-args.dangerous-subprocess-use-tainted-env-args",
        "shortlink": "https://sg.run/pLGg",
        "semgrep.dev": {
          "rule": {
            "r_id": 27262,
            "rv_id": 1263472,
            "rule_id": "AbUgrZ",
            "version_id": "jQTn54Y",
            "url": "https://semgrep.dev/playground/r/jQTn54Y/python.lang.security.audit.dangerous-subprocess-use-tainted-env-args.dangerous-subprocess-use-tainted-env-args",
            "origin": "community"
          }
        }
      },
      "languages": [
        "python"
      ],
      "severity": "ERROR"
    },
    {
      "id": "python.lang.security.audit.dangerous-system-call-tainted-env-args.dangerous-system-call-tainted-env-args",
      "mode": "taint",
      "options": {
        "symbolic_propagation": true
      },
      "pattern-sources": [
        {
          "patterns": [
            {
              "pattern-either": [
                {
                  "patterns": [
                    {
                      "pattern-either": [
                        {
                          "pattern": "os.environ"
                        },
                        {
                          "pattern": "os.environ.get('$FOO', ...)"
                        },
                        {
                          "pattern": "os.environb"
                        },
                        {
                          "pattern": "os.environb.get('$FOO', ...)"
                        },
                        {
                          "pattern": "os.getenv('$ANYTHING', ...)"
                        },
                        {
                          "pattern": "os.getenvb('$ANYTHING', ...)"
                        }
                      ]
                    }
                  ]
                },
                {
                  "patterns": [
                    {
                      "pattern-either": [
                        {
                          "patterns": [
                            {
                              "pattern-either": [
                                {
                                  "pattern": "sys.argv"
                                },
                                {
                                  "pattern": "sys.orig_argv"
                                }
                              ]
                            }
                          ]
                        },
                        {
                          "patterns": [
                            {
                              "pattern-inside": "$PARSER = argparse.ArgumentParser(...)\n...\n"
                            },
                            {
                              "pattern-inside": "$ARGS = $PARSER.parse_args()\n"
                            },
                            {
                              "pattern": "<... $ARGS ...>"
                            }
                          ]
                        },
                        {
                          "patterns": [
                            {
                              "pattern-inside": "$PARSER = optparse.OptionParser(...)\n...\n"
                            },
                            {
                              "pattern-inside": "$ARGS = $PARSER.parse_args()\n"
                            },
                            {
                              "pattern": "<... $ARGS ...>"
                            }
                          ]
                        },
                        {
                          "patterns": [
                            {
                              "pattern-either": [
                                {
                                  "pattern-inside": "$OPTS, $ARGS = getopt.getopt(...)\n...\n"
                                },
                                {
                                  "pattern-inside": "$OPTS, $ARGS = getopt.gnu_getopt(...)\n...\n"
                                }
                              ]
                            },
                            {
                              "pattern-either": [
                                {
                                  "patterns": [
                                    {
                                      "pattern-inside": "for $O, $A in $OPTS:\n  ...\n"
                                    },
                                    {
                                      "pattern": "$A"
                                    }
                                  ]
                                },
                                {
                                  "pattern": "$ARGS"
                                }
                              ]
                            }
                          ]
                        }
                      ]
                    }
                  ]
                }
              ]
            }
          ]
        }
      ],
      "pattern-sinks": [
        {
          "patterns": [
            {
              "pattern-not": "os.$W(\"...\", ...)"
            },
            {
              "pattern-either": [
                {
                  "pattern": "os.system(...)"
                },
                {
                  "pattern": "$X = __import__(\"os\")\n...\n$X.system(...)\n"
                },
                {
                  "pattern": "$X = __import__(\"os\")\n...\ngetattr($X, \"system\")(...)\n"
                },
                {
                  "pattern": "$X = getattr(os, \"system\")\n...\n$X(...)\n"
                },
                {
                  "pattern": "$X = __import__(\"os\")\n...\n$Y = getattr($X, \"system\")\n...\n$Y(...)\n"
                },
                {
                  "pattern": "os.popen(...)"
                },
                {
                  "pattern": "os.popen2(...)"
                },
                {
                  "pattern": "os.popen3(...)"
                },
                {
                  "pattern": "os.popen4(...)"
                }
              ]
            }
          ]
        }
      ],
      "message": "Found user-controlled data used in a system call. This could allow a malicious actor to execute commands. Use the 'subprocess' module instead, which is easier to use without accidentally exposing a command injection vulnerability.",
      "metadata": {
        "source-rule-url": "https://bandit.readthedocs.io/en/latest/plugins/b605_start_process_with_a_shell.html",
        "cwe": [
          "CWE-78: Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')"
        ],
        "owasp": [
          "A01:2017 - Injection",
          "A03:2021 - Injection",
          "A05:2025 - Injection"
        ],
        "references": [
          "https://semgrep.dev/docs/cheat-sheets/python-command-injection/"
        ],
        "asvs": {
          "section": "V5: Validation, Sanitization and Encoding Verification Requirements",
          "control_id": "5.2.4 Dyanmic Code Execution Features",
          "control_url": "https://github.com/OWASP/ASVS/blob/master/4.0/en/0x13-V5-Validation-Sanitization-Encoding.md#v52-sanitization-and-sandboxing-requirements",
          "version": "4"
        },
        "category": "security",
        "technology": [
          "python"
        ],
        "confidence": "MEDIUM",
        "cwe2022-top25": true,
        "cwe2021-top25": true,
        "subcategory": [
          "vuln"
        ],
        "likelihood": "MEDIUM",
        "impact": "HIGH",
        "license": "Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license",
        "vulnerability_class": [
          "Command Injection"
        ],
        "source": "https://semgrep.dev/r/python.lang.security.audit.dangerous-system-call-tainted-env-args.dangerous-system-call-tainted-env-args",
        "shortlink": "https://sg.run/XR2K",
        "semgrep.dev": {
          "rule": {
            "r_id": 27264,
            "rv_id": 1263474,
            "rule_id": "DbUR9g",
            "version_id": "9lT4bG4",
            "url": "https://semgrep.dev/playground/r/9lT4bG4/python.lang.security.audit.dangerous-system-call-tainted-env-args.dangerous-system-call-tainted-env-args",
            "origin": "community"
          }
        }
      },
      "languages": [
        "python"
      ],
      "severity": "ERROR"
    },
    {
      "id": "python.lang.security.audit.dangerous-testcapi-run-in-subinterp-tainted-env-args.dangerous-testcapi-run-in-subinterp-tainted-env-args",
      "mode": "taint",
      "options": {
        "symbolic_propagation": true
      },
      "pattern-sources": [
        {
          "patterns": [
            {
              "pattern-either": [
                {
                  "patterns": [
                    {
                      "pattern-either": [
                        {
                          "pattern": "os.environ"
                        },
                        {
                          "pattern": "os.environ.get('$FOO', ...)"
                        },
                        {
                          "pattern": "os.environb"
                        },
                        {
                          "pattern": "os.environb.get('$FOO', ...)"
                        },
                        {
                          "pattern": "os.getenv('$ANYTHING', ...)"
                        },
                        {
                          "pattern": "os.getenvb('$ANYTHING', ...)"
                        }
                      ]
                    }
                  ]
                },
                {
                  "patterns": [
                    {
                      "pattern-either": [
                        {
                          "patterns": [
                            {
                              "pattern-either": [
                                {
                                  "pattern": "sys.argv"
                                },
                                {
                                  "pattern": "sys.orig_argv"
                                }
                              ]
                            }
                          ]
                        },
                        {
                          "patterns": [
                            {
                              "pattern-inside": "$PARSER = argparse.ArgumentParser(...)\n...\n"
                            },
                            {
                              "pattern-inside": "$ARGS = $PARSER.parse_args()\n"
                            },
                            {
                              "pattern": "<... $ARGS ...>"
                            }
                          ]
                        },
                        {
                          "patterns": [
                            {
                              "pattern-inside": "$PARSER = optparse.OptionParser(...)\n...\n"
                            },
                            {
                              "pattern-inside": "$ARGS = $PARSER.parse_args()\n"
                            },
                            {
                              "pattern": "<... $ARGS ...>"
                            }
                          ]
                        },
                        {
                          "patterns": [
                            {
                              "pattern-either": [
                                {
                                  "pattern-inside": "$OPTS, $ARGS = getopt.getopt(...)\n...\n"
                                },
                                {
                                  "pattern-inside": "$OPTS, $ARGS = getopt.gnu_getopt(...)\n...\n"
                                }
                              ]
                            },
                            {
                              "pattern-either": [
                                {
                                  "patterns": [
                                    {
                                      "pattern-inside": "for $O, $A in $OPTS:\n  ...\n"
                                    },
                                    {
                                      "pattern": "$A"
                                    }
                                  ]
                                },
                                {
                                  "pattern": "$ARGS"
                                }
                              ]
                            }
                          ]
                        }
                      ]
                    }
                  ]
                }
              ]
            }
          ]
        }
      ],
      "pattern-sinks": [
        {
          "patterns": [
            {
              "pattern-either": [
                {
                  "pattern-inside": "_testcapi.run_in_subinterp($PAYLOAD, ...)\n"
                },
                {
                  "pattern-inside": "test.support.run_in_subinterp($PAYLOAD, ...)\n"
                }
              ]
            },
            {
              "pattern": "$PAYLOAD"
            },
            {
              "pattern-not": "_testcapi.run_in_subinterp(\"...\", ...)\n"
            },
            {
              "pattern-not": "test.support.run_in_subinterp(\"...\", ...)\n"
            }
          ]
        }
      ],
      "message": "Found user controlled content in `run_in_subinterp`. This is dangerous because it allows a malicious actor to run arbitrary Python code.",
      "metadata": {
        "cwe": [
          "CWE-95: Improper Neutralization of Directives in Dynamically Evaluated Code ('Eval Injection')"
        ],
        "owasp": [
          "A03:2021 - Injection",
          "A05:2025 - Injection"
        ],
        "references": [
          "https://semgrep.dev/docs/cheat-sheets/python-command-injection/"
        ],
        "category": "security",
        "technology": [
          "python"
        ],
        "confidence": "MEDIUM",
        "subcategory": [
          "vuln"
        ],
        "likelihood": "MEDIUM",
        "impact": "HIGH",
        "license": "Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license",
        "vulnerability_class": [
          "Code Injection"
        ],
        "source": "https://semgrep.dev/r/python.lang.security.audit.dangerous-testcapi-run-in-subinterp-tainted-env-args.dangerous-testcapi-run-in-subinterp-tainted-env-args",
        "shortlink": "https://sg.run/1DLw",
        "semgrep.dev": {
          "rule": {
            "r_id": 27266,
            "rv_id": 1263476,
            "rule_id": "0oUK7N",
            "version_id": "rxTAKpn",
            "url": "https://semgrep.dev/playground/r/rxTAKpn/python.lang.security.audit.dangerous-testcapi-run-in-subinterp-tainted-env-args.dangerous-testcapi-run-in-subinterp-tainted-env-args",
            "origin": "community"
          }
        }
      },
      "severity": "WARNING",
      "languages": [
        "python"
      ]
    },
    {
      "id": "python.lang.security.dangerous-code-run.dangerous-interactive-code-run",
      "mode": "taint",
      "options": {
        "symbolic_propagation": true
      },
      "pattern-sources": [
        {
          "patterns": [
            {
              "pattern-either": [
                {
                  "patterns": [
                    {
                      "pattern-either": [
                        {
                          "pattern": "flask.request.form.get(...)"
                        },
                        {
                          "pattern": "flask.request.form[...]"
                        },
                        {
                          "pattern": "flask.request.args.get(...)"
                        },
                        {
                          "pattern": "flask.request.args[...]"
                        },
                        {
                          "pattern": "flask.request.values.get(...)"
                        },
                        {
                          "pattern": "flask.request.values[...]"
                        },
                        {
                          "pattern": "flask.request.cookies.get(...)"
                        },
                        {
                          "pattern": "flask.request.cookies[...]"
                        },
                        {
                          "pattern": "flask.request.stream"
                        },
                        {
                          "pattern": "flask.request.headers.get(...)"
                        },
                        {
                          "pattern": "flask.request.headers[...]"
                        },
                        {
                          "pattern": "flask.request.data"
                        },
                        {
                          "pattern": "flask.request.full_path"
                        },
                        {
                          "pattern": "flask.request.url"
                        },
                        {
                          "pattern": "flask.request.json"
                        },
                        {
                          "pattern": "flask.request.get_json()"
                        },
                        {
                          "pattern": "flask.request.view_args.get(...)"
                        },
                        {
                          "pattern": "flask.request.view_args[...]"
                        },
                        {
                          "patterns": [
                            {
                              "pattern-inside": "@$APP.route(...)\ndef $FUNC(..., $ROUTEVAR, ...):\n  ...\n"
                            },
                            {
                              "focus-metavariable": "$ROUTEVAR"
                            }
                          ]
                        }
                      ]
                    }
                  ]
                },
                {
                  "patterns": [
                    {
                      "pattern-inside": "def $FUNC(request, ...):\n  ...\n"
                    },
                    {
                      "pattern-either": [
                        {
                          "pattern": "request.$PROPERTY.get(...)"
                        },
                        {
                          "pattern": "request.$PROPERTY[...]"
                        }
                      ]
                    }
                  ]
                },
                {
                  "patterns": [
                    {
                      "pattern-either": [
                        {
                          "pattern-inside": "@rest_framework.decorators.api_view(...)\ndef $FUNC($REQ, ...):\n  ...\n"
                        },
                        {
                          "patterns": [
                            {
                              "pattern-either": [
                                {
                                  "pattern-inside": "class $VIEW(..., rest_framework.views.APIView, ...):\n  ...\n"
                                },
                                {
                                  "pattern-inside": "class $VIEW(..., rest_framework.generics.GenericAPIView, ...):\n  ...                              \n"
                                }
                              ]
                            },
                            {
                              "pattern-inside": "def $METHOD(self, $REQ, ...):\n  ...\n"
                            },
                            {
                              "metavariable-regex": {
                                "metavariable": "$METHOD",
                                "regex": "(get|post|put|patch|delete|head)"
                              }
                            }
                          ]
                        }
                      ]
                    },
                    {
                      "pattern-either": [
                        {
                          "pattern": "$REQ.POST.get(...)"
                        },
                        {
                          "pattern": "$REQ.POST[...]"
                        },
                        {
                          "pattern": "$REQ.FILES.get(...)"
                        },
                        {
                          "pattern": "$REQ.FILES[...]"
                        },
                        {
                          "pattern": "$REQ.DATA.get(...)"
                        },
                        {
                          "pattern": "$REQ.DATA[...]"
                        },
                        {
                          "pattern": "$REQ.QUERY_PARAMS.get(...)"
                        },
                        {
                          "pattern": "$REQ.QUERY_PARAMS[...]"
                        },
                        {
                          "pattern": "$REQ.data.get(...)"
                        },
                        {
                          "pattern": "$REQ.data[...]"
                        },
                        {
                          "pattern": "$REQ.query_params.get(...)"
                        },
                        {
                          "pattern": "$REQ.query_params[...]"
                        },
                        {
                          "pattern": "$REQ.content_type"
                        },
                        {
                          "pattern": "$REQ.content_type"
                        },
                        {
                          "pattern": "$REQ.stream"
                        },
                        {
                          "pattern": "$REQ.stream"
                        }
                      ]
                    }
                  ]
                },
                {
                  "patterns": [
                    {
                      "pattern-either": [
                        {
                          "pattern-inside": "class $SERVER(..., http.server.BaseHTTPRequestHandler, ...):\n  ...\n"
                        },
                        {
                          "pattern-inside": "class $SERVER(..., http.server.StreamRequestHandler, ...):\n  ...\n"
                        },
                        {
                          "pattern-inside": "class $SERVER(..., http.server.DatagramRequestHandler, ...):\n  ...\n"
                        }
                      ]
                    },
                    {
                      "pattern-either": [
                        {
                          "pattern": "self.requestline"
                        },
                        {
                          "pattern": "self.path"
                        },
                        {
                          "pattern": "self.headers[...]"
                        },
                        {
                          "pattern": "self.headers.get(...)"
                        },
                        {
                          "pattern": "self.rfile"
                        }
                      ]
                    }
                  ]
                },
                {
                  "patterns": [
                    {
                      "pattern-inside": "@pyramid.view.view_config( ... )\ndef $VIEW($REQ):\n  ...\n"
                    },
                    {
                      "pattern": "$REQ.$ANYTHING"
                    },
                    {
                      "pattern-not": "$REQ.dbsession"
                    }
                  ]
                }
              ]
            }
          ]
        }
      ],
      "pattern-sinks": [
        {
          "patterns": [
            {
              "pattern-either": [
                {
                  "pattern-inside": "$X = code.InteractiveConsole(...)\n...\n"
                },
                {
                  "pattern-inside": "$X = code.InteractiveInterpreter(...)\n...\n"
                }
              ]
            },
            {
              "pattern-either": [
                {
                  "pattern": "$X.push($PAYLOAD,...)\n"
                },
                {
                  "pattern": "$X.runsource($PAYLOAD,...)\n"
                },
                {
                  "pattern": "$X.runcode(code.compile_command($PAYLOAD),...)\n"
                },
                {
                  "pattern": "$PL = code.compile_command($PAYLOAD,...)\n...\n$X.runcode($PL,...)\n"
                }
              ]
            },
            {
              "focus-metavariable": "$PAYLOAD"
            },
            {
              "pattern-not": "$X.push(\"...\",...)\n"
            },
            {
              "pattern-not": "$X.runsource(\"...\",...)\n"
            },
            {
              "pattern-not": "$X.runcode(code.compile_command(\"...\"),...)\n"
            },
            {
              "pattern-not": "$PL = code.compile_command(\"...\",...)\n...\n$X.runcode($PL,...)\n"
            }
          ]
        }
      ],
      "message": "Found user controlled data inside InteractiveConsole/InteractiveInterpreter method. This is dangerous if external data can reach this function call because it allows a malicious actor to run arbitrary Python code.",
      "metadata": {
        "cwe": [
          "CWE-95: Improper Neutralization of Directives in Dynamically Evaluated Code ('Eval Injection')"
        ],
        "owasp": [
          "A03:2021 - Injection",
          "A05:2025 - Injection"
        ],
        "references": [
          "https://semgrep.dev/docs/cheat-sheets/python-command-injection/"
        ],
        "category": "security",
        "technology": [
          "python"
        ],
        "confidence": "MEDIUM",
        "subcategory": [
          "vuln"
        ],
        "likelihood": "MEDIUM",
        "impact": "HIGH",
        "license": "Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license",
        "vulnerability_class": [
          "Code Injection"
        ],
        "source": "https://semgrep.dev/r/python.lang.security.dangerous-code-run.dangerous-interactive-code-run",
        "shortlink": "https://sg.run/9pRY",
        "semgrep.dev": {
          "rule": {
            "r_id": 27267,
            "rv_id": 1263521,
            "rule_id": "KxUKzx",
            "version_id": "l4TJRgo",
            "url": "https://semgrep.dev/playground/r/l4TJRgo/python.lang.security.dangerous-code-run.dangerous-interactive-code-run",
            "origin": "community"
          }
        }
      },
      "severity": "WARNING",
      "languages": [
        "python"
      ]
    },
    {
      "id": "python.lang.security.dangerous-os-exec.dangerous-os-exec",
      "mode": "taint",
      "options": {
        "symbolic_propagation": true
      },
      "pattern-sources": [
        {
          "patterns": [
            {
              "pattern-either": [
                {
                  "patterns": [
                    {
                      "pattern-either": [
                        {
                          "pattern": "flask.request.form.get(...)"
                        },
                        {
                          "pattern": "flask.request.form[...]"
                        },
                        {
                          "pattern": "flask.request.args.get(...)"
                        },
                        {
                          "pattern": "flask.request.args[...]"
                        },
                        {
                          "pattern": "flask.request.values.get(...)"
                        },
                        {
                          "pattern": "flask.request.values[...]"
                        },
                        {
                          "pattern": "flask.request.cookies.get(...)"
                        },
                        {
                          "pattern": "flask.request.cookies[...]"
                        },
                        {
                          "pattern": "flask.request.stream"
                        },
                        {
                          "pattern": "flask.request.headers.get(...)"
                        },
                        {
                          "pattern": "flask.request.headers[...]"
                        },
                        {
                          "pattern": "flask.request.data"
                        },
                        {
                          "pattern": "flask.request.full_path"
                        },
                        {
                          "pattern": "flask.request.url"
                        },
                        {
                          "pattern": "flask.request.json"
                        },
                        {
                          "pattern": "flask.request.get_json()"
                        },
                        {
                          "pattern": "flask.request.view_args.get(...)"
                        },
                        {
                          "pattern": "flask.request.view_args[...]"
                        },
                        {
                          "patterns": [
                            {
                              "pattern-inside": "@$APP.route(...)\ndef $FUNC(..., $ROUTEVAR, ...):\n  ...\n"
                            },
                            {
                              "focus-metavariable": "$ROUTEVAR"
                            }
                          ]
                        }
                      ]
                    }
                  ]
                },
                {
                  "patterns": [
                    {
                      "pattern-inside": "def $FUNC(request, ...):\n  ...\n"
                    },
                    {
                      "pattern-either": [
                        {
                          "pattern": "request.$PROPERTY.get(...)"
                        },
                        {
                          "pattern": "request.$PROPERTY[...]"
                        }
                      ]
                    }
                  ]
                },
                {
                  "patterns": [
                    {
                      "pattern-either": [
                        {
                          "pattern-inside": "@rest_framework.decorators.api_view(...)\ndef $FUNC($REQ, ...):\n  ...\n"
                        },
                        {
                          "patterns": [
                            {
                              "pattern-either": [
                                {
                                  "pattern-inside": "class $VIEW(..., rest_framework.views.APIView, ...):\n  ...\n"
                                },
                                {
                                  "pattern-inside": "class $VIEW(..., rest_framework.generics.GenericAPIView, ...):\n  ...                              \n"
                                }
                              ]
                            },
                            {
                              "pattern-inside": "def $METHOD(self, $REQ, ...):\n  ...\n"
                            },
                            {
                              "metavariable-regex": {
                                "metavariable": "$METHOD",
                                "regex": "(get|post|put|patch|delete|head)"
                              }
                            }
                          ]
                        }
                      ]
                    },
                    {
                      "pattern-either": [
                        {
                          "pattern": "$REQ.POST.get(...)"
                        },
                        {
                          "pattern": "$REQ.POST[...]"
                        },
                        {
                          "pattern": "$REQ.FILES.get(...)"
                        },
                        {
                          "pattern": "$REQ.FILES[...]"
                        },
                        {
                          "pattern": "$REQ.DATA.get(...)"
                        },
                        {
                          "pattern": "$REQ.DATA[...]"
                        },
                        {
                          "pattern": "$REQ.QUERY_PARAMS.get(...)"
                        },
                        {
                          "pattern": "$REQ.QUERY_PARAMS[...]"
                        },
                        {
                          "pattern": "$REQ.data.get(...)"
                        },
                        {
                          "pattern": "$REQ.data[...]"
                        },
                        {
                          "pattern": "$REQ.query_params.get(...)"
                        },
                        {
                          "pattern": "$REQ.query_params[...]"
                        },
                        {
                          "pattern": "$REQ.content_type"
                        },
                        {
                          "pattern": "$REQ.content_type"
                        },
                        {
                          "pattern": "$REQ.stream"
                        },
                        {
                          "pattern": "$REQ.stream"
                        }
                      ]
                    }
                  ]
                },
                {
                  "patterns": [
                    {
                      "pattern-either": [
                        {
                          "pattern-inside": "class $SERVER(..., http.server.BaseHTTPRequestHandler, ...):\n  ...\n"
                        },
                        {
                          "pattern-inside": "class $SERVER(..., http.server.StreamRequestHandler, ...):\n  ...\n"
                        },
                        {
                          "pattern-inside": "class $SERVER(..., http.server.DatagramRequestHandler, ...):\n  ...\n"
                        }
                      ]
                    },
                    {
                      "pattern-either": [
                        {
                          "pattern": "self.requestline"
                        },
                        {
                          "pattern": "self.path"
                        },
                        {
                          "pattern": "self.headers[...]"
                        },
                        {
                          "pattern": "self.headers.get(...)"
                        },
                        {
                          "pattern": "self.rfile"
                        }
                      ]
                    }
                  ]
                },
                {
                  "patterns": [
                    {
                      "pattern-inside": "@pyramid.view.view_config( ... )\ndef $VIEW($REQ):\n  ...\n"
                    },
                    {
                      "pattern": "$REQ.$ANYTHING"
                    },
                    {
                      "pattern-not": "$REQ.dbsession"
                    }
                  ]
                }
              ]
            }
          ]
        }
      ],
      "pattern-sinks": [
        {
          "patterns": [
            {
              "pattern-either": [
                {
                  "patterns": [
                    {
                      "pattern-not": "os.$METHOD(\"...\", ...)"
                    },
                    {
                      "pattern": "os.$METHOD(...)"
                    },
                    {
                      "metavariable-regex": {
                        "metavariable": "$METHOD",
                        "regex": "(execl|execle|execlp|execlpe|execv|execve|execvp|execvpe)"
                      }
                    }
                  ]
                },
                {
                  "patterns": [
                    {
                      "pattern-not": "os.$METHOD(\"...\", [$PATH,\"...\",\"...\",...],...)"
                    },
                    {
                      "pattern-inside": "os.$METHOD($BASH,[$PATH,\"-c\",$CMD,...],...)"
                    },
                    {
                      "pattern": "$CMD"
                    },
                    {
                      "metavariable-regex": {
                        "metavariable": "$METHOD",
                        "regex": "(execv|execve|execvp|execvpe)"
                      }
                    },
                    {
                      "metavariable-regex": {
                        "metavariable": "$BASH",
                        "regex": "(.*)(sh|bash|ksh|csh|tcsh|zsh)"
                      }
                    }
                  ]
                },
                {
                  "patterns": [
                    {
                      "pattern-not": "os.$METHOD(\"...\", $PATH, \"...\", \"...\",...)"
                    },
                    {
                      "pattern-inside": "os.$METHOD($BASH, $PATH, \"-c\", $CMD,...)"
                    },
                    {
                      "pattern": "$CMD"
                    },
                    {
                      "metavariable-regex": {
                        "metavariable": "$METHOD",
                        "regex": "(execl|execle|execlp|execlpe)"
                      }
                    },
                    {
                      "metavariable-regex": {
                        "metavariable": "$BASH",
                        "regex": "(.*)(sh|bash|ksh|csh|tcsh|zsh)"
                      }
                    }
                  ]
                }
              ]
            }
          ]
        }
      ],
      "message": "Found user controlled content when spawning a process. This is dangerous because it allows a malicious actor to execute commands.",
      "metadata": {
        "cwe": [
          "CWE-78: Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')"
        ],
        "owasp": [
          "A01:2017 - Injection",
          "A03:2021 - Injection",
          "A05:2025 - Injection"
        ],
        "references": [
          "https://semgrep.dev/docs/cheat-sheets/python-command-injection/"
        ],
        "asvs": {
          "section": "V5: Validation, Sanitization and Encoding Verification Requirements",
          "control_id": "5.3.8 OS Command Injection",
          "control_url": "https://github.com/OWASP/ASVS/blob/master/4.0/en/0x13-V5-Validation-Sanitization-Encoding.md#v53-output-encoding-and-injection-prevention-requirements",
          "version": "4"
        },
        "confidence": "MEDIUM",
        "category": "security",
        "technology": [
          "python"
        ],
        "cwe2022-top25": true,
        "cwe2021-top25": true,
        "subcategory": [
          "vuln"
        ],
        "likelihood": "MEDIUM",
        "impact": "MEDIUM",
        "license": "Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license",
        "vulnerability_class": [
          "Command Injection"
        ],
        "source": "https://semgrep.dev/r/python.lang.security.dangerous-os-exec.dangerous-os-exec",
        "shortlink": "https://sg.run/yL9x",
        "semgrep.dev": {
          "rule": {
            "r_id": 27268,
            "rv_id": 1263523,
            "rule_id": "qNUR13",
            "version_id": "6xT29rz",
            "url": "https://semgrep.dev/playground/r/6xT29rz/python.lang.security.dangerous-os-exec.dangerous-os-exec",
            "origin": "community"
          }
        }
      },
      "languages": [
        "python"
      ],
      "severity": "ERROR"
    },
    {
      "id": "python.lang.security.dangerous-spawn-process.dangerous-spawn-process",
      "mode": "taint",
      "options": {
        "symbolic_propagation": true
      },
      "pattern-sources": [
        {
          "patterns": [
            {
              "pattern-either": [
                {
                  "patterns": [
                    {
                      "pattern-either": [
                        {
                          "pattern": "flask.request.form.get(...)"
                        },
                        {
                          "pattern": "flask.request.form[...]"
                        },
                        {
                          "pattern": "flask.request.args.get(...)"
                        },
                        {
                          "pattern": "flask.request.args[...]"
                        },
                        {
                          "pattern": "flask.request.values.get(...)"
                        },
                        {
                          "pattern": "flask.request.values[...]"
                        },
                        {
                          "pattern": "flask.request.cookies.get(...)"
                        },
                        {
                          "pattern": "flask.request.cookies[...]"
                        },
                        {
                          "pattern": "flask.request.stream"
                        },
                        {
                          "pattern": "flask.request.headers.get(...)"
                        },
                        {
                          "pattern": "flask.request.headers[...]"
                        },
                        {
                          "pattern": "flask.request.data"
                        },
                        {
                          "pattern": "flask.request.full_path"
                        },
                        {
                          "pattern": "flask.request.url"
                        },
                        {
                          "pattern": "flask.request.json"
                        },
                        {
                          "pattern": "flask.request.get_json()"
                        },
                        {
                          "pattern": "flask.request.view_args.get(...)"
                        },
                        {
                          "pattern": "flask.request.view_args[...]"
                        },
                        {
                          "patterns": [
                            {
                              "pattern-inside": "@$APP.route(...)\ndef $FUNC(..., $ROUTEVAR, ...):\n  ...\n"
                            },
                            {
                              "pattern": "$ROUTEVAR"
                            }
                          ]
                        }
                      ]
                    }
                  ]
                },
                {
                  "patterns": [
                    {
                      "pattern-inside": "def $FUNC(request, ...):\n  ...\n"
                    },
                    {
                      "pattern-either": [
                        {
                          "pattern": "request.$PROPERTY.get(...)"
                        },
                        {
                          "pattern": "request.$PROPERTY[...]"
                        }
                      ]
                    }
                  ]
                },
                {
                  "patterns": [
                    {
                      "pattern-either": [
                        {
                          "pattern-inside": "@rest_framework.decorators.api_view(...)\ndef $FUNC($REQ, ...):\n  ...\n"
                        },
                        {
                          "patterns": [
                            {
                              "pattern-either": [
                                {
                                  "pattern-inside": "class $VIEW(..., rest_framework.views.APIView, ...):\n  ...\n"
                                },
                                {
                                  "pattern-inside": "class $VIEW(..., rest_framework.generics.GenericAPIView, ...):\n  ...                              \n"
                                }
                              ]
                            },
                            {
                              "pattern-inside": "def $METHOD(self, $REQ, ...):\n  ...\n"
                            },
                            {
                              "metavariable-regex": {
                                "metavariable": "$METHOD",
                                "regex": "(get|post|put|patch|delete|head)"
                              }
                            }
                          ]
                        }
                      ]
                    },
                    {
                      "pattern-either": [
                        {
                          "pattern": "$REQ.POST.get(...)"
                        },
                        {
                          "pattern": "$REQ.POST[...]"
                        },
                        {
                          "pattern": "$REQ.FILES.get(...)"
                        },
                        {
                          "pattern": "$REQ.FILES[...]"
                        },
                        {
                          "pattern": "$REQ.DATA.get(...)"
                        },
                        {
                          "pattern": "$REQ.DATA[...]"
                        },
                        {
                          "pattern": "$REQ.QUERY_PARAMS.get(...)"
                        },
                        {
                          "pattern": "$REQ.QUERY_PARAMS[...]"
                        },
                        {
                          "pattern": "$REQ.data.get(...)"
                        },
                        {
                          "pattern": "$REQ.data[...]"
                        },
                        {
                          "pattern": "$REQ.query_params.get(...)"
                        },
                        {
                          "pattern": "$REQ.query_params[...]"
                        },
                        {
                          "pattern": "$REQ.content_type"
                        },
                        {
                          "pattern": "$REQ.content_type"
                        },
                        {
                          "pattern": "$REQ.stream"
                        },
                        {
                          "pattern": "$REQ.stream"
                        }
                      ]
                    }
                  ]
                },
                {
                  "patterns": [
                    {
                      "pattern-either": [
                        {
                          "pattern-inside": "class $SERVER(..., http.server.BaseHTTPRequestHandler, ...):\n  ...\n"
                        },
                        {
                          "pattern-inside": "class $SERVER(..., http.server.StreamRequestHandler, ...):\n  ...\n"
                        },
                        {
                          "pattern-inside": "class $SERVER(..., http.server.DatagramRequestHandler, ...):\n  ...\n"
                        }
                      ]
                    },
                    {
                      "pattern-either": [
                        {
                          "pattern": "self.requestline"
                        },
                        {
                          "pattern": "self.path"
                        },
                        {
                          "pattern": "self.headers[...]"
                        },
                        {
                          "pattern": "self.headers.get(...)"
                        },
                        {
                          "pattern": "self.rfile"
                        }
                      ]
                    }
                  ]
                },
                {
                  "patterns": [
                    {
                      "pattern-inside": "@pyramid.view.view_config( ... )\ndef $VIEW($REQ):\n  ...\n"
                    },
                    {
                      "pattern": "$REQ.$ANYTHING"
                    },
                    {
                      "pattern-not": "$REQ.dbsession"
                    }
                  ]
                },
                {
                  "patterns": [
                    {
                      "pattern-either": [
                        {
                          "pattern": "os.environ['$ANYTHING']"
                        },
                        {
                          "pattern": "os.environ.get('$FOO', ...)"
                        },
                        {
                          "pattern": "os.environb['$ANYTHING']"
                        },
                        {
                          "pattern": "os.environb.get('$FOO', ...)"
                        },
                        {
                          "pattern": "os.getenv('$ANYTHING', ...)"
                        },
                        {
                          "pattern": "os.getenvb('$ANYTHING', ...)"
                        }
                      ]
                    }
                  ]
                },
                {
                  "patterns": [
                    {
                      "pattern-either": [
                        {
                          "patterns": [
                            {
                              "pattern-either": [
                                {
                                  "pattern": "sys.argv[...]"
                                },
                                {
                                  "pattern": "sys.orig_argv[...]"
                                }
                              ]
                            }
                          ]
                        },
                        {
                          "patterns": [
                            {
                              "pattern-inside": "$PARSER = argparse.ArgumentParser(...)\n...\n"
                            },
                            {
                              "pattern-inside": "$ARGS = $PARSER.parse_args()\n"
                            },
                            {
                              "pattern": "<... $ARGS ...>"
                            }
                          ]
                        },
                        {
                          "patterns": [
                            {
                              "pattern-inside": "$PARSER = optparse.OptionParser(...)\n...\n"
                            },
                            {
                              "pattern-inside": "$ARGS = $PARSER.parse_args()\n"
                            },
                            {
                              "pattern": "<... $ARGS ...>"
                            }
                          ]
                        },
                        {
                          "patterns": [
                            {
                              "pattern-either": [
                                {
                                  "pattern-inside": "$OPTS, $ARGS = getopt.getopt(...)\n...\n"
                                },
                                {
                                  "pattern-inside": "$OPTS, $ARGS = getopt.gnu_getopt(...)\n...\n"
                                }
                              ]
                            },
                            {
                              "pattern-either": [
                                {
                                  "patterns": [
                                    {
                                      "pattern-inside": "for $O, $A in $OPTS:\n  ...\n"
                                    },
                                    {
                                      "pattern": "$A"
                                    }
                                  ]
                                },
                                {
                                  "pattern": "$ARGS"
                                }
                              ]
                            }
                          ]
                        }
                      ]
                    }
                  ]
                }
              ]
            }
          ]
        }
      ],
      "pattern-sinks": [
        {
          "patterns": [
            {
              "pattern-either": [
                {
                  "patterns": [
                    {
                      "pattern-not": "os.$METHOD($MODE, \"...\", ...)"
                    },
                    {
                      "pattern-inside": "os.$METHOD($MODE, $CMD, ...)"
                    },
                    {
                      "pattern": "$CMD"
                    },
                    {
                      "metavariable-regex": {
                        "metavariable": "$METHOD",
                        "regex": "(spawnl|spawnle|spawnlp|spawnlpe|spawnv|spawnve|spawnvp|spawnvp|spawnvpe|posix_spawn|posix_spawnp|startfile)"
                      }
                    }
                  ]
                },
                {
                  "patterns": [
                    {
                      "pattern-not": "os.$METHOD($MODE, \"...\", [\"...\",\"...\",...], ...)"
                    },
                    {
                      "pattern-inside": "os.$METHOD($MODE, $BASH, [\"-c\",$CMD,...],...)"
                    },
                    {
                      "pattern": "$CMD"
                    },
                    {
                      "metavariable-regex": {
                        "metavariable": "$METHOD",
                        "regex": "(spawnv|spawnve|spawnvp|spawnvp|spawnvpe|posix_spawn|posix_spawnp)"
                      }
                    },
                    {
                      "metavariable-regex": {
                        "metavariable": "$BASH",
                        "regex": "(.*)(sh|bash|ksh|csh|tcsh|zsh)"
                      }
                    }
                  ]
                },
                {
                  "patterns": [
                    {
                      "pattern-not": "os.$METHOD($MODE, \"...\", \"...\", \"...\", ...)"
                    },
                    {
                      "pattern-inside": "os.$METHOD($MODE, $BASH, \"-c\", $CMD,...)"
                    },
                    {
                      "pattern": "$CMD"
                    },
                    {
                      "metavariable-regex": {
                        "metavariable": "$METHOD",
                        "regex": "(spawnl|spawnle|spawnlp|spawnlpe)"
                      }
                    },
                    {
                      "metavariable-regex": {
                        "metavariable": "$BASH",
                        "regex": "(.*)(sh|bash|ksh|csh|tcsh|zsh)"
                      }
                    }
                  ]
                }
              ]
            }
          ]
        }
      ],
      "message": "Found user controlled content when spawning a process. This is dangerous because it allows a malicious actor to execute commands.",
      "metadata": {
        "source-rule-url": "https://bandit.readthedocs.io/en/latest/plugins/b605_start_process_with_a_shell.html",
        "cwe": [
          "CWE-78: Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')"
        ],
        "owasp": [
          "A01:2017 - Injection",
          "A03:2021 - Injection",
          "A05:2025 - Injection"
        ],
        "references": [
          "https://semgrep.dev/docs/cheat-sheets/python-command-injection/"
        ],
        "asvs": {
          "section": "V5: Validation, Sanitization and Encoding Verification Requirements",
          "control_id": "5.3.8 OS Command Injection",
          "control_url": "https://github.com/OWASP/ASVS/blob/master/4.0/en/0x13-V5-Validation-Sanitization-Encoding.md#v53-output-encoding-and-injection-prevention-requirements",
          "version": "4"
        },
        "category": "security",
        "technology": [
          "python"
        ],
        "confidence": "MEDIUM",
        "cwe2022-top25": true,
        "cwe2021-top25": true,
        "subcategory": [
          "vuln"
        ],
        "likelihood": "MEDIUM",
        "impact": "MEDIUM",
        "license": "Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license",
        "vulnerability_class": [
          "Command Injection"
        ],
        "source": "https://semgrep.dev/r/python.lang.security.dangerous-spawn-process.dangerous-spawn-process",
        "shortlink": "https://sg.run/r8Zn",
        "semgrep.dev": {
          "rule": {
            "r_id": 27269,
            "rv_id": 1263524,
            "rule_id": "lBUJrn",
            "version_id": "o5TbDO5",
            "url": "https://semgrep.dev/playground/r/o5TbDO5/python.lang.security.dangerous-spawn-process.dangerous-spawn-process",
            "origin": "community"
          }
        }
      },
      "languages": [
        "python"
      ],
      "severity": "ERROR"
    },
    {
      "id": "python.lang.security.dangerous-subinterpreters-run-string.dangerous-subinterpreters-run-string",
      "mode": "taint",
      "options": {
        "symbolic_propagation": true
      },
      "pattern-sources": [
        {
          "patterns": [
            {
              "pattern-either": [
                {
                  "patterns": [
                    {
                      "pattern-either": [
                        {
                          "pattern": "flask.request.form.get(...)"
                        },
                        {
                          "pattern": "flask.request.form[...]"
                        },
                        {
                          "pattern": "flask.request.args.get(...)"
                        },
                        {
                          "pattern": "flask.request.args[...]"
                        },
                        {
                          "pattern": "flask.request.values.get(...)"
                        },
                        {
                          "pattern": "flask.request.values[...]"
                        },
                        {
                          "pattern": "flask.request.cookies.get(...)"
                        },
                        {
                          "pattern": "flask.request.cookies[...]"
                        },
                        {
                          "pattern": "flask.request.stream"
                        },
                        {
                          "pattern": "flask.request.headers.get(...)"
                        },
                        {
                          "pattern": "flask.request.headers[...]"
                        },
                        {
                          "pattern": "flask.request.data"
                        },
                        {
                          "pattern": "flask.request.full_path"
                        },
                        {
                          "pattern": "flask.request.url"
                        },
                        {
                          "pattern": "flask.request.json"
                        },
                        {
                          "pattern": "flask.request.get_json()"
                        },
                        {
                          "pattern": "flask.request.view_args.get(...)"
                        },
                        {
                          "pattern": "flask.request.view_args[...]"
                        },
                        {
                          "patterns": [
                            {
                              "pattern-inside": "@$APP.route(...)\ndef $FUNC(..., $ROUTEVAR, ...):\n  ...\n"
                            },
                            {
                              "focus-metavariable": "$ROUTEVAR"
                            }
                          ]
                        }
                      ]
                    }
                  ]
                },
                {
                  "patterns": [
                    {
                      "pattern-inside": "def $FUNC(request, ...):\n  ...\n"
                    },
                    {
                      "pattern-either": [
                        {
                          "pattern": "request.$PROPERTY.get(...)"
                        },
                        {
                          "pattern": "request.$PROPERTY[...]"
                        }
                      ]
                    }
                  ]
                },
                {
                  "patterns": [
                    {
                      "pattern-either": [
                        {
                          "pattern-inside": "@rest_framework.decorators.api_view(...)\ndef $FUNC($REQ, ...):\n  ...\n"
                        },
                        {
                          "patterns": [
                            {
                              "pattern-either": [
                                {
                                  "pattern-inside": "class $VIEW(..., rest_framework.views.APIView, ...):\n  ...\n"
                                },
                                {
                                  "pattern-inside": "class $VIEW(..., rest_framework.generics.GenericAPIView, ...):\n  ...                              \n"
                                }
                              ]
                            },
                            {
                              "pattern-inside": "def $METHOD(self, $REQ, ...):\n  ...\n"
                            },
                            {
                              "metavariable-regex": {
                                "metavariable": "$METHOD",
                                "regex": "(get|post|put|patch|delete|head)"
                              }
                            }
                          ]
                        }
                      ]
                    },
                    {
                      "pattern-either": [
                        {
                          "pattern": "$REQ.POST.get(...)"
                        },
                        {
                          "pattern": "$REQ.POST[...]"
                        },
                        {
                          "pattern": "$REQ.FILES.get(...)"
                        },
                        {
                          "pattern": "$REQ.FILES[...]"
                        },
                        {
                          "pattern": "$REQ.DATA.get(...)"
                        },
                        {
                          "pattern": "$REQ.DATA[...]"
                        },
                        {
                          "pattern": "$REQ.QUERY_PARAMS.get(...)"
                        },
                        {
                          "pattern": "$REQ.QUERY_PARAMS[...]"
                        },
                        {
                          "pattern": "$REQ.data.get(...)"
                        },
                        {
                          "pattern": "$REQ.data[...]"
                        },
                        {
                          "pattern": "$REQ.query_params.get(...)"
                        },
                        {
                          "pattern": "$REQ.query_params[...]"
                        },
                        {
                          "pattern": "$REQ.content_type"
                        },
                        {
                          "pattern": "$REQ.content_type"
                        },
                        {
                          "pattern": "$REQ.stream"
                        },
                        {
                          "pattern": "$REQ.stream"
                        }
                      ]
                    }
                  ]
                },
                {
                  "patterns": [
                    {
                      "pattern-either": [
                        {
                          "pattern-inside": "class $SERVER(..., http.server.BaseHTTPRequestHandler, ...):\n  ...\n"
                        },
                        {
                          "pattern-inside": "class $SERVER(..., http.server.StreamRequestHandler, ...):\n  ...\n"
                        },
                        {
                          "pattern-inside": "class $SERVER(..., http.server.DatagramRequestHandler, ...):\n  ...\n"
                        }
                      ]
                    },
                    {
                      "pattern-either": [
                        {
                          "pattern": "self.requestline"
                        },
                        {
                          "pattern": "self.path"
                        },
                        {
                          "pattern": "self.headers[...]"
                        },
                        {
                          "pattern": "self.headers.get(...)"
                        },
                        {
                          "pattern": "self.rfile"
                        }
                      ]
                    }
                  ]
                },
                {
                  "patterns": [
                    {
                      "pattern-inside": "@pyramid.view.view_config( ... )\ndef $VIEW($REQ):\n  ...\n"
                    },
                    {
                      "pattern": "$REQ.$ANYTHING"
                    },
                    {
                      "pattern-not": "$REQ.dbsession"
                    }
                  ]
                }
              ]
            }
          ]
        }
      ],
      "pattern-sinks": [
        {
          "patterns": [
            {
              "pattern": "_xxsubinterpreters.run_string($ID, $PAYLOAD, ...)\n"
            },
            {
              "pattern-not": "_xxsubinterpreters.run_string($ID, \"...\", ...)\n"
            },
            {
              "focus-metavariable": "$PAYLOAD"
            }
          ]
        }
      ],
      "message": "Found user controlled content in `run_string`. This is dangerous because it allows a malicious actor to run arbitrary Python code.",
      "metadata": {
        "cwe": [
          "CWE-95: Improper Neutralization of Directives in Dynamically Evaluated Code ('Eval Injection')"
        ],
        "owasp": [
          "A03:2021 - Injection",
          "A05:2025 - Injection"
        ],
        "references": [
          "https://bugs.python.org/issue43472",
          "https://semgrep.dev/docs/cheat-sheets/python-command-injection/"
        ],
        "category": "security",
        "technology": [
          "python"
        ],
        "confidence": "MEDIUM",
        "subcategory": [
          "vuln"
        ],
        "likelihood": "MEDIUM",
        "impact": "HIGH",
        "license": "Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license",
        "vulnerability_class": [
          "Code Injection"
        ],
        "source": "https://semgrep.dev/r/python.lang.security.dangerous-subinterpreters-run-string.dangerous-subinterpreters-run-string",
        "shortlink": "https://sg.run/bPop",
        "semgrep.dev": {
          "rule": {
            "r_id": 27270,
            "rv_id": 1263525,
            "rule_id": "PeURWr",
            "version_id": "zyTb2OX",
            "url": "https://semgrep.dev/playground/r/zyTb2OX/python.lang.security.dangerous-subinterpreters-run-string.dangerous-subinterpreters-run-string",
            "origin": "community"
          }
        }
      },
      "severity": "WARNING",
      "languages": [
        "python"
      ]
    },
    {
      "id": "python.lang.security.dangerous-subprocess-use.dangerous-subprocess-use",
      "mode": "taint",
      "options": {
        "symbolic_propagation": true
      },
      "pattern-sources": [
        {
          "patterns": [
            {
              "pattern-either": [
                {
                  "patterns": [
                    {
                      "pattern-either": [
                        {
                          "pattern": "flask.request.form.get(...)"
                        },
                        {
                          "pattern": "flask.request.form[...]"
                        },
                        {
                          "pattern": "flask.request.args.get(...)"
                        },
                        {
                          "pattern": "flask.request.args[...]"
                        },
                        {
                          "pattern": "flask.request.values.get(...)"
                        },
                        {
                          "pattern": "flask.request.values[...]"
                        },
                        {
                          "pattern": "flask.request.cookies.get(...)"
                        },
                        {
                          "pattern": "flask.request.cookies[...]"
                        },
                        {
                          "pattern": "flask.request.stream"
                        },
                        {
                          "pattern": "flask.request.headers.get(...)"
                        },
                        {
                          "pattern": "flask.request.headers[...]"
                        },
                        {
                          "pattern": "flask.request.data"
                        },
                        {
                          "pattern": "flask.request.full_path"
                        },
                        {
                          "pattern": "flask.request.url"
                        },
                        {
                          "pattern": "flask.request.json"
                        },
                        {
                          "pattern": "flask.request.get_json()"
                        },
                        {
                          "pattern": "flask.request.view_args.get(...)"
                        },
                        {
                          "pattern": "flask.request.view_args[...]"
                        },
                        {
                          "patterns": [
                            {
                              "pattern-inside": "@$APP.route(...)\ndef $FUNC(..., $ROUTEVAR, ...):\n  ...\n"
                            },
                            {
                              "focus-metavariable": "$ROUTEVAR"
                            }
                          ]
                        }
                      ]
                    }
                  ]
                },
                {
                  "patterns": [
                    {
                      "pattern-inside": "def $FUNC(request, ...):\n  ...\n"
                    },
                    {
                      "pattern-either": [
                        {
                          "pattern": "request.$PROPERTY.get(...)"
                        },
                        {
                          "pattern": "request.$PROPERTY[...]"
                        }
                      ]
                    }
                  ]
                },
                {
                  "patterns": [
                    {
                      "pattern-either": [
                        {
                          "pattern-inside": "@rest_framework.decorators.api_view(...)\ndef $FUNC($REQ, ...):\n  ...\n"
                        },
                        {
                          "patterns": [
                            {
                              "pattern-either": [
                                {
                                  "pattern-inside": "class $VIEW(..., rest_framework.views.APIView, ...):\n  ...\n"
                                },
                                {
                                  "pattern-inside": "class $VIEW(..., rest_framework.generics.GenericAPIView, ...):\n  ...                              \n"
                                }
                              ]
                            },
                            {
                              "pattern-inside": "def $METHOD(self, $REQ, ...):\n  ...\n"
                            },
                            {
                              "metavariable-regex": {
                                "metavariable": "$METHOD",
                                "regex": "(get|post|put|patch|delete|head)"
                              }
                            }
                          ]
                        }
                      ]
                    },
                    {
                      "pattern-either": [
                        {
                          "pattern": "$REQ.POST.get(...)"
                        },
                        {
                          "pattern": "$REQ.POST[...]"
                        },
                        {
                          "pattern": "$REQ.FILES.get(...)"
                        },
                        {
                          "pattern": "$REQ.FILES[...]"
                        },
                        {
                          "pattern": "$REQ.DATA.get(...)"
                        },
                        {
                          "pattern": "$REQ.DATA[...]"
                        },
                        {
                          "pattern": "$REQ.QUERY_PARAMS.get(...)"
                        },
                        {
                          "pattern": "$REQ.QUERY_PARAMS[...]"
                        },
                        {
                          "pattern": "$REQ.data.get(...)"
                        },
                        {
                          "pattern": "$REQ.data[...]"
                        },
                        {
                          "pattern": "$REQ.query_params.get(...)"
                        },
                        {
                          "pattern": "$REQ.query_params[...]"
                        },
                        {
                          "pattern": "$REQ.content_type"
                        },
                        {
                          "pattern": "$REQ.content_type"
                        },
                        {
                          "pattern": "$REQ.stream"
                        },
                        {
                          "pattern": "$REQ.stream"
                        }
                      ]
                    }
                  ]
                },
                {
                  "patterns": [
                    {
                      "pattern-either": [
                        {
                          "pattern-inside": "class $SERVER(..., http.server.BaseHTTPRequestHandler, ...):\n  ...\n"
                        },
                        {
                          "pattern-inside": "class $SERVER(..., http.server.StreamRequestHandler, ...):\n  ...\n"
                        },
                        {
                          "pattern-inside": "class $SERVER(..., http.server.DatagramRequestHandler, ...):\n  ...\n"
                        }
                      ]
                    },
                    {
                      "pattern-either": [
                        {
                          "pattern": "self.requestline"
                        },
                        {
                          "pattern": "self.path"
                        },
                        {
                          "pattern": "self.headers[...]"
                        },
                        {
                          "pattern": "self.headers.get(...)"
                        },
                        {
                          "pattern": "self.rfile"
                        }
                      ]
                    }
                  ]
                },
                {
                  "patterns": [
                    {
                      "pattern-inside": "@pyramid.view.view_config( ... )\ndef $VIEW($REQ):\n  ...\n"
                    },
                    {
                      "pattern": "$REQ.$ANYTHING"
                    },
                    {
                      "pattern-not": "$REQ.dbsession"
                    }
                  ]
                }
              ]
            }
          ]
        }
      ],
      "pattern-sinks": [
        {
          "patterns": [
            {
              "pattern-either": [
                {
                  "patterns": [
                    {
                      "pattern-not": "subprocess.$FUNC(\"...\", ...)"
                    },
                    {
                      "pattern-not": "subprocess.$FUNC([\"...\",...], ...)"
                    },
                    {
                      "pattern-not": "subprocess.$FUNC((\"...\",...), ...)"
                    },
                    {
                      "pattern-not": "subprocess.CalledProcessError(...)"
                    },
                    {
                      "pattern-not": "subprocess.SubprocessError(...)"
                    },
                    {
                      "pattern": "subprocess.$FUNC($CMD, ...)"
                    }
                  ]
                },
                {
                  "patterns": [
                    {
                      "pattern-not": "subprocess.$FUNC(\"=~/(sh|bash|ksh|csh|tcsh|zsh)/\",\"-c\",\"...\",...)"
                    },
                    {
                      "pattern": "subprocess.$FUNC(\"=~/(sh|bash|ksh|csh|tcsh|zsh)/\",\"-c\", $CMD)"
                    }
                  ]
                },
                {
                  "patterns": [
                    {
                      "pattern-not": "subprocess.$FUNC([\"=~/(sh|bash|ksh|csh|tcsh|zsh)/\",\"-c\",\"...\",...],...)"
                    },
                    {
                      "pattern-not": "subprocess.$FUNC((\"=~/(sh|bash|ksh|csh|tcsh|zsh)/\",\"-c\",\"...\",...),...)"
                    },
                    {
                      "pattern-either": [
                        {
                          "pattern": "subprocess.$FUNC([\"=~/(sh|bash|ksh|csh|tcsh|zsh)/\",\"-c\", $CMD], ...)"
                        },
                        {
                          "pattern": "subprocess.$FUNC((\"=~/(sh|bash|ksh|csh|tcsh|zsh)/\",\"-c\", $CMD), ...)"
                        }
                      ]
                    }
                  ]
                },
                {
                  "patterns": [
                    {
                      "pattern-not": "subprocess.$FUNC(\"=~/(python)/\",\"...\",...)"
                    },
                    {
                      "pattern": "subprocess.$FUNC(\"=~/(python)/\", $CMD)"
                    }
                  ]
                },
                {
                  "patterns": [
                    {
                      "pattern-not": "subprocess.$FUNC([\"=~/(python)/\",\"...\",...],...)"
                    },
                    {
                      "pattern-not": "subprocess.$FUNC((\"=~/(python)/\",\"...\",...),...)"
                    },
                    {
                      "pattern-either": [
                        {
                          "pattern": "subprocess.$FUNC([\"=~/(python)/\", $CMD],...)"
                        },
                        {
                          "pattern": "subprocess.$FUNC((\"=~/(python)/\", $CMD),...)"
                        }
                      ]
                    }
                  ]
                }
              ]
            },
            {
              "focus-metavariable": "$CMD"
            }
          ]
        }
      ],
      "message": "Detected subprocess function '$FUNC' with user controlled data. A malicious actor could leverage this to perform command injection. You may consider using 'shlex.escape()'.",
      "metadata": {
        "owasp": [
          "A01:2017 - Injection",
          "A03:2021 - Injection",
          "A05:2025 - Injection"
        ],
        "cwe": [
          "CWE-78: Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')"
        ],
        "asvs": {
          "section": "V5: Validation, Sanitization and Encoding Verification Requirements",
          "control_id": "5.3.8 OS Command Injection",
          "control_url": "https://github.com/OWASP/ASVS/blob/master/4.0/en/0x13-V5-Validation-Sanitization-Encoding.md#v53-output-encoding-and-injection-prevention-requirements",
          "version": "4"
        },
        "references": [
          "https://stackoverflow.com/questions/3172470/actual-meaning-of-shell-true-in-subprocess",
          "https://docs.python.org/3/library/subprocess.html",
          "https://docs.python.org/3/library/shlex.html",
          "https://semgrep.dev/docs/cheat-sheets/python-command-injection/"
        ],
        "category": "security",
        "technology": [
          "python"
        ],
        "confidence": "MEDIUM",
        "cwe2022-top25": true,
        "cwe2021-top25": true,
        "subcategory": [
          "vuln"
        ],
        "likelihood": "MEDIUM",
        "impact": "HIGH",
        "license": "Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license",
        "vulnerability_class": [
          "Command Injection"
        ],
        "source": "https://semgrep.dev/r/python.lang.security.dangerous-subprocess-use.dangerous-subprocess-use",
        "shortlink": "https://sg.run/NWxp",
        "semgrep.dev": {
          "rule": {
            "r_id": 27271,
            "rv_id": 1263526,
            "rule_id": "JDUz3R",
            "version_id": "pZT038J",
            "url": "https://semgrep.dev/playground/r/pZT038J/python.lang.security.dangerous-subprocess-use.dangerous-subprocess-use",
            "origin": "community"
          }
        }
      },
      "languages": [
        "python"
      ],
      "severity": "ERROR"
    },
    {
      "id": "python.lang.security.dangerous-system-call.dangerous-system-call",
      "mode": "taint",
      "options": {
        "symbolic_propagation": true
      },
      "pattern-sources": [
        {
          "patterns": [
            {
              "pattern-either": [
                {
                  "patterns": [
                    {
                      "pattern-either": [
                        {
                          "pattern": "flask.request.form.get(...)"
                        },
                        {
                          "pattern": "flask.request.form[...]"
                        },
                        {
                          "pattern": "flask.request.args.get(...)"
                        },
                        {
                          "pattern": "flask.request.args[...]"
                        },
                        {
                          "pattern": "flask.request.values.get(...)"
                        },
                        {
                          "pattern": "flask.request.values[...]"
                        },
                        {
                          "pattern": "flask.request.cookies.get(...)"
                        },
                        {
                          "pattern": "flask.request.cookies[...]"
                        },
                        {
                          "pattern": "flask.request.stream"
                        },
                        {
                          "pattern": "flask.request.headers.get(...)"
                        },
                        {
                          "pattern": "flask.request.headers[...]"
                        },
                        {
                          "pattern": "flask.request.data"
                        },
                        {
                          "pattern": "flask.request.full_path"
                        },
                        {
                          "pattern": "flask.request.url"
                        },
                        {
                          "pattern": "flask.request.json"
                        },
                        {
                          "pattern": "flask.request.get_json()"
                        },
                        {
                          "pattern": "flask.request.view_args.get(...)"
                        },
                        {
                          "pattern": "flask.request.view_args[...]"
                        },
                        {
                          "patterns": [
                            {
                              "pattern-inside": "@$APP.route(...)\ndef $FUNC(..., $ROUTEVAR, ...):\n  ...\n"
                            },
                            {
                              "focus-metavariable": "$ROUTEVAR"
                            }
                          ]
                        }
                      ]
                    }
                  ]
                },
                {
                  "patterns": [
                    {
                      "pattern-inside": "def $FUNC(request, ...):\n  ...\n"
                    },
                    {
                      "pattern-either": [
                        {
                          "pattern": "request.$PROPERTY.get(...)"
                        },
                        {
                          "pattern": "request.$PROPERTY[...]"
                        }
                      ]
                    }
                  ]
                },
                {
                  "patterns": [
                    {
                      "pattern-either": [
                        {
                          "pattern-inside": "@rest_framework.decorators.api_view(...)\ndef $FUNC($REQ, ...):\n  ...\n"
                        },
                        {
                          "patterns": [
                            {
                              "pattern-either": [
                                {
                                  "pattern-inside": "class $VIEW(..., rest_framework.views.APIView, ...):\n  ...\n"
                                },
                                {
                                  "pattern-inside": "class $VIEW(..., rest_framework.generics.GenericAPIView, ...):\n  ...                              \n"
                                }
                              ]
                            },
                            {
                              "pattern-inside": "def $METHOD(self, $REQ, ...):\n  ...\n"
                            },
                            {
                              "metavariable-regex": {
                                "metavariable": "$METHOD",
                                "regex": "(get|post|put|patch|delete|head)"
                              }
                            }
                          ]
                        }
                      ]
                    },
                    {
                      "pattern-either": [
                        {
                          "pattern": "$REQ.POST.get(...)"
                        },
                        {
                          "pattern": "$REQ.POST[...]"
                        },
                        {
                          "pattern": "$REQ.FILES.get(...)"
                        },
                        {
                          "pattern": "$REQ.FILES[...]"
                        },
                        {
                          "pattern": "$REQ.DATA.get(...)"
                        },
                        {
                          "pattern": "$REQ.DATA[...]"
                        },
                        {
                          "pattern": "$REQ.QUERY_PARAMS.get(...)"
                        },
                        {
                          "pattern": "$REQ.QUERY_PARAMS[...]"
                        },
                        {
                          "pattern": "$REQ.data.get(...)"
                        },
                        {
                          "pattern": "$REQ.data[...]"
                        },
                        {
                          "pattern": "$REQ.query_params.get(...)"
                        },
                        {
                          "pattern": "$REQ.query_params[...]"
                        },
                        {
                          "pattern": "$REQ.content_type"
                        },
                        {
                          "pattern": "$REQ.content_type"
                        },
                        {
                          "pattern": "$REQ.stream"
                        },
                        {
                          "pattern": "$REQ.stream"
                        }
                      ]
                    }
                  ]
                },
                {
                  "patterns": [
                    {
                      "pattern-either": [
                        {
                          "pattern-inside": "class $SERVER(..., http.server.BaseHTTPRequestHandler, ...):\n  ...\n"
                        },
                        {
                          "pattern-inside": "class $SERVER(..., http.server.StreamRequestHandler, ...):\n  ...\n"
                        },
                        {
                          "pattern-inside": "class $SERVER(..., http.server.DatagramRequestHandler, ...):\n  ...\n"
                        }
                      ]
                    },
                    {
                      "pattern-either": [
                        {
                          "pattern": "self.requestline"
                        },
                        {
                          "pattern": "self.path"
                        },
                        {
                          "pattern": "self.headers[...]"
                        },
                        {
                          "pattern": "self.headers.get(...)"
                        },
                        {
                          "pattern": "self.rfile"
                        }
                      ]
                    }
                  ]
                },
                {
                  "patterns": [
                    {
                      "pattern-inside": "@pyramid.view.view_config( ... )\ndef $VIEW($REQ):\n  ...\n"
                    },
                    {
                      "pattern": "$REQ.$ANYTHING"
                    },
                    {
                      "pattern-not": "$REQ.dbsession"
                    }
                  ]
                }
              ]
            }
          ]
        }
      ],
      "pattern-sinks": [
        {
          "patterns": [
            {
              "pattern-not": "os.$W(\"...\", ...)"
            },
            {
              "pattern-either": [
                {
                  "pattern": "os.system(...)"
                },
                {
                  "pattern": "getattr(os, \"system\")(...)"
                },
                {
                  "pattern": "__import__(\"os\").system(...)"
                },
                {
                  "pattern": "getattr(__import__(\"os\"), \"system\")(...)"
                },
                {
                  "pattern": "$X = __import__(\"os\")\n...\n$X.system(...)\n"
                },
                {
                  "pattern": "$X = __import__(\"os\")\n...\ngetattr($X, \"system\")(...)\n"
                },
                {
                  "pattern": "$X = getattr(os, \"system\")\n...\n$X(...)\n"
                },
                {
                  "pattern": "$X = __import__(\"os\")\n...\n$Y = getattr($X, \"system\")\n...\n$Y(...)\n"
                },
                {
                  "pattern": "os.popen(...)"
                },
                {
                  "pattern": "os.popen2(...)"
                },
                {
                  "pattern": "os.popen3(...)"
                },
                {
                  "pattern": "os.popen4(...)"
                }
              ]
            }
          ]
        }
      ],
      "message": "Found user-controlled data used in a system call. This could allow a malicious actor to execute commands. Use the 'subprocess' module instead, which is easier to use without accidentally exposing a command injection vulnerability.",
      "metadata": {
        "source-rule-url": "https://bandit.readthedocs.io/en/latest/plugins/b605_start_process_with_a_shell.html",
        "cwe": [
          "CWE-78: Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')"
        ],
        "owasp": [
          "A01:2017 - Injection",
          "A03:2021 - Injection",
          "A05:2025 - Injection"
        ],
        "references": [
          "https://semgrep.dev/docs/cheat-sheets/python-command-injection/"
        ],
        "asvs": {
          "section": "V5: Validation, Sanitization and Encoding Verification Requirements",
          "control_id": "5.2.4 Dyanmic Code Execution Features",
          "control_url": "https://github.com/OWASP/ASVS/blob/master/4.0/en/0x13-V5-Validation-Sanitization-Encoding.md#v52-sanitization-and-sandboxing-requirements",
          "version": "4"
        },
        "category": "security",
        "technology": [
          "python"
        ],
        "confidence": "MEDIUM",
        "cwe2022-top25": true,
        "cwe2021-top25": true,
        "subcategory": [
          "vuln"
        ],
        "likelihood": "HIGH",
        "impact": "HIGH",
        "license": "Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license",
        "vulnerability_class": [
          "Command Injection"
        ],
        "source": "https://semgrep.dev/r/python.lang.security.dangerous-system-call.dangerous-system-call",
        "shortlink": "https://sg.run/k0W7",
        "semgrep.dev": {
          "rule": {
            "r_id": 27272,
            "rv_id": 1263527,
            "rule_id": "5rUoP1",
            "version_id": "2KTv2Zn",
            "url": "https://semgrep.dev/playground/r/2KTv2Zn/python.lang.security.dangerous-system-call.dangerous-system-call",
            "origin": "community"
          }
        }
      },
      "languages": [
        "python"
      ],
      "severity": "ERROR"
    },
    {
      "id": "python.lang.security.dangerous-testcapi-run-in-subinterp.dangerous-testcapi-run-in-subinterp",
      "mode": "taint",
      "options": {
        "symbolic_propagation": true
      },
      "pattern-sources": [
        {
          "patterns": [
            {
              "pattern-either": [
                {
                  "patterns": [
                    {
                      "pattern-either": [
                        {
                          "pattern": "flask.request.form.get(...)"
                        },
                        {
                          "pattern": "flask.request.form[...]"
                        },
                        {
                          "pattern": "flask.request.args.get(...)"
                        },
                        {
                          "pattern": "flask.request.args[...]"
                        },
                        {
                          "pattern": "flask.request.values.get(...)"
                        },
                        {
                          "pattern": "flask.request.values[...]"
                        },
                        {
                          "pattern": "flask.request.cookies.get(...)"
                        },
                        {
                          "pattern": "flask.request.cookies[...]"
                        },
                        {
                          "pattern": "flask.request.stream"
                        },
                        {
                          "pattern": "flask.request.headers.get(...)"
                        },
                        {
                          "pattern": "flask.request.headers[...]"
                        },
                        {
                          "pattern": "flask.request.data"
                        },
                        {
                          "pattern": "flask.request.full_path"
                        },
                        {
                          "pattern": "flask.request.url"
                        },
                        {
                          "pattern": "flask.request.json"
                        },
                        {
                          "pattern": "flask.request.get_json()"
                        },
                        {
                          "pattern": "flask.request.view_args.get(...)"
                        },
                        {
                          "pattern": "flask.request.view_args[...]"
                        },
                        {
                          "patterns": [
                            {
                              "pattern-inside": "@$APP.route(...)\ndef $FUNC(..., $ROUTEVAR, ...):\n  ...\n"
                            },
                            {
                              "focus-metavariable": "$ROUTEVAR"
                            }
                          ]
                        }
                      ]
                    }
                  ]
                },
                {
                  "patterns": [
                    {
                      "pattern-inside": "def $FUNC(request, ...):\n  ...\n"
                    },
                    {
                      "pattern-either": [
                        {
                          "pattern": "request.$PROPERTY.get(...)"
                        },
                        {
                          "pattern": "request.$PROPERTY[...]"
                        }
                      ]
                    }
                  ]
                },
                {
                  "patterns": [
                    {
                      "pattern-either": [
                        {
                          "pattern-inside": "@rest_framework.decorators.api_view(...)\ndef $FUNC($REQ, ...):\n  ...\n"
                        },
                        {
                          "patterns": [
                            {
                              "pattern-either": [
                                {
                                  "pattern-inside": "class $VIEW(..., rest_framework.views.APIView, ...):\n  ...\n"
                                },
                                {
                                  "pattern-inside": "class $VIEW(..., rest_framework.generics.GenericAPIView, ...):\n  ...                              \n"
                                }
                              ]
                            },
                            {
                              "pattern-inside": "def $METHOD(self, $REQ, ...):\n  ...\n"
                            },
                            {
                              "metavariable-regex": {
                                "metavariable": "$METHOD",
                                "regex": "(get|post|put|patch|delete|head)"
                              }
                            }
                          ]
                        }
                      ]
                    },
                    {
                      "pattern-either": [
                        {
                          "pattern": "$REQ.POST.get(...)"
                        },
                        {
                          "pattern": "$REQ.POST[...]"
                        },
                        {
                          "pattern": "$REQ.FILES.get(...)"
                        },
                        {
                          "pattern": "$REQ.FILES[...]"
                        },
                        {
                          "pattern": "$REQ.DATA.get(...)"
                        },
                        {
                          "pattern": "$REQ.DATA[...]"
                        },
                        {
                          "pattern": "$REQ.QUERY_PARAMS.get(...)"
                        },
                        {
                          "pattern": "$REQ.QUERY_PARAMS[...]"
                        },
                        {
                          "pattern": "$REQ.data.get(...)"
                        },
                        {
                          "pattern": "$REQ.data[...]"
                        },
                        {
                          "pattern": "$REQ.query_params.get(...)"
                        },
                        {
                          "pattern": "$REQ.query_params[...]"
                        },
                        {
                          "pattern": "$REQ.content_type"
                        },
                        {
                          "pattern": "$REQ.content_type"
                        },
                        {
                          "pattern": "$REQ.stream"
                        },
                        {
                          "pattern": "$REQ.stream"
                        }
                      ]
                    }
                  ]
                },
                {
                  "patterns": [
                    {
                      "pattern-either": [
                        {
                          "pattern-inside": "class $SERVER(..., http.server.BaseHTTPRequestHandler, ...):\n  ...\n"
                        },
                        {
                          "pattern-inside": "class $SERVER(..., http.server.StreamRequestHandler, ...):\n  ...\n"
                        },
                        {
                          "pattern-inside": "class $SERVER(..., http.server.DatagramRequestHandler, ...):\n  ...\n"
                        }
                      ]
                    },
                    {
                      "pattern-either": [
                        {
                          "pattern": "self.requestline"
                        },
                        {
                          "pattern": "self.path"
                        },
                        {
                          "pattern": "self.headers[...]"
                        },
                        {
                          "pattern": "self.headers.get(...)"
                        },
                        {
                          "pattern": "self.rfile"
                        }
                      ]
                    }
                  ]
                },
                {
                  "patterns": [
                    {
                      "pattern-inside": "@pyramid.view.view_config( ... )\ndef $VIEW($REQ):\n  ...\n"
                    },
                    {
                      "pattern": "$REQ.$ANYTHING"
                    },
                    {
                      "pattern-not": "$REQ.dbsession"
                    }
                  ]
                }
              ]
            }
          ]
        }
      ],
      "pattern-sinks": [
        {
          "patterns": [
            {
              "pattern-either": [
                {
                  "pattern": "_testcapi.run_in_subinterp($PAYLOAD, ...)\n"
                },
                {
                  "pattern": "test.support.run_in_subinterp($PAYLOAD, ...)\n"
                }
              ]
            },
            {
              "focus-metavariable": "$PAYLOAD"
            },
            {
              "pattern-not": "_testcapi.run_in_subinterp(\"...\", ...)\n"
            },
            {
              "pattern-not": "test.support.run_in_subinterp(\"...\", ...)\n"
            }
          ]
        }
      ],
      "message": "Found user controlled content in `run_in_subinterp`. This is dangerous because it allows a malicious actor to run arbitrary Python code.",
      "metadata": {
        "cwe": [
          "CWE-95: Improper Neutralization of Directives in Dynamically Evaluated Code ('Eval Injection')"
        ],
        "owasp": [
          "A03:2021 - Injection",
          "A05:2025 - Injection"
        ],
        "references": [
          "https://semgrep.dev/docs/cheat-sheets/python-command-injection/"
        ],
        "category": "security",
        "technology": [
          "python"
        ],
        "confidence": "MEDIUM",
        "subcategory": [
          "vuln"
        ],
        "likelihood": "HIGH",
        "impact": "HIGH",
        "license": "Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license",
        "vulnerability_class": [
          "Code Injection"
        ],
        "source": "https://semgrep.dev/r/python.lang.security.dangerous-testcapi-run-in-subinterp.dangerous-testcapi-run-in-subinterp",
        "shortlink": "https://sg.run/wLpY",
        "semgrep.dev": {
          "rule": {
            "r_id": 27273,
            "rv_id": 1263528,
            "rule_id": "GdUkxR",
            "version_id": "X0Tzy1e",
            "url": "https://semgrep.dev/playground/r/X0Tzy1e/python.lang.security.dangerous-testcapi-run-in-subinterp.dangerous-testcapi-run-in-subinterp",
            "origin": "community"
          }
        }
      },
      "severity": "WARNING",
      "languages": [
        "python"
      ]
    },
    {
      "id": "python.django.security.injection.command.subprocess-injection.subprocess-injection",
      "languages": [
        "python"
      ],
      "mode": "taint",
      "options": {
        "symbolic_propagation": true
      },
      "pattern-sources": [
        {
          "patterns": [
            {
              "pattern-inside": "def $FUNC(..., $REQUEST, ...):\n  ...\n"
            },
            {
              "focus-metavariable": "$REQUEST"
            },
            {
              "metavariable-pattern": {
                "metavariable": "$REQUEST",
                "patterns": [
                  {
                    "pattern": "request"
                  },
                  {
                    "pattern-not-inside": "request.build_absolute_uri"
                  }
                ]
              }
            }
          ]
        }
      ],
      "pattern-sinks": [
        {
          "patterns": [
            {
              "pattern-either": [
                {
                  "patterns": [
                    {
                      "pattern": "subprocess.$FUNC(...)"
                    },
                    {
                      "pattern-not": "subprocess.$FUNC(\"...\", ...)"
                    },
                    {
                      "pattern-not": "subprocess.$FUNC([\"...\", ...], ...)"
                    },
                    {
                      "pattern-not-inside": "$CMD = [\"...\", ...]\n...\nsubprocess.$FUNC($CMD, ...)\n"
                    }
                  ]
                },
                {
                  "patterns": [
                    {
                      "pattern": "subprocess.$FUNC([\"$SHELL\", \"-c\", ...], ...)"
                    },
                    {
                      "metavariable-regex": {
                        "metavariable": "$SHELL",
                        "regex": "^(sh|bash|ksh|csh|tcsh|zsh)$"
                      }
                    }
                  ]
                },
                {
                  "patterns": [
                    {
                      "pattern": "subprocess.$FUNC([\"$INTERPRETER\", ...], ...)"
                    },
                    {
                      "metavariable-regex": {
                        "metavariable": "$INTERPRETER",
                        "regex": "^(python|python\\d)$"
                      }
                    }
                  ]
                }
              ]
            }
          ]
        }
      ],
      "pattern-sanitizers": [
        {
          "patterns": [
            {
              "pattern": "$DICT[$KEY]"
            },
            {
              "focus-metavariable": "$KEY"
            }
          ]
        }
      ],
      "severity": "ERROR",
      "message": "Detected user input entering a `subprocess` call unsafely. This could result in a command injection vulnerability. An attacker could use this vulnerability to execute arbitrary commands on the host, which allows them to download malware, scan sensitive data, or run any command they wish on the server. Do not let users choose the command to run. In general, prefer to use Python API versions of system commands. If you must use subprocess, use a dictionary to allowlist a set of commands.",
      "metadata": {
        "category": "security",
        "technology": [
          "flask"
        ],
        "owasp": [
          "A01:2017 - Injection",
          "A03:2021 - Injection",
          "A05:2025 - Injection"
        ],
        "cwe": [
          "CWE-78: Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')"
        ],
        "references": [
          "https://semgrep.dev/docs/cheat-sheets/python-command-injection/"
        ],
        "confidence": "HIGH",
        "cwe2022-top25": true,
        "cwe2021-top25": true,
        "subcategory": [
          "vuln"
        ],
        "likelihood": "MEDIUM",
        "impact": "HIGH",
        "license": "Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license",
        "vulnerability_class": [
          "Command Injection"
        ],
        "source": "https://semgrep.dev/r/python.django.security.injection.command.subprocess-injection.subprocess-injection",
        "shortlink": "https://sg.run/49BE",
        "semgrep.dev": {
          "rule": {
            "r_id": 31144,
            "rv_id": 1263388,
            "rule_id": "EwUepx",
            "version_id": "7ZTE3qK",
            "url": "https://semgrep.dev/playground/r/7ZTE3qK/python.django.security.injection.command.subprocess-injection.subprocess-injection",
            "origin": "community"
          }
        }
      }
    },
    {
      "id": "python.django.security.injection.csv-writer-injection.csv-writer-injection",
      "languages": [
        "python"
      ],
      "message": "Detected user input into a generated CSV file using the built-in `csv` module. If user data is used to generate the data in this file, it is possible that an attacker could inject a formula when the CSV is imported into a spreadsheet application that runs an attacker script, which could steal data from the importing user or, at worst, install malware on the user's computer. `defusedcsv` is a drop-in replacement with the same API that will attempt to mitigate formula injection attempts. You can use `defusedcsv` instead of `csv` to safely generate CSVs.",
      "metadata": {
        "category": "security",
        "confidence": "MEDIUM",
        "cwe": [
          "CWE-1236: Improper Neutralization of Formula Elements in a CSV File"
        ],
        "owasp": [
          "A01:2017 - Injection",
          "A03:2021 - Injection",
          "A05:2025 - Injection"
        ],
        "references": [
          "https://github.com/raphaelm/defusedcsv",
          "https://owasp.org/www-community/attacks/CSV_Injection",
          "https://web.archive.org/web/20220516052229/https://www.contextis.com/us/blog/comma-separated-vulnerabilities"
        ],
        "technology": [
          "django",
          "python"
        ],
        "subcategory": [
          "vuln"
        ],
        "impact": "MEDIUM",
        "likelihood": "MEDIUM",
        "license": "Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license",
        "vulnerability_class": [
          "Improper Validation"
        ],
        "source": "https://semgrep.dev/r/python.django.security.injection.csv-writer-injection.csv-writer-injection",
        "shortlink": "https://sg.run/Pw9q",
        "semgrep.dev": {
          "rule": {
            "r_id": 31145,
            "rv_id": 1263389,
            "rule_id": "7KUK1y",
            "version_id": "LjTkgD9",
            "url": "https://semgrep.dev/playground/r/LjTkgD9/python.django.security.injection.csv-writer-injection.csv-writer-injection",
            "origin": "community"
          }
        }
      },
      "mode": "taint",
      "pattern-sinks": [
        {
          "patterns": [
            {
              "pattern-inside": "$WRITER = csv.writer(...)\n\n...\n\n$WRITER.$WRITE(...)\n"
            },
            {
              "pattern": "$WRITER.$WRITE(...)"
            },
            {
              "metavariable-regex": {
                "metavariable": "$WRITE",
                "regex": "^(writerow|writerows|writeheader)$"
              }
            }
          ]
        }
      ],
      "pattern-sources": [
        {
          "patterns": [
            {
              "pattern-inside": "def $FUNC(..., $REQUEST, ...):\n  ...\n"
            },
            {
              "focus-metavariable": "$REQUEST"
            },
            {
              "metavariable-pattern": {
                "metavariable": "$REQUEST",
                "patterns": [
                  {
                    "pattern": "request"
                  },
                  {
                    "pattern-not-inside": "request.build_absolute_uri"
                  }
                ]
              }
            }
          ]
        }
      ],
      "severity": "ERROR"
    },
    {
      "id": "python.cryptography.security.insecure-cipher-algorithms-arc4.insecure-cipher-algorithm-arc4",
      "message": "ARC4 (Alleged RC4) is a stream cipher with serious weaknesses in its initial stream output.  Its use is strongly discouraged. ARC4 does not use mode constructions. Use a strong symmetric cipher such as EAS instead. With the `cryptography` package it is recommended to use the `Fernet` which is a secure implementation of AES in CBC mode with a 128-bit key.  Alternatively, keep using the `Cipher` class from the hazmat primitives but use the AES algorithm instead.",
      "metadata": {
        "source-rule-url": "https://github.com/PyCQA/bandit/blob/d5f8fa0d89d7b11442fc6ec80ca42953974354c8/bandit/blacklists/calls.py#L98",
        "cwe": [
          "CWE-327: Use of a Broken or Risky Cryptographic Algorithm"
        ],
        "owasp": [
          "A03:2017 - Sensitive Data Exposure",
          "A02:2021 - Cryptographic Failures",
          "A04:2025 - Cryptographic Failures"
        ],
        "bandit-code": "B304",
        "references": [
          "https://cryptography.io/en/latest/hazmat/primitives/symmetric-encryption/#weak-ciphers"
        ],
        "category": "security",
        "technology": [
          "cryptography"
        ],
        "subcategory": [
          "vuln"
        ],
        "likelihood": "MEDIUM",
        "impact": "MEDIUM",
        "confidence": "MEDIUM",
        "functional-categories": [
          "crypto::search::symmetric-algorithm::cryptography"
        ],
        "license": "Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license",
        "vulnerability_class": [
          "Cryptographic Issues"
        ],
        "source": "https://semgrep.dev/r/python.cryptography.security.insecure-cipher-algorithms-arc4.insecure-cipher-algorithm-arc4",
        "shortlink": "https://sg.run/xoZL",
        "semgrep.dev": {
          "rule": {
            "r_id": 33630,
            "rv_id": 1263348,
            "rule_id": "KxU8gK",
            "version_id": "QkTGq3Q",
            "url": "https://semgrep.dev/playground/r/QkTGq3Q/python.cryptography.security.insecure-cipher-algorithms-arc4.insecure-cipher-algorithm-arc4",
            "origin": "community"
          }
        }
      },
      "severity": "WARNING",
      "languages": [
        "python"
      ],
      "patterns": [
        {
          "pattern": "cryptography.hazmat.primitives.ciphers.algorithms.$ARC4($KEY)"
        },
        {
          "pattern-inside": "cryptography.hazmat.primitives.ciphers.Cipher(...)"
        },
        {
          "metavariable-regex": {
            "metavariable": "$ARC4",
            "regex": "^(ARC4)$"
          }
        },
        {
          "focus-metavariable": "$ARC4"
        }
      ],
      "fix": "AES"
    },
    {
      "id": "python.cryptography.security.insecure-cipher-algorithms-blowfish.insecure-cipher-algorithm-blowfish",
      "message": "Blowfish is a block cipher developed by Bruce Schneier. It is known to be susceptible to attacks when using weak keys.  The author has recommended that users of Blowfish move to newer algorithms such as AES. With the `cryptography` package it is recommended to use `Fernet` which is a secure implementation of AES in CBC mode with a 128-bit key.  Alternatively, keep using the `Cipher` class from the hazmat primitives but use the AES algorithm instead.",
      "metadata": {
        "source-rule-url": "https://github.com/PyCQA/bandit/blob/d5f8fa0d89d7b11442fc6ec80ca42953974354c8/bandit/blacklists/calls.py#L98",
        "cwe": [
          "CWE-327: Use of a Broken or Risky Cryptographic Algorithm"
        ],
        "owasp": [
          "A03:2017 - Sensitive Data Exposure",
          "A02:2021 - Cryptographic Failures",
          "A04:2025 - Cryptographic Failures"
        ],
        "bandit-code": "B304",
        "references": [
          "https://cryptography.io/en/latest/hazmat/primitives/symmetric-encryption/#weak-ciphers",
          "https://tools.ietf.org/html/rfc5469"
        ],
        "category": "security",
        "technology": [
          "cryptography"
        ],
        "subcategory": [
          "vuln"
        ],
        "likelihood": "MEDIUM",
        "impact": "MEDIUM",
        "confidence": "MEDIUM",
        "functional-categories": [
          "crypto::search::symmetric-algorithm::cryptography"
        ],
        "license": "Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license",
        "vulnerability_class": [
          "Cryptographic Issues"
        ],
        "source": "https://semgrep.dev/r/python.cryptography.security.insecure-cipher-algorithms-blowfish.insecure-cipher-algorithm-blowfish",
        "shortlink": "https://sg.run/OdzL",
        "semgrep.dev": {
          "rule": {
            "r_id": 33631,
            "rv_id": 1263349,
            "rule_id": "qNULvO",
            "version_id": "3ZT4XK7",
            "url": "https://semgrep.dev/playground/r/3ZT4XK7/python.cryptography.security.insecure-cipher-algorithms-blowfish.insecure-cipher-algorithm-blowfish",
            "origin": "community"
          }
        }
      },
      "severity": "WARNING",
      "languages": [
        "python"
      ],
      "patterns": [
        {
          "pattern": "cryptography.hazmat.primitives.ciphers.algorithms.$BLOWFISH($KEY)"
        },
        {
          "metavariable-regex": {
            "metavariable": "$BLOWFISH",
            "regex": "^(Blowfish)$"
          }
        },
        {
          "focus-metavariable": "$BLOWFISH"
        }
      ],
      "fix": "AES"
    },
    {
      "id": "python.cryptography.security.insecure-hash-algorithms-md5.insecure-hash-algorithm-md5",
      "message": "Detected MD5 hash algorithm which is considered insecure. MD5 is not collision resistant and is therefore not suitable as a cryptographic signature. Use SHA256 or SHA3 instead.",
      "metadata": {
        "source-rule-url": "https://github.com/PyCQA/bandit/blob/d5f8fa0d89d7b11442fc6ec80ca42953974354c8/bandit/blacklists/calls.py#L59",
        "cwe": [
          "CWE-327: Use of a Broken or Risky Cryptographic Algorithm"
        ],
        "owasp": [
          "A03:2017 - Sensitive Data Exposure",
          "A02:2021 - Cryptographic Failures",
          "A04:2025 - Cryptographic Failures"
        ],
        "bandit-code": "B303",
        "references": [
          "https://cryptography.io/en/latest/hazmat/primitives/cryptographic-hashes/#md5",
          "https://www.schneier.com/blog/archives/2012/10/when_will_we_se.html",
          "https://www.trendmicro.com/vinfo/us/security/news/vulnerabilities-and-exploits/sha-1-collision-signals-the-end-of-the-algorithm-s-viability",
          "http://2012.sharcs.org/slides/stevens.pdf",
          "https://pycryptodome.readthedocs.io/en/latest/src/hash/sha3_256.html"
        ],
        "category": "security",
        "technology": [
          "cryptography"
        ],
        "subcategory": [
          "vuln"
        ],
        "likelihood": "LOW",
        "impact": "MEDIUM",
        "confidence": "MEDIUM",
        "functional-categories": [
          "crypto::search::symmetric-algorithm::cryptography"
        ],
        "license": "Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license",
        "vulnerability_class": [
          "Cryptographic Issues"
        ],
        "source": "https://semgrep.dev/r/python.cryptography.security.insecure-hash-algorithms-md5.insecure-hash-algorithm-md5",
        "shortlink": "https://sg.run/eY88",
        "semgrep.dev": {
          "rule": {
            "r_id": 33632,
            "rv_id": 1263352,
            "rule_id": "lBUopp",
            "version_id": "JdTzxww",
            "url": "https://semgrep.dev/playground/r/JdTzxww/python.cryptography.security.insecure-hash-algorithms-md5.insecure-hash-algorithm-md5",
            "origin": "community"
          }
        }
      },
      "severity": "WARNING",
      "languages": [
        "python"
      ],
      "patterns": [
        {
          "pattern": "cryptography.hazmat.primitives.hashes.$MD5()"
        },
        {
          "metavariable-regex": {
            "metavariable": "$MD5",
            "regex": "^(MD5)$"
          }
        },
        {
          "focus-metavariable": "$MD5"
        }
      ],
      "fix": "SHA256"
    },
    {
      "id": "python.lang.security.insecure-hash-algorithms-md5.insecure-hash-algorithm-md5",
      "patterns": [
        {
          "pattern": "hashlib.md5(...)"
        },
        {
          "pattern-not": "hashlib.md5(..., usedforsecurity=False, ...)"
        }
      ],
      "message": "Detected MD5 hash algorithm which is considered insecure. MD5 is not collision resistant and is therefore not suitable as a cryptographic signature. Use SHA256 or SHA3 instead.",
      "metadata": {
        "source-rule-url": "https://github.com/PyCQA/bandit/blob/d5f8fa0d89d7b11442fc6ec80ca42953974354c8/bandit/blacklists/calls.py#L59",
        "cwe": [
          "CWE-327: Use of a Broken or Risky Cryptographic Algorithm"
        ],
        "owasp": [
          "A03:2017 - Sensitive Data Exposure",
          "A02:2021 - Cryptographic Failures",
          "A04:2025 - Cryptographic Failures"
        ],
        "bandit-code": "B303",
        "asvs": {
          "section": "V6 Stored Cryptography Verification Requirements",
          "control_id": "6.2.2 Insecure Custom Algorithm",
          "control_url": "https://github.com/OWASP/ASVS/blob/master/4.0/en/0x14-V6-Cryptography.md#v62-algorithms",
          "version": "4"
        },
        "references": [
          "https://www.schneier.com/blog/archives/2012/10/when_will_we_se.html",
          "https://www.trendmicro.com/vinfo/us/security/news/vulnerabilities-and-exploits/sha-1-collision-signals-the-end-of-the-algorithm-s-viability",
          "http://2012.sharcs.org/slides/stevens.pdf",
          "https://pycryptodome.readthedocs.io/en/latest/src/hash/sha3_256.html"
        ],
        "category": "security",
        "technology": [
          "python"
        ],
        "subcategory": [
          "vuln"
        ],
        "likelihood": "LOW",
        "impact": "MEDIUM",
        "confidence": "MEDIUM",
        "license": "Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license",
        "vulnerability_class": [
          "Cryptographic Issues"
        ],
        "source": "https://semgrep.dev/r/python.lang.security.insecure-hash-algorithms-md5.insecure-hash-algorithm-md5",
        "shortlink": "https://sg.run/vYrY",
        "semgrep.dev": {
          "rule": {
            "r_id": 33633,
            "rv_id": 1263536,
            "rule_id": "PeU2e2",
            "version_id": "kbTzGE1",
            "url": "https://semgrep.dev/playground/r/kbTzGE1/python.lang.security.insecure-hash-algorithms-md5.insecure-hash-algorithm-md5",
            "origin": "community"
          }
        }
      },
      "severity": "WARNING",
      "languages": [
        "python"
      ]
    },
    {
      "id": "python.pycryptodome.security.insecure-cipher-algorithm-blowfish.insecure-cipher-algorithm-blowfish",
      "message": "Detected Blowfish cipher algorithm which is considered insecure. This algorithm is not cryptographically secure and can be reversed easily. Use secure stream ciphers such as ChaCha20, XChaCha20 and Salsa20, or a block cipher such as AES with a block size of 128 bits. When using a block cipher, use a modern mode of operation that also provides authentication, such as GCM.",
      "metadata": {
        "source-rule-url": "https://github.com/PyCQA/bandit/blob/d5f8fa0d89d7b11442fc6ec80ca42953974354c8/bandit/blacklists/calls.py#L84",
        "cwe": [
          "CWE-327: Use of a Broken or Risky Cryptographic Algorithm"
        ],
        "owasp": [
          "A03:2017 - Sensitive Data Exposure",
          "A02:2021 - Cryptographic Failures",
          "A04:2025 - Cryptographic Failures"
        ],
        "bandit-code": "B304",
        "references": [
          "https://stackoverflow.com/questions/1135186/whats-wrong-with-xor-encryption",
          "https://www.pycryptodome.org/src/cipher/cipher"
        ],
        "category": "security",
        "technology": [
          "pycryptodome"
        ],
        "subcategory": [
          "vuln"
        ],
        "likelihood": "LOW",
        "impact": "MEDIUM",
        "confidence": "HIGH",
        "functional-categories": [
          "crypto::search::symmetric-algorithm::pycryptodome",
          "crypto::search::symmetric-algorithm::pycryptodomex"
        ],
        "license": "Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license",
        "vulnerability_class": [
          "Cryptographic Issues"
        ],
        "source": "https://semgrep.dev/r/python.pycryptodome.security.insecure-cipher-algorithm-blowfish.insecure-cipher-algorithm-blowfish",
        "shortlink": "https://sg.run/dlOE",
        "semgrep.dev": {
          "rule": {
            "r_id": 33634,
            "rv_id": 1263545,
            "rule_id": "JDUGnK",
            "version_id": "ExTExln",
            "url": "https://semgrep.dev/playground/r/ExTExln/python.pycryptodome.security.insecure-cipher-algorithm-blowfish.insecure-cipher-algorithm-blowfish",
            "origin": "community"
          }
        }
      },
      "options": {
        "symbolic_propagation": true
      },
      "severity": "WARNING",
      "languages": [
        "python"
      ],
      "pattern-either": [
        {
          "pattern": "Cryptodome.Cipher.Blowfish.new(...)"
        },
        {
          "pattern": "Crypto.Cipher.Blowfish.new(...)"
        }
      ]
    },
    {
      "id": "python.pycryptodome.security.insecure-cipher-algorithm-des.insecure-cipher-algorithm-des",
      "message": "Detected DES cipher or Triple DES algorithm which is considered insecure. This algorithm is not cryptographically secure and can be reversed easily. Use a secure symmetric cipher from the cryptodome package instead. Use secure stream ciphers such as ChaCha20, XChaCha20 and Salsa20, or a block cipher such as AES with a block size of 128 bits. When using a block cipher, use a modern mode of operation that also provides authentication, such as GCM.",
      "metadata": {
        "source-rule-url": "https://github.com/PyCQA/bandit/blob/d5f8fa0d89d7b11442fc6ec80ca42953974354c8/bandit/blacklists/calls.py#L84",
        "cwe": [
          "CWE-327: Use of a Broken or Risky Cryptographic Algorithm"
        ],
        "owasp": [
          "A03:2017 - Sensitive Data Exposure",
          "A02:2021 - Cryptographic Failures",
          "A04:2025 - Cryptographic Failures"
        ],
        "bandit-code": "B304",
        "references": [
          "https://cwe.mitre.org/data/definitions/326.html",
          "https://www.pycryptodome.org/src/cipher/cipher"
        ],
        "category": "security",
        "technology": [
          "pycryptodome"
        ],
        "subcategory": [
          "vuln"
        ],
        "likelihood": "LOW",
        "impact": "MEDIUM",
        "confidence": "HIGH",
        "functional-categories": [
          "crypto::search::symmetric-algorithm::pycryptodome",
          "crypto::search::symmetric-algorithm::pycryptodomex"
        ],
        "license": "Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license",
        "vulnerability_class": [
          "Cryptographic Issues"
        ],
        "source": "https://semgrep.dev/r/python.pycryptodome.security.insecure-cipher-algorithm-des.insecure-cipher-algorithm-des",
        "shortlink": "https://sg.run/Z5bw",
        "semgrep.dev": {
          "rule": {
            "r_id": 33635,
            "rv_id": 1263546,
            "rule_id": "5rUr73",
            "version_id": "7ZTE3G7",
            "url": "https://semgrep.dev/playground/r/7ZTE3G7/python.pycryptodome.security.insecure-cipher-algorithm-des.insecure-cipher-algorithm-des",
            "origin": "community"
          }
        }
      },
      "options": {
        "symbolic_propagation": true
      },
      "severity": "WARNING",
      "languages": [
        "python"
      ],
      "pattern-either": [
        {
          "pattern": "Cryptodome.Cipher.DES.new(...)"
        },
        {
          "pattern": "Crypto.Cipher.DES.new(...)"
        },
        {
          "pattern": "Cryptodome.Cipher.DES3.new(...)"
        },
        {
          "pattern": "Crypto.Cipher.DES3.new(...)"
        }
      ]
    },
    {
      "id": "python.pycryptodome.security.insecure-cipher-algorithm-rc2.insecure-cipher-algorithm-rc2",
      "message": "Detected RC2 cipher algorithm which is considered insecure. This algorithm is not cryptographically secure and can be reversed easily. Use secure stream ciphers such as ChaCha20, XChaCha20 and Salsa20, or a block cipher such as AES with a block size of 128 bits. When using a block cipher, use a modern mode of operation that also provides authentication, such as GCM.",
      "metadata": {
        "source-rule-url": "https://github.com/PyCQA/bandit/blob/d5f8fa0d89d7b11442fc6ec80ca42953974354c8/bandit/blacklists/calls.py#L84",
        "cwe": [
          "CWE-327: Use of a Broken or Risky Cryptographic Algorithm"
        ],
        "owasp": [
          "A03:2017 - Sensitive Data Exposure",
          "A02:2021 - Cryptographic Failures",
          "A04:2025 - Cryptographic Failures"
        ],
        "bandit-code": "B304",
        "references": [
          "https://cwe.mitre.org/data/definitions/326.html",
          "https://www.pycryptodome.org/src/cipher/cipher"
        ],
        "category": "security",
        "technology": [
          "pycryptodome"
        ],
        "subcategory": [
          "vuln"
        ],
        "likelihood": "LOW",
        "impact": "MEDIUM",
        "confidence": "HIGH",
        "functional-categories": [
          "crypto::search::symmetric-algorithm::pycryptodome",
          "crypto::search::symmetric-algorithm::pycryptodomex"
        ],
        "license": "Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license",
        "vulnerability_class": [
          "Cryptographic Issues"
        ],
        "source": "https://semgrep.dev/r/python.pycryptodome.security.insecure-cipher-algorithm-rc2.insecure-cipher-algorithm-rc2",
        "shortlink": "https://sg.run/nAbY",
        "semgrep.dev": {
          "rule": {
            "r_id": 33636,
            "rv_id": 1263547,
            "rule_id": "GdUYlW",
            "version_id": "LjTkgn6",
            "url": "https://semgrep.dev/playground/r/LjTkgn6/python.pycryptodome.security.insecure-cipher-algorithm-rc2.insecure-cipher-algorithm-rc2",
            "origin": "community"
          }
        }
      },
      "options": {
        "symbolic_propagation": true
      },
      "severity": "WARNING",
      "languages": [
        "python"
      ],
      "pattern-either": [
        {
          "pattern": "Cryptodome.Cipher.ARC2.new(...)"
        },
        {
          "pattern": "Crypto.Cipher.ARC2.new(...)"
        }
      ]
    },
    {
      "id": "python.pycryptodome.security.insecure-cipher-algorithm-rc4.insecure-cipher-algorithm-rc4",
      "message": "Detected ARC4 cipher algorithm which is considered insecure. This algorithm is not cryptographically secure and can be reversed easily. Use secure stream ciphers such as ChaCha20, XChaCha20 and Salsa20, or a block cipher such as AES with a block size of 128 bits. When using a block cipher, use a modern mode of operation that also provides authentication, such as GCM.",
      "metadata": {
        "source-rule-url": "https://github.com/PyCQA/bandit/blob/d5f8fa0d89d7b11442fc6ec80ca42953974354c8/bandit/blacklists/calls.py#L84",
        "cwe": [
          "CWE-327: Use of a Broken or Risky Cryptographic Algorithm"
        ],
        "owasp": [
          "A03:2017 - Sensitive Data Exposure",
          "A02:2021 - Cryptographic Failures",
          "A04:2025 - Cryptographic Failures"
        ],
        "bandit-code": "B304",
        "references": [
          "https://cwe.mitre.org/data/definitions/326.html",
          "https://www.pycryptodome.org/src/cipher/cipher"
        ],
        "category": "security",
        "technology": [
          "pycryptodome"
        ],
        "subcategory": [
          "vuln"
        ],
        "likelihood": "LOW",
        "impact": "MEDIUM",
        "confidence": "HIGH",
        "functional-categories": [
          "crypto::search::symmetric-algorithm::pycryptodome",
          "crypto::search::symmetric-algorithm::pycryptodomex"
        ],
        "license": "Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license",
        "vulnerability_class": [
          "Cryptographic Issues"
        ],
        "source": "https://semgrep.dev/r/python.pycryptodome.security.insecure-cipher-algorithm-rc4.insecure-cipher-algorithm-rc4",
        "shortlink": "https://sg.run/Eo6N",
        "semgrep.dev": {
          "rule": {
            "r_id": 33637,
            "rv_id": 1263548,
            "rule_id": "ReUnEB",
            "version_id": "8KT5rXY",
            "url": "https://semgrep.dev/playground/r/8KT5rXY/python.pycryptodome.security.insecure-cipher-algorithm-rc4.insecure-cipher-algorithm-rc4",
            "origin": "community"
          }
        }
      },
      "severity": "WARNING",
      "languages": [
        "python"
      ],
      "pattern-either": [
        {
          "pattern": "Cryptodome.Cipher.ARC4.new(...)"
        },
        {
          "pattern": "Crypto.Cipher.ARC4.new(...)"
        }
      ]
    },
    {
      "id": "python.pycryptodome.security.insecure-hash-algorithm-md2.insecure-hash-algorithm-md2",
      "message": "Detected MD2 hash algorithm which is considered insecure. MD2 is not collision resistant and is therefore not suitable as a cryptographic signature.  Use a modern hash algorithm from the SHA-2, SHA-3, or BLAKE2 family instead.",
      "metadata": {
        "source-rule-url": "https://github.com/PyCQA/bandit/blob/d5f8fa0d89d7b11442fc6ec80ca42953974354c8/bandit/blacklists/calls.py#L59",
        "cwe": [
          "CWE-327: Use of a Broken or Risky Cryptographic Algorithm"
        ],
        "owasp": [
          "A03:2017 - Sensitive Data Exposure",
          "A02:2021 - Cryptographic Failures",
          "A04:2025 - Cryptographic Failures"
        ],
        "references": [
          "https://www.pycryptodome.org/src/hash/hash#modern-hash-algorithms",
          "https://www.schneier.com/blog/archives/2012/10/when_will_we_se.html",
          "https://www.trendmicro.com/vinfo/us/security/news/vulnerabilities-and-exploits/sha-1-collision-signals-the-end-of-the-algorithm-s-viability",
          "http://2012.sharcs.org/slides/stevens.pdf",
          "https://pycryptodome.readthedocs.io/en/latest/src/hash/sha3_256.html"
        ],
        "category": "security",
        "technology": [
          "pycryptodome"
        ],
        "subcategory": [
          "vuln"
        ],
        "likelihood": "LOW",
        "impact": "MEDIUM",
        "confidence": "HIGH",
        "functional-categories": [
          "crypto::search::hash-algorithm::pycryptodome",
          "crypto::search::hash-algorithm::pycryptodomex"
        ],
        "license": "Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license",
        "vulnerability_class": [
          "Cryptographic Issues"
        ],
        "source": "https://semgrep.dev/r/python.pycryptodome.security.insecure-hash-algorithm-md2.insecure-hash-algorithm-md2",
        "shortlink": "https://sg.run/7JP2",
        "semgrep.dev": {
          "rule": {
            "r_id": 33638,
            "rv_id": 1263550,
            "rule_id": "AbU0Ex",
            "version_id": "QkTGqD8",
            "url": "https://semgrep.dev/playground/r/QkTGqD8/python.pycryptodome.security.insecure-hash-algorithm-md2.insecure-hash-algorithm-md2",
            "origin": "community"
          }
        }
      },
      "options": {
        "symbolic_propagation": true
      },
      "severity": "WARNING",
      "languages": [
        "python"
      ],
      "pattern-either": [
        {
          "pattern": "Crypto.Hash.MD2.new(...)"
        },
        {
          "pattern": "Cryptodome.Hash.MD2.new (...)"
        }
      ]
    },
    {
      "id": "python.pycryptodome.security.insecure-hash-algorithm-md4.insecure-hash-algorithm-md4",
      "message": "Detected MD4 hash algorithm which is considered insecure. MD4 is not collision resistant and is therefore not suitable as a cryptographic signature. Use a modern hash algorithm from the SHA-2, SHA-3, or BLAKE2 family instead.",
      "metadata": {
        "source-rule-url": "https://github.com/PyCQA/bandit/blob/d5f8fa0d89d7b11442fc6ec80ca42953974354c8/bandit/blacklists/calls.py#L59",
        "cwe": [
          "CWE-327: Use of a Broken or Risky Cryptographic Algorithm"
        ],
        "owasp": [
          "A03:2017 - Sensitive Data Exposure",
          "A02:2021 - Cryptographic Failures",
          "A04:2025 - Cryptographic Failures"
        ],
        "references": [
          "https://www.pycryptodome.org/src/hash/hash#modern-hash-algorithms",
          "https://www.schneier.com/blog/archives/2012/10/when_will_we_se.html",
          "https://www.trendmicro.com/vinfo/us/security/news/vulnerabilities-and-exploits/sha-1-collision-signals-the-end-of-the-algorithm-s-viability",
          "http://2012.sharcs.org/slides/stevens.pdf",
          "https://pycryptodome.readthedocs.io/en/latest/src/hash/sha3_256.html"
        ],
        "category": "security",
        "technology": [
          "pycryptodome"
        ],
        "subcategory": [
          "vuln"
        ],
        "likelihood": "LOW",
        "impact": "MEDIUM",
        "confidence": "HIGH",
        "functional-categories": [
          "crypto::search::hash-algorithm::pycryptodome",
          "crypto::search::hash-algorithm::pycryptodomex"
        ],
        "license": "Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license",
        "vulnerability_class": [
          "Cryptographic Issues"
        ],
        "source": "https://semgrep.dev/r/python.pycryptodome.security.insecure-hash-algorithm-md4.insecure-hash-algorithm-md4",
        "shortlink": "https://sg.run/Lve6",
        "semgrep.dev": {
          "rule": {
            "r_id": 33639,
            "rv_id": 1263551,
            "rule_id": "BYUJy4",
            "version_id": "3ZT4Xnp",
            "url": "https://semgrep.dev/playground/r/3ZT4Xnp/python.pycryptodome.security.insecure-hash-algorithm-md4.insecure-hash-algorithm-md4",
            "origin": "community"
          }
        }
      },
      "options": {
        "symbolic_propagation": true
      },
      "severity": "WARNING",
      "languages": [
        "python"
      ],
      "pattern-either": [
        {
          "pattern": "Crypto.Hash.MD4.new(...)"
        },
        {
          "pattern": "Cryptodome.Hash.MD4.new (...)"
        }
      ]
    },
    {
      "id": "python.pycryptodome.security.insecure-hash-algorithm-md5.insecure-hash-algorithm-md5",
      "message": "Detected MD5 hash algorithm which is considered insecure. MD5 is not collision resistant and is therefore not suitable as a cryptographic signature.  Use a modern hash algorithm from the SHA-2, SHA-3, or BLAKE2 family instead.",
      "metadata": {
        "source-rule-url": "https://github.com/PyCQA/bandit/blob/d5f8fa0d89d7b11442fc6ec80ca42953974354c8/bandit/blacklists/calls.py#L59",
        "cwe": [
          "CWE-327: Use of a Broken or Risky Cryptographic Algorithm"
        ],
        "owasp": [
          "A03:2017 - Sensitive Data Exposure",
          "A02:2021 - Cryptographic Failures",
          "A04:2025 - Cryptographic Failures"
        ],
        "references": [
          "https://www.pycryptodome.org/src/hash/hash#modern-hash-algorithms",
          "https://www.schneier.com/blog/archives/2012/10/when_will_we_se.html",
          "https://www.trendmicro.com/vinfo/us/security/news/vulnerabilities-and-exploits/sha-1-collision-signals-the-end-of-the-algorithm-s-viability",
          "http://2012.sharcs.org/slides/stevens.pdf",
          "https://pycryptodome.readthedocs.io/en/latest/src/hash/sha3_256.html"
        ],
        "category": "security",
        "technology": [
          "pycryptodome"
        ],
        "subcategory": [
          "vuln"
        ],
        "likelihood": "LOW",
        "impact": "MEDIUM",
        "confidence": "HIGH",
        "functional-categories": [
          "crypto::search::hash-algorithm::pycryptodome",
          "crypto::search::hash-algorithm::pycryptodomex"
        ],
        "license": "Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license",
        "vulnerability_class": [
          "Cryptographic Issues"
        ],
        "source": "https://semgrep.dev/r/python.pycryptodome.security.insecure-hash-algorithm-md5.insecure-hash-algorithm-md5",
        "shortlink": "https://sg.run/85JN",
        "semgrep.dev": {
          "rule": {
            "r_id": 33640,
            "rv_id": 1263552,
            "rule_id": "DbUXwo",
            "version_id": "44TEjpk",
            "url": "https://semgrep.dev/playground/r/44TEjpk/python.pycryptodome.security.insecure-hash-algorithm-md5.insecure-hash-algorithm-md5",
            "origin": "community"
          }
        }
      },
      "options": {
        "symbolic_propagation": true
      },
      "severity": "WARNING",
      "languages": [
        "python"
      ],
      "pattern-either": [
        {
          "pattern": "Crypto.Hash.MD5.new(...)"
        },
        {
          "pattern": "Cryptodome.Hash.MD5.new (...)"
        }
      ]
    },
    {
      "id": "python.cryptography.security.empty-aes-key.empty-aes-key",
      "message": "Potential empty AES encryption key. Using an empty key in AES encryption can result in weak encryption and may allow attackers to easily decrypt sensitive data. Ensure that a strong, non-empty key is used for AES encryption.",
      "patterns": [
        {
          "pattern": "AES.new(\"\",...)"
        }
      ],
      "languages": [
        "python"
      ],
      "severity": "WARNING",
      "metadata": {
        "cwe": [
          "CWE-327: Use of a Broken or Risky Cryptographic Algorithm",
          "CWE-310: Cryptographic Issues"
        ],
        "references": [
          "https://cwe.mitre.org/data/definitions/327.html",
          "https://cwe.mitre.org/data/definitions/310.html"
        ],
        "category": "security",
        "subcategory": [
          "vuln"
        ],
        "likelihood": "MEDIUM",
        "impact": "HIGH",
        "confidence": "MEDIUM",
        "owasp": "A6:2017 misconfiguration",
        "functional-categories": [
          "crypto::search::key-length::pycrypto",
          "crypto::search::key-length::pycryptodome"
        ],
        "technology": [
          "python",
          "pycrypto",
          "pycryptodome"
        ],
        "license": "Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license",
        "vulnerability_class": [
          "Cryptographic Issues"
        ],
        "source": "https://semgrep.dev/r/python.cryptography.security.empty-aes-key.empty-aes-key",
        "shortlink": "https://sg.run/zQ9G",
        "semgrep.dev": {
          "rule": {
            "r_id": 44817,
            "rv_id": 946105,
            "rule_id": "OrUADK",
            "version_id": "8KTKjRg",
            "url": "https://semgrep.dev/playground/r/8KTKjRg/python.cryptography.security.empty-aes-key.empty-aes-key",
            "origin": "community"
          }
        }
      }
    },
    {
      "id": "python.django.security.hashids-with-django-secret.hashids-with-django-secret",
      "languages": [
        "python"
      ],
      "message": "The Django secret key is used as salt in HashIDs. The HashID mechanism is not secure. By observing sufficient HashIDs, the salt used to construct them can be recovered. This means the Django secret key can be obtained by attackers, through the HashIDs.",
      "metadata": {
        "category": "security",
        "subcategory": [
          "vuln"
        ],
        "cwe": [
          "CWE-327: Use of a Broken or Risky Cryptographic Algorithm"
        ],
        "owasp": [
          "A02:2021 \u2013 Cryptographic Failures"
        ],
        "references": [
          "https://docs.djangoproject.com/en/4.2/ref/settings/#std-setting-SECRET_KEY",
          "http://carnage.github.io/2015/08/cryptanalysis-of-hashids"
        ],
        "technology": [
          "django"
        ],
        "likelihood": "LOW",
        "impact": "HIGH",
        "confidence": "HIGH",
        "license": "Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license",
        "vulnerability_class": [
          "Cryptographic Issues"
        ],
        "source": "https://semgrep.dev/r/python.django.security.hashids-with-django-secret.hashids-with-django-secret",
        "shortlink": "https://sg.run/bxeZ",
        "semgrep.dev": {
          "rule": {
            "r_id": 72426,
            "rv_id": 946163,
            "rule_id": "0oUXqy",
            "version_id": "0bT15nn",
            "url": "https://semgrep.dev/playground/r/0bT15nn/python.django.security.hashids-with-django-secret.hashids-with-django-secret",
            "origin": "community"
          }
        }
      },
      "pattern-either": [
        {
          "pattern": "hashids.Hashids(..., salt=django.conf.settings.SECRET_KEY, ...)"
        },
        {
          "pattern": "hashids.Hashids(django.conf.settings.SECRET_KEY, ...)"
        }
      ],
      "severity": "ERROR"
    },
    {
      "id": "python.flask.security.hashids-with-flask-secret.hashids-with-flask-secret",
      "languages": [
        "python"
      ],
      "message": "The Flask secret key is used as salt in HashIDs. The HashID mechanism is not secure. By observing sufficient HashIDs, the salt used to construct them can be recovered. This means the Flask secret key can be obtained by attackers, through the HashIDs.",
      "metadata": {
        "category": "security",
        "subcategory": [
          "vuln"
        ],
        "cwe": [
          "CWE-327: Use of a Broken or Risky Cryptographic Algorithm"
        ],
        "owasp": [
          "A02:2021 \u2013 Cryptographic Failures"
        ],
        "references": [
          "https://flask.palletsprojects.com/en/2.2.x/config/#SECRET_KEY",
          "http://carnage.github.io/2015/08/cryptanalysis-of-hashids"
        ],
        "technology": [
          "flask"
        ],
        "likelihood": "LOW",
        "impact": "HIGH",
        "confidence": "HIGH",
        "license": "Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license",
        "vulnerability_class": [
          "Cryptographic Issues"
        ],
        "source": "https://semgrep.dev/r/python.flask.security.hashids-with-flask-secret.hashids-with-flask-secret",
        "shortlink": "https://sg.run/N0Rx",
        "semgrep.dev": {
          "rule": {
            "r_id": 72427,
            "rv_id": 946220,
            "rule_id": "KxUX3z",
            "version_id": "0bT15Px",
            "url": "https://semgrep.dev/playground/r/0bT15Px/python.flask.security.hashids-with-flask-secret.hashids-with-flask-secret",
            "origin": "community"
          }
        }
      },
      "pattern-either": [
        {
          "pattern": "hashids.Hashids(..., salt=flask.current_app.config['SECRET_KEY'], ...)"
        },
        {
          "pattern": "hashids.Hashids(flask.current_app.config['SECRET_KEY'], ...)"
        },
        {
          "patterns": [
            {
              "pattern-inside": "$APP = flask.Flask(...)\n...\n"
            },
            {
              "pattern-either": [
                {
                  "pattern": "hashids.Hashids(..., salt=$APP.config['SECRET_KEY'], ...)"
                },
                {
                  "pattern": "hashids.Hashids($APP.config['SECRET_KEY'], ...)"
                }
              ]
            }
          ]
        }
      ],
      "severity": "ERROR"
    },
    {
      "id": "python.lang.security.use-defused-xml-parse.use-defused-xml-parse",
      "metadata": {
        "owasp": [
          "A04:2017 - XML External Entities (XXE)",
          "A05:2021 - Security Misconfiguration",
          "A02:2025 - Security Misconfiguration"
        ],
        "cwe": [
          "CWE-611: Improper Restriction of XML External Entity Reference"
        ],
        "references": [
          "https://docs.python.org/3/library/xml.html",
          "https://github.com/tiran/defusedxml",
          "https://owasp.org/www-community/vulnerabilities/XML_External_Entity_(XXE)_Processing"
        ],
        "category": "security",
        "technology": [
          "python"
        ],
        "cwe2022-top25": true,
        "cwe2021-top25": true,
        "subcategory": [
          "vuln"
        ],
        "likelihood": "LOW",
        "impact": "MEDIUM",
        "confidence": "MEDIUM",
        "license": "Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license",
        "vulnerability_class": [
          "XML Injection"
        ],
        "source": "https://semgrep.dev/r/python.lang.security.use-defused-xml-parse.use-defused-xml-parse",
        "shortlink": "https://sg.run/n3jG",
        "semgrep.dev": {
          "rule": {
            "r_id": 72436,
            "rv_id": 1263541,
            "rule_id": "X5Uqnx",
            "version_id": "vdT06ER",
            "url": "https://semgrep.dev/playground/r/vdT06ER/python.lang.security.use-defused-xml-parse.use-defused-xml-parse",
            "origin": "community"
          }
        }
      },
      "message": "The native Python `xml` library is vulnerable to XML External Entity (XXE) attacks.  These attacks can leak confidential data and \"XML bombs\" can cause denial of service. Do not use this library to parse untrusted input. Instead  the Python documentation recommends using `defusedxml`.",
      "languages": [
        "python"
      ],
      "severity": "ERROR",
      "patterns": [
        {
          "pattern": "xml.etree.ElementTree.parse($...ARGS)"
        },
        {
          "pattern-not": "xml.etree.ElementTree.parse(\"...\")"
        }
      ],
      "fix": "defusedxml.etree.ElementTree.parse($...ARGS)"
    },
    {
      "id": "python.django.security.django-using-request-post-after-is-valid.django-using-request-post-after-is-valid",
      "patterns": [
        {
          "pattern-inside": "def $FUNC(request, ...):\n  ...\n"
        },
        {
          "pattern-inside": "if $FORM.is_valid():\n  ...\n"
        },
        {
          "pattern-either": [
            {
              "pattern": "request.POST[...]"
            },
            {
              "pattern": "request.POST.get(...)"
            }
          ]
        }
      ],
      "message": "Use $FORM.cleaned_data[] instead of request.POST[] after form.is_valid() has been executed to only access sanitized data",
      "languages": [
        "python"
      ],
      "severity": "WARNING",
      "metadata": {
        "category": "security",
        "cwe": "CWE-20: Improper Input Validation",
        "references": [
          "https://docs.djangoproject.com/en/4.2/ref/forms/api/#accessing-clean-data"
        ],
        "confidence": "MEDIUM",
        "likelihood": "MEDIUM",
        "impact": "MEDIUM",
        "subcategory": [
          "audit"
        ],
        "technology": [
          "django"
        ],
        "license": "Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license",
        "vulnerability_class": [
          "Improper Validation"
        ],
        "source": "https://semgrep.dev/r/python.django.security.django-using-request-post-after-is-valid.django-using-request-post-after-is-valid",
        "shortlink": "https://sg.run/kJn7",
        "semgrep.dev": {
          "rule": {
            "r_id": 73472,
            "rv_id": 946161,
            "rule_id": "JDUjqx",
            "version_id": "DkTNpEJ",
            "url": "https://semgrep.dev/playground/r/DkTNpEJ/python.django.security.django-using-request-post-after-is-valid.django-using-request-post-after-is-valid",
            "origin": "community"
          }
        }
      }
    },
    {
      "id": "python.fastapi.security.wildcard-cors.wildcard-cors",
      "languages": [
        "python"
      ],
      "message": "CORS policy allows any origin (using wildcard '*'). This is insecure and should be avoided.",
      "mode": "taint",
      "pattern-sources": [
        {
          "pattern": "[..., \"*\", ...]"
        }
      ],
      "pattern-sinks": [
        {
          "patterns": [
            {
              "pattern": "$APP.add_middleware(\n  CORSMiddleware,\n  allow_origins=$ORIGIN,\n  ...);\n"
            },
            {
              "focus-metavariable": "$ORIGIN"
            }
          ]
        }
      ],
      "severity": "WARNING",
      "metadata": {
        "cwe": [
          "CWE-942: Permissive Cross-domain Policy with Untrusted Domains"
        ],
        "owasp": [
          "A05:2021 - Security Misconfiguration",
          "A02:2025 - Security Misconfiguration"
        ],
        "category": "security",
        "technology": [
          "python",
          "fastapi"
        ],
        "references": [
          "https://owasp.org/Top10/A05_2021-Security_Misconfiguration",
          "https://cwe.mitre.org/data/definitions/942.html"
        ],
        "likelihood": "HIGH",
        "impact": "LOW",
        "confidence": "MEDIUM",
        "vulnerability_class": [
          "Configuration"
        ],
        "subcategory": [
          "vuln"
        ],
        "license": "Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license",
        "source": "https://semgrep.dev/r/python.fastapi.security.wildcard-cors.wildcard-cors",
        "shortlink": "https://sg.run/KxApY",
        "semgrep.dev": {
          "rule": {
            "r_id": 112311,
            "rv_id": 1263413,
            "rule_id": "lBU4JQ3",
            "version_id": "A8Tgd1R",
            "url": "https://semgrep.dev/playground/r/A8Tgd1R/python.fastapi.security.wildcard-cors.wildcard-cors",
            "origin": "community"
          }
        }
      }
    },
    {
      "id": "python.twilio.security.twiml-injection.twiml-injection",
      "languages": [
        "python"
      ],
      "severity": "WARNING",
      "message": "Using non-constant TwiML (Twilio Markup Language) argument when creating a Twilio conversation could allow the injection of additional TwiML commands",
      "metadata": {
        "cwe": [
          "CWE-91: XML Injection"
        ],
        "owasp": [
          "A03:2021 - Injection",
          "A05:2025 - Injection"
        ],
        "category": "security",
        "technology": [
          "python",
          "twilio",
          "twiml"
        ],
        "confidence": "MEDIUM",
        "likelihood": "HIGH",
        "impact": "MEDIUM",
        "subcategory": [
          "vuln"
        ],
        "references": [
          "https://codeberg.org/fennix/funjection"
        ],
        "license": "Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license",
        "vulnerability_class": [
          "Other"
        ],
        "source": "https://semgrep.dev/r/python.twilio.security.twiml-injection.twiml-injection",
        "shortlink": "https://sg.run/GdEEy",
        "semgrep.dev": {
          "rule": {
            "r_id": 134692,
            "rv_id": 1263580,
            "rule_id": "oqUgjj2",
            "version_id": "kbTzGp1",
            "url": "https://semgrep.dev/playground/r/kbTzGp1/python.twilio.security.twiml-injection.twiml-injection",
            "origin": "community"
          }
        }
      },
      "mode": "taint",
      "pattern-sources": [
        {
          "pattern": "f\"...\"\n"
        },
        {
          "pattern": "\"...\" % ...\n"
        },
        {
          "pattern": "\"...\".format(...)\n"
        },
        {
          "patterns": [
            {
              "pattern": "$ARG"
            },
            {
              "pattern-inside": "def $F(..., $ARG, ...):\n    ...\n"
            }
          ]
        }
      ],
      "pattern-sanitizers": [
        {
          "pattern": "xml.sax.saxutils.escape(...)"
        },
        {
          "pattern": "html.escape(...)"
        }
      ],
      "pattern-sinks": [
        {
          "patterns": [
            {
              "pattern": "$CLIENT.calls.create(..., twiml=$SINK, ...)\n"
            },
            {
              "focus-metavariable": "$SINK"
            }
          ]
        }
      ]
    },
    {
      "id": "python.lang.security.insecure-uuid-version.insecure-uuid-version",
      "patterns": [
        {
          "pattern": "uuid.uuid1(...)"
        }
      ],
      "message": "Using UUID version 1 for UUID generation can lead to predictable UUIDs based on system information (e.g., MAC address, timestamp). This may lead to security risks such as the sandwich attack. Consider using `uuid.uuid4()` instead for better randomness and security.",
      "metadata": {
        "references": [
          "https://www.landh.tech/blog/20230811-sandwich-attack/"
        ],
        "cwe": [
          "CWE-330: Use of Insufficiently Random Values"
        ],
        "owasp": [
          "A02:2021 - Cryptographic Failures",
          "A04:2025 - Cryptographic Failures"
        ],
        "asvs": {
          "section": "V6 Stored Cryptography Verification Requirements",
          "control_id": "6.3.2 Insecure UUID Generation",
          "control_url": "https://github.com/OWASP/ASVS/blob/master/4.0/en/0x14-V6-Cryptography.md#v63-random-values",
          "version": "4"
        },
        "category": "security",
        "technology": [
          "python"
        ],
        "subcategory": [
          "audit"
        ],
        "likelihood": "LOW",
        "impact": "MEDIUM",
        "confidence": "MEDIUM",
        "license": "Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license",
        "vulnerability_class": [
          "Cryptographic Issues"
        ],
        "source": "https://semgrep.dev/r/python.lang.security.insecure-uuid-version.insecure-uuid-version",
        "shortlink": "https://sg.run/BYBgW",
        "semgrep.dev": {
          "rule": {
            "r_id": 148295,
            "rv_id": 1263539,
            "rule_id": "kxUd1yD",
            "version_id": "O9Tpx97",
            "url": "https://semgrep.dev/playground/r/O9Tpx97/python.lang.security.insecure-uuid-version.insecure-uuid-version",
            "origin": "community"
          }
        }
      },
      "languages": [
        "python"
      ],
      "severity": "WARNING",
      "fix-regex": {
        "regex": "uuid1",
        "replacement": "uuid4"
      }
    },
    {
      "id": "python.lang.security.audit.sha224-hash.sha224-hash",
      "message": "This code uses a 224-bit hash function, which is deprecated or disallowed in some security policies. Consider updating to a stronger hash function such as SHA-384 or higher to ensure compliance and security.",
      "metadata": {
        "cwe": [
          "CWE-327: Use of a Broken or Risky Cryptographic Algorithm"
        ],
        "owasp": [
          "A03:2017 - Sensitive Data Exposure",
          "A02:2021 - Cryptographic Failures",
          "A04:2025 - Cryptographic Failures"
        ],
        "references": [
          "https://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-131Ar3.ipd.pdf",
          "https://www.cyber.gov.au/resources-business-and-government/essential-cyber-security/ism/cyber-security-guidelines/guidelines-cryptography"
        ],
        "category": "security",
        "technology": [
          "python"
        ],
        "subcategory": [
          "vuln"
        ],
        "likelihood": "LOW",
        "impact": "LOW",
        "confidence": "HIGH",
        "license": "Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license",
        "vulnerability_class": [
          "Cryptographic Issues"
        ],
        "source": "https://semgrep.dev/r/python.lang.security.audit.sha224-hash.sha224-hash",
        "shortlink": "https://sg.run/Db1Yv",
        "semgrep.dev": {
          "rule": {
            "r_id": 151752,
            "rv_id": 1263511,
            "rule_id": "BYUX0y9",
            "version_id": "5PTo1QL",
            "url": "https://semgrep.dev/playground/r/5PTo1QL/python.lang.security.audit.sha224-hash.sha224-hash",
            "origin": "community"
          }
        }
      },
      "severity": "WARNING",
      "languages": [
        "python"
      ],
      "pattern-either": [
        {
          "pattern": "hashlib.sha224(...)"
        },
        {
          "pattern": "hashlib.sha3_224(...)"
        }
      ]
    },
    {
      "id": "python.flask.security.audit.flask-url-for-external-true.flask-url-for-external-true",
      "message": "Function `flask.url_for` with `_external=True` argument will generate URLs using the `Host` header of the HTTP request, which may lead to security risks such as Host header injection",
      "metadata": {
        "cwe": [
          "CWE-673: External Influence of Sphere Definition"
        ],
        "owasp": [
          "A03:2021 - Injection",
          "A05:2025 - Injection"
        ],
        "category": "security",
        "technology": [
          "flask"
        ],
        "references": [
          "https://flask.palletsprojects.com/en/latest/api/#flask.url_for",
          "https://portswigger.net/kb/issues/00500300_host-header-injection"
        ],
        "subcategory": [
          "audit"
        ],
        "likelihood": "MEDIUM",
        "impact": "LOW",
        "confidence": "HIGH",
        "license": "Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license",
        "vulnerability_class": [
          "Other"
        ],
        "source": "https://semgrep.dev/r/python.flask.security.audit.flask-url-for-external-true.flask-url-for-external-true",
        "shortlink": "https://sg.run/gEGeR",
        "semgrep.dev": {
          "rule": {
            "r_id": 191541,
            "rv_id": 1263418,
            "rule_id": "JDU5oql",
            "version_id": "K3TKk6n",
            "url": "https://semgrep.dev/playground/r/K3TKk6n/python.flask.security.audit.flask-url-for-external-true.flask-url-for-external-true",
            "origin": "community"
          }
        }
      },
      "languages": [
        "python"
      ],
      "severity": "WARNING",
      "patterns": [
        {
          "pattern-not": "flask.url_for(..., _external=False, ...)"
        },
        {
          "pattern-not": "url_for(..., _external=False, ...)"
        },
        {
          "pattern-either": [
            {
              "pattern": "flask.url_for(..., _external=$VAR, ...)"
            },
            {
              "pattern": "url_for(..., _external=$VAR, ...)"
            }
          ]
        }
      ]
    },
    {
      "id": "python.flask.security.injection.csv-writer-injection.csv-writer-injection",
      "languages": [
        "python"
      ],
      "message": "Detected user input into a generated CSV file using the built-in `csv` module. If user data is used to generate the data in this file, it is possible that an attacker could inject a formula when the CSV is imported into a spreadsheet application that runs an attacker script, which could steal data from the importing user or, at worst, install malware on the user's computer. `defusedcsv` is a drop-in replacement with the same API that will attempt to mitigate formula injection attempts. You can use `defusedcsv` instead of `csv` to safely generate CSVs.",
      "metadata": {
        "category": "security",
        "confidence": "MEDIUM",
        "cwe": [
          "CWE-1236: Improper Neutralization of Formula Elements in a CSV File"
        ],
        "owasp": [
          "A01:2017 - Injection",
          "A03:2021 - Injection",
          "A05:2025 - Injection"
        ],
        "references": [
          "https://github.com/raphaelm/defusedcsv",
          "https://owasp.org/www-community/attacks/CSV_Injection",
          "https://web.archive.org/web/20220516052229/https://www.contextis.com/us/blog/comma-separated-vulnerabilities"
        ],
        "technology": [
          "python",
          "flask"
        ],
        "subcategory": [
          "vuln"
        ],
        "impact": "MEDIUM",
        "likelihood": "MEDIUM",
        "license": "Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license",
        "vulnerability_class": [
          "Improper Validation"
        ],
        "source": "https://semgrep.dev/r/python.flask.security.injection.csv-writer-injection.csv-writer-injection",
        "shortlink": "https://sg.run/JzqQ",
        "semgrep.dev": {
          "rule": {
            "r_id": 31146,
            "rv_id": 1263428,
            "rule_id": "L1UR2K",
            "version_id": "jQTn50Y",
            "url": "https://semgrep.dev/playground/r/jQTn50Y/python.flask.security.injection.csv-writer-injection.csv-writer-injection",
            "origin": "community"
          }
        }
      },
      "mode": "taint",
      "pattern-sinks": [
        {
          "patterns": [
            {
              "pattern-inside": "$WRITER = csv.writer(...)\n\n...\n\n$WRITER.$WRITE(...)\n"
            },
            {
              "pattern": "$WRITER.$WRITE(...)"
            },
            {
              "metavariable-regex": {
                "metavariable": "$WRITE",
                "regex": "^(writerow|writerows|writeheader)$"
              }
            }
          ]
        }
      ],
      "pattern-sources": [
        {
          "patterns": [
            {
              "pattern-either": [
                {
                  "patterns": [
                    {
                      "pattern-either": [
                        {
                          "pattern": "flask.request.form.get(...)"
                        },
                        {
                          "pattern": "flask.request.form[...]"
                        },
                        {
                          "pattern": "flask.request.args.get(...)"
                        },
                        {
                          "pattern": "flask.request.args[...]"
                        },
                        {
                          "pattern": "flask.request.values.get(...)"
                        },
                        {
                          "pattern": "flask.request.values[...]"
                        },
                        {
                          "pattern": "flask.request.cookies.get(...)"
                        },
                        {
                          "pattern": "flask.request.cookies[...]"
                        },
                        {
                          "pattern": "flask.request.stream"
                        },
                        {
                          "pattern": "flask.request.headers.get(...)"
                        },
                        {
                          "pattern": "flask.request.headers[...]"
                        },
                        {
                          "pattern": "flask.request.data"
                        },
                        {
                          "pattern": "flask.request.full_path"
                        },
                        {
                          "pattern": "flask.request.url"
                        },
                        {
                          "pattern": "flask.request.json"
                        },
                        {
                          "pattern": "flask.request.get_json()"
                        },
                        {
                          "pattern": "flask.request.view_args.get(...)"
                        },
                        {
                          "pattern": "flask.request.view_args[...]"
                        }
                      ]
                    }
                  ]
                },
                {
                  "patterns": [
                    {
                      "pattern-inside": "@$APP.route($ROUTE, ...)\ndef $FUNC(..., $ROUTEVAR, ...):\n  ...\n"
                    },
                    {
                      "focus-metavariable": "$ROUTEVAR"
                    }
                  ]
                }
              ]
            }
          ]
        }
      ],
      "severity": "ERROR"
    },
    {
      "id": "python.flask.security.injection.subprocess-injection.subprocess-injection",
      "languages": [
        "python"
      ],
      "mode": "taint",
      "options": {
        "symbolic_propagation": true
      },
      "pattern-sources": [
        {
          "pattern-either": [
            {
              "patterns": [
                {
                  "pattern-either": [
                    {
                      "pattern": "flask.request.form.get(...)"
                    },
                    {
                      "pattern": "flask.request.form[...]"
                    },
                    {
                      "pattern": "flask.request.args.get(...)"
                    },
                    {
                      "pattern": "flask.request.args[...]"
                    },
                    {
                      "pattern": "flask.request.values.get(...)"
                    },
                    {
                      "pattern": "flask.request.values[...]"
                    },
                    {
                      "pattern": "flask.request.cookies.get(...)"
                    },
                    {
                      "pattern": "flask.request.cookies[...]"
                    },
                    {
                      "pattern": "flask.request.stream"
                    },
                    {
                      "pattern": "flask.request.headers.get(...)"
                    },
                    {
                      "pattern": "flask.request.headers[...]"
                    },
                    {
                      "pattern": "flask.request.data"
                    },
                    {
                      "pattern": "flask.request.full_path"
                    },
                    {
                      "pattern": "flask.request.url"
                    },
                    {
                      "pattern": "flask.request.json"
                    },
                    {
                      "pattern": "flask.request.get_json()"
                    },
                    {
                      "pattern": "flask.request.view_args.get(...)"
                    },
                    {
                      "pattern": "flask.request.view_args[...]"
                    }
                  ]
                }
              ]
            },
            {
              "patterns": [
                {
                  "pattern-inside": "@$APP.route($ROUTE, ...)\ndef $FUNC(..., $ROUTEVAR, ...):\n  ...\n"
                },
                {
                  "focus-metavariable": "$ROUTEVAR"
                }
              ]
            }
          ]
        }
      ],
      "pattern-sinks": [
        {
          "patterns": [
            {
              "pattern-either": [
                {
                  "patterns": [
                    {
                      "pattern": "subprocess.$FUNC(...)"
                    },
                    {
                      "pattern-not": "subprocess.$FUNC(\"...\", ...)"
                    },
                    {
                      "pattern-not": "subprocess.$FUNC([\"...\", ...], ...)"
                    },
                    {
                      "pattern-not-inside": "$CMD = [\"...\", ...]\n...\nsubprocess.$FUNC($CMD, ...)\n"
                    }
                  ]
                },
                {
                  "patterns": [
                    {
                      "pattern": "subprocess.$FUNC([\"$SHELL\", \"-c\", ...], ...)"
                    },
                    {
                      "metavariable-regex": {
                        "metavariable": "$SHELL",
                        "regex": "^(sh|bash|ksh|csh|tcsh|zsh)$"
                      }
                    }
                  ]
                },
                {
                  "patterns": [
                    {
                      "pattern": "subprocess.$FUNC([\"$INTERPRETER\", ...], ...)"
                    },
                    {
                      "metavariable-regex": {
                        "metavariable": "$INTERPRETER",
                        "regex": "^(python|python\\d)$"
                      }
                    }
                  ]
                }
              ]
            }
          ]
        }
      ],
      "pattern-sanitizers": [
        {
          "patterns": [
            {
              "pattern": "$DICT[$KEY]"
            },
            {
              "focus-metavariable": "$KEY"
            }
          ]
        }
      ],
      "severity": "ERROR",
      "message": "Detected user input entering a `subprocess` call unsafely. This could result in a command injection vulnerability. An attacker could use this vulnerability to execute arbitrary commands on the host, which allows them to download malware, scan sensitive data, or run any command they wish on the server. Do not let users choose the command to run. In general, prefer to use Python API versions of system commands. If you must use subprocess, use a dictionary to allowlist a set of commands.",
      "metadata": {
        "category": "security",
        "technology": [
          "flask"
        ],
        "owasp": [
          "A01:2017 - Injection",
          "A03:2021 - Injection",
          "A05:2025 - Injection"
        ],
        "cwe": [
          "CWE-78: Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')"
        ],
        "references": [
          "https://semgrep.dev/docs/cheat-sheets/python-command-injection/"
        ],
        "confidence": "HIGH",
        "cwe2022-top25": true,
        "cwe2021-top25": true,
        "subcategory": [
          "vuln"
        ],
        "likelihood": "HIGH",
        "impact": "MEDIUM",
        "license": "Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license",
        "vulnerability_class": [
          "Command Injection"
        ],
        "source": "https://semgrep.dev/r/python.flask.security.injection.subprocess-injection.subprocess-injection",
        "shortlink": "https://sg.run/5gW3",
        "semgrep.dev": {
          "rule": {
            "r_id": 31147,
            "rv_id": 1263433,
            "rule_id": "8GU3qp",
            "version_id": "bZT53gQ",
            "url": "https://semgrep.dev/playground/r/bZT53gQ/python.flask.security.injection.subprocess-injection.subprocess-injection",
            "origin": "community"
          }
        }
      }
    },
    {
      "id": "python.cryptography.security.mode-without-authentication.crypto-mode-without-authentication",
      "message": "An encryption mode of operation is being used without proper message authentication. This can potentially result in the encrypted content to be decrypted by an attacker. Consider instead use an AEAD mode of operation like GCM. ",
      "languages": [
        "python"
      ],
      "severity": "ERROR",
      "metadata": {
        "category": "security",
        "technology": [
          "cryptography"
        ],
        "cwe": [
          "CWE-327: Use of a Broken or Risky Cryptographic Algorithm"
        ],
        "owasp": [
          "A03:2017 - Sensitive Data Exposure",
          "A02:2021 - Cryptographic Failures",
          "A04:2025 - Cryptographic Failures"
        ],
        "references": [
          "https://owasp.org/Top10/A02_2021-Cryptographic_Failures"
        ],
        "subcategory": [
          "audit"
        ],
        "likelihood": "LOW",
        "impact": "MEDIUM",
        "confidence": "MEDIUM",
        "license": "Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license",
        "vulnerability_class": [
          "Cryptographic Issues"
        ],
        "source": "https://semgrep.dev/r/python.cryptography.security.mode-without-authentication.crypto-mode-without-authentication",
        "shortlink": "https://sg.run/N9JL",
        "semgrep.dev": {
          "rule": {
            "r_id": 31871,
            "rv_id": 1263357,
            "rule_id": "lBUpNZ",
            "version_id": "BjTkZj5",
            "url": "https://semgrep.dev/playground/r/BjTkZj5/python.cryptography.security.mode-without-authentication.crypto-mode-without-authentication",
            "origin": "community"
          }
        }
      },
      "patterns": [
        {
          "pattern-either": [
            {
              "patterns": [
                {
                  "pattern": "Cipher(..., $HAZMAT_MODE(...),...)\n"
                },
                {
                  "pattern-not-inside": "Cipher(..., $HAZMAT_MODE(...),...)\n...\nHMAC(...)\n"
                },
                {
                  "pattern-not-inside": "Cipher(..., $HAZMAT_MODE(...),...)\n...\nhmac.HMAC(...)\n"
                }
              ]
            }
          ]
        },
        {
          "metavariable-pattern": {
            "metavariable": "$HAZMAT_MODE",
            "patterns": [
              {
                "pattern-either": [
                  {
                    "pattern": "modes.CTR"
                  },
                  {
                    "pattern": "modes.CBC"
                  },
                  {
                    "pattern": "modes.CFB"
                  },
                  {
                    "pattern": "modes.OFB"
                  }
                ]
              }
            ]
          }
        }
      ]
    },
    {
      "id": "python.pycryptodome.security.mode-without-authentication.crypto-mode-without-authentication",
      "message": "An encryption mode of operation is being used without proper message authentication. This can potentially result in the encrypted content to be decrypted by an attacker. Consider instead use an AEAD mode of operation like GCM. ",
      "languages": [
        "python"
      ],
      "severity": "ERROR",
      "metadata": {
        "category": "security",
        "technology": [
          "cryptography"
        ],
        "cwe": [
          "CWE-327: Use of a Broken or Risky Cryptographic Algorithm"
        ],
        "owasp": [
          "A03:2017 - Sensitive Data Exposure",
          "A02:2021 - Cryptographic Failures",
          "A04:2025 - Cryptographic Failures"
        ],
        "references": [
          "https://owasp.org/Top10/A02_2021-Cryptographic_Failures"
        ],
        "subcategory": [
          "vuln"
        ],
        "likelihood": "LOW",
        "impact": "MEDIUM",
        "confidence": "MEDIUM",
        "license": "Semgrep Rules License v1.0. For more details, visit semgrep.dev/legal/rules-license",
        "vulnerability_class": [
          "Cryptographic Issues"
        ],
        "source": "https://semgrep.dev/r/python.pycryptodome.security.mode-without-authentication.crypto-mode-without-authentication",
        "shortlink": "https://sg.run/k1K1",
        "semgrep.dev": {
          "rule": {
            "r_id": 31872,
            "rv_id": 1263556,
            "rule_id": "YGUw8w",
            "version_id": "GxTkeyz",
            "url": "https://semgrep.dev/playground/r/GxTkeyz/python.pycryptodome.security.mode-without-authentication.crypto-mode-without-authentication",
            "origin": "community"
          }
        }
      },
      "patterns": [
        {
          "pattern-either": [
            {
              "patterns": [
                {
                  "pattern-either": [
                    {
                      "pattern": "AES.new(..., $PYCRYPTODOME_MODE)\n"
                    }
                  ]
                },
                {
                  "pattern-not-inside": "AES.new(..., $PYCRYPTODOME_MODE)\n...\nHMAC.new\n"
                },
                {
                  "metavariable-pattern": {
                    "metavariable": "$PYCRYPTODOME_MODE",
                    "patterns": [
                      {
                        "pattern-either": [
                          {
                            "pattern": "AES.MODE_CBC"
                          },
                          {
                            "pattern": "AES.MODE_CTR"
                          },
                          {
                            "pattern": "AES.MODE_CFB"
                          },
                          {
                            "pattern": "AES.MODE_OFB"
                          }
                        ]
                      }
                    ]
                  }
                }
              ]
            }
          ]
        }
      ]
    }
  ],
  "missed": 923
}