/.semgrep/rules/check-safe-requests.yaml

rules:
  - id: unsafe-requests-get
    patterns:
      - pattern: requests.get(...)
    paths:
      exclude:
        - "**/security/safe_requests.py"
        - "**/tests/**"
        - "**/*_test.py"
        - "**/test_*.py"
        - "**/examples/**"
    message: >-
      Direct requests.get() bypasses SSRF protection.
      Use safe_get() from security module instead.
      Import: from ...security import safe_get
      For localhost services: safe_get(url, allow_localhost=True)
    languages: [python]
    severity: ERROR
    metadata:
      category: security
      cwe: "CWE-918: Server-Side Request Forgery (SSRF)"
      owasp: "A10:2021 - Server-Side Request Forgery"
      references:
        - https://cwe.mitre.org/data/definitions/918.html
        - https://cheatsheetseries.owasp.org/cheatsheets/Server_Side_Request_Forgery_Prevention_Cheat_Sheet.html

  - id: unsafe-requests-post
    patterns:
      - pattern: requests.post(...)
    paths:
      exclude:
        - "**/security/safe_requests.py"
        - "**/tests/**"
        - "**/*_test.py"
        - "**/test_*.py"
        - "**/examples/**"
    message: >-
      Direct requests.post() bypasses SSRF protection.
      Use safe_post() from security module instead.
      Import: from ...security import safe_post
      For localhost services: safe_post(url, allow_localhost=True)
    languages: [python]
    severity: ERROR
    metadata:
      category: security
      cwe: "CWE-918: Server-Side Request Forgery (SSRF)"
      owasp: "A10:2021 - Server-Side Request Forgery"
      references:
        - https://cwe.mitre.org/data/definitions/918.html
        - https://cheatsheetseries.owasp.org/cheatsheets/Server_Side_Request_Forgery_Prevention_Cheat_Sheet.html

  - id: unsafe-requests-session
    patterns:
      - pattern: requests.Session()
    paths:
      exclude:
        - "**/security/safe_requests.py"
        - "**/tests/**"
        - "**/*_test.py"
        - "**/test_*.py"
        - "**/examples/**"
    message: >-
      Direct requests.Session() bypasses SSRF protection.
      Use SafeSession() from security module instead.
      Import: from ...security import SafeSession
      For localhost services: SafeSession(allow_localhost=True)
    languages: [python]
    severity: ERROR
    metadata:
      category: security
      cwe: "CWE-918: Server-Side Request Forgery (SSRF)"
      owasp: "A10:2021 - Server-Side Request Forgery"
      references:
        - https://cwe.mitre.org/data/definitions/918.html
        - https://cheatsheetseries.owasp.org/cheatsheets/Server_Side_Request_Forgery_Prevention_Cheat_Sheet.html

  - id: unsafe-requests-put
    patterns:
      - pattern: requests.put(...)
    paths:
      exclude:
        - "**/security/safe_requests.py"
        - "**/tests/**"
        - "**/*_test.py"
        - "**/test_*.py"
        - "**/examples/**"
    message: >-
      Direct requests.put() bypasses SSRF protection.
      Use SafeSession() from security module for HTTP requests.
    languages: [python]
    severity: ERROR
    metadata:
      category: security
      cwe: "CWE-918: Server-Side Request Forgery (SSRF)"
      owasp: "A10:2021 - Server-Side Request Forgery"

  - id: unsafe-requests-delete
    patterns:
      - pattern: requests.delete(...)
    paths:
      exclude:
        - "**/security/safe_requests.py"
        - "**/tests/**"
        - "**/*_test.py"
        - "**/test_*.py"
        - "**/examples/**"
    message: >-
      Direct requests.delete() bypasses SSRF protection.
      Use SafeSession() from security module for HTTP requests.
    languages: [python]
    severity: ERROR
    metadata:
      category: security
      cwe: "CWE-918: Server-Side Request Forgery (SSRF)"
      owasp: "A10:2021 - Server-Side Request Forgery"

  - id: unsafe-requests-patch
    patterns:
      - pattern: requests.patch(...)
    paths:
      exclude:
        - "**/security/safe_requests.py"
        - "**/tests/**"
        - "**/*_test.py"
        - "**/test_*.py"
        - "**/examples/**"
    message: >-
      Direct requests.patch() bypasses SSRF protection.
      Use SafeSession() from security module for HTTP requests.
    languages: [python]
    severity: ERROR
    metadata:
      category: security
      cwe: "CWE-918: Server-Side Request Forgery (SSRF)"
      owasp: "A10:2021 - Server-Side Request Forgery"