rules:
- id: avoid-bind-to-all-interfaces
  message: >-
    Running `socket.bind` to 0.0.0.0, ::, or empty string could unexpectedly
    expose the server publicly as it binds to all available interfaces. Consider
    instead getting correct address from an environment variable or
    configuration file.
  metadata:
    cwe: 'CWE-200: Exposure of Sensitive Information to an Unauthorized Actor'
    owasp: 'A6: Security Misconfiguration'
    category: security
    technology:
    - python
  languages: [python]
  severity: INFO
  pattern-either:
  - pattern: |
      $S = socket.socket(...)
      ...
      $S.bind(("0.0.0.0", ...))
  - pattern: |
      $S = socket.socket(...)
      ...
      $S.bind(("::", ...))
  - pattern: |
      $S = socket.socket(...)
      ...
      $S.bind(("", ...))