feat(python/django): add rule to detect missing SecurityMiddleware

[balaakasam]

Summary

This PR adds a new Semgrep rule to detect when Django's SecurityMiddleware is missing from the MIDDLEWARE setting in Django applications.

Problem

Django's SecurityMiddleware provides several critical security protections:

• HTTPS redirection (SECURE_SSL_REDIRECT)
• HTTP Strict Transport Security (HSTS) headers
• Content type sniffing protection (X-Content-Type-Options)
• Cross-site scripting filter (X-XSS-Protection)

When SecurityMiddleware is absent, none of these protections are active, leaving web applications — particularly ecommerce applications handling payment and personal data - exposed to common web attacks and non-compliant with PCI-DSS requirements.

This misconfiguration is common and does not currently have a rule in the Semgrep registry.

Changes

• Added missing-security-middleware.yaml - rule targeting Python/Django settings files where MIDDLEWARE list does not include SecurityMiddleware
• Added missing-security-middleware.py - test file with positive case (missing middleware, should trigger) and negative case
  (middleware present, should not trigger)

References

• https://docs.djangoproject.com/en/stable/ref/middleware/#django.middleware.security.SecurityMiddleware
• https://docs.djangoproject.com/en/stable/topics/security/
• OWASP A05:2021 - Security Misconfiguration
• CWE-16: Configuration

[CLAassistant]

All committers have signed the CLA.

[CLAassistant]

Thank you for your submission! We really appreciate it. Like many open source projects, we ask that you sign our Contributor License Agreement before we can accept your contribution.
_{You have signed the CLA already but the status is still pending? Let us recheck it.}

[balaakasam]

Hello team, just checking in on this PR. Happy to make any if needed adjustments to get this to closure. Please let me know
if there is anything I can improve. Thank you!

[balaakasam]

Hi, just following up. CLA is now signed and all checks are passing. Happy to make any adjustments if needed, waiting to hear back. Thanks you.

[balaakasam]

Hi team, following up to see if anything else is needed from my end to get this going. Please let me know. Thank you.

[balaakasam]

Hi team, following up to see if anything else is needed from my end to get this going. Please let me know. Thank you.

[balaakasam]

Hi team, following up to see if anything else is needed from my end to get this going as this has been open since a very long time. Please let me know. Thank you.