Add yaml checker for exposed stacktrace

checkers/python/exposed-stacktrace.test.py

@@ -0,0 +1,19 @@
+import logging
+import traceback
+
+from django.http import HttpResponse
+
+LOGGER = logging.getLogger(__name__)
+
+
+# <expect-error>
+def debug_view(request):
+    error_trace = traceback.format_exc()
+    return HttpResponse(error_trace, content_type="text/plain", status=500)
+
+
+# <no-error>
+def save_view(request):
+    tb = traceback.format_stack()
+    LOGGER.error(tb)
+    return HttpResponse("Internal Server Error", content_type="text/plain", status=500)

checkers/python/exposed-stacktrace.yml

@@ -0,0 +1,27 @@
+language: py
+name: exposed-stacktrace
+message: Detect exposed stack traces
+
+pattern: |
+  (function_definition
+   body: (block
+  	(expression_statement
+  	 ((assignment
+  	   left: (identifier) @var
+  	   right: (call
+  		   function: (attribute
+  			      object: (identifier) @module
+  			      attribute: (identifier) @func)))))
+  	  (return_statement
+  	   (call
+              function: (identifier) @resp
+              arguments: (argument_list (identifier) @stacktrace)))
+  	  (#eq? @module "traceback")
+  	  (#match? @func "format_(stack|exc|tb)")
+  	  (#match? @resp "(Json|Http)Response")
+  	  (#eq? @stacktrace @var))) @exposed-stacktrace
+
+description: |
+  Stack traces may expose sensitive information, including file paths,
+  folder structures, and internal logic. Instead of returning a stack
+  trace, use logging to monitor program behaviour safely.