numpy-f2py-compile.yaml

rules:
  - id: numpy-f2py-compile
    message: Compiling arbitrary code can result in code execution. Ensure the source code is from a trusted location
    languages: [python]
    severity: ERROR
    metadata:
      category: security
      cwe: "CWE-676: Use of Potentially Dangerous Function"
      subcategory: [audit]
      confidence: MEDIUM
      likelihood: MEDIUM
      impact: HIGH
      technology: [numpy]
      description: "Potential arbitrary code execution from `NumPy` `f2py` compilation"
      references:
        - https://numpy.org/doc/stable/f2py/usage.html

    patterns:
      - pattern: numpy.f2py.compile(...)
      - pattern-not: numpy.f2py.compile("...", ...)