Python: Module not intended for production

python/ql/src/experimental/Security/CWE-602/DangerousHttpServer.qhelp

@@ -0,0 +1,23 @@
+<!DOCTYPE qhelp PUBLIC "-//Semmle//qhelp//EN" "qhelp.dtd">
+<qhelp>
+
+<overview>
+<p>
+http.server is not recommended for production, as it only implements basic security checks. Use a production level server implementation for deployment.
+</p>
+</overview>
+
+<recommendation>
+
+</recommendation>
+
+<references>
+
+<li>
+Python Standard Library: <a href="https://docs.python.org/3/library/http.server.html">http.server</a>.
+Issue: <a href="https://bugs.python.org/issue32084">Issue 32084</a>.
+Issue: <a href="https://bugs.python.org/issue26657">Issue 26657</a>.
+</li>
+</references>
+
+</qhelp>

python/ql/src/experimental/Security/CWE-602/DangerousHttpServer.ql

@@ -0,0 +1,21 @@
+/**
+ * @name Dangerous http.server module
+ * @description Use of a module that is not recommended for production, as it only implements basic security checks.
+ * @kind problem
+ * @problem.severity warning
+ * @id py/dangerous-http-server
+ * @tags reliability
+ *       security
+ */
+
+import python
+
+ModuleValue http_server(string mod, string msg) {
+  mod = "http.server" and
+  msg = "http.server is not recommended for production. It only implements basic security checks." and
+  result = Module::named(mod)
+}
+
+from AstNode c, string mod, string msg
+where c = http_server(mod, msg).getAReference().getNode()
+select c, msg

python/ql/test/experimental/Security/CWE-602/DangerousHttpServer.expected

@@ -0,0 +1 @@
+| DangerousHttpServer.py:6:11:6:21 | Attribute | http.server is not recommended for production. It only implements basic security checks. |

python/ql/test/experimental/Security/CWE-602/DangerousHttpServer.py

@@ -0,0 +1,10 @@
+import http.server
+import socketserver
+
+PORT = 8000
+
+Handler = http.server.SimpleHTTPRequestHandler
+
+with socketserver.TCPServer(("", PORT), Handler) as httpd:
+    print("serving at port", PORT)
+    httpd.serve_forever()

python/ql/test/experimental/Security/CWE-602/DangerousHttpServer.qlref

@@ -0,0 +1 @@
+experimental/Security/CWE-602/DangerousHttpServer.ql