rules:
- id: hashids-with-django-secret
  languages:
  - python
  message: >-
    The Django secret key is used as salt in HashIDs. The HashID mechanism is not secure.
    By observing sufficient HashIDs, the salt used to construct them can be recovered.
    This means the Django secret key can be obtained by attackers, through the HashIDs.
  metadata:
    category: security
    subcategory:
    - vuln
    cwe:
    - "CWE-327: Use of a Broken or Risky Cryptographic Algorithm"
    owasp:
    - A02:2021 – Cryptographic Failures
    references:
    - https://docs.djangoproject.com/en/4.2/ref/settings/#std-setting-SECRET_KEY
    - http://carnage.github.io/2015/08/cryptanalysis-of-hashids
    technology:
    - django
    likelihood: LOW
    impact: HIGH
    confidence: HIGH
  pattern-either:
  - pattern: hashids.Hashids(..., salt=django.conf.settings.SECRET_KEY, ...)
  - pattern: hashids.Hashids(django.conf.settings.SECRET_KEY, ...)
  severity: ERROR