Mercurial Repositories > eric / file comparison

comparison: src/eric7/Plugins/CheckerPlugins/CodeStyleChecker/Security/translations.py

src/eric7/Plugins/CheckerPlugins/CodeStyleChecker/Security/translations.py

branch
eric7
changeset 11147
dee6e106b4d3
parent 11136
437db2f032fd
child 11148
15e30f0c76a8
equal deleted inserted replaced
11146:59e04f7003e9 11147:dee6e106b4d3
11 11
12 from PyQt6.QtCore import QCoreApplication 12 from PyQt6.QtCore import QCoreApplication
13 13
14 _securityMessages = { 14 _securityMessages = {
15 # assert used 15 # assert used
16 "S101": QCoreApplication.translate( 16 "S-101": QCoreApplication.translate(
17 "Security", 17 "Security",
18 "Use of 'assert' detected. The enclosed code will be removed when" 18 "Use of 'assert' detected. The enclosed code will be removed when"
19 " compiling to optimised byte code.", 19 " compiling to optimised byte code.",
20 ), 20 ),
21 # exec used 21 # exec used
22 "S102": QCoreApplication.translate("Security", "Use of 'exec' detected."), 22 "S-102": QCoreApplication.translate("Security", "Use of 'exec' detected."),
23 # bad file permissions 23 # bad file permissions
24 "S103": QCoreApplication.translate( 24 "S-103": QCoreApplication.translate(
25 "Security", "'chmod' setting a permissive mask {0} on file ({1})." 25 "Security", "'chmod' setting a permissive mask {0} on file ({1})."
26 ), 26 ),
27 # bind to all interfaces 27 # bind to all interfaces
28 "S104": QCoreApplication.translate( 28 "S-104": QCoreApplication.translate(
29 "Security", "Possible binding to all interfaces." 29 "Security", "Possible binding to all interfaces."
30 ), 30 ),
31 # hardcoded passwords 31 # hardcoded passwords
32 "S105": QCoreApplication.translate( 32 "S-105": QCoreApplication.translate(
33 "Security", "Possible hardcoded password: '{0}'" 33 "Security", "Possible hardcoded password: '{0}'"
34 ), 34 ),
35 "S106": QCoreApplication.translate( 35 "S-106": QCoreApplication.translate(
36 "Security", "Possible hardcoded password: '{0}'" 36 "Security", "Possible hardcoded password: '{0}'"
37 ), 37 ),
38 "S107": QCoreApplication.translate( 38 "S-107": QCoreApplication.translate(
39 "Security", "Possible hardcoded password: '{0}'" 39 "Security", "Possible hardcoded password: '{0}'"
40 ), 40 ),
41 # hardcoded tmp directory 41 # hardcoded tmp directory
42 "S108": QCoreApplication.translate( 42 "S-108": QCoreApplication.translate(
43 "Security", "Probable insecure usage of temp file/directory." 43 "Security", "Probable insecure usage of temp file/directory."
44 ), 44 ),
45 # try-except and contextlib.suppress 45 # try-except and contextlib.suppress
46 "S110": QCoreApplication.translate("Security", "Try, Except, Pass detected."), 46 "S-110": QCoreApplication.translate("Security", "Try, Except, Pass detected."),
47 "S112": QCoreApplication.translate("Security", "Try, Except, Continue detected."), 47 "S-112": QCoreApplication.translate("Security", "Try, Except, Continue detected."),
48 "S113": QCoreApplication.translate("Security", "'contextlib.suppress()' detected."), 48 "S-113": QCoreApplication.translate("Security", "'contextlib.suppress()' detected."),
49 # request without timeout 49 # request without timeout
50 "S114.1": QCoreApplication.translate("Security", "Call to {0} without timeout."), 50 "S-114.1": QCoreApplication.translate("Security", "Call to {0} without timeout."),
51 "S114.2": QCoreApplication.translate( 51 "S-114.2": QCoreApplication.translate(
52 "Security", 52 "Security",
53 "Call to {0} with timeout set to None.", 53 "Call to {0} with timeout set to None.",
54 ), 54 ),
55 # flask app 55 # flask app
56 "S201": QCoreApplication.translate( 56 "S-201": QCoreApplication.translate(
57 "Security", 57 "Security",
58 "A Flask app appears to be run with debug=True, which exposes the" 58 "A Flask app appears to be run with debug=True, which exposes the"
59 " Werkzeug debugger and allows the execution of arbitrary code.", 59 " Werkzeug debugger and allows the execution of arbitrary code.",
60 ), 60 ),
61 # tarfile.extractall 61 # tarfile.extractall
62 "S202.1": QCoreApplication.translate( 62 "S-202.1": QCoreApplication.translate(
63 "Security", 63 "Security",
64 "Usage of 'tarfile.extractall(members=function(tarfile))'. " 64 "Usage of 'tarfile.extractall(members=function(tarfile))'. "
65 "Make sure your function properly discards dangerous members ({0}).", 65 "Make sure your function properly discards dangerous members ({0}).",
66 ), 66 ),
67 "S202.2": QCoreApplication.translate( 67 "S-202.2": QCoreApplication.translate(
68 "Security", 68 "Security",
69 "Found 'tarfile.extractall(members=?)' but couldn't identify the type of" 69 "Found 'tarfile.extractall(members=?)' but couldn't identify the type of"
70 " members. Check if the members were properly validated ({0}).", 70 " members. Check if the members were properly validated ({0}).",
71 ), 71 ),
72 "S202.3": QCoreApplication.translate( 72 "S-202.3": QCoreApplication.translate(
73 "Security", 73 "Security",
74 "'tarfile.extractall()' used without any validation. Please check and" 74 "'tarfile.extractall()' used without any validation. Please check and"
75 " discard dangerous members.", 75 " discard dangerous members.",
76 ), 76 ),
77 # prohibited calls 77 # prohibited calls
78 "S301": QCoreApplication.translate( 78 "S-301": QCoreApplication.translate(
79 "Security", 79 "Security",
80 "Pickle and modules that wrap it can be unsafe when used to " 80 "Pickle and modules that wrap it can be unsafe when used to "
81 "deserialize untrusted data, possible security issue.", 81 "deserialize untrusted data, possible security issue.",
82 ), 82 ),
83 "S302": QCoreApplication.translate( 83 "S-302": QCoreApplication.translate(
84 "Security", "Deserialization with the marshal module is possibly dangerous." 84 "Security", "Deserialization with the marshal module is possibly dangerous."
85 ), 85 ),
86 "S303": QCoreApplication.translate( 86 "S-303": QCoreApplication.translate(
87 "Security", "Use of insecure MD2, MD4, MD5, or SHA1 hash function." 87 "Security", "Use of insecure MD2, MD4, MD5, or SHA1 hash function."
88 ), 88 ),
89 "S304": QCoreApplication.translate( 89 "S-304": QCoreApplication.translate(
90 "Security", 90 "Security",
91 "Use of insecure cipher '{0}'. Replace with a known secure cipher" 91 "Use of insecure cipher '{0}'. Replace with a known secure cipher"
92 " such as AES.", 92 " such as AES.",
93 ), 93 ),
94 "S305": QCoreApplication.translate( 94 "S-305": QCoreApplication.translate(
95 "Security", "Use of insecure cipher mode '{0}'." 95 "Security", "Use of insecure cipher mode '{0}'."
96 ), 96 ),
97 "S306": QCoreApplication.translate( 97 "S-306": QCoreApplication.translate(
98 "Security", "Use of insecure and deprecated function (mktemp)." 98 "Security", "Use of insecure and deprecated function (mktemp)."
99 ), 99 ),
100 "S307": QCoreApplication.translate( 100 "S-307": QCoreApplication.translate(
101 "Security", 101 "Security",
102 "Use of possibly insecure function - consider using safer ast.literal_eval.", 102 "Use of possibly insecure function - consider using safer ast.literal_eval.",
103 ), 103 ),
104 "S308": QCoreApplication.translate( 104 "S-308": QCoreApplication.translate(
105 "Security", 105 "Security",
106 "Use of mark_safe() may expose cross-site scripting vulnerabilities" 106 "Use of mark_safe() may expose cross-site scripting vulnerabilities"
107 " and should be reviewed.", 107 " and should be reviewed.",
108 ), 108 ),
109 "S310": QCoreApplication.translate( 109 "S-310": QCoreApplication.translate(
110 "Security", 110 "Security",
111 "Audit url open for permitted schemes. Allowing use of file:/ or" 111 "Audit url open for permitted schemes. Allowing use of file:/ or"
112 " custom schemes is often unexpected.", 112 " custom schemes is often unexpected.",
113 ), 113 ),
114 "S311": QCoreApplication.translate( 114 "S-311": QCoreApplication.translate(
115 "Security", 115 "Security",
116 "Standard pseudo-random generators are not suitable for" 116 "Standard pseudo-random generators are not suitable for"
117 " security/cryptographic purposes.", 117 " security/cryptographic purposes.",
118 ), 118 ),
119 "S312": QCoreApplication.translate( 119 "S-312": QCoreApplication.translate(
120 "Security", 120 "Security",
121 "Telnet-related functions are being called. Telnet is considered" 121 "Telnet-related functions are being called. Telnet is considered"
122 " insecure. Use SSH or some other encrypted protocol.", 122 " insecure. Use SSH or some other encrypted protocol.",
123 ), 123 ),
124 "S313": QCoreApplication.translate( 124 "S-313": QCoreApplication.translate(
125 "Security", 125 "Security",
126 "Using '{0}' to parse untrusted XML data is known to be vulnerable to" 126 "Using '{0}' to parse untrusted XML data is known to be vulnerable to"
127 " XML attacks. Replace '{0}' with its defusedxml equivalent function" 127 " XML attacks. Replace '{0}' with its defusedxml equivalent function"
128 " or make sure defusedxml.defuse_stdlib() is called.", 128 " or make sure defusedxml.defuse_stdlib() is called.",
129 ), 129 ),
130 "S314": QCoreApplication.translate( 130 "S-314": QCoreApplication.translate(
131 "Security", 131 "Security",
132 "Using '{0}' to parse untrusted XML data is known to be vulnerable to" 132 "Using '{0}' to parse untrusted XML data is known to be vulnerable to"
133 " XML attacks. Replace '{0}' with its defusedxml equivalent function" 133 " XML attacks. Replace '{0}' with its defusedxml equivalent function"
134 " or make sure defusedxml.defuse_stdlib() is called.", 134 " or make sure defusedxml.defuse_stdlib() is called.",
135 ), 135 ),
136 "S315": QCoreApplication.translate( 136 "S-315": QCoreApplication.translate(
137 "Security", 137 "Security",
138 "Using '{0}' to parse untrusted XML data is known to be vulnerable to" 138 "Using '{0}' to parse untrusted XML data is known to be vulnerable to"
139 " XML attacks. Replace '{0}' with its defusedxml equivalent function" 139 " XML attacks. Replace '{0}' with its defusedxml equivalent function"
140 " or make sure defusedxml.defuse_stdlib() is called.", 140 " or make sure defusedxml.defuse_stdlib() is called.",
141 ), 141 ),
142 "S316": QCoreApplication.translate( 142 "S-316": QCoreApplication.translate(
143 "Security", 143 "Security",
144 "Using '{0}' to parse untrusted XML data is known to be vulnerable to" 144 "Using '{0}' to parse untrusted XML data is known to be vulnerable to"
145 " XML attacks. Replace '{0}' with its defusedxml equivalent function" 145 " XML attacks. Replace '{0}' with its defusedxml equivalent function"
146 " or make sure defusedxml.defuse_stdlib() is called.", 146 " or make sure defusedxml.defuse_stdlib() is called.",
147 ), 147 ),
148 "S317": QCoreApplication.translate( 148 "S-317": QCoreApplication.translate(
149 "Security", 149 "Security",
150 "Using '{0}' to parse untrusted XML data is known to be vulnerable to" 150 "Using '{0}' to parse untrusted XML data is known to be vulnerable to"
151 " XML attacks. Replace '{0}' with its defusedxml equivalent function" 151 " XML attacks. Replace '{0}' with its defusedxml equivalent function"
152 " or make sure defusedxml.defuse_stdlib() is called.", 152 " or make sure defusedxml.defuse_stdlib() is called.",
153 ), 153 ),
154 "S318": QCoreApplication.translate( 154 "S-318": QCoreApplication.translate(
155 "Security", 155 "Security",
156 "Using '{0}' to parse untrusted XML data is known to be vulnerable to" 156 "Using '{0}' to parse untrusted XML data is known to be vulnerable to"
157 " XML attacks. Replace '{0}' with its defusedxml equivalent function" 157 " XML attacks. Replace '{0}' with its defusedxml equivalent function"
158 " or make sure defusedxml.defuse_stdlib() is called.", 158 " or make sure defusedxml.defuse_stdlib() is called.",
159 ), 159 ),
160 "S319": QCoreApplication.translate( 160 "S-319": QCoreApplication.translate(
161 "Security", 161 "Security",
162 "Using '{0}' to parse untrusted XML data is known to be vulnerable to" 162 "Using '{0}' to parse untrusted XML data is known to be vulnerable to"
163 " XML attacks. Replace '{0}' with its defusedxml equivalent function" 163 " XML attacks. Replace '{0}' with its defusedxml equivalent function"
164 " or make sure defusedxml.defuse_stdlib() is called.", 164 " or make sure defusedxml.defuse_stdlib() is called.",
165 ), 165 ),
166 "S321": QCoreApplication.translate( 166 "S-321": QCoreApplication.translate(
167 "Security", 167 "Security",
168 "FTP-related functions are being called. FTP is considered insecure." 168 "FTP-related functions are being called. FTP is considered insecure."
169 " Use SSH/SFTP/SCP or some other encrypted protocol.", 169 " Use SSH/SFTP/SCP or some other encrypted protocol.",
170 ), 170 ),
171 "S323": QCoreApplication.translate( 171 "S-323": QCoreApplication.translate(
172 "Security", 172 "Security",
173 "By default, Python will create a secure, verified SSL context for" 173 "By default, Python will create a secure, verified SSL context for"
174 " use in such classes as HTTPSConnection. However, it still allows" 174 " use in such classes as HTTPSConnection. However, it still allows"
175 " using an insecure context via the _create_unverified_context that" 175 " using an insecure context via the _create_unverified_context that"
176 " reverts to the previous behavior that does not validate" 176 " reverts to the previous behavior that does not validate"
177 " certificates or perform hostname checks.", 177 " certificates or perform hostname checks.",
178 ), 178 ),
179 # hashlib functions 179 # hashlib functions
180 "S331": QCoreApplication.translate( 180 "S-331": QCoreApplication.translate(
181 "Security", "Use of insecure {0} hash function." 181 "Security", "Use of insecure {0} hash function."
182 ), 182 ),
183 "S332": QCoreApplication.translate( 183 "S-332": QCoreApplication.translate(
184 "Security", 184 "Security",
185 "Use of insecure {0} hash for security. Consider 'usedforsecurity=False'.", 185 "Use of insecure {0} hash for security. Consider 'usedforsecurity=False'.",
186 ), 186 ),
187 # prohibited imports 187 # prohibited imports
188 "S401": QCoreApplication.translate( 188 "S-401": QCoreApplication.translate(
189 "Security", 189 "Security",
190 "A telnet-related module is being imported. Telnet is considered" 190 "A telnet-related module is being imported. Telnet is considered"
191 " insecure. Use SSH or some other encrypted protocol.", 191 " insecure. Use SSH or some other encrypted protocol.",
192 ), 192 ),
193 "S402": QCoreApplication.translate( 193 "S-402": QCoreApplication.translate(
194 "Security", 194 "Security",
195 "A FTP-related module is being imported. FTP is considered" 195 "A FTP-related module is being imported. FTP is considered"
196 " insecure. Use SSH/SFTP/SCP or some other encrypted protocol.", 196 " insecure. Use SSH/SFTP/SCP or some other encrypted protocol.",
197 ), 197 ),
198 "S403": QCoreApplication.translate( 198 "S-403": QCoreApplication.translate(
199 "Security", 199 "Security",
200 "Consider possible security implications associated with the '{0}' module.", 200 "Consider possible security implications associated with the '{0}' module.",
201 ), 201 ),
202 "S404": QCoreApplication.translate( 202 "S-404": QCoreApplication.translate(
203 "Security", 203 "Security",
204 "Consider possible security implications associated with the '{0}' module.", 204 "Consider possible security implications associated with the '{0}' module.",
205 ), 205 ),
206 "S405": QCoreApplication.translate( 206 "S-405": QCoreApplication.translate(
207 "Security", 207 "Security",
208 "Using '{0}' to parse untrusted XML data is known to be vulnerable" 208 "Using '{0}' to parse untrusted XML data is known to be vulnerable"
209 " to XML attacks. Replace '{0}' with the equivalent defusedxml" 209 " to XML attacks. Replace '{0}' with the equivalent defusedxml"
210 " package, or make sure defusedxml.defuse_stdlib() is called.", 210 " package, or make sure defusedxml.defuse_stdlib() is called.",
211 ), 211 ),
212 "S406": QCoreApplication.translate( 212 "S-406": QCoreApplication.translate(
213 "Security", 213 "Security",
214 "Using '{0}' to parse untrusted XML data is known to be vulnerable" 214 "Using '{0}' to parse untrusted XML data is known to be vulnerable"
215 " to XML attacks. Replace '{0}' with the equivalent defusedxml" 215 " to XML attacks. Replace '{0}' with the equivalent defusedxml"
216 " package, or make sure defusedxml.defuse_stdlib() is called.", 216 " package, or make sure defusedxml.defuse_stdlib() is called.",
217 ), 217 ),
218 "S407": QCoreApplication.translate( 218 "S-407": QCoreApplication.translate(
219 "Security", 219 "Security",
220 "Using '{0}' to parse untrusted XML data is known to be vulnerable" 220 "Using '{0}' to parse untrusted XML data is known to be vulnerable"
221 " to XML attacks. Replace '{0}' with the equivalent defusedxml" 221 " to XML attacks. Replace '{0}' with the equivalent defusedxml"
222 " package, or make sure defusedxml.defuse_stdlib() is called.", 222 " package, or make sure defusedxml.defuse_stdlib() is called.",
223 ), 223 ),
224 "S408": QCoreApplication.translate( 224 "S-408": QCoreApplication.translate(
225 "Security", 225 "Security",
226 "Using '{0}' to parse untrusted XML data is known to be vulnerable" 226 "Using '{0}' to parse untrusted XML data is known to be vulnerable"
227 " to XML attacks. Replace '{0}' with the equivalent defusedxml" 227 " to XML attacks. Replace '{0}' with the equivalent defusedxml"
228 " package, or make sure defusedxml.defuse_stdlib() is called.", 228 " package, or make sure defusedxml.defuse_stdlib() is called.",
229 ), 229 ),
230 "S409": QCoreApplication.translate( 230 "S-409": QCoreApplication.translate(
231 "Security", 231 "Security",
232 "Using '{0}' to parse untrusted XML data is known to be vulnerable" 232 "Using '{0}' to parse untrusted XML data is known to be vulnerable"
233 " to XML attacks. Replace '{0}' with the equivalent defusedxml" 233 " to XML attacks. Replace '{0}' with the equivalent defusedxml"
234 " package, or make sure defusedxml.defuse_stdlib() is called.", 234 " package, or make sure defusedxml.defuse_stdlib() is called.",
235 ), 235 ),
236 "S411": QCoreApplication.translate( 236 "S-411": QCoreApplication.translate(
237 "Security", 237 "Security",
238 "Using '{0}' to parse untrusted XML data is known to be vulnerable" 238 "Using '{0}' to parse untrusted XML data is known to be vulnerable"
239 " to XML attacks. Use defusedxml.xmlrpc.monkey_patch() function to" 239 " to XML attacks. Use defusedxml.xmlrpc.monkey_patch() function to"
240 " monkey-patch xmlrpclib and mitigate XML vulnerabilities.", 240 " monkey-patch xmlrpclib and mitigate XML vulnerabilities.",
241 ), 241 ),
242 "S412": QCoreApplication.translate( 242 "S-412": QCoreApplication.translate(
243 "Security", 243 "Security",
244 "Consider possible security implications associated with '{0}' module.", 244 "Consider possible security implications associated with '{0}' module.",
245 ), 245 ),
246 "S413": QCoreApplication.translate( 246 "S-413": QCoreApplication.translate(
247 "Security", 247 "Security",
248 "The pyCrypto library and its module '{0}' are no longer actively" 248 "The pyCrypto library and its module '{0}' are no longer actively"
249 " maintained and have been deprecated. Consider using" 249 " maintained and have been deprecated. Consider using"
250 " pyca/cryptography library.", 250 " pyca/cryptography library.",
251 ), 251 ),
252 "S414": QCoreApplication.translate( 252 "S-414": QCoreApplication.translate(
253 "Security", 253 "Security",
254 "An IPMI-related module is being imported. IPMI is considered " 254 "An IPMI-related module is being imported. IPMI is considered "
255 "insecure. Use an encrypted protocol.", 255 "insecure. Use an encrypted protocol.",
256 ), 256 ),
257 # insecure certificate usage 257 # insecure certificate usage
258 "S501": QCoreApplication.translate( 258 "S-501": QCoreApplication.translate(
259 "Security", 259 "Security",
260 "'requests' call with verify=False disabling SSL certificate checks," 260 "'requests' call with verify=False disabling SSL certificate checks,"
261 " security issue.", 261 " security issue.",
262 ), 262 ),
263 # insecure SSL/TLS protocol version 263 # insecure SSL/TLS protocol version
264 "S502.1": QCoreApplication.translate( 264 "S-502.1": QCoreApplication.translate(
265 "Security", 265 "Security",
266 "'ssl.wrap_socket' call with insecure SSL/TLS protocol version" 266 "'ssl.wrap_socket' call with insecure SSL/TLS protocol version"
267 " identified, security issue.", 267 " identified, security issue.",
268 ), 268 ),
269 "S502.2": QCoreApplication.translate( 269 "S-502.2": QCoreApplication.translate(
270 "Security", 270 "Security",
271 "'SSL.Context' call with insecure SSL/TLS protocol version identified," 271 "'SSL.Context' call with insecure SSL/TLS protocol version identified,"
272 " security issue.", 272 " security issue.",
273 ), 273 ),
274 "S502.3": QCoreApplication.translate( 274 "S-502.3": QCoreApplication.translate(
275 "Security", 275 "Security",
276 "Function call with insecure SSL/TLS protocol version identified," 276 "Function call with insecure SSL/TLS protocol version identified,"
277 " security issue.", 277 " security issue.",
278 ), 278 ),
279 "S503": QCoreApplication.translate( 279 "S-503": QCoreApplication.translate(
280 "Security", 280 "Security",
281 "Function definition identified with insecure SSL/TLS protocol" 281 "Function definition identified with insecure SSL/TLS protocol"
282 " version by default, possible security issue.", 282 " version by default, possible security issue.",
283 ), 283 ),
284 "S504": QCoreApplication.translate( 284 "S-504": QCoreApplication.translate(
285 "Security", 285 "Security",
286 "'ssl.wrap_socket' call with no SSL/TLS protocol version specified," 286 "'ssl.wrap_socket' call with no SSL/TLS protocol version specified,"
287 " the default 'SSLv23' could be insecure, possible security issue.", 287 " the default 'SSLv23' could be insecure, possible security issue.",
288 ), 288 ),
289 # weak cryptographic keys 289 # weak cryptographic keys
290 "S505": QCoreApplication.translate( 290 "S-505": QCoreApplication.translate(
291 "Security", "{0} key sizes below {1:d} bits are considered breakable." 291 "Security", "{0} key sizes below {1:d} bits are considered breakable."
292 ), 292 ),
293 # YAML load 293 # YAML load
294 "S506": QCoreApplication.translate( 294 "S-506": QCoreApplication.translate(
295 "Security", 295 "Security",
296 "Use of unsafe 'yaml.load()'. Allows instantiation of arbitrary" 296 "Use of unsafe 'yaml.load()'. Allows instantiation of arbitrary"
297 " objects. Consider 'yaml.safe_load()'.", 297 " objects. Consider 'yaml.safe_load()'.",
298 ), 298 ),
299 # SSH host key verification 299 # SSH host key verification
300 "S507": QCoreApplication.translate( 300 "S-507": QCoreApplication.translate(
301 "Security", 301 "Security",
302 "Paramiko call with policy set to automatically trust the unknown host key.", 302 "Paramiko call with policy set to automatically trust the unknown host key.",
303 ), 303 ),
304 # insecure SNMP 304 # insecure SNMP
305 "S508": QCoreApplication.translate( 305 "S-508": QCoreApplication.translate(
306 "Security", 306 "Security",
307 "The use of SNMPv1 and SNMPv2 is insecure. You should use SNMPv3 if possible.", 307 "The use of SNMPv1 and SNMPv2 is insecure. You should use SNMPv3 if possible.",
308 ), 308 ),
309 "S509": QCoreApplication.translate( 309 "S-509": QCoreApplication.translate(
310 "Security", 310 "Security",
311 "You should not use SNMPv3 without encryption. noAuthNoPriv & authNoPriv is" 311 "You should not use SNMPv3 without encryption. noAuthNoPriv & authNoPriv is"
312 " insecure.", 312 " insecure.",
313 ), 313 ),
314 # Shell injection 314 # Shell injection
315 "S601": QCoreApplication.translate( 315 "S-601": QCoreApplication.translate(
316 "Security", 316 "Security",
317 "Possible shell injection via 'Paramiko' call, check inputs are" 317 "Possible shell injection via 'Paramiko' call, check inputs are"
318 " properly sanitized.", 318 " properly sanitized.",
319 ), 319 ),
320 "S602.L": QCoreApplication.translate( 320 "S-602.L": QCoreApplication.translate(
321 "Security", 321 "Security",
322 "'subprocess' call with shell=True seems safe, but may be changed" 322 "'subprocess' call with shell=True seems safe, but may be changed"
323 " in the future, consider rewriting without shell", 323 " in the future, consider rewriting without shell",
324 ), 324 ),
325 "S602.H": QCoreApplication.translate( 325 "S-602.H": QCoreApplication.translate(
326 "Security", "'subprocess' call with shell=True identified, security issue." 326 "Security", "'subprocess' call with shell=True identified, security issue."
327 ), 327 ),
328 "S603": QCoreApplication.translate( 328 "S-603": QCoreApplication.translate(
329 "Security", "'subprocess' call - check for execution of untrusted input." 329 "Security", "'subprocess' call - check for execution of untrusted input."
330 ), 330 ),
331 "S604": QCoreApplication.translate( 331 "S-604": QCoreApplication.translate(
332 "Security", 332 "Security",
333 "Function call with shell=True parameter identified, possible" 333 "Function call with shell=True parameter identified, possible"
334 " security issue.", 334 " security issue.",
335 ), 335 ),
336 "S605.L": QCoreApplication.translate( 336 "S-605.L": QCoreApplication.translate(
337 "Security", 337 "Security",
338 "Starting a process with a shell: Seems safe, but may be changed in" 338 "Starting a process with a shell: Seems safe, but may be changed in"
339 " the future, consider rewriting without shell", 339 " the future, consider rewriting without shell",
340 ), 340 ),
341 "S605.H": QCoreApplication.translate( 341 "S-605.H": QCoreApplication.translate(
342 "Security", 342 "Security",
343 "Starting a process with a shell, possible injection detected," 343 "Starting a process with a shell, possible injection detected,"
344 " security issue.", 344 " security issue.",
345 ), 345 ),
346 "S606": QCoreApplication.translate( 346 "S-606": QCoreApplication.translate(
347 "Security", "Starting a process without a shell." 347 "Security", "Starting a process without a shell."
348 ), 348 ),
349 "S607": QCoreApplication.translate( 349 "S-607": QCoreApplication.translate(
350 "Security", "Starting a process with a partial executable path." 350 "Security", "Starting a process with a partial executable path."
351 ), 351 ),
352 # SQL injection 352 # SQL injection
353 "S608": QCoreApplication.translate( 353 "S-608": QCoreApplication.translate(
354 "Security", 354 "Security",
355 "Possible SQL injection vector through string-based query construction.", 355 "Possible SQL injection vector through string-based query construction.",
356 ), 356 ),
357 # Wildcard injection 357 # Wildcard injection
358 "S609": QCoreApplication.translate( 358 "S-609": QCoreApplication.translate(
359 "Security", "Possible wildcard injection in call: {0}" 359 "Security", "Possible wildcard injection in call: {0}"
360 ), 360 ),
361 # Django SQL injection 361 # Django SQL injection
362 "S610": QCoreApplication.translate( 362 "S-610": QCoreApplication.translate(
363 "Security", "Use of 'extra()' opens a potential SQL attack vector." 363 "Security", "Use of 'extra()' opens a potential SQL attack vector."
364 ), 364 ),
365 "S611": QCoreApplication.translate( 365 "S-611": QCoreApplication.translate(
366 "Security", "Use of 'RawSQL()' opens a potential SQL attack vector." 366 "Security", "Use of 'RawSQL()' opens a potential SQL attack vector."
367 ), 367 ),
368 # insecure logging.config.listen() 368 # insecure logging.config.listen()
369 "S612": QCoreApplication.translate( 369 "S-612": QCoreApplication.translate(
370 "Security", 370 "Security",
371 "Use of insecure logging.config.listen() detected.", 371 "Use of insecure logging.config.listen() detected.",
372 ), 372 ),
373 # Trojan Source 373 # Trojan Source
374 "S613": QCoreApplication.translate( 374 "S-613": QCoreApplication.translate(
375 "Security", 375 "Security",
376 "The Python source file contains bidirectional control characters ({0}).", 376 "The Python source file contains bidirectional control characters ({0}).",
377 ), 377 ),
378 # PyTorch unsafe load or save 378 # PyTorch unsafe load or save
379 "S614": QCoreApplication.translate( 379 "S-614": QCoreApplication.translate(
380 "Security", "Use of unsafe PyTorch load or save." 380 "Security", "Use of unsafe PyTorch load or save."
381 ), 381 ),
382 # Jinja2 templates 382 # Jinja2 templates
383 "S701.1": QCoreApplication.translate( 383 "S-701.1": QCoreApplication.translate(
384 "Security", 384 "Security",
385 "Using jinja2 templates with 'autoescape=False' is dangerous and can" 385 "Using jinja2 templates with 'autoescape=False' is dangerous and can"
386 " lead to XSS. Use 'autoescape=True' or use the 'select_autoescape'" 386 " lead to XSS. Use 'autoescape=True' or use the 'select_autoescape'"
387 " function to mitigate XSS vulnerabilities.", 387 " function to mitigate XSS vulnerabilities.",
388 ), 388 ),
389 "S701.2": QCoreApplication.translate( 389 "S-701.2": QCoreApplication.translate(
390 "Security", 390 "Security",
391 "By default, jinja2 sets 'autoescape' to False. Consider using" 391 "By default, jinja2 sets 'autoescape' to False. Consider using"
392 " 'autoescape=True' or use the 'select_autoescape' function to" 392 " 'autoescape=True' or use the 'select_autoescape' function to"
393 " mitigate XSS vulnerabilities.", 393 " mitigate XSS vulnerabilities.",
394 ), 394 ),
395 # Mako templates 395 # Mako templates
396 "S702": QCoreApplication.translate( 396 "S-702": QCoreApplication.translate(
397 "Security", 397 "Security",
398 "Mako templates allow HTML/JS rendering by default and are inherently" 398 "Mako templates allow HTML/JS rendering by default and are inherently"
399 " open to XSS attacks. Ensure variables in all templates are properly" 399 " open to XSS attacks. Ensure variables in all templates are properly"
400 " sanitized via the 'n', 'h' or 'x' flags (depending on context). For" 400 " sanitized via the 'n', 'h' or 'x' flags (depending on context). For"
401 " example, to HTML escape the variable 'data' do ${{ data |h }}.", 401 " example, to HTML escape the variable 'data' do ${{ data |h }}.",
402 ), 402 ),
403 # Django XSS vulnerability 403 # Django XSS vulnerability
404 "S703": QCoreApplication.translate( 404 "S-703": QCoreApplication.translate(
405 "Security", "Potential XSS on 'mark_safe()' function." 405 "Security", "Potential XSS on 'mark_safe()' function."
406 ), 406 ),
407 # hardcoded AWS passwords 407 # hardcoded AWS passwords
408 "S801": QCoreApplication.translate( 408 "S-801": QCoreApplication.translate(
409 "Security", "Possible hardcoded AWS access key ID: {0}" 409 "Security", "Possible hardcoded AWS access key ID: {0}"
410 ), 410 ),
411 "S802": QCoreApplication.translate( 411 "S-802": QCoreApplication.translate(
412 "Security", "Possible hardcoded AWS secret access key: {0}" 412 "Security", "Possible hardcoded AWS secret access key: {0}"
413 ), 413 ),
414 } 414 }
415 415
416 _securityMessagesSampleArgs = { 416 _securityMessagesSampleArgs = {
417 "S103": ["0o777", "testfile.txt"], 417 "S-103": ["0o777", "testfile.txt"],
418 "S105": ["password"], 418 "S-105": ["password"],
419 "S106": ["password"], 419 "S-106": ["password"],
420 "S107": ["password"], 420 "S-107": ["password"],
421 "S114.1": ["requests"], 421 "S-114.1": ["requests"],
422 "S114.2": ["httpx"], 422 "S-114.2": ["httpx"],
423 "S202.1": ["members_filter(tar)"], 423 "S-202.1": ["members_filter(tar)"],
424 "S202.2": ["tar"], 424 "S-202.2": ["tar"],
425 "S304": ["Crypto.Cipher.DES"], 425 "S-304": ["Crypto.Cipher.DES"],
426 "S305": ["cryptography.hazmat.primitives.ciphers.modes.ECB"], 426 "S-305": ["cryptography.hazmat.primitives.ciphers.modes.ECB"],
427 "S313": ["xml.etree.cElementTree.parse"], 427 "S-313": ["xml.etree.cElementTree.parse"],
428 "S314": ["xml.etree.ElementTree.parse"], 428 "S-314": ["xml.etree.ElementTree.parse"],
429 "S315": ["xml.sax.expatreader.create_parser"], 429 "S-315": ["xml.sax.expatreader.create_parser"],
430 "S316": ["xml.dom.expatbuilder.parse"], 430 "S-316": ["xml.dom.expatbuilder.parse"],
431 "S317": ["xml.sax.parse"], 431 "S-317": ["xml.sax.parse"],
432 "S318": ["xml.dom.minidom.parse"], 432 "S-318": ["xml.dom.minidom.parse"],
433 "S319": ["xml.dom.pulldom.parse"], 433 "S-319": ["xml.dom.pulldom.parse"],
434 "S331": ["MD5"], 434 "S-331": ["MD5"],
435 "S403": ["pickle"], 435 "S-403": ["pickle"],
436 "S404": ["subprocess"], 436 "S-404": ["subprocess"],
437 "S405": ["xml.etree.ElementTree"], 437 "S-405": ["xml.etree.ElementTree"],
438 "S406": ["xml.sax"], 438 "S-406": ["xml.sax"],
439 "S407": ["xml.dom.expatbuilder"], 439 "S-407": ["xml.dom.expatbuilder"],
440 "S408": ["xml.dom.minidom"], 440 "S-408": ["xml.dom.minidom"],
441 "S409": ["xml.dom.pulldom"], 441 "S-409": ["xml.dom.pulldom"],
442 "S411": ["xmlrpclib"], 442 "S-411": ["xmlrpclib"],
443 "S412": ["wsgiref.handlers.CGIHandler"], 443 "S-412": ["wsgiref.handlers.CGIHandler"],
444 "S413": ["Crypto.Cipher"], 444 "S-413": ["Crypto.Cipher"],
445 "S505": ["RSA", 2048], 445 "S-505": ["RSA", 2048],
446 "S609": ["os.system"], 446 "S-609": ["os.system"],
447 "S613": [repr("\u202e")], 447 "S-613": [repr("\u202e")],
448 "S801": ["A1B2C3D4E5F6G7H8I9J0"], # secok 448 "S-801": ["A1B2C3D4E5F6G7H8I9J0"], # secok
449 "S802": ["aA1bB2cC3dD4/eE5fF6gG7+hH8iI9jJ0=kKlLM+="], # secok 449 "S-802": ["aA1bB2cC3dD4/eE5fF6gG7+hH8iI9jJ0=kKlLM+="], # secok
450 } 450 }

Mercurial Repository: eric

eric ide

mercurial