Added missing CWE information for pixee codemods

Author: andrecsilva

src/core_codemods/add_requests_timeouts.py

@@ -27,6 +27,7 @@ def on_result_found(self, original_node, updated_node):
             Reference(
                 url="https://docs.python-requests.org/en/master/user/quickstart/#timeouts"
             ),
+            Reference(url="https://cwe.mitre.org/data/definitions/1088.html"),
         ],
     ),
     detector=SemgrepRuleDetector(

src/core_codemods/django_debug_flag_on.py

@@ -16,6 +16,7 @@ class DjangoDebugFlagOn(SimpleCodemod):
             Reference(
                 url="https://docs.djangoproject.com/en/4.2/ref/settings/#std-setting-DEBUG"
             ),
+            Reference(url="https://cwe.mitre.org/data/definitions/489.html"),
         ],
     )
     change_description = "Flip `Django` debug flag to off."

src/core_codemods/django_session_cookie_secure_off.py

@@ -16,6 +16,7 @@ class DjangoSessionCookieSecureOff(SimpleCodemod):
             Reference(
                 url="https://docs.djangoproject.com/en/4.2/ref/settings/#session-cookie-secure"
             ),
+            Reference(url="https://cwe.mitre.org/data/definitions/614.html"),
         ],
     )
     change_description = "Sets Django's `SESSION_COOKIE_SECURE` flag if off or missing."

src/core_codemods/file_resource_leak.py

@@ -73,8 +73,8 @@ def line_filter(x):
         summary="Automatically Close Resources",
         review_guidance=ReviewGuidance.MERGE_WITHOUT_REVIEW,
         references=[
-            Reference(url="https://cwe.mitre.org/data/definitions/772.html"),
             Reference(url="https://cwe.mitre.org/data/definitions/404.html"),
+            Reference(url="https://cwe.mitre.org/data/definitions/772.html"),
         ],
     ),
     transformer=LibcstTransformerPipeline(FileResourceLeakTransformer),

src/core_codemods/flask_enable_csrf_protection.py

@@ -19,6 +19,7 @@ class FlaskEnableCSRFProtection(
         references=[
             Reference(url="https://owasp.org/www-community/attacks/csrf"),
             Reference(url="https://flask-wtf.readthedocs.io/en/1.2.x/csrf/"),
+            Reference(url="https://cwe.mitre.org/data/definitions/352.html"),
         ],
     )
 

src/core_codemods/harden_pickle_load.py

@@ -21,6 +21,9 @@ class HardenPickleLoad(SimpleCodemod, ImportModifierCodemod):
             Reference(
                 url="https://github.com/trailofbits/fickling",
             ),
+            Reference(
+                url="https://cwe.mitre.org/data/definitions/502.html",
+            ),
         ],
     )
 

src/core_codemods/harden_ruamel.py

@@ -11,6 +11,7 @@ class HardenRuamel(SimpleCodemod):
             Reference(
                 url="https://owasp.org/www-community/vulnerabilities/Deserialization_of_untrusted_data"
             ),
+            Reference(url="https://cwe.mitre.org/data/definitions/502.html"),
         ],
     )
     change_description = (

src/core_codemods/https_connection.py

@@ -59,6 +59,7 @@ class HTTPSConnection(SimpleCodemod):
             Reference(
                 url="https://urllib3.readthedocs.io/en/stable/reference/urllib3.connectionpool.html#urllib3.HTTPConnectionPool"
             ),
+            Reference(url="https://cwe.mitre.org/data/definitions/319.html"),
         ],
     )
 

src/core_codemods/lxml_safe_parser_defaults.py

@@ -17,6 +17,7 @@ class LxmlSafeParserDefaults(SimpleCodemod):
             Reference(
                 url="https://cheatsheetseries.owasp.org/cheatsheets/XML_External_Entity_Prevention_Cheat_Sheet.html"
             ),
+            Reference(url="https://cwe.mitre.org/data/definitions/611.html"),
         ],
     )
     change_description = "Replace `lxml` parser parameters with safe defaults."

src/core_codemods/lxml_safe_parsing.py

@@ -17,6 +17,7 @@ class LxmlSafeParsing(SimpleCodemod):
             Reference(
                 url="https://cheatsheetseries.owasp.org/cheatsheets/XML_External_Entity_Prevention_Cheat_Sheet.html"
             ),
+            Reference(url="https://cwe.mitre.org/data/definitions/611.html"),
         ],
     )
     change_description = (