codeslick-cli 1.5.0 → 1.5.1
This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
|
@@ -76,8 +76,8 @@ function checkInjectionAttacks(lines, unsafeSqlVariables, unsafeCommandVariables
|
|
|
76
76
|
'Privilege escalation'
|
|
77
77
|
], 'exec(dynamic_code)', '# Refactor to avoid dynamic code execution\n# Use configuration files, function mappings, or plugins instead', 'exec() should never be used with untrusted input. Redesign architecture to eliminate need for dynamic code execution'));
|
|
78
78
|
}
|
|
79
|
-
// 3. compile() - HIGH
|
|
80
|
-
if (trimmed.includes('compile(')) {
|
|
79
|
+
// 3. compile() - HIGH (exclude re.compile() which is safe regex compilation)
|
|
80
|
+
if (trimmed.includes('compile(') && !trimmed.includes('re.compile(')) {
|
|
81
81
|
vulnerabilities.push((0, createVulnerability_1.createPythonSecurityVulnerability)('eval-usage', 'compile() can execute arbitrary code', 'Avoid compile() with untrusted input, validate strictly if required', lineNumber, 'compile() creates code objects that can be executed with exec(), providing another vector for code injection.', 'code = compile(user_input, "<string>", "exec"); exec(code)', [
|
|
82
82
|
'Code injection',
|
|
83
83
|
'Remote code execution',
|
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"file":"injection-attacks.js","sourceRoot":"","sources":["../../../../../../../../src/lib/analyzers/python/security-checks/injection-attacks.ts"],"names":[],"mappings":";AAAA;;;;;;GAMG;;AA2BH,sDAyWC;AAjYD,sEAAiF;AAEjF;;;;;;;;;;;;;;;;;;;;;GAqBG;AACH,SAAgB,qBAAqB,CACnC,KAAe,EACf,kBAAuC,EACvC,sBAA2C;IAE3C,MAAM,eAAe,GAA4B,EAAE,CAAC;IACpD,IAAI,kBAAkB,GAAG,KAAK,CAAC;IAE/B,KAAK,CAAC,OAAO,CAAC,CAAC,IAAI,EAAE,KAAK,EAAE,EAAE;QAC5B,MAAM,UAAU,GAAG,KAAK,GAAG,CAAC,CAAC;QAC7B,MAAM,OAAO,GAAG,IAAI,CAAC,IAAI,EAAE,CAAC;QAE5B,kFAAkF;QAClF,MAAM,cAAc,GAAG,OAAO,CAAC,QAAQ,CAAC,KAAK,CAAC,IAAI,OAAO,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC;QAE1E,IAAI,cAAc,EAAE,CAAC;YACnB,IAAI,CAAC,kBAAkB,EAAE,CAAC;gBACxB,kBAAkB,GAAG,IAAI,CAAC;gBAC1B,MAAM,gBAAgB,GAAG,CAAC,OAAO,CAAC,KAAK,CAAC,MAAM,CAAC,IAAI,EAAE,CAAC,CAAC,MAAM,GAAG,CAAC,OAAO,CAAC,KAAK,CAAC,MAAM,CAAC,IAAI,EAAE,CAAC,CAAC,MAAM,CAAC;gBACrG,IAAI,gBAAgB,IAAI,CAAC,EAAE,CAAC;oBAC1B,kBAAkB,GAAG,KAAK,CAAC;gBAC7B,CAAC;gBACD,OAAO;YACT,CAAC;iBAAM,CAAC;gBACN,kBAAkB,GAAG,KAAK,CAAC;gBAC3B,OAAO;YACT,CAAC;QACH,CAAC;QAED,+EAA+E;QAC/E,IAAI,CAAC,OAAO,IAAI,kBAAkB,IAAI,OAAO,CAAC,UAAU,CAAC,GAAG,CAAC,EAAE,CAAC;YAC9D,OAAO;QACT,CAAC;QAED,6BAA6B;QAC7B,uBAAuB;QACvB,IAAI,OAAO,CAAC,QAAQ,CAAC,OAAO,CAAC,EAAE,CAAC;YAC9B,eAAe,CAAC,IAAI,CAAC,IAAA,uDAAiC,EACpD,YAAY,EACZ,wCAAwC,EACxC,+DAA+D,EAC/D,UAAU,EACV,8HAA8H,EAC9H,+EAA+E,EAC/E;gBACE,6BAA6B;gBAC7B,4BAA4B;gBAC5B,6BAA6B;gBAC7B,oBAAoB;aACrB,EACD,2BAA2B,EAC3B,iIAAiI,EACjI,4GAA4G,CAC7G,CAAC,CAAC;QACL,CAAC;QAED,uBAAuB;QACvB,IAAI,OAAO,CAAC,QAAQ,CAAC,OAAO,CAAC,EAAE,CAAC;YAC9B,eAAe,CAAC,IAAI,CAAC,IAAA,uDAAiC,EACpD,YAAY,EACZ,wCAAwC,EACxC,mDAAmD,EACnD,UAAU,EACV,kIAAkI,EAClI,iGAAiG,EACjG;gBACE,6BAA6B;gBAC7B,oBAAoB;gBACpB,mBAAmB;gBACnB,sBAAsB;aACvB,EACD,oBAAoB,EACpB,8GAA8G,EAC9G,sHAAsH,CACvH,CAAC,CAAC;QACL,CAAC;QAED,
|
|
1
|
+
{"version":3,"file":"injection-attacks.js","sourceRoot":"","sources":["../../../../../../../../src/lib/analyzers/python/security-checks/injection-attacks.ts"],"names":[],"mappings":";AAAA;;;;;;GAMG;;AA2BH,sDAyWC;AAjYD,sEAAiF;AAEjF;;;;;;;;;;;;;;;;;;;;;GAqBG;AACH,SAAgB,qBAAqB,CACnC,KAAe,EACf,kBAAuC,EACvC,sBAA2C;IAE3C,MAAM,eAAe,GAA4B,EAAE,CAAC;IACpD,IAAI,kBAAkB,GAAG,KAAK,CAAC;IAE/B,KAAK,CAAC,OAAO,CAAC,CAAC,IAAI,EAAE,KAAK,EAAE,EAAE;QAC5B,MAAM,UAAU,GAAG,KAAK,GAAG,CAAC,CAAC;QAC7B,MAAM,OAAO,GAAG,IAAI,CAAC,IAAI,EAAE,CAAC;QAE5B,kFAAkF;QAClF,MAAM,cAAc,GAAG,OAAO,CAAC,QAAQ,CAAC,KAAK,CAAC,IAAI,OAAO,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC;QAE1E,IAAI,cAAc,EAAE,CAAC;YACnB,IAAI,CAAC,kBAAkB,EAAE,CAAC;gBACxB,kBAAkB,GAAG,IAAI,CAAC;gBAC1B,MAAM,gBAAgB,GAAG,CAAC,OAAO,CAAC,KAAK,CAAC,MAAM,CAAC,IAAI,EAAE,CAAC,CAAC,MAAM,GAAG,CAAC,OAAO,CAAC,KAAK,CAAC,MAAM,CAAC,IAAI,EAAE,CAAC,CAAC,MAAM,CAAC;gBACrG,IAAI,gBAAgB,IAAI,CAAC,EAAE,CAAC;oBAC1B,kBAAkB,GAAG,KAAK,CAAC;gBAC7B,CAAC;gBACD,OAAO;YACT,CAAC;iBAAM,CAAC;gBACN,kBAAkB,GAAG,KAAK,CAAC;gBAC3B,OAAO;YACT,CAAC;QACH,CAAC;QAED,+EAA+E;QAC/E,IAAI,CAAC,OAAO,IAAI,kBAAkB,IAAI,OAAO,CAAC,UAAU,CAAC,GAAG,CAAC,EAAE,CAAC;YAC9D,OAAO;QACT,CAAC;QAED,6BAA6B;QAC7B,uBAAuB;QACvB,IAAI,OAAO,CAAC,QAAQ,CAAC,OAAO,CAAC,EAAE,CAAC;YAC9B,eAAe,CAAC,IAAI,CAAC,IAAA,uDAAiC,EACpD,YAAY,EACZ,wCAAwC,EACxC,+DAA+D,EAC/D,UAAU,EACV,8HAA8H,EAC9H,+EAA+E,EAC/E;gBACE,6BAA6B;gBAC7B,4BAA4B;gBAC5B,6BAA6B;gBAC7B,oBAAoB;aACrB,EACD,2BAA2B,EAC3B,iIAAiI,EACjI,4GAA4G,CAC7G,CAAC,CAAC;QACL,CAAC;QAED,uBAAuB;QACvB,IAAI,OAAO,CAAC,QAAQ,CAAC,OAAO,CAAC,EAAE,CAAC;YAC9B,eAAe,CAAC,IAAI,CAAC,IAAA,uDAAiC,EACpD,YAAY,EACZ,wCAAwC,EACxC,mDAAmD,EACnD,UAAU,EACV,kIAAkI,EAClI,iGAAiG,EACjG;gBACE,6BAA6B;gBAC7B,oBAAoB;gBACpB,mBAAmB;gBACnB,sBAAsB;aACvB,EACD,oBAAoB,EACpB,8GAA8G,EAC9G,sHAAsH,CACvH,CAAC,CAAC;QACL,CAAC;QAED,6EAA6E;QAC7E,IAAI,OAAO,CAAC,QAAQ,CAAC,UAAU,CAAC,IAAI,CAAC,OAAO,CAAC,QAAQ,CAAC,aAAa,CAAC,EAAE,CAAC;YACrE,eAAe,CAAC,IAAI,CAAC,IAAA,uDAAiC,EACpD,YAAY,EACZ,sCAAsC,EACtC,qEAAqE,EACrE,UAAU,EACV,+GAA+G,EAC/G,4DAA4D,EAC5D;gBACE,gBAAgB;gBAChB,uBAAuB;gBACvB,6BAA6B;aAC9B,EACD,gDAAgD,EAChD,4GAA4G,EAC5G,+GAA+G,CAChH,CAAC,CAAC;QACL,CAAC;QAED,8BAA8B;QAC9B,sDAAsD;QACtD,IAAI,OAAO,CAAC,KAAK,CAAC,gCAAgC,CAAC;YAC/C,OAAO,CAAC,KAAK,CAAC,iCAAiC,CAAC;YAChD,OAAO,CAAC,KAAK,CAAC,sBAAsB,CAAC,EAAE,CAAC;YAC1C,eAAe,CAAC,IAAI,CAAC,IAAA,uDAAiC,EACpD,eAAe,EACf,kDAAkD,EAClD,6CAA6C,EAC7C,UAAU,EACV,iKAAiK,EACjK,wFAAwF,EACxF;gBACE,0CAA0C;gBAC1C,uBAAuB;gBACvB,mBAAmB;gBACnB,kBAAkB;gBAClB,sBAAsB;aACvB,EACD,6DAA6D,EAC7D,uIAAuI,EACvI,8HAA8H,CAC/H,CAAC,CAAC;QACL,CAAC;QAED,qEAAqE;QACrE,uDAAuD;QACvD,IAAI,OAAO,CAAC,KAAK,CAAC,6BAA6B,CAAC,EAAE,CAAC;YACjD,MAAM,eAAe,GAAG,OAAO,CAAC,KAAK,CAAC,6BAA6B,CAAC,CAAC;YACrE,IAAI,eAAe,EAAE,CAAC;gBACpB,MAAM,OAAO,GAAG,eAAe,CAAC,CAAC,CAAC,CAAC;gBACnC,IAAI,kBAAkB,CAAC,GAAG,CAAC,OAAO,CAAC,EAAE,CAAC;oBACpC,MAAM,aAAa,GAAG,kBAAkB,CAAC,GAAG,CAAC,OAAO,CAAE,CAAC;oBACvD,eAAe,CAAC,IAAI,CAAC,IAAA,uDAAiC,EACpD,eAAe,EACf,sCAAsC,OAAO,0BAA0B,aAAa,GAAG,EACvF,6CAA6C,EAC7C,UAAU,EACV,aAAa,OAAO,wDAAwD,aAAa,0FAA0F,EACnL,+DAA+D,aAAa,mCAAmC,UAAU,gBAAgB,EACzI;wBACE,0CAA0C;wBAC1C,uBAAuB;wBACvB,mBAAmB;wBACnB,kBAAkB;wBAClB,sBAAsB;qBACvB,EACD,UAAU,aAAa,kEAAkE,UAAU,0BAA0B,EAC7H,uIAAuI,EACvI,8HAA8H,CAC/H,CAAC,CAAC;gBACL,CAAC;YACH,CAAC;QACH,CAAC;QAED,2CAA2C;QAC3C,IAAI,CAAC,OAAO,CAAC,QAAQ,CAAC,YAAY,CAAC,IAAI,OAAO,CAAC,QAAQ,CAAC,kBAAkB,CAAC;YACtE,OAAO,CAAC,QAAQ,CAAC,iBAAiB,CAAC,IAAI,OAAO,CAAC,QAAQ,CAAC,mBAAmB,CAAC,CAAC;YAC9E,CAAC,OAAO,CAAC,QAAQ,CAAC,GAAG,CAAC,IAAI,OAAO,CAAC,QAAQ,CAAC,IAAI,CAAC,IAAI,OAAO,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC,EAAE,CAAC;YAChF,eAAe,CAAC,IAAI,CAAC,IAAA,uDAAiC,EACpD,mBAAmB,EACnB,0CAA0C,EAC1C,0DAA0D,EAC1D,UAAU,EACV,wIAAwI,EACxI,6DAA6D,EAC7D;gBACE,6BAA6B;gBAC7B,4BAA4B;gBAC5B,eAAe;gBACf,sBAAsB;gBACtB,uBAAuB;aACxB,EACD,6BAA6B,EAC7B,oGAAoG,EACpG,4HAA4H,CAC7H,CAAC,CAAC;QACL,CAAC;QAED,8EAA8E;QAC9E,8DAA8D;QAC9D,MAAM,qBAAqB,GAAG,OAAO,CAAC,KAAK,CAAC,gFAAgF,CAAC,CAAC;QAC9H,IAAI,qBAAqB,EAAE,CAAC;YAC1B,MAAM,OAAO,GAAG,qBAAqB,CAAC,CAAC,CAAC,CAAC;YACzC,IAAI,sBAAsB,CAAC,GAAG,CAAC,OAAO,CAAC,EAAE,CAAC;gBACxC,MAAM,aAAa,GAAG,sBAAsB,CAAC,GAAG,CAAC,OAAO,CAAE,CAAC;gBAC3D,eAAe,CAAC,IAAI,CAAC,IAAA,uDAAiC,EACpD,mBAAmB,EACnB,0CAA0C,OAAO,0BAA0B,aAAa,GAAG,EAC3F,0DAA0D,EAC1D,UAAU,EACV,aAAa,OAAO,4DAA4D,aAAa,yGAAyG,EACtM,0CAA0C,aAAa,gCAAgC,UAAU,gBAAgB,EACjH;oBACE,6BAA6B;oBAC7B,4BAA4B;oBAC5B,0DAA0D;oBAC1D,sBAAsB;oBACtB,uBAAuB;iBACxB,EACD,UAAU,aAAa,6CAA6C,UAAU,uBAAuB,EACrG,iGAAiG,EACjG,sNAAsN,CACvN,CAAC,CAAC;YACL,CAAC;QACH,CAAC;QAED,4EAA4E;QAC5E,kGAAkG;QAClG,IAAI,OAAO,CAAC,KAAK,CAAC,yDAAyD,CAAC,EAAE,CAAC;YAC7E,oDAAoD;YACpD,MAAM,cAAc,GAAG,eAAe,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAC9C,CAAC,CAAC,IAAI,KAAK,UAAU,IAAI,CAAC,CAAC,QAAQ,KAAK,mBAAmB,CAC5D,CAAC;YAEF,IAAI,CAAC,cAAc,EAAE,CAAC;gBACpB,eAAe,CAAC,IAAI,CAAC,IAAA,uDAAiC,EACpD,mBAAmB,EACnB,0EAA0E,EAC1E,6DAA6D,EAC7D,UAAU,EACV,6OAA6O,EAC7O,sHAAsH,EACtH;oBACE,6BAA6B;oBAC7B,0BAA0B;oBAC1B,kDAAkD;oBAClD,sBAAsB;oBACtB,uBAAuB;oBACvB,+CAA+C;iBAChD,EACD,4GAA4G,EAC5G,uPAAuP,EACvP,8RAA8R,CAC/R,CAAC,CAAC;YACL,CAAC;QACH,CAAC;QAED,oFAAoF;QACpF,uEAAuE;QACvE,IAAI,OAAO,CAAC,QAAQ,CAAC,mBAAmB,CAAC;YACrC,CAAC,OAAO,CAAC,QAAQ,CAAC,aAAa,CAAC;YAChC,CAAC,OAAO,CAAC,QAAQ,CAAC,eAAe,CAAC,EAAE,CAAC;YACvC,2DAA2D;YAC3D,MAAM,YAAY,GAAG,OAAO,CAAC,KAAK,CAAC,2CAA2C,CAAC;gBAC3D,OAAO,CAAC,QAAQ,CAAC,UAAU,CAAC;gBAC5B,OAAO,CAAC,QAAQ,CAAC,QAAQ,CAAC,CAAC;YAE/C,IAAI,YAAY,EAAE,CAAC;gBACjB,eAAe,CAAC,IAAI,CAAC,IAAA,uDAAiC,EACpD,mBAAmB,EACnB,6DAA6D,EAC7D,uDAAuD,EACvD,UAAU,EACV,wNAAwN,EACxN,4DAA4D,EAC5D;oBACE,6BAA6B;oBAC7B,0BAA0B;oBAC1B,wDAAwD;oBACxD,0BAA0B;iBAC3B,EACD,2BAA2B,EAC3B,4EAA4E,EAC5E,yIAAyI,CAC1I,CAAC,CAAC;YACL,CAAC;QACH,CAAC;QAED,qCAAqC;QACrC,IAAI,OAAO,CAAC,KAAK,CAAC,qCAAqC,CAAC,EAAE,CAAC;YACzD,eAAe,CAAC,IAAI,CAAC,IAAA,uDAAiC,EACpD,mBAAmB,EACnB,sDAAsD,EACtD,oDAAoD,EACpD,UAAU,EACV,oIAAoI,EACpI,4DAA4D,EAC5D;gBACE,mBAAmB;gBACnB,yBAAyB;gBACzB,mBAAmB;gBACnB,WAAW;aACZ,EACD,qCAAqC,EACrC,2FAA2F,EAC3F,wGAAwG,CACzG,CAAC,CAAC;QACL,CAAC;QAED,gGAAgG;QAChG,6EAA6E;QAC7E,IAAI,OAAO,CAAC,QAAQ,CAAC,mBAAmB,CAAC,IAAI,OAAO,CAAC,QAAQ,CAAC,OAAO,CAAC,IAAI,OAAO,CAAC,QAAQ,CAAC,MAAM,CAAC,EAAE,CAAC;YACnG,0CAA0C;YAC1C,IAAI,OAAO,CAAC,KAAK,CAAC,0CAA0C,CAAC;gBACzD,OAAO,CAAC,KAAK,CAAC,wCAAwC,CAAC,EAAE,CAAC;gBAC5D,6CAA6C;gBAC7C,MAAM,eAAe,GAAG,eAAe,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAC/C,CAAC,CAAC,IAAI,KAAK,UAAU,IAAI,CAAC,CAAC,OAAO,CAAC,QAAQ,CAAC,YAAY,CAAC,CAC1D,CAAC;gBAEF,IAAI,CAAC,eAAe,EAAE,CAAC;oBACrB,eAAe,CAAC,IAAI,CAAC,IAAA,uDAAiC,EACpD,mBAAmB,EACnB,4DAA4D,EAC5D,oDAAoD,EACpD,UAAU,EACV,4JAA4J,EAC5J,8DAA8D,EAC9D;wBACE,mBAAmB;wBACnB,yBAAyB;wBACzB,mBAAmB;wBACnB,WAAW;qBACZ,EACD,+DAA+D,EAC/D,4FAA4F,EAC5F,mHAAmH,CACpH,CAAC,CAAC;gBACL,CAAC;YACH,CAAC;QACH,CAAC;QAED,kGAAkG;QAClG,6DAA6D;QAC7D,uFAAuF;QACvF,MAAM,eAAe,GAAG,OAAO,CAAC,KAAK,CAAC,0DAA0D,CAAC,CAAC;QAClG,MAAM,kBAAkB,GAAG,CAAC,eAAe,CAAC,CAAC,CAAC,OAAO,CAAC,KAAK,CAAC,0DAA0D,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC;QAC/H,MAAM,cAAc,GAAG,OAAO,CAAC,KAAK,CAAC,yBAAyB,CAAC,IAAI,OAAO,CAAC,KAAK,CAAC,gCAAgC,CAAC,CAAC;QAEnH,IAAI,CAAC,eAAe,IAAI,kBAAkB,IAAI,cAAc,CAAC;YACzD,CAAC,OAAO,CAAC,QAAQ,CAAC,OAAO,CAAC,IAAI,OAAO,CAAC,QAAQ,CAAC,WAAW,CAAC,CAAC;YAC5D,CAAC,OAAO,CAAC,QAAQ,CAAC,cAAc,CAAC,IAAK,mDAAmD;YACzF,CAAC,OAAO,CAAC,QAAQ,CAAC,UAAU,CAAC,IAAU,gCAAgC;YACvE,CAAC,OAAO,CAAC,QAAQ,CAAC,WAAW,CAAC,EAAE,CAAC,CAAM,2BAA2B;YAEpE,MAAM,cAAc,GAAG,eAAe,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAC9C,CAAC,CAAC,IAAI,KAAK,UAAU,IAAI,CAAC,CAAC,QAAQ,KAAK,gBAAgB,CACzD,CAAC;YAEF,IAAI,CAAC,cAAc,EAAE,CAAC;gBACpB,eAAe,CAAC,IAAI,CAAC,IAAA,uDAAiC,EACpD,gBAAgB,EAChB,oEAAoE,EACpE,uFAAuF,EACvF,UAAU,EACV,iPAAiP,EACjP,0EAA0E,EAC1E;oBACE,2DAA2D;oBAC3D,yCAAyC;oBACzC,wBAAwB;oBACxB,oCAAoC;oBACpC,4CAA4C;iBAC7C,EACD,qJAAqJ,EACrJ,8fAA8f,EAC9f,kSAAkS,CACnS,CAAC,CAAC;YACL,CAAC;QACH,CAAC;IACH,CAAC,CAAC,CAAC;IAEH,OAAO,eAAe,CAAC;AACzB,CAAC"}
|