Skip to content

Commit 0dae60c

Browse files
pedrobpereirapedrobpereira
committed
bump: adds new semgrep rules
1 parent 7cb05d0 commit 0dae60c

File tree

4 files changed

+92
-8
lines changed

4 files changed

+92
-8
lines changed

‎integration-tests/config-discover/expected/tools-configs/pylint.rc‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -5,5 +5,5 @@ load-plugins=
55

66
[MESSAGES CONTROL]
77
disable=all
8-
enable=C0123,C0200,C0303,E0100,E0101,E0102,E0103,E0104,E0105,E0106,E0107,E0108,E0110,E0112,E0113,E0114,E0115,E0116,E0117,E0202,E0203,E0211,E0236,E0238,E0239,E0240,E0241,E0301,E0302,E0601,E0603,E0604,E0701,E0702,E0704,E0710,E0711,E0712,E1003,E1102,E1111,E1120,E1121,E1123,E1124,E1125,E1126,E1127,E1132,E1200,E1201,E1205,E1206,E1300,E1301,E1302,E1303,E1304,E1305,E1306,R0202,R0203,W0101,W0102,W0104,W0105,W0106,W0107,W0108,W0109,W0120,W0122,W0124,W0150,W0199,W0221,W0222,W0233,W0404,W0410,W0601,W0602,W0604,W0611,W0612,W0622,W0702,W0705,W0711,W1300,W1301,W1302,W1303,W1305,W1306,W1307
8+
enable=C0123,C0200,E0100,E0101,E0102,E0103,E0104,E0105,E0106,E0107,E0108,E0110,E0112,E0113,E0114,E0115,E0116,E0117,E0202,E0203,E0211,E0236,E0238,E0239,E0240,E0241,E0301,E0302,E0601,E0603,E0604,E0701,E0702,E0704,E0710,E0711,E0712,E1003,E1102,E1111,E1120,E1121,E1123,E1124,E1125,E1126,E1127,E1132,E1200,E1201,E1205,E1206,E1300,E1301,E1302,E1303,E1304,E1305,E1306,R0202,R0203,W0101,W0102,W0104,W0105,W0106,W0107,W0108,W0109,W0120,W0122,W0124,W0150,W0199,W0221,W0222,W0233,W0404,W0410,W0601,W0602,W0604,W0611,W0612,W0622,W0702,W0705,W0711,W1300,W1301,W1302,W1303,W1305,W1306,W1307
99

‎integration-tests/init-without-token/expected/tools-configs/pylint.rc‎

Lines changed: 6 additions & 6 deletions
Original file line numberDiff line numberDiff line change
@@ -1,9 +1,9 @@
1-
[MASTER]
2-
ignore=CVS
3-
persistent=yes
4-
load-plugins=
51

2+
3+
[MASTER]
64
[MESSAGES CONTROL]
75
disable=all
8-
enable=C0123,C0200,C0303,E0100,E0101,E0102,E0103,E0104,E0105,E0106,E0107,E0108,E0110,E0112,E0113,E0114,E0115,E0116,E0117,E0202,E0203,E0211,E0236,E0238,E0239,E0240,E0241,E0301,E0302,E0601,E0603,E0604,E0701,E0702,E0704,E0710,E0711,E0712,E1003,E1102,E1111,E1120,E1121,E1123,E1124,E1125,E1126,E1127,E1132,E1200,E1201,E1205,E1206,E1300,E1301,E1302,E1303,E1304,E1305,E1306,R0202,R0203,W0101,W0102,W0104,W0105,W0106,W0107,W0108,W0109,W0120,W0122,W0124,W0150,W0199,W0221,W0222,W0233,W0404,W0410,W0601,W0602,W0604,W0611,W0612,W0622,W0702,W0705,W0711,W1300,W1301,W1302,W1303,W1305,W1306,W1307
9-
6+
enable=C0123,C0200,E0100,E0101,E0102,E0103,E0104,E0105,E0106,E0107,E0108,E0110,E0112,E0113,E0114,E0115,E0116,E0117,E0202,E0203,E0211,E0236,E0238,E0239,E0240,E0241,E0301,E0302,E0601,E0603,E0604,E0701,E0702,E0704,E0710,E0711,E0712,E1003,E1102,E1111,E1120,E1121,E1123,E1124,E1125,E1126,E1127,E1132,E1200,E1201,E1205,E1206,E1300,E1301,E1302,E1303,E1304,E1305,E1306,R0202,R0203,W0101,W0102,W0104,W0105,W0106,W0107,W0108,W0109,W0120,W0122,W0124,W0150,W0199,W0221,W0222,W0233,W0404,W0410,W0601,W0602,W0604,W0611,W0612,W0622,W0702,W0705,W0711,W1300,W1301,W1302,W1303,W1305,W1306,W1307
7+
ignore=CVS
8+
load-plugins=
9+
persistent=yes

‎plugins/tools/semgrep/embedded/rules.yaml‎

Lines changed: 85 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -113519,4 +113519,89 @@ rules:
113519113519
category: security
113520113520
impact: MEDIUM
113521113521
confidence: LOW
113522+
- id: codacy.python.openai.non-guardrails-direct-call
113523+
message: "Direct OpenAI SDK call detected. Use Guardrails client (GuardrailsOpenAI/GuardrailsAsyncOpenAI) instead."
113524+
severity: WARNING
113525+
languages: [python]
113526+
metadata:
113527+
category: security
113528+
cwe: "CWE-20: Improper Input Validation"
113529+
references:
113530+
- https://openai.github.io/openai-guardrails-python/
113531+
justification: >
113532+
Guardrails is a drop-in replacement that automatically validates inputs/outputs.
113533+
Prefer Guardrails clients over raw openai.* calls.
113534+
confidence: MEDIUM
113535+
patterns:
113536+
- pattern-either:
113537+
- pattern: openai.ChatCompletion.create(...)
113538+
- pattern: openai.Completion.create(...)
113539+
- pattern: openai.chat.completions.create(...)
113540+
- pattern: openai.responses.create(...)
113541+
- pattern: openai.embeddings.create(...)
113542+
- pattern: openai.images.generate(...)
113543+
- pattern: openai.audio.transcriptions.create(...)
113544+
- pattern: openai.audio.speech.create(...)
113545+
- id: codacy.python.openai.non-guardrails-client-usage
113546+
message: "OpenAI client used without Guardrails. Replace with GuardrailsOpenAI / GuardrailsAsyncOpenAI."
113547+
severity: WARNING
113548+
languages: [python]
113549+
metadata:
113550+
category: security
113551+
cwe: "CWE-20: Improper Input Validation"
113552+
references:
113553+
- https://openai.github.io/openai-guardrails-python/
113554+
justification: >
113555+
Guardrails advises using GuardrailsOpenAI/GuardrailsAsyncOpenAI as a drop-in replacement
113556+
so validation runs automatically on every API call.
113557+
confidence: MEDIUM
113558+
# Catch typical client flows while avoiding false hits when the client *is* a Guardrails client.
113559+
patterns:
113560+
- pattern-either:
113561+
# Synchronous client patterns
113562+
- pattern: |
113563+
$C = OpenAI(...)
113564+
...
113565+
$C.chat.completions.create(...)
113566+
- pattern: |
113567+
$C = OpenAI(...)
113568+
...
113569+
$C.responses.create(...)
113570+
- pattern: |
113571+
$C = OpenAI(...)
113572+
...
113573+
$C.embeddings.create(...)
113574+
# Async client patterns
113575+
- pattern: |
113576+
$C = AsyncOpenAI(...)
113577+
...
113578+
$C.chat.completions.create(...)
113579+
- pattern: |
113580+
$C = AsyncOpenAI(...)
113581+
...
113582+
$C.responses.create(...)
113583+
- pattern: |
113584+
$C = AsyncOpenAI(...)
113585+
...
113586+
$C.embeddings.create(...)
113587+
- pattern-not: |
113588+
$C = GuardrailsOpenAI(...)
113589+
- pattern-not: |
113590+
$C = GuardrailsAsyncOpenAI(...)
113591+
- id: codacy.python.openai.import-without-guardrails
113592+
message: "OpenAI SDK imported without Guardrails import. Consider GuardrailsOpenAI / GuardrailsAsyncOpenAI."
113593+
severity: INFO
113594+
languages: [python]
113595+
metadata:
113596+
category: security
113597+
references:
113598+
- https://openai.github.io/openai-guardrails-python/
113599+
confidence: MEDIUM
113600+
# Soft signal: import present but no Guardrails import in same file.
113601+
# This is informational to help teams spot likely non-guardrailed files early.
113602+
pattern: |
113603+
import openai
113604+
pattern-not: |
113605+
from guardrails import GuardrailsOpenAI |
113606+
from guardrails import GuardrailsAsyncOpenAI
113522113607

‎tools/pylint/pylintDefaultPatterns.go‎

Lines changed: 0 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -4,7 +4,6 @@ package pylint
44
var DefaultPatterns = []string{
55
"C0123",
66
"C0200",
7-
"C0303",
87
"E0100",
98
"E0101",
109
"E0102",

0 commit comments

Comments
 (0)