mcp-server-semgrep/semgrep-rules/python/django/security/audit/unvalidated-password.yaml

MCP Server for Semgrep Integration - static code analysis with AI

rules:
- id: unvalidated-password
  patterns:
  - pattern-not-inside: |
      if <... django.contrib.auth.password_validation.validate_password(...) ...>:
          ...
  - pattern-not-inside: |
      django.contrib.auth.password_validation.validate_password(...)
      ...
  - pattern-not-inside: |
      try:
        ...
        django.contrib.auth.password_validation.validate_password(...)
        ...
      except $EX:
        ...
      ...
  - pattern-not-inside: |
      try:
        ...
        django.contrib.auth.password_validation.validate_password(...)
        ...
      except $EX as $E:
        ...
      ...
  - pattern-not: UserModel().set_password($X)
  - pattern: $MODEL.set_password($X)
  fix: >
    if django.contrib.auth.password_validation.validate_password($X, user=$MODEL):
        $MODEL.set_password($X)
  message: >-
    The password on '$MODEL' is being set without validating the password.
    Call django.contrib.auth.password_validation.validate_password() with
    validation functions before setting the password. See
    https://docs.djangoproject.com/en/3.0/topics/auth/passwords/
    for more information.
  metadata:
    cwe:
    - 'CWE-521: Weak Password Requirements'
    owasp:
    - A07:2021 - Identification and Authentication Failures
    references:
    - https://docs.djangoproject.com/en/3.0/topics/auth/passwords/#module-django.contrib.auth.password_validation
    category: security
    technology:
    - django
    subcategory:
    - audit
    likelihood: LOW
    impact: MEDIUM
    confidence: LOW
  languages: [python]
  severity: WARNING