-
Notifications
You must be signed in to change notification settings - Fork 1k
Commit
This commit does not belong to any branch on this repository, and may belong to a fork outside of the repository.
- Loading branch information
1 parent
1216658
commit f926d18
Showing
14 changed files
with
343 additions
and
49 deletions.
There are no files selected for viewing
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Original file line number | Diff line number | Diff line change |
---|---|---|
@@ -0,0 +1,22 @@ | ||
from os import chmod | ||
import stat | ||
|
||
keyfile = "foo" | ||
|
||
chmod("/etc/passwd", 0o227) # Error | ||
chmod("/etc/passwd", 0o7) # Error | ||
chmod("/etc/passwd", 0o664) # OK | ||
chmod("/etc/passwd", 0o777) # Error | ||
chmod("/etc/passwd", 0o770) # Error | ||
chmod("/etc/passwd", 0o776) # Error | ||
chmod("/etc/passwd", 0o760) # OK | ||
chmod("~/.bashrc", 511) # Error | ||
chmod("/etc/hosts", 0o777) # Error | ||
chmod("/tmp/oh_hai", 0x1FF) # Error | ||
chmod("/etc/passwd", stat.S_IRWXU) # OK | ||
chmod(keyfile, 0o777) # Error | ||
chmod(keyfile, 0o7 | 0o70 | 0o700) # Error | ||
chmod(keyfile, stat.S_IRWXO | stat.S_IRWXG | stat.S_IRWXU) # Error | ||
chmod("~/hidden_exec", stat.S_IXGRP) # Error | ||
chmod("~/hidden_exec", stat.S_IXOTH) # OK | ||
chmod("/etc/passwd", stat.S_IWOTH) # Error |
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Original file line number | Diff line number | Diff line change |
---|---|---|
|
@@ -889,6 +889,7 @@ | |
"S10", | ||
"S101", | ||
"S102", | ||
"S103", | ||
"S104", | ||
"S105", | ||
"S106", | ||
|
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Original file line number | Diff line number | Diff line change |
---|---|---|
@@ -0,0 +1,107 @@ | ||
use num_traits::ToPrimitive; | ||
use once_cell::sync::Lazy; | ||
use rustc_hash::{FxHashMap, FxHashSet}; | ||
use rustpython_ast::{Constant, Expr, ExprKind, Keyword, Operator}; | ||
|
||
use crate::ast::helpers::{compose_call_path, match_module_member, SimpleCallArgs}; | ||
use crate::ast::types::Range; | ||
use crate::registry::{Check, CheckKind}; | ||
|
||
const WOTH: u16 = 0o2; | ||
const XGRP: u16 = 0o10; | ||
|
||
static PYSTAT_MAPPING: Lazy<FxHashMap<&'static str, u16>> = Lazy::new(|| { | ||
FxHashMap::from_iter([ | ||
("stat.ST_MODE", 0o0), | ||
("stat.S_IFDOOR", 0o0), | ||
("stat.S_IFPORT", 0o0), | ||
("stat.ST_INO", 0o1), | ||
("stat.S_IXOTH", 0o1), | ||
("stat.UF_NODUMP", 0o1), | ||
("stat.ST_DEV", 0o2), | ||
("stat.S_IWOTH", 0o2), | ||
("stat.UF_IMMUTABLE", 0o2), | ||
("stat.ST_NLINK", 0o3), | ||
("stat.ST_UID", 0o4), | ||
("stat.S_IROTH", 0o4), | ||
("stat.UF_APPEND", 0o4), | ||
("stat.ST_GID", 0o5), | ||
("stat.ST_SIZE", 0o6), | ||
("stat.ST_ATIME", 0o7), | ||
("stat.S_IRWXO", 0o7), | ||
("stat.ST_MTIME", 0o10), | ||
("stat.S_IXGRP", 0o10), | ||
("stat.UF_OPAQUE", 0o10), | ||
("stat.ST_CTIME", 0o11), | ||
("stat.S_IWGRP", 0o20), | ||
("stat.UF_NOUNLINK", 0o20), | ||
("stat.S_IRGRP", 0o40), | ||
("stat.UF_COMPRESSED", 0o40), | ||
("stat.S_IRWXG", 0o70), | ||
("stat.S_IEXEC", 0o100), | ||
("stat.S_IXUSR", 0o100), | ||
("stat.S_IWRITE", 0o200), | ||
("stat.S_IWUSR", 0o200), | ||
("stat.S_IREAD", 0o400), | ||
("stat.S_IRUSR", 0o400), | ||
("stat.S_IRWXU", 0o700), | ||
("stat.S_ISVTX", 0o1000), | ||
("stat.S_ISGID", 0o2000), | ||
("stat.S_ENFMT", 0o2000), | ||
("stat.S_ISUID", 0o4000), | ||
]) | ||
}); | ||
|
||
fn get_int_value(expr: &Expr) -> Option<u16> { | ||
match &expr.node { | ||
ExprKind::Constant { | ||
value: Constant::Int(value), | ||
.. | ||
} => value.to_u16(), | ||
ExprKind::Attribute { .. } => { | ||
if let Some(path) = compose_call_path(expr) { | ||
PYSTAT_MAPPING.get(path.as_str()).copied() | ||
} else { | ||
None | ||
} | ||
} | ||
ExprKind::BinOp { left, op, right } => { | ||
if let (Some(left_value), Some(right_value)) = | ||
(get_int_value(left), get_int_value(right)) | ||
{ | ||
match op { | ||
Operator::BitAnd => Some(left_value & right_value), | ||
Operator::BitOr => Some(left_value | right_value), | ||
Operator::BitXor => Some(left_value ^ right_value), | ||
_ => None, | ||
} | ||
} else { | ||
None | ||
} | ||
} | ||
_ => None, | ||
} | ||
} | ||
|
||
pub fn bad_file_permissions( | ||
func: &Expr, | ||
args: &Vec<Expr>, | ||
keywords: &Vec<Keyword>, | ||
from_imports: &FxHashMap<&str, FxHashSet<&str>>, | ||
import_aliases: &FxHashMap<&str, &str>, | ||
) -> Option<Check> { | ||
if match_module_member(func, "os", "chmod", from_imports, import_aliases) { | ||
let call_args = SimpleCallArgs::new(args, keywords); | ||
if let Some(mode_arg) = call_args.get_argument("mode", Some(1)) { | ||
if let Some(int_value) = get_int_value(mode_arg) { | ||
if (int_value & WOTH > 0) || (int_value & XGRP > 0) { | ||
return Some(Check::new( | ||
CheckKind::BadFilePermissions(int_value), | ||
Range::from_located(mode_arg), | ||
)); | ||
} | ||
} | ||
} | ||
} | ||
None | ||
} |
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
135 changes: 135 additions & 0 deletions
135
src/flake8_bandit/snapshots/ruff__flake8_bandit__tests__S103_S103.py.snap
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Original file line number | Diff line number | Diff line change |
---|---|---|
@@ -0,0 +1,135 @@ | ||
--- | ||
source: src/flake8_bandit/mod.rs | ||
expression: checks | ||
--- | ||
- kind: | ||
BadFilePermissions: 151 | ||
location: | ||
row: 6 | ||
column: 21 | ||
end_location: | ||
row: 6 | ||
column: 26 | ||
fix: ~ | ||
parent: ~ | ||
- kind: | ||
BadFilePermissions: 7 | ||
location: | ||
row: 7 | ||
column: 21 | ||
end_location: | ||
row: 7 | ||
column: 24 | ||
fix: ~ | ||
parent: ~ | ||
- kind: | ||
BadFilePermissions: 511 | ||
location: | ||
row: 9 | ||
column: 21 | ||
end_location: | ||
row: 9 | ||
column: 26 | ||
fix: ~ | ||
parent: ~ | ||
- kind: | ||
BadFilePermissions: 504 | ||
location: | ||
row: 10 | ||
column: 21 | ||
end_location: | ||
row: 10 | ||
column: 26 | ||
fix: ~ | ||
parent: ~ | ||
- kind: | ||
BadFilePermissions: 510 | ||
location: | ||
row: 11 | ||
column: 21 | ||
end_location: | ||
row: 11 | ||
column: 26 | ||
fix: ~ | ||
parent: ~ | ||
- kind: | ||
BadFilePermissions: 511 | ||
location: | ||
row: 13 | ||
column: 19 | ||
end_location: | ||
row: 13 | ||
column: 22 | ||
fix: ~ | ||
parent: ~ | ||
- kind: | ||
BadFilePermissions: 511 | ||
location: | ||
row: 14 | ||
column: 20 | ||
end_location: | ||
row: 14 | ||
column: 25 | ||
fix: ~ | ||
parent: ~ | ||
- kind: | ||
BadFilePermissions: 511 | ||
location: | ||
row: 15 | ||
column: 21 | ||
end_location: | ||
row: 15 | ||
column: 26 | ||
fix: ~ | ||
parent: ~ | ||
- kind: | ||
BadFilePermissions: 511 | ||
location: | ||
row: 17 | ||
column: 15 | ||
end_location: | ||
row: 17 | ||
column: 20 | ||
fix: ~ | ||
parent: ~ | ||
- kind: | ||
BadFilePermissions: 511 | ||
location: | ||
row: 18 | ||
column: 15 | ||
end_location: | ||
row: 18 | ||
column: 33 | ||
fix: ~ | ||
parent: ~ | ||
- kind: | ||
BadFilePermissions: 511 | ||
location: | ||
row: 19 | ||
column: 15 | ||
end_location: | ||
row: 19 | ||
column: 57 | ||
fix: ~ | ||
parent: ~ | ||
- kind: | ||
BadFilePermissions: 8 | ||
location: | ||
row: 20 | ||
column: 23 | ||
end_location: | ||
row: 20 | ||
column: 35 | ||
fix: ~ | ||
parent: ~ | ||
- kind: | ||
BadFilePermissions: 2 | ||
location: | ||
row: 22 | ||
column: 21 | ||
end_location: | ||
row: 22 | ||
column: 33 | ||
fix: ~ | ||
parent: ~ | ||
|
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Oops, something went wrong.