Feature Request: Whitelist lines ending in # nosec

[KevinHock]

So both detect-secrets and Bandit have the concept of whitelisting a line by putting a comment at the end, similar to how you've probably seen people do # noqa: F401 or whatever, with pylint.

Let us steal once again, from Bandit, since they are most similar to us, here are the relevant lines, but we shall change lineno + 1 for to enumerate(lines, start=1) because it is more pythonic.

They also have the --ignore-nosec do not skip lines with # nosec comments command line optionso we shall pass in the set of lines to the 2 calls tofind_vulnerabilities` in __main__,

[KevinHock]

While I initially thought we would just give the option to add # nosec to the sinks, e.g.

@app.route('/menu', methods=['POST'])
def menu():
    param = request.form['suggestion']
    command = 'echo ' + param + ' >> ' + 'menu.txt'

    subprocess.call(command, shell=True)  # nosec

    with open('menu.txt','r') as f:
        menu = f.read()

    return render_template('command_injection.html', menu=menu)

We can, without writing any more lines of code, give the option to add # nosec to the sources, e.g.

@app.route('/menu', methods=['POST'])
def menu():
    param = request.form['suggestion']  # nosec
    command = 'echo ' + param + ' >> ' + 'menu.txt'

    subprocess.call(command, shell=True)

    with open('menu.txt','r') as f:
        menu = f.read()

    return render_template('command_injection.html', menu=menu)

This may be the preference of a security team, as the code may change in the future, and it's more dangerous to have the sink be whitelisted, because there may be multiple vuln chains.

[KevinHock]

Would you like to take this one, @omergunal?

[omergunal]

sure

[KevinHock]

I forgot to say this before, but after passing the set of lines to find_vulnerabilities we can ignore both sources and sinks in the same function, find_triggers, something like if node.lineno not in nosec_lines:

[KevinHock]

Also for some reason I cannot 'Assign' you the issue in GitHub, maybe you can assign yourself.

[omergunal]

I couldnt do

[KevinHock]

Woohoo 👍