Skip to content

Commit d132750

Browse files
pedrobpereirapedrobpereira
committed
bump: adds new semgrep rules
1 parent 7cb05d0 commit d132750

File tree

7 files changed

+251
-9
lines changed

7 files changed

+251
-9
lines changed

‎integration-tests/config-discover/expected/tools-configs/pylint.rc‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -5,5 +5,5 @@ load-plugins=
55

66
[MESSAGES CONTROL]
77
disable=all
8-
enable=C0123,C0200,C0303,E0100,E0101,E0102,E0103,E0104,E0105,E0106,E0107,E0108,E0110,E0112,E0113,E0114,E0115,E0116,E0117,E0202,E0203,E0211,E0236,E0238,E0239,E0240,E0241,E0301,E0302,E0601,E0603,E0604,E0701,E0702,E0704,E0710,E0711,E0712,E1003,E1102,E1111,E1120,E1121,E1123,E1124,E1125,E1126,E1127,E1132,E1200,E1201,E1205,E1206,E1300,E1301,E1302,E1303,E1304,E1305,E1306,R0202,R0203,W0101,W0102,W0104,W0105,W0106,W0107,W0108,W0109,W0120,W0122,W0124,W0150,W0199,W0221,W0222,W0233,W0404,W0410,W0601,W0602,W0604,W0611,W0612,W0622,W0702,W0705,W0711,W1300,W1301,W1302,W1303,W1305,W1306,W1307
8+
enable=C0123,C0200,E0100,E0101,E0102,E0103,E0104,E0105,E0106,E0107,E0108,E0110,E0112,E0113,E0114,E0115,E0116,E0117,E0202,E0203,E0211,E0236,E0238,E0239,E0240,E0241,E0301,E0302,E0601,E0603,E0604,E0701,E0702,E0704,E0710,E0711,E0712,E1003,E1102,E1111,E1120,E1121,E1123,E1124,E1125,E1126,E1127,E1132,E1200,E1201,E1205,E1206,E1300,E1301,E1302,E1303,E1304,E1305,E1306,R0202,R0203,W0101,W0102,W0104,W0105,W0106,W0107,W0108,W0109,W0120,W0122,W0124,W0150,W0199,W0221,W0222,W0233,W0404,W0410,W0601,W0602,W0604,W0611,W0612,W0622,W0702,W0705,W0711,W1300,W1301,W1302,W1303,W1305,W1306,W1307
99

‎integration-tests/config-discover/expected/tools-configs/semgrep.yaml‎

Lines changed: 79 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -34476,3 +34476,82 @@ rules:
3447634476
- '*.yml'
3447734477
pattern-regex: "[​‌‍⁠\uFEFF]"
3447834478
severity: WARNING
34479+
- id: codacy.python.openai.non-guardrails-direct-call
34480+
languages:
34481+
- python
34482+
message: Direct OpenAI SDK call detected. Use Guardrails client (GuardrailsOpenAI/GuardrailsAsyncOpenAI) instead.
34483+
metadata:
34484+
category: security
34485+
confidence: MEDIUM
34486+
cwe: 'CWE-20: Improper Input Validation'
34487+
justification: |
34488+
Guardrails is a drop-in replacement that automatically validates inputs/outputs. Prefer Guardrails clients over raw openai.* calls.
34489+
references:
34490+
- https://openai.github.io/openai-guardrails-python/
34491+
patterns:
34492+
- pattern-either:
34493+
- pattern: openai.ChatCompletion.create(...)
34494+
- pattern: openai.Completion.create(...)
34495+
- pattern: openai.chat.completions.create(...)
34496+
- pattern: openai.responses.create(...)
34497+
- pattern: openai.embeddings.create(...)
34498+
- pattern: openai.images.generate(...)
34499+
- pattern: openai.audio.transcriptions.create(...)
34500+
- pattern: openai.audio.speech.create(...)
34501+
severity: WARNING
34502+
- id: codacy.python.openai.non-guardrails-client-usage
34503+
languages:
34504+
- python
34505+
message: OpenAI client used without Guardrails. Replace with GuardrailsOpenAI / GuardrailsAsyncOpenAI.
34506+
metadata:
34507+
category: security
34508+
confidence: MEDIUM
34509+
cwe: 'CWE-20: Improper Input Validation'
34510+
justification: |
34511+
Guardrails advises using GuardrailsOpenAI/GuardrailsAsyncOpenAI as a drop-in replacement so validation runs automatically on every API call.
34512+
references:
34513+
- https://openai.github.io/openai-guardrails-python/
34514+
patterns:
34515+
- pattern-either:
34516+
- pattern: |
34517+
$C = OpenAI(...)
34518+
...
34519+
$C.chat.completions.create(...)
34520+
- pattern: |
34521+
$C = OpenAI(...)
34522+
...
34523+
$C.responses.create(...)
34524+
- pattern: |
34525+
$C = OpenAI(...)
34526+
...
34527+
$C.embeddings.create(...)
34528+
- pattern: |
34529+
$C = AsyncOpenAI(...)
34530+
...
34531+
$C.chat.completions.create(...)
34532+
- pattern: |
34533+
$C = AsyncOpenAI(...)
34534+
...
34535+
$C.responses.create(...)
34536+
- pattern: |
34537+
$C = AsyncOpenAI(...)
34538+
...
34539+
$C.embeddings.create(...)
34540+
- pattern-not: |
34541+
$C = GuardrailsOpenAI(...)
34542+
- pattern-not: |
34543+
$C = GuardrailsAsyncOpenAI(...)
34544+
severity: WARNING
34545+
- id: codacy.python.openai.import-without-guardrails
34546+
languages:
34547+
- python
34548+
message: OpenAI SDK imported without Guardrails import. Consider GuardrailsOpenAI / GuardrailsAsyncOpenAI.
34549+
metadata:
34550+
category: security
34551+
confidence: MEDIUM
34552+
references:
34553+
- https://openai.github.io/openai-guardrails-python/
34554+
pattern: |
34555+
import openai
34556+
pattern-not: "from guardrails import GuardrailsOpenAI |\nfrom guardrails import GuardrailsAsyncOpenAI \n"
34557+
severity: INFO

‎integration-tests/init-with-token/expected/codacy.yaml‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -6,6 +6,6 @@ tools:
66
- [email protected]
77
- [email protected]
88
- [email protected]
9-
- [email protected].7
9+
- [email protected].9
1010
- [email protected]
1111
- [email protected]

‎integration-tests/init-without-token/expected/tools-configs/pylint.rc‎

Lines changed: 6 additions & 6 deletions
Original file line numberDiff line numberDiff line change
@@ -1,9 +1,9 @@
1-
[MASTER]
2-
ignore=CVS
3-
persistent=yes
4-
load-plugins=
51

2+
3+
[MASTER]
64
[MESSAGES CONTROL]
75
disable=all
8-
enable=C0123,C0200,C0303,E0100,E0101,E0102,E0103,E0104,E0105,E0106,E0107,E0108,E0110,E0112,E0113,E0114,E0115,E0116,E0117,E0202,E0203,E0211,E0236,E0238,E0239,E0240,E0241,E0301,E0302,E0601,E0603,E0604,E0701,E0702,E0704,E0710,E0711,E0712,E1003,E1102,E1111,E1120,E1121,E1123,E1124,E1125,E1126,E1127,E1132,E1200,E1201,E1205,E1206,E1300,E1301,E1302,E1303,E1304,E1305,E1306,R0202,R0203,W0101,W0102,W0104,W0105,W0106,W0107,W0108,W0109,W0120,W0122,W0124,W0150,W0199,W0221,W0222,W0233,W0404,W0410,W0601,W0602,W0604,W0611,W0612,W0622,W0702,W0705,W0711,W1300,W1301,W1302,W1303,W1305,W1306,W1307
9-
6+
enable=C0123,C0200,E0100,E0101,E0102,E0103,E0104,E0105,E0106,E0107,E0108,E0110,E0112,E0113,E0114,E0115,E0116,E0117,E0202,E0203,E0211,E0236,E0238,E0239,E0240,E0241,E0301,E0302,E0601,E0603,E0604,E0701,E0702,E0704,E0710,E0711,E0712,E1003,E1102,E1111,E1120,E1121,E1123,E1124,E1125,E1126,E1127,E1132,E1200,E1201,E1205,E1206,E1300,E1301,E1302,E1303,E1304,E1305,E1306,R0202,R0203,W0101,W0102,W0104,W0105,W0106,W0107,W0108,W0109,W0120,W0122,W0124,W0150,W0199,W0221,W0222,W0233,W0404,W0410,W0601,W0602,W0604,W0611,W0612,W0622,W0702,W0705,W0711,W1300,W1301,W1302,W1303,W1305,W1306,W1307
7+
ignore=CVS
8+
load-plugins=
9+
persistent=yes

‎integration-tests/init-without-token/expected/tools-configs/semgrep.yaml‎

Lines changed: 79 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -34476,3 +34476,82 @@ rules:
3447634476
- '*.yml'
3447734477
pattern-regex: "[​‌‍⁠\uFEFF]"
3447834478
severity: WARNING
34479+
- id: codacy.python.openai.non-guardrails-direct-call
34480+
languages:
34481+
- python
34482+
message: Direct OpenAI SDK call detected. Use Guardrails client (GuardrailsOpenAI/GuardrailsAsyncOpenAI) instead.
34483+
metadata:
34484+
category: security
34485+
confidence: MEDIUM
34486+
cwe: 'CWE-20: Improper Input Validation'
34487+
justification: |
34488+
Guardrails is a drop-in replacement that automatically validates inputs/outputs. Prefer Guardrails clients over raw openai.* calls.
34489+
references:
34490+
- https://openai.github.io/openai-guardrails-python/
34491+
patterns:
34492+
- pattern-either:
34493+
- pattern: openai.ChatCompletion.create(...)
34494+
- pattern: openai.Completion.create(...)
34495+
- pattern: openai.chat.completions.create(...)
34496+
- pattern: openai.responses.create(...)
34497+
- pattern: openai.embeddings.create(...)
34498+
- pattern: openai.images.generate(...)
34499+
- pattern: openai.audio.transcriptions.create(...)
34500+
- pattern: openai.audio.speech.create(...)
34501+
severity: WARNING
34502+
- id: codacy.python.openai.non-guardrails-client-usage
34503+
languages:
34504+
- python
34505+
message: OpenAI client used without Guardrails. Replace with GuardrailsOpenAI / GuardrailsAsyncOpenAI.
34506+
metadata:
34507+
category: security
34508+
confidence: MEDIUM
34509+
cwe: 'CWE-20: Improper Input Validation'
34510+
justification: |
34511+
Guardrails advises using GuardrailsOpenAI/GuardrailsAsyncOpenAI as a drop-in replacement so validation runs automatically on every API call.
34512+
references:
34513+
- https://openai.github.io/openai-guardrails-python/
34514+
patterns:
34515+
- pattern-either:
34516+
- pattern: |
34517+
$C = OpenAI(...)
34518+
...
34519+
$C.chat.completions.create(...)
34520+
- pattern: |
34521+
$C = OpenAI(...)
34522+
...
34523+
$C.responses.create(...)
34524+
- pattern: |
34525+
$C = OpenAI(...)
34526+
...
34527+
$C.embeddings.create(...)
34528+
- pattern: |
34529+
$C = AsyncOpenAI(...)
34530+
...
34531+
$C.chat.completions.create(...)
34532+
- pattern: |
34533+
$C = AsyncOpenAI(...)
34534+
...
34535+
$C.responses.create(...)
34536+
- pattern: |
34537+
$C = AsyncOpenAI(...)
34538+
...
34539+
$C.embeddings.create(...)
34540+
- pattern-not: |
34541+
$C = GuardrailsOpenAI(...)
34542+
- pattern-not: |
34543+
$C = GuardrailsAsyncOpenAI(...)
34544+
severity: WARNING
34545+
- id: codacy.python.openai.import-without-guardrails
34546+
languages:
34547+
- python
34548+
message: OpenAI SDK imported without Guardrails import. Consider GuardrailsOpenAI / GuardrailsAsyncOpenAI.
34549+
metadata:
34550+
category: security
34551+
confidence: MEDIUM
34552+
references:
34553+
- https://openai.github.io/openai-guardrails-python/
34554+
pattern: |
34555+
import openai
34556+
pattern-not: "from guardrails import GuardrailsOpenAI |\nfrom guardrails import GuardrailsAsyncOpenAI \n"
34557+
severity: INFO

‎plugins/tools/semgrep/embedded/rules.yaml‎

Lines changed: 85 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -113519,4 +113519,89 @@ rules:
113519113519
category: security
113520113520
impact: MEDIUM
113521113521
confidence: LOW
113522+
- id: codacy.python.openai.non-guardrails-direct-call
113523+
message: "Direct OpenAI SDK call detected. Use Guardrails client (GuardrailsOpenAI/GuardrailsAsyncOpenAI) instead."
113524+
severity: WARNING
113525+
languages: [python]
113526+
metadata:
113527+
category: security
113528+
cwe: "CWE-20: Improper Input Validation"
113529+
references:
113530+
- https://openai.github.io/openai-guardrails-python/
113531+
justification: >
113532+
Guardrails is a drop-in replacement that automatically validates inputs/outputs.
113533+
Prefer Guardrails clients over raw openai.* calls.
113534+
confidence: MEDIUM
113535+
patterns:
113536+
- pattern-either:
113537+
- pattern: openai.ChatCompletion.create(...)
113538+
- pattern: openai.Completion.create(...)
113539+
- pattern: openai.chat.completions.create(...)
113540+
- pattern: openai.responses.create(...)
113541+
- pattern: openai.embeddings.create(...)
113542+
- pattern: openai.images.generate(...)
113543+
- pattern: openai.audio.transcriptions.create(...)
113544+
- pattern: openai.audio.speech.create(...)
113545+
- id: codacy.python.openai.non-guardrails-client-usage
113546+
message: "OpenAI client used without Guardrails. Replace with GuardrailsOpenAI / GuardrailsAsyncOpenAI."
113547+
severity: WARNING
113548+
languages: [python]
113549+
metadata:
113550+
category: security
113551+
cwe: "CWE-20: Improper Input Validation"
113552+
references:
113553+
- https://openai.github.io/openai-guardrails-python/
113554+
justification: >
113555+
Guardrails advises using GuardrailsOpenAI/GuardrailsAsyncOpenAI as a drop-in replacement
113556+
so validation runs automatically on every API call.
113557+
confidence: MEDIUM
113558+
# Catch typical client flows while avoiding false hits when the client *is* a Guardrails client.
113559+
patterns:
113560+
- pattern-either:
113561+
# Synchronous client patterns
113562+
- pattern: |
113563+
$C = OpenAI(...)
113564+
...
113565+
$C.chat.completions.create(...)
113566+
- pattern: |
113567+
$C = OpenAI(...)
113568+
...
113569+
$C.responses.create(...)
113570+
- pattern: |
113571+
$C = OpenAI(...)
113572+
...
113573+
$C.embeddings.create(...)
113574+
# Async client patterns
113575+
- pattern: |
113576+
$C = AsyncOpenAI(...)
113577+
...
113578+
$C.chat.completions.create(...)
113579+
- pattern: |
113580+
$C = AsyncOpenAI(...)
113581+
...
113582+
$C.responses.create(...)
113583+
- pattern: |
113584+
$C = AsyncOpenAI(...)
113585+
...
113586+
$C.embeddings.create(...)
113587+
- pattern-not: |
113588+
$C = GuardrailsOpenAI(...)
113589+
- pattern-not: |
113590+
$C = GuardrailsAsyncOpenAI(...)
113591+
- id: codacy.python.openai.import-without-guardrails
113592+
message: "OpenAI SDK imported without Guardrails import. Consider GuardrailsOpenAI / GuardrailsAsyncOpenAI."
113593+
severity: INFO
113594+
languages: [python]
113595+
metadata:
113596+
category: security
113597+
references:
113598+
- https://openai.github.io/openai-guardrails-python/
113599+
confidence: MEDIUM
113600+
# Soft signal: import present but no Guardrails import in same file.
113601+
# This is informational to help teams spot likely non-guardrailed files early.
113602+
pattern: |
113603+
import openai
113604+
pattern-not: |
113605+
from guardrails import GuardrailsOpenAI |
113606+
from guardrails import GuardrailsAsyncOpenAI
113522113607

‎tools/pylint/pylintDefaultPatterns.go‎

Lines changed: 0 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -4,7 +4,6 @@ package pylint
44
var DefaultPatterns = []string{
55
"C0123",
66
"C0200",
7-
"C0303",
87
"E0100",
98
"E0101",
109
"E0102",

0 commit comments

Comments
 (0)