# Python analysis detects more OWASP Top 10 security issues

**URL:** <https://community.sonarsource.com/t/python-analysis-detects-more-owasp-top-10-security-issues/20357>\
**Category:** Sonar Updates\
**Tags:** python, security\
**Created:** [February 19, 2020, 2:38pm UTC](https://community.sonarsource.com/t/python-analysis-detects-more-owasp-top-10-security-issues/20357 "2020-02-19T14:38:28Z")\
**Posts on this page:** 1\
**Page:** 1

<div class="post-metadata">

**Author:** ![Alexandre\_Gigleux](https://dub1.discourse-cdn.com/sonarsource/user_avatar/community.sonarsource.com/alexandre_gigleux/32/26_2.png) [@Alexandre\_Gigleux](https://community.sonarsource.com/u/Alexandre_Gigleux)\
**Post date:** [February 19, 2020, 2:38pm UTC](https://community.sonarsource.com/t/python-analysis-detects-more-owasp-top-10-security-issues/20357/1 "2020-02-19T14:38:28Z")

</div>

Hello Python developers,

The latest updates on Python analyzer help you make your Python code more secure and compliant with OWASP Top 10 2017. Here are the 10 new rules:

Vulnerability Detection:

- [S3649](https://rules.sonarsource.com/python/RSPEC-3649): Database queries should not be vulnerable to injection attacks (A1 - Blocker)
- [S2115](https://rules.sonarsource.com/python/RSPEC-2115): Databases should be password-protected (A3 - Blocker)
- [S5527](https://rules.sonarsource.com/python/RSPEC-5527): Server hostnames should be verified during SSL/TLS connections (A3, A6 - Critical)
- [S2053](https://rules.sonarsource.com/python/RSPEC-2053): Hashes should include an unpredictable salt (A3 - Critical)

Security Hotspot Detection:

- [S2068](https://rules.sonarsource.com/python/RSPEC-2068): Hard-coded credentials are security-sensitive (A2)
- [S5300](https://rules.sonarsource.com/python/RSPEC-5300): Sending emails is security-sensitive (A1)
- [S5042](https://rules.sonarsource.com/python/RSPEC-5042): Expanding archive files is security-sensitive (A5)
- [S5122](https://rules.sonarsource.com/python/RSPEC-5122): Enabling Cross-Origin Resource Sharing (CORS) is security-sensitive (A6)
- [S2092](https://rules.sonarsource.com/python/RSPEC-2092): Creating cookies without the “secure” flag is security-sensitive (A3)
- [S3330](https://rules.sonarsource.com/python/RSPEC-3330): Creating cookies without the “HttpOnly” flag is security-sensitive (A7)

These features are already available on [SonarCloud](https://sonarcloud.io/), and will be included in SonarQube 8.2.

Alex