mcp-server-semgrep/semgrep-rules/python/django/security/passwords/use-none-for-password-default.yaml

MCP Server for Semgrep Integration - static code analysis with AI

rules:
- id: use-none-for-password-default
  message: >-
    '$VAR' is using the empty string as its default and is being used to set
    the password on '$MODEL'. If you meant to set an unusable password, set
    the default value to 'None' or call 'set_unusable_password()'.
  metadata:
    cwe:
    - 'CWE-521: Weak Password Requirements'
    owasp:
    - A07:2021 - Identification and Authentication Failures
    references:
    - https://docs.djangoproject.com/en/3.0/ref/contrib/auth/#django.contrib.auth.models.User.set_password
    category: security
    technology:
    - django
    subcategory:
    - vuln
    likelihood: MEDIUM
    impact: MEDIUM
    confidence: MEDIUM
  languages: [python]
  severity: ERROR
  patterns:
    - pattern-either:
        - pattern: |
            $VAR = request.$W.get($X, $EMPTY)
            ...
            $MODEL.set_password($VAR)
            ...
            $MODEL.save(...)
        - pattern: |
            def $F(..., $VAR=$EMPTY, ...):
              ...
              $MODEL.set_password($VAR)
    - metavariable-pattern:
        metavariable: $EMPTY
        pattern: '""'
    - focus-metavariable: $EMPTY
  fix: |
    None