formatted-string-bashoperator.yaml

rules:
- id: formatted-string-bashoperator
  message: >-
    Found a formatted string in BashOperator: $CMD.
    This could be vulnerable to injection.
    Be extra sure your variables are not controllable by external sources.
  metadata:
    cwe:
    - "CWE-78: Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')"
    owasp:
    - A01:2017 - Injection
    - A03:2021 - Injection
    category: security
    technology:
    - airflow
    references:
    - https://owasp.org/Top10/A03_2021-Injection
    cwe2022-top25: true
    cwe2021-top25: true
    subcategory:
    - audit
    likelihood: LOW
    impact: HIGH
    confidence: LOW
  languages:
  - python
  severity: ERROR
  pattern-either:
  - pattern: |
      airflow.operators.bash_operator.BashOperator(..., bash_command="..." + $CONCAT, ...)
  - pattern: |
      airflow.operators.bash_operator.BashOperator(..., bash_command="...".format(...), ...)
  - pattern: |
      airflow.operators.bash_operator.BashOperator(..., bash_command=f"...", ...)
  - pattern: |
      airflow.operators.bash_operator.BashOperator(..., bash_command="..." % $PARAMS, ...)
  - pattern: |
      $CMD = "..." % $PARAMS
      ...
      airflow.operators.bash_operator.BashOperator(..., bash_command=$CMD, ...)
  - pattern: |
      $CMD = $STR.format(...)
      ...
      airflow.operators.bash_operator.BashOperator(..., bash_command=$CMD, ...)
  - pattern: |
      $CMD = f"..."
      ...
      airflow.operators.bash_operator.BashOperator(..., bash_command=$CMD, ...)
  - pattern: |
      $CMD = "..." + $CONCAT
      ...
      airflow.operators.bash_operator.BashOperator(..., bash_command=$CMD, ...)
  - pattern: |
      $CMD = "..."
      ...
      $CMD += $CONCAT
      ...
      airflow.operators.bash_operator.BashOperator(..., bash_command=$CMD, ...)