mcp-server-semgrep/semgrep-rules/python/cryptography/security/insecure-cipher-algorithms-arc4.yaml

MCP Server for Semgrep Integration - static code analysis with AI

rules:
- id: insecure-cipher-algorithm-arc4
  message: >-
    ARC4 (Alleged RC4) is a stream cipher with serious weaknesses in its initial stream output. 
    Its use is strongly discouraged. ARC4 does not use mode constructions.
    Use a strong symmetric cipher such as EAS instead.
    With the `cryptography` package it is recommended to use the `Fernet` which is a secure implementation
    of AES in CBC mode with a 128-bit key. 
    Alternatively, keep using the `Cipher` class from the hazmat primitives but use the AES algorithm instead.
  metadata:
    source-rule-url: https://github.com/PyCQA/bandit/blob/d5f8fa0d89d7b11442fc6ec80ca42953974354c8/bandit/blacklists/calls.py#L98
    cwe:
    - 'CWE-327: Use of a Broken or Risky Cryptographic Algorithm'
    owasp:
    - A03:2017 - Sensitive Data Exposure
    - A02:2021 - Cryptographic Failures
    bandit-code: B304
    references:
    - https://cryptography.io/en/latest/hazmat/primitives/symmetric-encryption/#weak-ciphers
    category: security
    technology:
    - cryptography
    subcategory:
    - vuln
    likelihood: MEDIUM
    impact: MEDIUM
    confidence: MEDIUM
    functional-categories:
    - crypto::search::symmetric-algorithm::cryptography
  severity: WARNING
  languages:
  - python
  patterns:
    - pattern: cryptography.hazmat.primitives.ciphers.algorithms.$ARC4($KEY)
    - pattern-inside: cryptography.hazmat.primitives.ciphers.Cipher(...)
    - metavariable-regex:
        metavariable: $ARC4
        regex: ^(ARC4)$
    - focus-metavariable: $ARC4
  fix: AES