Add/update Python_Django_rules.mdc security rules

Author: justin-pagano-klv

.cursor/rules/Python_Django_rules.mdc

@@ -0,0 +1,37 @@
+---
+description: Generates secure Python/Django code inherently preventing top security weaknesses, adhering to OWASP ASVS and avoiding common CWEs.
+globs: **/*.py
+alwaysApply: false
+---
+
+# Secure Python/Django Code Generation Rules
+
+As a security-aware developer, generate secure Python code using Django that inherently prevents top security weaknesses. Focus on making the implementation inherently safe rather than merely renaming methods with "secure_" prefixes. Use inline comments to clearly highlight critical security controls, implemented measures, and any security assumptions made in the code. Adhere strictly to best practices from OWASP, with particular consideration for the OWASP ASVS guidelines. Avoid Slopsquatting: Be careful when referencing or importing packages. Do not guess if a package exists. Comment on any low reputation or uncommon packages you have included.
+
+### CWE-79: Cross-Site Scripting (XSS)
+**Summary:** Untrusted data is rendered in a web page without proper sanitization, leading to malicious script execution in the user's browser.
+**Mitigation Rule:** Always use Django's template engine's auto-escaping feature for all user-supplied data displayed in templates. If raw HTML must be rendered, use Django's `mark_safe` function only after strict sanitization with a dedicated library like `bleach`.
+
+### CWE-89: SQL Injection
+**Summary:** Untrusted input is used to construct SQL queries, allowing an attacker to alter the query's intent or execute arbitrary database commands.
+**Mitigation Rule:** Exclusively use Django's Object-Relational Mapper (ORM) QuerySet API for all database interactions. Avoid raw SQL queries; if absolutely necessary, use Django's `connection.cursor().execute()` with parameterized queries to prevent injection.
+
+### CWE-200: Exposure of Sensitive Information
+**Summary:** Sensitive information such as personally identifiable data, credentials, or system details is disclosed to an unauthorized actor.
+**Mitigation Rule:** Implement robust access controls using Django's permission system and `login_required` decorator. Ensure all communication uses HTTPS. Filter sensitive data from API responses, logs, and error messages. Avoid verbose error messages in production environments.
+
+### CWE-22: Improper Limitation of a Pathname to a Restricted Directory (Path Traversal)
+**Summary:** Untrusted input is used to access files outside an intended directory, potentially allowing access to sensitive system files.
+**Mitigation Rule:** Strictly validate and sanitize all user-supplied file paths. Use `os.path.abspath` and `os.path.normpath` in conjunction with `os.path.commonpath` to ensure that resolved paths remain within an explicitly defined, trusted base directory for file operations. Store uploaded files in non-executable directories.
+
+### CWE-352: Cross-Site Request Forgery (CSRF)
+**Summary:** An attacker induces a victim to perform an unintended action on a web application where they are authenticated.
+**Mitigation Rule:** Ensure all state-changing HTTP methods (POST, PUT, DELETE) in Django views and forms include and validate the `csrf_token` through Django's built-in `CsrfViewMiddleware` and `{% csrf_token %}` template tag.
+
+### CWE-502: Deserialization of Untrusted Data
+**Summary:** Deserializing data from an untrusted source can lead to arbitrary code execution, denial of service, or other vulnerabilities.
+**Mitigation Rule:** Never deserialize untrusted data using unsafe formats or functions like `pickle`. If deserialization is required, use secure formats like JSON and `json.loads`, ensuring no arbitrary code execution is possible through the deserialized content.
+
+### CWE-798: Use of Hard-coded Credentials
+**Summary:** Sensitive data such as passwords, API keys, or encryption keys are directly embedded within the source code, making them easily discoverable.
+**Mitigation Rule:** All secrets, including database credentials, API keys, and private keys, must be loaded from environment variables using libraries like `python-decouple` or `django-environ`, or from a secure secrets management service (e.g., HashiCorp Vault, AWS Secrets Manager). Never hardcode secrets in the codebase or commit them to version control.