Add input linter when asking for password

dlint/linters/__init__.py

@@ -36,6 +36,7 @@
 from .bad_xmlsec_module_attribute_use import BadXmlsecModuleAttributeUseLinter
 from .bad_yaml_use import BadYAMLUseLinter
 from .bad_zipfile_use import BadZipfileUseLinter
+from .input_password_ask import InputPasswordUseLinter
 
 from .twisted.inlinecallbacks_yield_statement import InlineCallbacksYieldStatementLinter
 from .twisted.returnvalue_in_inlinecallbacks import ReturnValueInInlineCallbacksLinter
@@ -80,4 +81,5 @@
     InlineCallbacksYieldStatementLinter,
     ReturnValueInInlineCallbacksLinter,
     YieldReturnStatementLinter,
+    InputPasswordUseLinter,
 )

dlint/linters/input_password_ask.py

@@ -0,0 +1,33 @@
+#!/usr/bin/env python
+
+from . import base
+
+
+class InputPasswordUseLinter(base.BaseLinter):
+    """This linter looks for use of the Python "input" function with a string
+    argument containing the word "password" in any format.
+    """
+    off_by_default = False
+
+    _code = 'DUO139'
+    _error_tmpl = 'DUO139 avoid using "input" to ask for password'
+
+    def visit_Call(self, node):
+
+        if (node.func.id == "input"):
+            value = self._get_arg_or_kwarg(node)
+
+            if "password" in value.lower():
+                self.results.append(
+                    base.Flake8Result(
+                        lineno=node.lineno,
+                        col_offset=node.col_offset,
+                        message=self._error_tmpl
+                    )
+                )
+
+    def _get_arg_or_kwarg(self, node):
+        if node.args:
+            return node.args[0].value
+        if node.keywords:
+            return node.keywords[0].value.value

docs/README.md

@@ -42,6 +42,7 @@ Dlint uses a simple, folder-based hierarchy written in [Markdown](https://en.wik
 - [`DUO136` `BadXmlsecModuleAttributeUseLinter` insecure "xmlsec" attribute use](https://github.com/dlint-py/dlint/blob/master/docs/linters/DUO136.md)
 - [`DUO137` `BadItsDangerousKwargUseLinter` insecure "itsdangerous" use allowing empty signing](https://github.com/dlint-py/dlint/blob/master/docs/linters/DUO137.md)
 - [`DUO138` `BadReCatastrophicUseLinter` catastrophic "re" usage - denial-of-service possible](https://github.com/dlint-py/dlint/blob/master/docs/linters/DUO138.md)
+- todo
 
 # FAQs
 

docs/linters/DUO139.md

@@ -0,0 +1,25 @@
+# DUO139
+
+This linter searches for use of the built-in `input` function with some form of the string
+"password" as an argument to the function.
+
+## Problematic code
+
+```python
+input("password: ")
+input("Password: ")
+input("PASSWORD")
+```
+
+## Correct code
+
+```python
+import getpass
+
+getpass.getpass()
+```
+
+## Rationale
+
+[getpass](https://docs.python.org/3.7/library/getpass.html) safely asks for a password without echoing the input by default.
+

tests/test_input_password_ask.py

@@ -0,0 +1,53 @@
+#!/usr/bin/env python
+
+import pytest
+import unittest
+
+import dlint
+
+
+@pytest.mark.parametrize("code", [
+    """input('enter your name:')""",
+    """input = 1""",
+    """password = 'something'""",
+])
+def test_input_password_not_used(code):
+    python_node = dlint.test.base.get_ast_node(code)
+
+    linter = dlint.linters.InputPasswordUseLinter()
+    linter.visit(python_node)
+
+    result = linter.get_results()
+    expected = []
+
+    assert result == expected
+
+
+@pytest.mark.parametrize("code", [
+    """input('enter your password:')""",
+    """input('enter your PASSWORD:')""",
+    # unable to detect if the intent wasn't to ask for password because word 'password' is present
+    """input('Please enter your name. Please do not enter your password')""",
+    """input(prompt='enter your PASSWORD:')""",
+])
+def test_input_password_bad(code):
+    python_node = dlint.test.base.get_ast_node(code)
+
+    linter = dlint.linters.InputPasswordUseLinter()
+    linter.visit(python_node)
+
+    result = linter.get_results()
+
+    expected = [
+        dlint.linters.base.Flake8Result(
+            lineno=1,
+            col_offset=0,
+            message=dlint.linters.InputPasswordUseLinter._error_tmpl
+        )
+    ]
+
+    assert result == expected
+
+
+if __name__ == "__main__":
+    unittest.main()