Mercurial Repositories > eric / file comparison
comparison: src/eric7/Plugins/CheckerPlugins/CodeStyleChecker/Security/Checks/blackListCalls.py
src/eric7/Plugins/CheckerPlugins/CodeStyleChecker/Security/Checks/blackListCalls.py
- branch
- eric7
- changeset 9221
- bf71ee032bb4
- parent 9209
- b99e7fd55fd3
- child 9325
- 8157eb19aba5
equal
deleted
inserted
replaced
| 9220:e9e7eca7efee | 9221:bf71ee032bb4 |
|---|---|
| 19 import fnmatch | 19 import fnmatch |
| 20 | 20 |
| 21 import AstUtilities | 21 import AstUtilities |
| 22 | 22 |
| 23 _blacklists = { | 23 _blacklists = { |
| 24 'S301': ([ | 24 "S301": ( |
| 25 'pickle.loads', | 25 [ |
| 26 'pickle.load', | 26 "pickle.loads", |
| 27 'pickle.Unpickler', | 27 "pickle.load", |
| 28 'cPickle.loads', | 28 "pickle.Unpickler", |
| 29 'cPickle.load', | 29 "cPickle.loads", |
| 30 'cPickle.Unpickler', | 30 "cPickle.load", |
| 31 'dill.loads', | 31 "cPickle.Unpickler", |
| 32 'dill.load', | 32 "dill.loads", |
| 33 'dill.Unpickler', | 33 "dill.load", |
| 34 'shelve.open', | 34 "dill.Unpickler", |
| 35 'shelve.DbfilenameShelf'], | 35 "shelve.open", |
| 36 "M"), | 36 "shelve.DbfilenameShelf", |
| 37 'S302': ([ | 37 ], |
| 38 'marshal.load', | 38 "M", |
| 39 'marshal.loads'], | 39 ), |
| 40 "M"), | 40 "S302": (["marshal.load", "marshal.loads"], "M"), |
| 41 'S303': ([ | 41 "S303": ( |
| 42 'hashlib.md5', | 42 [ |
| 43 'hashlib.sha1', | 43 "hashlib.md5", |
| 44 'Crypto.Hash.MD2.new', | 44 "hashlib.sha1", |
| 45 'Crypto.Hash.MD4.new', | 45 "Crypto.Hash.MD2.new", |
| 46 'Crypto.Hash.MD5.new', | 46 "Crypto.Hash.MD4.new", |
| 47 'Crypto.Hash.SHA.new', | 47 "Crypto.Hash.MD5.new", |
| 48 'Cryptodome.Hash.MD2.new', | 48 "Crypto.Hash.SHA.new", |
| 49 'Cryptodome.Hash.MD4.new', | 49 "Cryptodome.Hash.MD2.new", |
| 50 'Cryptodome.Hash.MD5.new', | 50 "Cryptodome.Hash.MD4.new", |
| 51 'Cryptodome.Hash.SHA.new', | 51 "Cryptodome.Hash.MD5.new", |
| 52 'cryptography.hazmat.primitives.hashes.MD5', | 52 "Cryptodome.Hash.SHA.new", |
| 53 'cryptography.hazmat.primitives.hashes.SHA1'], | 53 "cryptography.hazmat.primitives.hashes.MD5", |
| 54 "M"), | 54 "cryptography.hazmat.primitives.hashes.SHA1", |
| 55 'S304': ([ | 55 ], |
| 56 'Crypto.Cipher.ARC2.new', | 56 "M", |
| 57 'Crypto.Cipher.ARC4.new', | 57 ), |
| 58 'Crypto.Cipher.Blowfish.new', | 58 "S304": ( |
| 59 'Crypto.Cipher.DES.new', | 59 [ |
| 60 'Crypto.Cipher.XOR.new', | 60 "Crypto.Cipher.ARC2.new", |
| 61 'Cryptodome.Cipher.ARC2.new', | 61 "Crypto.Cipher.ARC4.new", |
| 62 'Cryptodome.Cipher.ARC4.new', | 62 "Crypto.Cipher.Blowfish.new", |
| 63 'Cryptodome.Cipher.Blowfish.new', | 63 "Crypto.Cipher.DES.new", |
| 64 'Cryptodome.Cipher.DES.new', | 64 "Crypto.Cipher.XOR.new", |
| 65 'Cryptodome.Cipher.XOR.new', | 65 "Cryptodome.Cipher.ARC2.new", |
| 66 'cryptography.hazmat.primitives.ciphers.algorithms.ARC4', | 66 "Cryptodome.Cipher.ARC4.new", |
| 67 'cryptography.hazmat.primitives.ciphers.algorithms.Blowfish', | 67 "Cryptodome.Cipher.Blowfish.new", |
| 68 'cryptography.hazmat.primitives.ciphers.algorithms.IDEA'], | 68 "Cryptodome.Cipher.DES.new", |
| 69 "H"), | 69 "Cryptodome.Cipher.XOR.new", |
| 70 'S305': ([ | 70 "cryptography.hazmat.primitives.ciphers.algorithms.ARC4", |
| 71 'cryptography.hazmat.primitives.ciphers.modes.ECB'], | 71 "cryptography.hazmat.primitives.ciphers.algorithms.Blowfish", |
| 72 "M"), | 72 "cryptography.hazmat.primitives.ciphers.algorithms.IDEA", |
| 73 'S306': ([ | 73 ], |
| 74 'tempfile.mktemp'], | 74 "H", |
| 75 "M"), | 75 ), |
| 76 'S307': ([ | 76 "S305": (["cryptography.hazmat.primitives.ciphers.modes.ECB"], "M"), |
| 77 'eval'], | 77 "S306": (["tempfile.mktemp"], "M"), |
| 78 "M"), | 78 "S307": (["eval"], "M"), |
| 79 'S308': ([ | 79 "S308": (["django.utils.safestring.mark_safe"], "M"), |
| 80 'django.utils.safestring.mark_safe'], | 80 "S309": ( |
| 81 "M"), | 81 [ |
| 82 'S309': ([ | 82 "httplib.HTTPSConnection", |
| 83 'httplib.HTTPSConnection', | 83 "http.client.HTTPSConnection", |
| 84 'http.client.HTTPSConnection', | 84 "six.moves.http_client.HTTPSConnection", |
| 85 'six.moves.http_client.HTTPSConnection'], | 85 ], |
| 86 "M"), | 86 "M", |
| 87 'S310': ([ | 87 ), |
| 88 'urllib.urlopen', | 88 "S310": ( |
| 89 'urllib.request.urlopen', | 89 [ |
| 90 'urllib.urlretrieve', | 90 "urllib.urlopen", |
| 91 'urllib.request.urlretrieve', | 91 "urllib.request.urlopen", |
| 92 'urllib.URLopener', | 92 "urllib.urlretrieve", |
| 93 'urllib.request.URLopener', | 93 "urllib.request.urlretrieve", |
| 94 'urllib.FancyURLopener', | 94 "urllib.URLopener", |
| 95 'urllib.request.FancyURLopener', | 95 "urllib.request.URLopener", |
| 96 'urllib2.urlopen', | 96 "urllib.FancyURLopener", |
| 97 'urllib2.Request', | 97 "urllib.request.FancyURLopener", |
| 98 'six.moves.urllib.request.urlopen', | 98 "urllib2.urlopen", |
| 99 'six.moves.urllib.request.urlretrieve', | 99 "urllib2.Request", |
| 100 'six.moves.urllib.request.URLopener', | 100 "six.moves.urllib.request.urlopen", |
| 101 'six.moves.urllib.request.FancyURLopener'], | 101 "six.moves.urllib.request.urlretrieve", |
| 102 ""), | 102 "six.moves.urllib.request.URLopener", |
| 103 'S311': ([ | 103 "six.moves.urllib.request.FancyURLopener", |
| 104 'random.random', | 104 ], |
| 105 'random.randrange', | 105 "", |
| 106 'random.randint', | 106 ), |
| 107 'random.choice', | 107 "S311": ( |
| 108 'random.uniform', | 108 [ |
| 109 'random.triangular'], | 109 "random.random", |
| 110 "L"), | 110 "random.randrange", |
| 111 'S312': ([ | 111 "random.randint", |
| 112 'telnetlib.*'], | 112 "random.choice", |
| 113 "H"), | 113 "random.uniform", |
| 114 'S313': ([ | 114 "random.triangular", |
| 115 'xml.etree.cElementTree.parse', | 115 ], |
| 116 'xml.etree.cElementTree.iterparse', | 116 "L", |
| 117 'xml.etree.cElementTree.fromstring', | 117 ), |
| 118 'xml.etree.cElementTree.XMLParser'], | 118 "S312": (["telnetlib.*"], "H"), |
| 119 "M"), | 119 "S313": ( |
| 120 'S314': ([ | 120 [ |
| 121 'xml.etree.ElementTree.parse', | 121 "xml.etree.cElementTree.parse", |
| 122 'xml.etree.ElementTree.iterparse', | 122 "xml.etree.cElementTree.iterparse", |
| 123 'xml.etree.ElementTree.fromstring', | 123 "xml.etree.cElementTree.fromstring", |
| 124 'xml.etree.ElementTree.XMLParser'], | 124 "xml.etree.cElementTree.XMLParser", |
| 125 "M"), | 125 ], |
| 126 'S315': ([ | 126 "M", |
| 127 'xml.sax.expatreader.create_parser'], | 127 ), |
| 128 "M"), | 128 "S314": ( |
| 129 'S316': ([ | 129 [ |
| 130 'xml.dom.expatbuilder.parse', | 130 "xml.etree.ElementTree.parse", |
| 131 'xml.dom.expatbuilder.parseString'], | 131 "xml.etree.ElementTree.iterparse", |
| 132 "M"), | 132 "xml.etree.ElementTree.fromstring", |
| 133 'S317': ([ | 133 "xml.etree.ElementTree.XMLParser", |
| 134 'xml.sax.parse', | 134 ], |
| 135 'xml.sax.parseString', | 135 "M", |
| 136 'xml.sax.make_parser'], | 136 ), |
| 137 "M"), | 137 "S315": (["xml.sax.expatreader.create_parser"], "M"), |
| 138 'S318': ([ | 138 "S316": (["xml.dom.expatbuilder.parse", "xml.dom.expatbuilder.parseString"], "M"), |
| 139 'xml.dom.minidom.parse', | 139 "S317": (["xml.sax.parse", "xml.sax.parseString", "xml.sax.make_parser"], "M"), |
| 140 'xml.dom.minidom.parseString'], | 140 "S318": (["xml.dom.minidom.parse", "xml.dom.minidom.parseString"], "M"), |
| 141 "M"), | 141 "S319": (["xml.dom.pulldom.parse", "xml.dom.pulldom.parseString"], "M"), |
| 142 'S319': ([ | 142 "S320": ( |
| 143 'xml.dom.pulldom.parse', | 143 [ |
| 144 'xml.dom.pulldom.parseString'], | 144 "lxml.etree.parse", |
| 145 "M"), | 145 "lxml.etree.fromstring", |
| 146 'S320': ([ | 146 "lxml.etree.RestrictedElement", |
| 147 'lxml.etree.parse', | 147 "lxml.etree.GlobalParserTLS", |
| 148 'lxml.etree.fromstring', | 148 "lxml.etree.getDefaultParser", |
| 149 'lxml.etree.RestrictedElement', | 149 "lxml.etree.check_docinfo", |
| 150 'lxml.etree.GlobalParserTLS', | 150 ], |
| 151 'lxml.etree.getDefaultParser', | 151 "M", |
| 152 'lxml.etree.check_docinfo'], | 152 ), |
| 153 "M"), | 153 "S321": (["ftplib.*"], "H"), |
| 154 'S321': ([ | 154 "S322": (["input"], "H"), |
| 155 'ftplib.*'], | 155 "S323": (["ssl._create_unverified_context"], "M"), |
| 156 "H"), | 156 "S324": (["os.tempnam", "os.tmpnam"], "M"), |
| 157 'S322': ([ | |
| 158 'input'], | |
| 159 "H"), | |
| 160 'S323': ([ | |
| 161 'ssl._create_unverified_context'], | |
| 162 "M"), | |
| 163 'S324': ([ | |
| 164 'os.tempnam', | |
| 165 'os.tmpnam'], | |
| 166 "M"), | |
| 167 } | 157 } |
| 168 | 158 |
| 169 | 159 |
| 170 def getChecks(): | 160 def getChecks(): |
| 171 """ | 161 """ |
| 172 Public method to get a dictionary with checks handled by this module. | 162 Public method to get a dictionary with checks handled by this module. |
| 173 | 163 |
| 174 @return dictionary containing checker lists containing checker function and | 164 @return dictionary containing checker lists containing checker function and |
| 175 list of codes | 165 list of codes |
| 176 @rtype dict | 166 @rtype dict |
| 177 """ | 167 """ |
| 178 return { | 168 return { |
| 183 | 173 |
| 184 | 174 |
| 185 def checkBlacklist(reportError, context, config): | 175 def checkBlacklist(reportError, context, config): |
| 186 """ | 176 """ |
| 187 Function to check for blacklisted method calls. | 177 Function to check for blacklisted method calls. |
| 188 | 178 |
| 189 @param reportError function to be used to report errors | 179 @param reportError function to be used to report errors |
| 190 @type func | 180 @type func |
| 191 @param context security context object | 181 @param context security context object |
| 192 @type SecurityContext | 182 @type SecurityContext |
| 193 @param config dictionary with configuration data | 183 @param config dictionary with configuration data |
| 194 @type dict | 184 @type dict |
| 195 """ | 185 """ |
| 196 nodeType = context.node.__class__.__name__ | 186 nodeType = context.node.__class__.__name__ |
| 197 | 187 |
| 198 if nodeType == 'Call': | 188 if nodeType == "Call": |
| 199 func = context.node.func | 189 func = context.node.func |
| 200 if isinstance(func, ast.Name) and func.id == '__import__': | 190 if isinstance(func, ast.Name) and func.id == "__import__": |
| 201 if len(context.node.args): | 191 if len(context.node.args): |
| 202 if AstUtilities.isString(context.node.args[0]): | 192 if AstUtilities.isString(context.node.args[0]): |
| 203 name = context.node.args[0].s | 193 name = context.node.args[0].s |
| 204 else: | 194 else: |
| 205 name = "UNKNOWN" | 195 name = "UNKNOWN" |
| 210 # In the case the Call is an importlib.import, treat the first | 200 # In the case the Call is an importlib.import, treat the first |
| 211 # argument name as an actual import module name. | 201 # argument name as an actual import module name. |
| 212 # Will produce None if argument is not a literal or identifier. | 202 # Will produce None if argument is not a literal or identifier. |
| 213 if name in ["importlib.import_module", "importlib.__import__"]: | 203 if name in ["importlib.import_module", "importlib.__import__"]: |
| 214 name = context.callArgs[0] | 204 name = context.callArgs[0] |
| 215 | 205 |
| 216 for code in _blacklists: | 206 for code in _blacklists: |
| 217 qualnames, severity = _blacklists[code] | 207 qualnames, severity = _blacklists[code] |
| 218 for qualname in qualnames: | 208 for qualname in qualnames: |
| 219 if name and fnmatch.fnmatch(name, qualname): | 209 if name and fnmatch.fnmatch(name, qualname): |
| 220 reportError( | 210 reportError( |
| 221 context.node.lineno - 1, | 211 context.node.lineno - 1, |
| 222 context.node.col_offset, | 212 context.node.col_offset, |
| 223 code, | 213 code, |
| 224 severity, | 214 severity, |
| 225 "H", | 215 "H", |
| 226 name | 216 name, |
| 227 ) | 217 ) |
