Sandbox URL Creation

[pixeebot]

This codemod sandboxes calls to requests.get to be more resistant to Server-Side Request Forgery (SSRF) attacks.

Most of the time when you make a GET request to a URL, you're intending to reference an HTTP endpoint, like an internal microservice. However, URLs can point to local file system files, a Gopher stream in your local network, a JAR file on a remote Internet site, and all kinds of other unexpected and undesirable outcomes. When the URL values are influenced by attackers, they can trick your application into fetching internal resources, running malicious code, or otherwise harming the system.
Consider the following code for a Flask app:

from flask import Flask, request
import requests

app = Flask(__name__)

@app.route("/request-url")
def request_url():
    url = request.args["loc"]
    resp = requests.get(url)
    ...

In this case, an attacker could supply a value like "http://169.254.169.254/user-data/" and attempt to access user information.

Our changes introduce sandboxing around URL creation that force developers to specify some boundaries on the types of URLs they expect to create:

  from flask import Flask, request
- import requests
+ from security import safe_requests

  app = Flask(__name__)

  @app.route("/request-url")
  def request_url():
    url = request.args["loc"]
-   resp = requests.get(url)
+   resp = safe_requests.get(url)
    ...

This change alone reduces attack surface significantly because the default behavior of safe_requests.get raises a SecurityException if
a user attempts to access a known infrastructure location, unless specifically disabled.

If you have feedback on this codemod, please let us know!

F.A.Q.

Why does this codemod require a Pixee dependency?

We always prefer to use built-in Python functions or one from a well-known and trusted community dependency. However, we cannot find any such control. If you know of one, please let us know.

Why is this codemod marked as Merge After Cursory Review?

By default, the protection only weaves in 2 checks, which we believe will not cause any issues with the vast majority of code:

1. The given URL must be HTTP/HTTPS.
2. The given URL must not point to a "well-known infrastructure target", which includes things like AWS Metadata Service endpoints, and internal routers (e.g., 192.168.1.1) which are common targets of attacks.

However, on rare occasions an application may use a URL protocol like "file://" or "ftp://" in backend or middleware code.

If you want to allow those protocols, change the incoming PR to look more like this and get the best security possible:

-resp = requests.get(url)
+resp = safe_requests.get(url, allowed_protocols=("ftp",))

Dependency Updates

This codemod relies on an external dependency. We have automatically added this dependency to your project's requirements.txt file.

This library holds security tools for protecting Python API calls.

There are a number of places where Python project dependencies can be expressed, including setup.py, pyproject.toml, setup.cfg, and requirements.txt files. If this change is incorrect, or if you are using another packaging system such as poetry, it may be necessary for you to manually add the dependency to the proper location in your project.

More reading

• https://github.com/pixee/python-security/blob/main/src/security/safe_requests/api.py
• https://cheatsheetseries.owasp.org/cheatsheets/Server_Side_Request_Forgery_Prevention_Cheat_Sheet.html
• https://www.rapid7.com/blog/post/2021/11/23/owasp-top-10-deep-dive-defending-against-server-side-request-forgery/
• https://blog.assetnote.io/2021/01/13/blind-ssrf-chains/
• https://cwe.mitre.org/data/definitions/20
• https://cwe.mitre.org/data/definitions/918

🧚🤖 Powered by Pixeebot

Feedback | Community | Docs | Codemod ID: pixee:python/url-sandbox

[pixeebot]

This library holds security tools for protecting Python API calls.

License: MIT ✅ Open Source ✅ More facts

[sonarqubecloud]

Quality Gate passed

Issues
0 New issues
0 Accepted issues

Measures
0 Security Hotspots
0.0% Coverage on New Code
0.0% Duplication on New Code

See analysis details on SonarQube Cloud

To fix the problem, we need to ensure that the constructed file path is contained within a safe root folder. We can achieve this by normalizing the path using os.path.normpath and then checking that the normalized path starts with the root folder. This will prevent path traversal attacks.

1. Normalize the constructed file path using os.path.normpath.
2. Check that the normalized path starts with the intended base path.
3. If the check fails, return a 404 response.

To fix the problem, we need to ensure that the constructed file paths are safe and do not allow path traversal attacks. We can achieve this by normalizing the paths and ensuring they remain within a designated safe directory. Additionally, we should validate the width and height parameters to ensure they are within acceptable ranges.

1. Normalize the constructed file paths using os.path.normpath.
2. Ensure the normalized paths start with the designated safe directory.
3. Validate the width and height parameters to ensure they are positive integers.

To fix the problem, we need to ensure that the constructed file paths are safe and do not allow path traversal attacks. We can achieve this by normalizing the paths and ensuring they remain within a designated safe directory. Additionally, we should validate the width and height parameters to ensure they are within acceptable ranges.

1. Normalize the constructed file paths using os.path.normpath.
2. Ensure the normalized paths start with the designated safe directory.
3. Validate the width and height parameters to ensure they are positive integers.

To fix the problem, we need to ensure that the constructed file paths are safe and do not allow access to unintended files. We can achieve this by normalizing the path and ensuring it is contained within a safe root directory. Additionally, we should validate the width and height parameters to ensure they are within acceptable ranges.

1. Normalize the constructed file path using os.path.normpath.
2. Ensure the normalized path starts with the intended base path.
3. Validate the width and height parameters to ensure they are positive integers.

To fix the problem, we need to ensure that the constructed file path is safe and does not allow path traversal attacks. We can achieve this by normalizing the path and ensuring it remains within the intended directory. Specifically, we will:

1. Normalize the constructed file path using os.path.normpath.
2. Check that the normalized path starts with the intended base directory.

To fix the problem, we need to ensure that detailed error messages and stack traces are not exposed to the user. Instead, we should log the detailed error information on the server and return a generic error message to the user. This can be achieved by modifying the exception handling code to log the exception and return a generic error message.

1. Modify the exception handling code to log the detailed error message using logging.exception().
2. Return a generic error message to the user without including the exception details.

To fix the problem, we need to ensure that detailed error information is not exposed to the user. Instead, we should log the detailed error information on the server and return a generic error message to the user. This can be achieved by modifying the exception handling code to log the exception details and return a generic error message.

1. Modify the exception handling code to log the detailed error information using logging.exception().
2. Return a generic error message to the user without including the exception details.

To fix the problem, we should avoid including the exception message in the response sent to the user. Instead, we can log the detailed error message on the server and return a generic error message to the user. This approach ensures that sensitive information is not exposed while still allowing developers to debug the issue using the server logs.

To fix the problem, we need to ensure that the constructed file path is contained within a safe root folder. We can achieve this by normalizing the path using os.path.normpath and then checking that the normalized path starts with the root folder. This will prevent directory traversal attacks by ensuring that the endpoint value cannot be used to access files outside the intended directory.

1. Normalize the constructed file path using os.path.normpath.
2. Check that the normalized path starts with the root folder.
3. Raise an exception if the path is not within the root folder.

To fix the problem, we need to ensure that detailed error messages, including stack traces, are not exposed to end users. Instead, we should log the detailed error information on the server and return a generic error message to the user. This can be achieved by modifying the exception handling code to log the exception and return a generic message.

1. Import the logging module if not already imported.
2. Modify the exception handling block to log the detailed error message using logging.error.
3. Return a generic error message to the user.

[pixeebot]

I'm confident in this change, but I'm not a maintainer of this project. Do you see any reason not to merge it?

If this change was not helpful, or you have suggestions for improvements, please let me know!

[pixeebot]

Just a friendly ping to remind you about this change. If there are concerns about it, we'd love to hear about them!