onnx-session-options.yaml

rules:
  - id: onnx-session-options
    message: Loading custom operator libraries can result in arbitrary code execution
    languages: [python]
    severity: ERROR
    metadata:
      category: security
      cwe: "CWE-676: Use of Potentially Dangerous Function"
      subcategory: [audit]
      confidence: MEDIUM
      likelihood: MEDIUM
      impact: HIGH
      technology: [onnx]
      description: "Potential arbitrary code execution from `ONNX` library loading"
      references:
        - https://onnxruntime.ai/docs/reference/operators/add-custom-op.html

    patterns:
      - pattern-inside: |
          $SESSION = onnxruntime.SessionOptions(...)
          ...
      - pattern: $SESSION.register_custom_ops_library(...)
      - pattern-not: $SESSION.register_custom_ops_library("...")