1 assert True
3 s = socket.socket(socket.AF_INET, socket.SOCK_STREAM)
4 s.bind(('0.0.0.0', 31137))
5 s.bind(('192.168.0.1', 8080))
5 # Insecure mode 6 mode = ECB(iv) 7
1 from Crypto.Cipher import ARC2 as pycrypto_arc2 2 from Crypto.Cipher import ARC4 as pycrypto_arc4 3 from Crypto.Cipher import Blowfish as pycrypto_blowfish
1 from Crypto.Cipher import ARC2 as pycrypto_arc2 2 from Crypto.Cipher import ARC4 as pycrypto_arc4 3 from Crypto.Cipher import Blowfish as pycrypto_blowfish
2 from Crypto.Cipher import ARC4 as pycrypto_arc4 3 from Crypto.Cipher import Blowfish as pycrypto_blowfish 4 from Crypto.Cipher import DES as pycrypto_des
3 from Crypto.Cipher import Blowfish as pycrypto_blowfish 4 from Crypto.Cipher import DES as pycrypto_des 5 from Crypto.Cipher import XOR as pycrypto_xor
4 from Crypto.Cipher import DES as pycrypto_des 5 from Crypto.Cipher import XOR as pycrypto_xor 6 from Cryptodome.Cipher import ARC2 as pycryptodomex_arc2
10 from Cryptodome.Cipher import XOR as pycryptodomex_xor 11 from Crypto.Hash import SHA 12 from Crypto import Random
11 from Crypto.Hash import SHA 12 from Crypto import Random 13 from Crypto.Util import Counter
12 from Crypto import Random 13 from Crypto.Util import Counter 14 from cryptography.hazmat.primitives.ciphers import Cipher
21 iv = Random.new().read(pycrypto_arc2.block_size) 22 cipher = pycrypto_arc2.new(key, pycrypto_arc2.MODE_CFB, iv) 23 msg = iv + cipher.encrypt(b'Attack at dawn')
23 msg = iv + cipher.encrypt(b'Attack at dawn') 24 cipher = pycryptodomex_arc2.new(key, pycryptodomex_arc2.MODE_CFB, iv) 25 msg = iv + cipher.encrypt(b'Attack at dawn')
28 nonce = Random.new().read(16) 29 tempkey = SHA.new(key+nonce).digest() 30 cipher = pycrypto_arc4.new(tempkey)
29 tempkey = SHA.new(key+nonce).digest() 30 cipher = pycrypto_arc4.new(tempkey) 31 msg = nonce + cipher.encrypt(b'Open the pod bay doors, HAL')
31 msg = nonce + cipher.encrypt(b'Open the pod bay doors, HAL') 32 cipher = pycryptodomex_arc4.new(tempkey) 33 msg = nonce + cipher.encrypt(b'Open the pod bay doors, HAL')
41 bs = pycrypto_blowfish.block_size 42 cipher = pycrypto_blowfish.new(key, pycrypto_blowfish.MODE_CBC, iv) 43 msg = iv + cipher.encrypt(plaintext + padding)
44 bs = pycryptodomex_blowfish.block_size 45 cipher = pycryptodomex_blowfish.new(key, pycryptodomex_blowfish.MODE_CBC, iv) 46 msg = iv + cipher.encrypt(plaintext + padding)
51 ctr = Counter.new(pycrypto_des.block_size*8/2, prefix=nonce) 52 cipher = pycrypto_des.new(key, pycrypto_des.MODE_CTR, counter=ctr) 53 msg = nonce + cipher.encrypt(plaintext)
55 ctr = Counter.new(pycryptodomex_des.block_size*8/2, prefix=nonce) 56 cipher = pycryptodomex_des.new(key, pycryptodomex_des.MODE_CTR, counter=ctr) 57 msg = nonce + cipher.encrypt(plaintext)
60 plaintext = b'Encrypt me' 61 cipher = pycrypto_xor.new(key) 62 msg = cipher.encrypt(plaintext)
62 msg = cipher.encrypt(plaintext) 63 cipher = pycryptodomex_xor.new(key) 64 msg = cipher.encrypt(plaintext)
65 66 cipher = Cipher(algorithms.ARC4(key), mode=None, backend=default_backend()) 67 encryptor = cipher.encryptor()
69 70 cipher = Cipher(algorithms.Blowfish(key), mode=None, backend=default_backend()) 71 encryptor = cipher.encryptor()
73 74 cipher = Cipher(algorithms.CAST5(key), mode=None, backend=default_backend()) 75 encryptor = cipher.encryptor()
77 78 cipher = Cipher(algorithms.IDEA(key), mode=None, backend=default_backend()) 79 encryptor = cipher.encryptor()
81 82 cipher = Cipher(algorithms.SEED(key), mode=None, backend=default_backend()) 83 encryptor = cipher.encryptor()
85 86 cipher = Cipher(algorithms.TripleDES(key), mode=None, backend=default_backend()) 87 encryptor = cipher.encryptor()
1 from cryptography.hazmat.primitives import hashes 2 from Crypto.Hash import MD2 as pycrypto_md2 3 from Crypto.Hash import MD4 as pycrypto_md4
2 from Crypto.Hash import MD2 as pycrypto_md2 3 from Crypto.Hash import MD4 as pycrypto_md4 4 from Crypto.Hash import MD5 as pycrypto_md5
3 from Crypto.Hash import MD4 as pycrypto_md4 4 from Crypto.Hash import MD5 as pycrypto_md5 5 from Crypto.Hash import SHA as pycrypto_sha
4 from Crypto.Hash import MD5 as pycrypto_md5 5 from Crypto.Hash import SHA as pycrypto_sha 6 from Cryptodome.Hash import MD2 as pycryptodomex_md2
12 13 hashlib.md5(1) 14 hashlib.md5(1).hexdigest()
13 hashlib.md5(1) 14 hashlib.md5(1).hexdigest() 15
15
16 abc = str.replace(hashlib.md5("1"), "###")
17
17
18 print(hashlib.md5("1"))
19
19 20 hashlib.sha1(1) 21
23 24 pycrypto_md2.new() 25 pycrypto_md4.new()
24 pycrypto_md2.new() 25 pycrypto_md4.new() 26 pycrypto_md5.new()
25 pycrypto_md4.new() 26 pycrypto_md5.new() 27 pycrypto_sha.new()
26 pycrypto_md5.new() 27 pycrypto_sha.new() 28
28 29 pycryptodomex_md2.new() 30 pycryptodomex_md4.new()
29 pycryptodomex_md2.new() 30 pycryptodomex_md4.new() 31 pycryptodomex_md5.new()
30 pycryptodomex_md4.new() 31 pycryptodomex_md5.new() 32 pycryptodomex_sha.new()
31 pycryptodomex_md5.new() 32 pycryptodomex_sha.new() 33
33 34 hashes.MD5() 35 hashes.SHA1()
34 hashes.MD5() 35 hashes.SHA1() 36
36
37 crypt.crypt("asdfasdfasdfasdf", salt=crypt.METHOD_CRYPT)
38 crypt.crypt("asdfasdfasdfasdf", salt=crypt.METHOD_MD5)
37 crypt.crypt("asdfasdfasdfasdf", salt=crypt.METHOD_CRYPT)
38 crypt.crypt("asdfasdfasdfasdf", salt=crypt.METHOD_MD5)
39 crypt.crypt("asdfasdfasdfasdf", salt=crypt.METHOD_BLOWFISH)
38 crypt.crypt("asdfasdfasdfasdf", salt=crypt.METHOD_MD5)
39 crypt.crypt("asdfasdfasdfasdf", salt=crypt.METHOD_BLOWFISH)
40 crypt.crypt("asdfasdfasdfasdf")
43 44 crypt.mksalt(crypt.METHOD_CRYPT) 45 crypt.mksalt(crypt.METHOD_MD5)
44 crypt.mksalt(crypt.METHOD_CRYPT) 45 crypt.mksalt(crypt.METHOD_MD5) 46 crypt.mksalt(crypt.METHOD_BLOWFISH)
45 crypt.mksalt(crypt.METHOD_MD5) 46 crypt.mksalt(crypt.METHOD_BLOWFISH) 47 crypt.mksalt()
1 import dill 2 import io 3
5 pick = dill.dumps({'a': 'b', 'c': 'd'})
6 print(dill.loads(pick))
7
10 file_obj.seek(0) 11 print(dill.load(file_obj)) 12
13 file_obj.seek(0) 14 print(dill.Unpickler(file_obj).load())
11 12 User.objects.filter(username='admin').extra(dict(could_be='insecure')) 13 User.objects.filter(username='admin').extra(select=dict(could_be='insecure'))
12 User.objects.filter(username='admin').extra(dict(could_be='insecure')) 13 User.objects.filter(username='admin').extra(select=dict(could_be='insecure')) 14 query = '"username") AS "username", * FROM "auth_user" WHERE 1=1 OR "username"=? --'
14 query = '"username") AS "username", * FROM "auth_user" WHERE 1=1 OR "username"=? --'
15 User.objects.filter(username='admin').extra(select={'test': query})
16 User.objects.filter(username='admin').extra(select={'test': '%secure' % 'nos'})
15 User.objects.filter(username='admin').extra(select={'test': query})
16 User.objects.filter(username='admin').extra(select={'test': '%secure' % 'nos'})
17 User.objects.filter(username='admin').extra(select={'test': '{}secure'.format('nos')})
16 User.objects.filter(username='admin').extra(select={'test': '%secure' % 'nos'})
17 User.objects.filter(username='admin').extra(select={'test': '{}secure'.format('nos')})
18
19 where_var = ['1=1) OR 1=1 AND (1=1'] 20 User.objects.filter(username='admin').extra(where=where_var) 21 where_str = '1=1) OR 1=1 AND (1=1'
21 where_str = '1=1) OR 1=1 AND (1=1' 22 User.objects.filter(username='admin').extra(where=[where_str]) 23 User.objects.filter(username='admin').extra(where=['%secure' % 'nos'])
22 User.objects.filter(username='admin').extra(where=[where_str])
23 User.objects.filter(username='admin').extra(where=['%secure' % 'nos'])
24 User.objects.filter(username='admin').extra(where=['{}secure'.format('no')])
23 User.objects.filter(username='admin').extra(where=['%secure' % 'nos'])
24 User.objects.filter(username='admin').extra(where=['{}secure'.format('no')])
25
26 tables_var = ['django_content_type" WHERE "auth_user"."username"="admin'] 27 User.objects.all().extra(tables=tables_var).distinct() 28 tables_str = 'django_content_type" WHERE "auth_user"."username"="admin'
28 tables_str = 'django_content_type" WHERE "auth_user"."username"="admin' 29 User.objects.all().extra(tables=[tables_str]).distinct()
4 User.objects.annotate(val=RawSQL('secure', []))
5 User.objects.annotate(val=RawSQL('%secure' % 'nos', []))
6 User.objects.annotate(val=RawSQL('{}secure'.format('no'), []))
5 User.objects.annotate(val=RawSQL('%secure' % 'nos', []))
6 User.objects.annotate(val=RawSQL('{}secure'.format('no'), []))
7 raw = '"username") AS "val" FROM "auth_user" WHERE "username"="admin" --'
7 raw = '"username") AS "val" FROM "auth_user" WHERE "username"="admin" --' 8 User.objects.annotate(val=RawSQL(raw, [])) 9 raw = '"username") AS "val" FROM "auth_user"' \
10 ' WHERE "username"="admin" OR 1=%s --'
11 User.objects.annotate(val=RawSQL(raw, [0]))
12 User.objects.annotate(val=RawSQL(sql='{}secure'.format('no'), params=[]))
11 User.objects.annotate(val=RawSQL(raw, [0]))
12 User.objects.annotate(val=RawSQL(sql='{}secure'.format('no'), params=[]))
13 User.objects.annotate(val=RawSQL(params=[], sql='{}secure'.format('no')))
12 User.objects.annotate(val=RawSQL(sql='{}secure'.format('no'), params=[]))
13 User.objects.annotate(val=RawSQL(params=[], sql='{}secure'.format('no')))
2
3 print(eval("1+1"))
4 print(eval("os.getcwd()"))
3 print(eval("1+1"))
4 print(eval("os.getcwd()"))
5 print(eval("os.chmod('%s', 0777)" % 'test.txt'))
4 print(eval("os.getcwd()"))
5 print(eval("os.chmod('%s', 0777)" % 'test.txt'))
6
1 exec("do evil")
9 #bad 10 app.run(debug=True) 11
1 from ftplib import FTP 2 from ftplib import FTP_TLS 3
1 from ftplib import FTP 2 from ftplib import FTP_TLS 3
5 # bad
6 ftp = FTP('ftp.debian.org')
7 ftp.login()
3 class SomeClass: 4 password = "class_password" 5
7 # Severity: Low Confidence: Medium
8 def someFunction(user, password="Admin"):
9 print("Hi " + user)
10
13 # Severity: Low Confidence: Medium
14 if password == "root":
15 print("OK, logged in")
19 # Severity: Low Confidence: Medium
20 if password == '':
21 print("No password!")
25 # Severity: Low Confidence: Medium
26 if password == "ajklawejrkl42348swfgkg":
27 print("Nice password!")
32 # Severity: Low Confidence: Medium 33 if obj.password == "this cool password": 34 print(obj.password)
37 # Severity: Low Confidence: Medium 38 def doLogin(password="blerg"): 39 pass 40
45 # Severity: Low Confidence: Medium 46 doLogin(password="blerg") 47
49 # Severity: Low Confidence: Medium 50 password = "blerg" 51
53 # Severity: Low Confidence: Medium 54 password["password"] = "blerg" 55
57 # Severity: Low Confidence: Medium 58 EMAIL_PASSWORD = "secret" 59
61 # Severity: Low Confidence: Medium 62 email_pwd = 'emails_secret' 63
65 # Severity: Low Confidence: Medium 66 my_secret_password_for_email = 'd6s$f9g!j8mg7hw?n&2' 67
69 # Severity: Low Confidence: Medium 70 passphrase='1234' 71
93 # https://github.com/PyCQA/bandit/issues/313
94 log({"server": server, "password": 'pass', "user": user})
95
101 # https://github.com/PyCQA/bandit/issues/1267
102 info = {"password": "12345"}
103
1 with open('/tmp/abc', 'w') as f:
2 f.write('def')
3
7
8 with open('/var/tmp/123', 'w') as f:
9 f.write('def')
10
11 with open('/dev/shm/unit/test', 'w') as f:
12 f.write('def')
2
3 hashlib.new('md5')
4
4
5 hashlib.new('md4', b'test')
6
6 7 hashlib.new(name='md5', data=b'test') 8
8
9 hashlib.new('MD4', data=b'test')
10
10
11 hashlib.new('sha1')
12
12
13 hashlib.new('sha1', data=b'test')
14
14
15 hashlib.new('sha', data=b'test')
16
16 17 hashlib.new(name='SHA', data=b'test') 18
18
19 hashlib.new('sha1', usedforsecurity=True)
20
9 if __name__ == '__main__': 10 wsgiref.handlers.CGIHandler().run(application)
4 root = static.File("/root")
5 root.putChild("cgi-bin", twcgi.CGIDirectory("/var/www/cgi-bin"))
6 reactor.listenTCP(80, server.Site(root))
4 root = static.File("/root")
5 root.putChild("login.cgi", twcgi.CGIScript("/var/www/cgi-bin/login.py"))
6 reactor.listenTCP(80, server.Site(root))
9 # Example #1: No revision (defaults to floating 'main')
10 unsafe_model_no_revision = AutoModel.from_pretrained("org/model_name")
11
12 # Example #2: Floating revision: 'main' 13 unsafe_model_main = AutoModel.from_pretrained( 14 "org/model_name", 15 revision="main" 16 ) 17
18 # Example #3: Floating tag revision: 'v1.0.0' 19 unsafe_model_tag = AutoModel.from_pretrained( 20 "org/model_name", 21 revision="v1.0.0" 22 ) 23
27 # Example #4: No revision
28 unsafe_tokenizer_no_revision = AutoTokenizer.from_pretrained("org/model_name")
29
30 # Example #5: Floating revision: 'main' 31 unsafe_tokenizer_main = AutoTokenizer.from_pretrained( 32 "org/model_name", 33 revision="main" 34 ) 35
36 # Example #6: Floating tag revision: 'v1.0.0' 37 unsafe_tokenizer_tag = AutoTokenizer.from_pretrained( 38 "org/model_name", 39 revision="v1.0.0" 40 ) 41
45 # Example #8: No revision
46 unsafe_dataset_no_revision = load_dataset("org_dataset")
47
48 # Example #9: Floating revision: 'main'
49 unsafe_dataset_main = load_dataset("org_dataset", revision="main")
50
51 # Example #10: Floating tag revision: 'v1.0.0'
52 unsafe_dataset_tag = load_dataset("org_dataset", revision="v1.0.0")
53
57 # Example #11: No revision 58 unsafe_file_no_revision = hf_hub_download( 59 repo_id="org/model_name", 60 filename="config.json" 61 ) 62
63 # Example #12: Floating revision: 'main' 64 unsafe_file_main = hf_hub_download( 65 repo_id="org/model_name", 66 filename="config.json", 67 revision="main" 68 ) 69
70 # Example #13: Floating tag revision: 'v1.0.0' 71 unsafe_file_tag = hf_hub_download( 72 repo_id="org/model_name", 73 filename="config.json", 74 revision="v1.0.0" 75 ) 76
80 # Example #14: No revision 81 unsafe_snapshot_no_revision = snapshot_download(repo_id="org/model_name") 82
83 # Example #15: Floating revision: 'main' 84 unsafe_snapshot_main = snapshot_download( 85 repo_id="org/model_name", 86 revision="main" 87 ) 88
89 # Example #16: Floating tag revision: 'v1.0.0' 90 unsafe_snapshot_tag = snapshot_download( 91 repo_id="org/model_name", 92 revision="v1.0.0" 93 ) 94
1 from subprocess import Popen as pop 2 import hashlib as h 3 import hashlib as hh
5 import hashlib as hhhh 6 from pickle import loads as lp 7 import pickle as p
6 from pickle import loads as lp 7 import pickle as p 8
8
9 pop('/bin/gcc --version', shell=True)
10
10
11 h.md5('1')
12 hh.md5('2')
11 h.md5('1')
12 hh.md5('2')
13 hhh.md5('3').hexdigest()
12 hh.md5('2')
13 hhh.md5('3').hexdigest()
14 hhhh.md5('4')
13 hhh.md5('3').hexdigest()
14 hhhh.md5('4')
15 lp({'key': 'value'})
14 hhhh.md5('4')
15 lp({'key': 'value'})
1 from subprocess import Popen 2 3 from ..foo import sys
5 from .. import sys 6 from .. import subprocess 7 from ..subprocess import Popen
6 from .. import subprocess 7 from ..subprocess import Popen
1 os = __import__("os")
2 pickle = __import__("pickle")
3 sys = __import__("sys")
3 sys = __import__("sys")
4 subprocess = __import__("subprocess")
5
2 a = importlib.import_module('os')
3 b = importlib.import_module('pickle')
4 c = importlib.__import__('sys')
4 c = importlib.__import__('sys')
5 d = importlib.__import__('subprocess')
6
12 g = importlib.import_module(name='sys') 13 h = importlib.__import__(name='subprocess') 14 i = importlib.import_module(name='subprocess', package='bar.baz')
13 h = importlib.__import__(name='subprocess') 14 i = importlib.import_module(name='subprocess', package='bar.baz') 15 j = importlib.__import__(name='sys', package='bar.baz')
1 import os 2 import pickle 3 import sys
3 import sys 4 import subprocess
8 loader=templateLoader ) 9 Environment(loader=templateLoader, load=templateLoader, autoescape=something) 10 templateEnv = jinja2.Environment(autoescape=False, loader=templateLoader )
9 Environment(loader=templateLoader, load=templateLoader, autoescape=something) 10 templateEnv = jinja2.Environment(autoescape=False, loader=templateLoader ) 11 Environment(loader=templateLoader,
10 templateEnv = jinja2.Environment(autoescape=False, loader=templateLoader ) 11 Environment(loader=templateLoader, 12 load=templateLoader, 13 autoescape=False) 14
14 15 Environment(loader=templateLoader, 16 load=templateLoader) 17
28 return 'foobar' 29 Environment(loader=templateLoader, autoescape=fake_func())
5 6 print(jsonpickle.decode(pick)) 7
7 8 print(jsonpickle.unpickler.decode(pick)) 9
9 10 print(jsonpickle.unpickler.Unpickler().restore(pick))
2 3 t = logging.config.listen(9999)
5
6 Template("hello")
7
9 # in for now so that if it gets fixed inadvertitently we know.
10 mako.template.Template("hern")
11 template.Template("hern")
10 mako.template.Template("hern")
11 template.Template("hern")
3 mystr = '<b>Hello World</b>' 4 mystr = safestring.mark_safe(mystr)
9 my_insecure_str = insecure_function('insecure', cls='" onload="alert(\'xss\')')
10 safestring.mark_safe(my_insecure_str)
11 safestring.SafeText(my_insecure_str)
9 my_insecure_str = insecure_function('insecure', cls='" onload="alert(\'xss\')')
10 safestring.mark_safe(my_insecure_str)
11 safestring.SafeText(my_insecure_str)
10 safestring.mark_safe(my_insecure_str) 11 safestring.SafeText(my_insecure_str) 12 safestring.SafeUnicode(my_insecure_str)
11 safestring.SafeText(my_insecure_str) 12 safestring.SafeUnicode(my_insecure_str) 13 safestring.SafeString(my_insecure_str)
12 safestring.SafeUnicode(my_insecure_str) 13 safestring.SafeString(my_insecure_str) 14 safestring.SafeBytes(my_insecure_str)
13 safestring.SafeString(my_insecure_str) 14 safestring.SafeBytes(my_insecure_str) 15
21 my_insecure_str = 'Secure' 22 safestring.mark_safe(my_insecure_str) 23
21 my_insecure_str = 'Secure' 22 safestring.mark_safe(my_insecure_str) 23
29 my_insecure_str = insecure_function('insecure', cls=cls)
30 safestring.mark_safe(my_insecure_str)
31
29 my_insecure_str = insecure_function('insecure', cls=cls)
30 safestring.mark_safe(my_insecure_str)
31
40 my_insecure_str = insecure_function('insecure', cls=cls)
41 safestring.mark_safe(my_insecure_str)
42
40 my_insecure_str = insecure_function('insecure', cls=cls)
41 safestring.mark_safe(my_insecure_str)
42
53 my_insecure_str = insecure_function('insecure', cls=cls)
54 safestring.mark_safe(my_insecure_str)
55
53 my_insecure_str = insecure_function('insecure', cls=cls)
54 safestring.mark_safe(my_insecure_str)
55
58 my_insecure_str = insecure_function('insecure', cls=cls)
59 safestring.mark_safe('<b>{} {}</b>'.format(my_insecure_str, 'STR'))
60
58 my_insecure_str = insecure_function('insecure', cls=cls)
59 safestring.mark_safe('<b>{} {}</b>'.format(my_insecure_str, 'STR'))
60
63 my_insecure_str = insecure_function('insecure', cls=cls)
64 safestring.mark_safe('<b>{}</b>'.format(*[my_insecure_str]))
65
63 my_insecure_str = insecure_function('insecure', cls=cls)
64 safestring.mark_safe('<b>{}</b>'.format(*[my_insecure_str]))
65
68 my_insecure_str = insecure_function('insecure', cls=cls)
69 safestring.mark_safe('<b>{b}</b>'.format(b=my_insecure_str))
70
68 my_insecure_str = insecure_function('insecure', cls=cls)
69 safestring.mark_safe('<b>{b}</b>'.format(b=my_insecure_str))
70
73 my_insecure_str = insecure_function('insecure', cls=cls)
74 safestring.mark_safe('<b>{b}</b>'.format(**{'b': my_insecure_str}))
75
73 my_insecure_str = insecure_function('insecure', cls=cls)
74 safestring.mark_safe('<b>{b}</b>'.format(**{'b': my_insecure_str}))
75
78 my_insecure_str = insecure_function('insecure', cls=cls)
79 safestring.mark_safe('<b>%s</b>' % my_insecure_str)
80
78 my_insecure_str = insecure_function('insecure', cls=cls)
79 safestring.mark_safe('<b>%s</b>' % my_insecure_str)
80
83 my_insecure_str = insecure_function('insecure', cls=cls)
84 safestring.mark_safe('<b>%s %s</b>' % (my_insecure_str, 'b'))
85
83 my_insecure_str = insecure_function('insecure', cls=cls)
84 safestring.mark_safe('<b>%s %s</b>' % (my_insecure_str, 'b'))
85
88 my_insecure_str = insecure_function('insecure', cls=cls)
89 safestring.mark_safe('<b>%(b)s</b>' % {'b': my_insecure_str})
90
88 my_insecure_str = insecure_function('insecure', cls=cls)
89 safestring.mark_safe('<b>%(b)s</b>' % {'b': my_insecure_str})
90
93 import sre_constants 94 safestring.mark_safe(sre_constants.ANY) 95
93 import sre_constants 94 safestring.mark_safe(sre_constants.ANY) 95
98 import sre_constants.ANY as any_str 99 safestring.mark_safe(any_str) 100
98 import sre_constants.ANY as any_str 99 safestring.mark_safe(any_str) 100
103 from sre_constants import ANY 104 safestring.mark_safe(ANY) 105
103 from sre_constants import ANY 104 safestring.mark_safe(ANY) 105
108 from sre_constants import ANY as any_str 109 safestring.mark_safe(any_str) 110
108 from sre_constants import ANY as any_str 109 safestring.mark_safe(any_str) 110
113 with open(path) as f: 114 safestring.mark_safe(f.read()) 115
113 with open(path) as f: 114 safestring.mark_safe(f.read()) 115
118 with open(path) as f: 119 safestring.mark_safe(f) 120
118 with open(path) as f: 119 safestring.mark_safe(f) 120
125 my_secure_str += insecure_function('insecure', cls='" onload="alert(\'xss\')')
126 safestring.mark_safe(my_secure_str)
127
125 my_secure_str += insecure_function('insecure', cls='" onload="alert(\'xss\')')
126 safestring.mark_safe(my_secure_str)
127
132 my_secure_str += insecure_function('insecure', cls='" onload="alert(\'xss\')')
133 safestring.mark_safe(my_secure_str)
134
132 my_secure_str += insecure_function('insecure', cls='" onload="alert(\'xss\')')
133 safestring.mark_safe(my_secure_str)
134
142 my_secure_str = 'Secure' 143 safestring.mark_safe(my_secure_str) 144
142 my_secure_str = 'Secure' 143 safestring.mark_safe(my_secure_str) 144
148 def test_insecure_shadow(): # var assigned out of scope 149 safestring.mark_safe(mystr) 150
148 def test_insecure_shadow(): # var assigned out of scope 149 safestring.mark_safe(mystr) 150
152 def test_insecure(str_arg): 153 safestring.mark_safe(str_arg) 154
152 def test_insecure(str_arg): 153 safestring.mark_safe(str_arg) 154
158 str_arg = 'could be insecure' 159 safestring.mark_safe(str_arg) 160
158 str_arg = 'could be insecure' 159 safestring.mark_safe(str_arg) 160
166 text, url = choice(HTML_CHOICES)
167 safestring.mark_safe('<a href="{0}">{1}</a>'.format(url, text))
166 text, url = choice(HTML_CHOICES)
167 safestring.mark_safe('<a href="{0}">{1}</a>'.format(url, text))
3
4 safestring.mark_safe('<b>secure</b>')
5 safestring.SafeText('<b>secure</b>')
10 my_secure_str = '<b>Hello World</b>' 11 safestring.mark_safe(my_secure_str) 12
13 my_secure_str, _ = ('<b>Hello World</b>', '')
14 safestring.mark_safe(my_secure_str)
15
16 also_secure_str = my_secure_str 17 safestring.mark_safe(also_secure_str) 18
28 my_secure_str = 'Secure' 29 safestring.mark_safe(my_secure_str) 30
32 def format_secure():
33 safestring.mark_safe('<b>{}</b>'.format('secure'))
34 my_secure_str = 'secure'
34 my_secure_str = 'secure'
35 safestring.mark_safe('<b>{}</b>'.format(my_secure_str))
36 safestring.mark_safe('<b>{} {}</b>'.format(my_secure_str, 'a'))
35 safestring.mark_safe('<b>{}</b>'.format(my_secure_str))
36 safestring.mark_safe('<b>{} {}</b>'.format(my_secure_str, 'a'))
37 safestring.mark_safe('<b>{} {}</b>'.format(*[my_secure_str, 'a']))
36 safestring.mark_safe('<b>{} {}</b>'.format(my_secure_str, 'a'))
37 safestring.mark_safe('<b>{} {}</b>'.format(*[my_secure_str, 'a']))
38 safestring.mark_safe('<b>{b}</b>'.format(b=my_secure_str)) # nosec TODO
40 my_secure_str = '<b>{}</b>'.format(my_secure_str)
41 safestring.mark_safe(my_secure_str)
42
44 def percent_secure():
45 safestring.mark_safe('<b>%s</b>' % 'secure')
46 my_secure_str = 'secure'
46 my_secure_str = 'secure'
47 safestring.mark_safe('<b>%s</b>' % my_secure_str)
48 safestring.mark_safe('<b>%s %s</b>' % (my_secure_str, 'a'))
47 safestring.mark_safe('<b>%s</b>' % my_secure_str)
48 safestring.mark_safe('<b>%s %s</b>' % (my_secure_str, 'a'))
49 safestring.mark_safe('<b>%(b)s</b>' % {'b': my_secure_str}) # nosec TODO
53 with open(path) as f:
54 safestring.mark_safe('Secure')
55
61 my_secure_str += ' Secure' 62 safestring.mark_safe(my_secure_str) 63 while ord(os.urandom(1)) % 2 == 0:
64 my_secure_str += ' Secure' 65 safestring.mark_safe(my_secure_str) 66
74 my_secure_str = 'Secure' 75 safestring.mark_safe(my_secure_str)
4 content = "<script>alert('Hello, world!')</script>"
5 Markup(f"unsafe {content}") # B704
6 flask.Markup("unsafe {}".format(content)) # B704
5 Markup(f"unsafe {content}") # B704
6 flask.Markup("unsafe {}".format(content)) # B704
7 Markup("safe {}").format(content)
9 escape(content)
10 Markup(content) # B704
11 flask.Markup("unsafe %s" % content) # B704
10 Markup(content) # B704
11 flask.Markup("unsafe %s" % content) # B704
12 Markup(object="safe")
4 content = "<script>alert('Hello, world!')</script>"
5 Markup(clean(content))
6
8 cleaned = clean(content) 9 Markup(cleaned)
4 content = "<script>alert('Hello, world!')</script>"
5 Markup(f"unsafe {content}")
6 literal(f"unsafe {content}")
5 serialized = marshal.dumps({'a': 1})
6 print(marshal.loads(serialized))
7
10 file_obj.seek(0) 11 print(marshal.load(file_obj)) 12 file_obj.close()
6
7 mktemp(foo)
8 tempfile.mktemp('foo')
7 mktemp(foo)
8 tempfile.mktemp('foo')
9 mt(foo)
8 tempfile.mktemp('foo')
9 mt(foo)
10 tmp.mktemp(foo)
9 mt(foo) 10 tmp.mktemp(foo)
1 import subprocess
2
3 subprocess.check_output("/some_command",
4 "args", 5 shell=True, 6 universal_newlines=True) 7 8 subprocess.check_output( 9 "/some_command",
10 "args", 11 shell=True, 12 universal_newlines=True 13 )
6 # candidate #1
7 subprocess.Popen('/bin/ls *', shell=True)
8 # candidate #2
14 # candidate #3 15 y = yaml.load(temp_str) 16 # candidate #4
21 # candidate #5 22 xml.sax.make_parser() 23 # candidate #6
6 # candidate #1
7 subprocess.Popen('/bin/ls *', shell=True)
8 # candidate #2
5 ssh_client = client.SSHClient() 6 ssh_client.set_missing_host_key_policy(client.AutoAddPolicy) 7 ssh_client.set_missing_host_key_policy(client.WarningPolicy)
6 ssh_client.set_missing_host_key_policy(client.AutoAddPolicy) 7 ssh_client.set_missing_host_key_policy(client.WarningPolicy) 8 ssh_client.set_missing_host_key_policy(client.AutoAddPolicy())
7 ssh_client.set_missing_host_key_policy(client.WarningPolicy) 8 ssh_client.set_missing_host_key_policy(client.AutoAddPolicy()) 9 ssh_client.set_missing_host_key_policy(client.WarningPolicy())
8 ssh_client.set_missing_host_key_policy(client.AutoAddPolicy()) 9 ssh_client.set_missing_host_key_policy(client.WarningPolicy()) 10
10 11 ssh_client.set_missing_host_key_policy(AutoAddPolicy) 12 ssh_client.set_missing_host_key_policy(WarningPolicy)
11 ssh_client.set_missing_host_key_policy(AutoAddPolicy) 12 ssh_client.set_missing_host_key_policy(WarningPolicy) 13 ssh_client.set_missing_host_key_policy(AutoAddPolicy())
12 ssh_client.set_missing_host_key_policy(WarningPolicy) 13 ssh_client.set_missing_host_key_policy(AutoAddPolicy()) 14 ssh_client.set_missing_host_key_policy(WarningPolicy())
13 ssh_client.set_missing_host_key_policy(AutoAddPolicy()) 14 ssh_client.set_missing_host_key_policy(WarningPolicy())
8 shell=True) #nosec (on the specific kwarg line)
9 subprocess.Popen('#nosec', shell=True)
10 subprocess.Popen('/bin/ls *', shell=True) # type: ... # nosec # noqa: E501 ; pylint: disable=line-too-long
8 shell=True) #nosec (on the specific kwarg line)
9 subprocess.Popen('#nosec', shell=True)
10 subprocess.Popen('/bin/ls *', shell=True) # type: ... # nosec # noqa: E501 ; pylint: disable=line-too-long
10 subprocess.Popen('/bin/ls *', shell=True) # type: ... # nosec # noqa: E501 ; pylint: disable=line-too-long
11 subprocess.Popen('/bin/ls *', shell=True) # type: ... # nosec B607 # noqa: E501 ; pylint: disable=line-too-long
12 subprocess.Popen('/bin/ls *', shell=True) #nosec subprocess_popen_with_shell_equals_true (on the line)
16 subprocess.Popen('/bin/ls *', shell=True) # type: ... # noqa: E501 ; pylint: disable=line-too-long # nosec
17 subprocess.Popen('#nosec', shell=True) # nosec B607, B101
18 subprocess.Popen('#nosec', shell=True) # nosec B602, subprocess_popen_with_shell_equals_true
17 subprocess.Popen('#nosec', shell=True) # nosec B607, B101
18 subprocess.Popen('#nosec', shell=True) # nosec B602, subprocess_popen_with_shell_equals_true
5
6 os.chmod('/etc/passwd', 0o227)
7 os.chmod('/etc/passwd', 0o7)
6 os.chmod('/etc/passwd', 0o227)
7 os.chmod('/etc/passwd', 0o7)
8 os.chmod('/etc/passwd', 0o664)
7 os.chmod('/etc/passwd', 0o7)
8 os.chmod('/etc/passwd', 0o664)
9 os.chmod('/etc/passwd', 0o777)
8 os.chmod('/etc/passwd', 0o664)
9 os.chmod('/etc/passwd', 0o777)
10 os.chmod('/etc/passwd', 0o770)
9 os.chmod('/etc/passwd', 0o777)
10 os.chmod('/etc/passwd', 0o770)
11 os.chmod('/etc/passwd', 0o776)
10 os.chmod('/etc/passwd', 0o770)
11 os.chmod('/etc/passwd', 0o776)
12 os.chmod('/etc/passwd', 0o760)
11 os.chmod('/etc/passwd', 0o776)
12 os.chmod('/etc/passwd', 0o760)
13 os.chmod('~/.bashrc', 511)
12 os.chmod('/etc/passwd', 0o760)
13 os.chmod('~/.bashrc', 511)
14 os.chmod('/etc/hosts', 0o777)
13 os.chmod('~/.bashrc', 511)
14 os.chmod('/etc/hosts', 0o777)
15 os.chmod('/tmp/oh_hai', 0x0)
14 os.chmod('/etc/hosts', 0o777)
15 os.chmod('/tmp/oh_hai', 0x0)
16 os.chmod('/etc/passwd', stat.S_IRWXU)
14 os.chmod('/etc/hosts', 0o777)
15 os.chmod('/tmp/oh_hai', 0x0)
16 os.chmod('/etc/passwd', stat.S_IRWXU)
16 os.chmod('/etc/passwd', stat.S_IRWXU)
17 os.chmod(keyfile, 0o777)
18 os.chmod('~/hidden_exec', stat.S_IXGRP)
2 3 os.execl(path, arg0, arg1) 4 os.execle(path, arg0, arg1, env)
3 os.execl(path, arg0, arg1) 4 os.execle(path, arg0, arg1, env) 5 os.execlp(file, arg0, arg1)
4 os.execle(path, arg0, arg1, env) 5 os.execlp(file, arg0, arg1) 6 os.execlpe(file, arg0, arg1, env)
5 os.execlp(file, arg0, arg1) 6 os.execlpe(file, arg0, arg1, env) 7 os.execv(path, args)
6 os.execlpe(file, arg0, arg1, env) 7 os.execv(path, args) 8 os.execve(path, args, env)
7 os.execv(path, args) 8 os.execve(path, args, env) 9 os.execvp(file, args)
8 os.execve(path, args, env) 9 os.execvp(file, args) 10 os.execvpe(file, args, env)
9 os.execvp(file, args) 10 os.execvpe(file, args, env) 11
5
6 os.popen('/bin/uname -av')
7 popen('/bin/uname -av')
6 os.popen('/bin/uname -av')
7 popen('/bin/uname -av')
8 o.popen('/bin/uname -av')
7 popen('/bin/uname -av')
8 o.popen('/bin/uname -av')
9 pos('/bin/uname -av')
8 o.popen('/bin/uname -av')
9 pos('/bin/uname -av')
10 os.popen2('/bin/uname -av')
9 pos('/bin/uname -av')
10 os.popen2('/bin/uname -av')
11 os.popen3('/bin/uname -av')
10 os.popen2('/bin/uname -av')
11 os.popen3('/bin/uname -av')
12 os.popen4('/bin/uname -av')
11 os.popen3('/bin/uname -av')
12 os.popen4('/bin/uname -av')
13
13
14 os.popen4('/bin/uname -av; rm -rf /')
15 os.popen4(some_var)
14 os.popen4('/bin/uname -av; rm -rf /')
15 os.popen4(some_var)
2 3 os.spawnl(mode, path) 4 os.spawnle(mode, path, env)
3 os.spawnl(mode, path) 4 os.spawnle(mode, path, env) 5 os.spawnlp(mode, file)
4 os.spawnle(mode, path, env) 5 os.spawnlp(mode, file) 6 os.spawnlpe(mode, file, env)
5 os.spawnlp(mode, file) 6 os.spawnlpe(mode, file, env) 7 os.spawnv(mode, path, args)
6 os.spawnlpe(mode, file, env) 7 os.spawnv(mode, path, args) 8 os.spawnve(mode, path, args, env)
7 os.spawnv(mode, path, args) 8 os.spawnve(mode, path, args, env) 9 os.spawnvp(mode, file, args)
8 os.spawnve(mode, path, args, env) 9 os.spawnvp(mode, file, args) 10 os.spawnvpe(mode, file, args, env)
9 os.spawnvp(mode, file, args) 10 os.spawnvpe(mode, file, args, env)
2
3 os.startfile('/bin/foo.docx')
4 os.startfile('/bin/bad.exe')
3 os.startfile('/bin/foo.docx')
4 os.startfile('/bin/bad.exe')
5 os.startfile('/bin/text.txt')
4 os.startfile('/bin/bad.exe')
5 os.startfile('/bin/text.txt')
2
3 os.system('/bin/echo hi')
1 import pickle 2 import pandas as pd 3
11 12 print(pd.read_pickle(pick))
6 # this is not safe
7 client.exec_command('something; really; unsafe')
8
1 from subprocess import Popen as pop
2
3 pop('gcc --version', shell=False)
2
3 pop('gcc --version', shell=False)
4 pop('/bin/gcc --version', shell=False)
2
3 pop('gcc --version', shell=False)
4 pop('/bin/gcc --version', shell=False)
3 pop('gcc --version', shell=False)
4 pop('/bin/gcc --version', shell=False)
5 pop(var, shell=False)
4 pop('/bin/gcc --version', shell=False)
5 pop(var, shell=False)
6
6 7 pop(['ls', '-l'], shell=False) 8 pop(['/bin/ls', '-l'], shell=False)
6 7 pop(['ls', '-l'], shell=False) 8 pop(['/bin/ls', '-l'], shell=False)
7 pop(['ls', '-l'], shell=False) 8 pop(['/bin/ls', '-l'], shell=False) 9
9
10 pop('../ls -l', shell=False)
11
11
12 pop('c:\\hello\\something', shell=False)
13 pop('c:/hello/something_else', shell=False)
12 pop('c:\\hello\\something', shell=False)
13 pop('c:/hello/something_else', shell=False)
1 import io 2 import pickle 3
6 pick = pickle.dumps({'a': 'b', 'c': 'd'})
7 print(pickle.loads(pick))
8
11 file_obj.seek(0) 12 print(pickle.load(file_obj)) 13
14 file_obj.seek(0) 15 print(pickle.Unpickler(file_obj).load())
4
5 print(commands.getstatusoutput('/bin/echo / | xargs ls'))
6 print(commands.getoutput('/bin/echo / | xargs ls'))
5 print(commands.getstatusoutput('/bin/echo / | xargs ls'))
6 print(commands.getoutput('/bin/echo / | xargs ls'))
7
10
11 print(popen2.popen2('/bin/echo / | xargs ls')[0].read())
12 print(popen2.popen3('/bin/echo / | xargs ls')[0].read())
11 print(popen2.popen2('/bin/echo / | xargs ls')[0].read())
12 print(popen2.popen3('/bin/echo / | xargs ls')[0].read())
13 print(popen2.popen4('/bin/echo / | xargs ls')[0].read())
12 print(popen2.popen3('/bin/echo / | xargs ls')[0].read())
13 print(popen2.popen4('/bin/echo / | xargs ls')[0].read())
14 print(popen2.Popen3('/bin/echo / | xargs ls').fromchild.read())
13 print(popen2.popen4('/bin/echo / | xargs ls')[0].read())
14 print(popen2.Popen3('/bin/echo / | xargs ls').fromchild.read())
15 print(popen2.Popen4('/bin/echo / | xargs ls').fromchild.read())
14 print(popen2.Popen3('/bin/echo / | xargs ls').fromchild.read())
15 print(popen2.Popen4('/bin/echo / | xargs ls').fromchild.read())
1 from Crypto.Cipher import AES 2 from Crypto import Random 3
1 from Crypto.Cipher import AES 2 from Crypto import Random 3
1 from pyghmi.ipmi import command 2 3 cmd = command.Command(bmc="bmc",
4 userid="userid", 5 password="ZjE4ZjI0NTE4YmI2NGJjZDliOGY3ZmJiY2UyN2IzODQK")
9 loaded_model = models.resnet18()
10 loaded_model.load_state_dict(torch.load('model_weights.pth'))
11
17 unsafe_model = models.resnet18()
18 unsafe_model.load_state_dict(torch.load('model_weights.pth', weights_only=False))
19
21 cpu_model = models.resnet18()
22 cpu_model.load_state_dict(torch.load('model_weights.pth', map_location='cpu'))
23
4 5 bad = random.Random() 6 bad = random.random()
5 bad = random.Random() 6 bad = random.random() 7 bad = random.randrange()
6 bad = random.random() 7 bad = random.randrange() 8 bad = random.randint()
7 bad = random.randrange() 8 bad = random.randint() 9 bad = random.choice()
8 bad = random.randint() 9 bad = random.choice() 10 bad = random.choices()
9 bad = random.choice() 10 bad = random.choices() 11 bad = random.uniform()
10 bad = random.choices() 11 bad = random.uniform() 12 bad = random.triangular()
11 bad = random.uniform() 12 bad = random.triangular() 13 bad = random.randbytes()
12 bad = random.triangular() 13 bad = random.randbytes() 14 bad = random.sample()
13 bad = random.randbytes() 14 bad = random.sample() 15 bad = random.randrange()
14 bad = random.sample() 15 bad = random.randrange() 16 bad = random.getrandbits()
15 bad = random.randrange() 16 bad = random.getrandbits() 17
5 # Errors
6 requests.get('https://gmail.com')
7 requests.get('https://gmail.com', timeout=None)
6 requests.get('https://gmail.com')
7 requests.get('https://gmail.com', timeout=None)
8 requests.post('https://gmail.com')
7 requests.get('https://gmail.com', timeout=None)
8 requests.post('https://gmail.com')
9 requests.post('https://gmail.com', timeout=None)
8 requests.post('https://gmail.com')
9 requests.post('https://gmail.com', timeout=None)
10 requests.put('https://gmail.com')
9 requests.post('https://gmail.com', timeout=None)
10 requests.put('https://gmail.com')
11 requests.put('https://gmail.com', timeout=None)
10 requests.put('https://gmail.com')
11 requests.put('https://gmail.com', timeout=None)
12 requests.delete('https://gmail.com')
11 requests.put('https://gmail.com', timeout=None)
12 requests.delete('https://gmail.com')
13 requests.delete('https://gmail.com', timeout=None)
12 requests.delete('https://gmail.com')
13 requests.delete('https://gmail.com', timeout=None)
14 requests.patch('https://gmail.com')
13 requests.delete('https://gmail.com', timeout=None)
14 requests.patch('https://gmail.com')
15 requests.patch('https://gmail.com', timeout=None)
14 requests.patch('https://gmail.com')
15 requests.patch('https://gmail.com', timeout=None)
16 requests.options('https://gmail.com')
15 requests.patch('https://gmail.com', timeout=None)
16 requests.options('https://gmail.com')
17 requests.options('https://gmail.com', timeout=None)
16 requests.options('https://gmail.com')
17 requests.options('https://gmail.com', timeout=None)
18 requests.head('https://gmail.com')
17 requests.options('https://gmail.com', timeout=None)
18 requests.head('https://gmail.com')
19 requests.head('https://gmail.com', timeout=None)
18 requests.head('https://gmail.com')
19 requests.head('https://gmail.com', timeout=None)
20 httpx.get('https://gmail.com')
20 httpx.get('https://gmail.com')
21 httpx.get('https://gmail.com', timeout=None)
22 httpx.post('https://gmail.com')
22 httpx.post('https://gmail.com')
23 httpx.post('https://gmail.com', timeout=None)
24 httpx.put('https://gmail.com')
24 httpx.put('https://gmail.com')
25 httpx.put('https://gmail.com', timeout=None)
26 httpx.delete('https://gmail.com')
26 httpx.delete('https://gmail.com')
27 httpx.delete('https://gmail.com', timeout=None)
28 httpx.patch('https://gmail.com')
28 httpx.patch('https://gmail.com')
29 httpx.patch('https://gmail.com', timeout=None)
30 httpx.options('https://gmail.com')
30 httpx.options('https://gmail.com')
31 httpx.options('https://gmail.com', timeout=None)
32 httpx.head('https://gmail.com')
32 httpx.head('https://gmail.com')
33 httpx.head('https://gmail.com', timeout=None)
34 httpx.Client()
34 httpx.Client() 35 httpx.Client(timeout=None) 36 httpx.AsyncClient()
36 httpx.AsyncClient() 37 httpx.AsyncClient(timeout=None) 38 with httpx.Client() as client:
39 client.get('https://gmail.com')
40 with httpx.Client(timeout=None) as client:
41 client.get('https://gmail.com')
43 await client.get('https://gmail.com')
44 async with httpx.AsyncClient(timeout=None) as client:
45 await client.get('https://gmail.com')
5 requests.get('https://gmail.com', timeout=30, verify=True)
6 requests.get('https://gmail.com', timeout=30, verify=False)
7 requests.post('https://gmail.com', timeout=30, verify=True)
7 requests.post('https://gmail.com', timeout=30, verify=True)
8 requests.post('https://gmail.com', timeout=30, verify=False)
9 requests.put('https://gmail.com', timeout=30, verify=True)
9 requests.put('https://gmail.com', timeout=30, verify=True)
10 requests.put('https://gmail.com', timeout=30, verify=False)
11 requests.delete('https://gmail.com', timeout=30, verify=True)
11 requests.delete('https://gmail.com', timeout=30, verify=True)
12 requests.delete('https://gmail.com', timeout=30, verify=False)
13 requests.patch('https://gmail.com', timeout=30, verify=True)
13 requests.patch('https://gmail.com', timeout=30, verify=True)
14 requests.patch('https://gmail.com', timeout=30, verify=False)
15 requests.options('https://gmail.com', timeout=30, verify=True)
15 requests.options('https://gmail.com', timeout=30, verify=True)
16 requests.options('https://gmail.com', timeout=30, verify=False)
17 requests.head('https://gmail.com', timeout=30, verify=True)
17 requests.head('https://gmail.com', timeout=30, verify=True)
18 requests.head('https://gmail.com', timeout=30, verify=False)
19
21 httpx.request('GET', 'https://gmail.com', timeout=30, verify=True)
22 httpx.request('GET', 'https://gmail.com', timeout=30, verify=False)
23 httpx.get('https://gmail.com', timeout=30, verify=True)
23 httpx.get('https://gmail.com', timeout=30, verify=True)
24 httpx.get('https://gmail.com', timeout=30, verify=False)
25 httpx.options('https://gmail.com', timeout=30, verify=True)
25 httpx.options('https://gmail.com', timeout=30, verify=True)
26 httpx.options('https://gmail.com', timeout=30, verify=False)
27 httpx.head('https://gmail.com', timeout=30, verify=True)
27 httpx.head('https://gmail.com', timeout=30, verify=True)
28 httpx.head('https://gmail.com', timeout=30, verify=False)
29 httpx.post('https://gmail.com', timeout=30, verify=True)
29 httpx.post('https://gmail.com', timeout=30, verify=True)
30 httpx.post('https://gmail.com', timeout=30, verify=False)
31 httpx.put('https://gmail.com', timeout=30, verify=True)
31 httpx.put('https://gmail.com', timeout=30, verify=True)
32 httpx.put('https://gmail.com', timeout=30, verify=False)
33 httpx.patch('https://gmail.com', timeout=30, verify=True)
33 httpx.patch('https://gmail.com', timeout=30, verify=True)
34 httpx.patch('https://gmail.com', timeout=30, verify=False)
35 httpx.delete('https://gmail.com', timeout=30, verify=True)
35 httpx.delete('https://gmail.com', timeout=30, verify=True)
36 httpx.delete('https://gmail.com', timeout=30, verify=False)
37 httpx.stream('https://gmail.com', timeout=30, verify=True)
37 httpx.stream('https://gmail.com', timeout=30, verify=True)
38 httpx.stream('https://gmail.com', timeout=30, verify=False)
39 httpx.Client(timeout=30)
39 httpx.Client(timeout=30) 40 httpx.Client(timeout=30, verify=False) 41 httpx.AsyncClient(timeout=30)
41 httpx.AsyncClient(timeout=30) 42 httpx.AsyncClient(timeout=30, verify=False)
1 import os 2 import shelve 3 import tempfile
7
8 with shelve.open(filename) as db:
9 db['spam'] = {'eggs': 'ham'}
10 11 with shelve.open(filename) as db: 12 print(db['spam'])
1 subprocess.call(["/bin/ls", "-l"]) 2 subprocess.call(["/bin/ls", "-l"]) #noqa 3 subprocess.call(["/bin/ls", "-l"]) # noqa
1 subprocess.call(["/bin/ls", "-l"]) 2 subprocess.call(["/bin/ls", "-l"]) #noqa 3 subprocess.call(["/bin/ls", "-l"]) # noqa
2 subprocess.call(["/bin/ls", "-l"]) #noqa 3 subprocess.call(["/bin/ls", "-l"]) # noqa 4 subprocess.call(["/bin/ls", "-l"]) # nosec
4 subprocess.call(["/bin/ls", "-l"]) # nosec 5 subprocess.call(["/bin/ls", "-l"]) 6 subprocess.call(["/bin/ls", "-l"]) #nosec
6 subprocess.call(["/bin/ls", "-l"]) #nosec 7 subprocess.call(["/bin/ls", "-l"])
3 # SHOULD FAIL
4 a = CommunityData('public', mpModel=0)
5 # SHOULD FAIL
5 # SHOULD FAIL
6 insecure = UsmUserData("securityName")
7 # SHOULD FAIL
7 # SHOULD FAIL
8 auth_no_priv = UsmUserData("securityName","authName")
9 # SHOULD PASS
3 # bad 4 query = """SELECT * 5 FROM foo WHERE id = '%s'""" % identifier 6 query = """INSERT INTO foo
5 FROM foo WHERE id = '%s'""" % identifier
6 query = """INSERT INTO foo
7 VALUES ('a', 'b', '%s')""" % value
8 query = """DELETE FROM foo
7 VALUES ('a', 'b', '%s')""" % value
8 query = """DELETE FROM foo
9 WHERE id = '%s'""" % identifier
10 query = """UPDATE foo
9 WHERE id = '%s'""" % identifier 10 query = """UPDATE foo 11 SET value = 'b' 12 WHERE id = '%s'""" % identifier 13 query = """WITH cte AS (SELECT x FROM foo)
12 WHERE id = '%s'""" % identifier 13 query = """WITH cte AS (SELECT x FROM foo) 14 SELECT x FROM cte WHERE x = '%s'""" % identifier 15 # bad alternate forms
15 # bad alternate forms 16 query = """SELECT * 17 FROM foo 18 WHERE id = '""" + identifier + "'" 19 query = """SELECT *
18 WHERE id = '""" + identifier + "'"
19 query = """SELECT *
20 FROM foo
21 WHERE id = '{}'""".format(identifier)
22
22
23 query = f"""
24 SELECT *
25 FROM foo
26 WHERE id = {identifier}
27 """
28
29 # bad
30 cur.execute("""SELECT *
31 FROM foo
32 WHERE id = '%s'""" % identifier)
33 cur.execute("""INSERT INTO foo
32 WHERE id = '%s'""" % identifier)
33 cur.execute("""INSERT INTO foo
34 VALUES ('a', 'b', '%s')""" % value)
35 cur.execute("""DELETE FROM foo
34 VALUES ('a', 'b', '%s')""" % value)
35 cur.execute("""DELETE FROM foo
36 WHERE id = '%s'""" % identifier)
37 cur.execute("""UPDATE foo
36 WHERE id = '%s'""" % identifier)
37 cur.execute("""UPDATE foo
38 SET value = 'b'
39 WHERE id = '%s'""" % identifier)
40 # bad alternate forms
40 # bad alternate forms
41 cur.execute("""SELECT *
42 FROM foo
43 WHERE id = '""" + identifier + "'")
44 cur.execute("""SELECT *
43 WHERE id = '""" + identifier + "'")
44 cur.execute("""SELECT *
45 FROM foo
46 WHERE id = '{}'""".format(identifier))
47
48 # bad with f-string
49 query = f"""
50 SELECT *
51 FROM foo
52 WHERE id = {identifier}
53 """
54 query = f"""
53 """
54 query = f"""
55 SELECT *
56 FROM foo
57 WHERE id = {identifier}
58 """
59
59
60 query = f"""
61 SELECT *
62 FROM foo
63 WHERE id = {identifier}"""
64 query = f"""
63 WHERE id = {identifier}"""
64 query = f"""
65 SELECT *
66 FROM foo
67 WHERE id = {identifier}"""
68
68
69 cur.execute(f"""
70 SELECT
71 {column_name}
72 FROM foo
73 WHERE id = 1""")
74
74
75 cur.execute(f"""
76 SELECT
77 {a + b}
78 FROM foo
79 WHERE id = 1""")
80
80
81 cur.execute(f"""
82 INSERT INTO
83 {table_name}
84 VALUES (1)""")
85 cur.execute(f"""
84 VALUES (1)""")
85 cur.execute(f"""
86 UPDATE {table_name}
87 SET id = 1""")
88
89 # implicit concatenation mixed with f-strings
90 cur.execute("SELECT "
91 f"{column_name} "
92 "FROM foo "
93 "WHERE id = 1"
94 )
94 )
95 cur.execute("INSERT INTO "
96 f"{table_name} "
97 "VALUES (1)")
98 cur.execute(f"UPDATE {table_name} "
97 "VALUES (1)")
98 cur.execute(f"UPDATE {table_name} "
99 "SET id = 1")
100
121
122 a()("""SELECT %s
123 FROM foo""" % val)
124
3 # bad
4 query = "SELECT * FROM foo WHERE id = '%s'" % identifier
5 query = "INSERT INTO foo VALUES ('a', 'b', '%s')" % value
4 query = "SELECT * FROM foo WHERE id = '%s'" % identifier
5 query = "INSERT INTO foo VALUES ('a', 'b', '%s')" % value
6 query = "INSERT INTO foo VALUES('a', 'b', '%s')" % value
5 query = "INSERT INTO foo VALUES ('a', 'b', '%s')" % value
6 query = "INSERT INTO foo VALUES('a', 'b', '%s')" % value
7 query = "DELETE FROM foo WHERE id = '%s'" % identifier
6 query = "INSERT INTO foo VALUES('a', 'b', '%s')" % value
7 query = "DELETE FROM foo WHERE id = '%s'" % identifier
8 query = "UPDATE foo SET value = 'b' WHERE id = '%s'" % identifier
7 query = "DELETE FROM foo WHERE id = '%s'" % identifier 8 query = "UPDATE foo SET value = 'b' WHERE id = '%s'" % identifier 9 query = """WITH cte AS (SELECT x FROM foo)
8 query = "UPDATE foo SET value = 'b' WHERE id = '%s'" % identifier 9 query = """WITH cte AS (SELECT x FROM foo) 10 SELECT x FROM cte WHERE x = '%s'""" % identifier 11 # bad alternate forms
11 # bad alternate forms
12 query = "SELECT * FROM foo WHERE id = '" + identifier + "'"
13 query = "SELECT * FROM foo WHERE id = '{}'".format(identifier)
12 query = "SELECT * FROM foo WHERE id = '" + identifier + "'"
13 query = "SELECT * FROM foo WHERE id = '{}'".format(identifier)
14 query = "SELECT * FROM foo WHERE id = '[VALUE]'".replace("[VALUE]", identifier)
13 query = "SELECT * FROM foo WHERE id = '{}'".format(identifier)
14 query = "SELECT * FROM foo WHERE id = '[VALUE]'".replace("[VALUE]", identifier)
15
16 # bad
17 cur.execute("SELECT * FROM foo WHERE id = '%s'" % identifier)
18 cur.execute("INSERT INTO foo VALUES ('a', 'b', '%s')" % value)
17 cur.execute("SELECT * FROM foo WHERE id = '%s'" % identifier)
18 cur.execute("INSERT INTO foo VALUES ('a', 'b', '%s')" % value)
19 cur.execute("INSERT INTO foo VALUES('a', 'b', '%s')" % value)
18 cur.execute("INSERT INTO foo VALUES ('a', 'b', '%s')" % value)
19 cur.execute("INSERT INTO foo VALUES('a', 'b', '%s')" % value)
20 cur.execute("DELETE FROM foo WHERE id = '%s'" % identifier)
19 cur.execute("INSERT INTO foo VALUES('a', 'b', '%s')" % value)
20 cur.execute("DELETE FROM foo WHERE id = '%s'" % identifier)
21 cur.execute("UPDATE foo SET value = 'b' WHERE id = '%s'" % identifier)
20 cur.execute("DELETE FROM foo WHERE id = '%s'" % identifier)
21 cur.execute("UPDATE foo SET value = 'b' WHERE id = '%s'" % identifier)
22 # bad alternate forms
22 # bad alternate forms
23 cur.execute("SELECT * FROM foo WHERE id = '" + identifier + "'")
24 cur.execute("SELECT * FROM foo WHERE id = '{}'".format(identifier))
23 cur.execute("SELECT * FROM foo WHERE id = '" + identifier + "'")
24 cur.execute("SELECT * FROM foo WHERE id = '{}'".format(identifier))
25 cur.execute("SELECT * FROM foo WHERE id = '[VALUE]'".replace("[VALUE]", identifier))
24 cur.execute("SELECT * FROM foo WHERE id = '{}'".format(identifier))
25 cur.execute("SELECT * FROM foo WHERE id = '[VALUE]'".replace("[VALUE]", identifier))
26
27 # bad f-strings
28 cur.execute(f"SELECT {column_name} FROM foo WHERE id = 1")
29 cur.execute(f"SELECT {a + b} FROM foo WHERE id = 1")
28 cur.execute(f"SELECT {column_name} FROM foo WHERE id = 1")
29 cur.execute(f"SELECT {a + b} FROM foo WHERE id = 1")
30 cur.execute(f"INSERT INTO {table_name} VALUES (1)")
29 cur.execute(f"SELECT {a + b} FROM foo WHERE id = 1")
30 cur.execute(f"INSERT INTO {table_name} VALUES (1)")
31 cur.execute(f"INSERT INTO {table_name} VALUES(1)")
30 cur.execute(f"INSERT INTO {table_name} VALUES (1)")
31 cur.execute(f"INSERT INTO {table_name} VALUES(1)")
32 cur.execute(f"UPDATE {table_name} SET id = 1")
31 cur.execute(f"INSERT INTO {table_name} VALUES(1)")
32 cur.execute(f"UPDATE {table_name} SET id = 1")
33
46
47 a()("SELECT %s FROM foo" % val)
48
3 4 ssl.wrap_socket(ssl_version=ssl.PROTOCOL_SSLv2) 5 SSL.Context(method=SSL.SSLv2_METHOD)
4 ssl.wrap_socket(ssl_version=ssl.PROTOCOL_SSLv2) 5 SSL.Context(method=SSL.SSLv2_METHOD) 6 SSL.Context(method=SSL.SSLv23_METHOD)
5 SSL.Context(method=SSL.SSLv2_METHOD) 6 SSL.Context(method=SSL.SSLv23_METHOD) 7
7 8 herp_derp(ssl_version=ssl.PROTOCOL_SSLv2) 9 herp_derp(method=SSL.SSLv2_METHOD)
8 herp_derp(ssl_version=ssl.PROTOCOL_SSLv2) 9 herp_derp(method=SSL.SSLv2_METHOD) 10 herp_derp(method=SSL.SSLv23_METHOD)
9 herp_derp(method=SSL.SSLv2_METHOD) 10 herp_derp(method=SSL.SSLv23_METHOD) 11
12 # strict tests 13 ssl.wrap_socket(ssl_version=ssl.PROTOCOL_SSLv3) 14 ssl.wrap_socket(ssl_version=ssl.PROTOCOL_TLSv1)
13 ssl.wrap_socket(ssl_version=ssl.PROTOCOL_SSLv3) 14 ssl.wrap_socket(ssl_version=ssl.PROTOCOL_TLSv1) 15 SSL.Context(method=SSL.SSLv3_METHOD)
14 ssl.wrap_socket(ssl_version=ssl.PROTOCOL_TLSv1) 15 SSL.Context(method=SSL.SSLv3_METHOD) 16 SSL.Context(method=SSL.TLSv1_METHOD)
15 SSL.Context(method=SSL.SSLv3_METHOD) 16 SSL.Context(method=SSL.TLSv1_METHOD) 17
17 18 herp_derp(ssl_version=ssl.PROTOCOL_SSLv3) 19 herp_derp(ssl_version=ssl.PROTOCOL_TLSv1)
18 herp_derp(ssl_version=ssl.PROTOCOL_SSLv3) 19 herp_derp(ssl_version=ssl.PROTOCOL_TLSv1) 20 herp_derp(method=SSL.SSLv3_METHOD)
19 herp_derp(ssl_version=ssl.PROTOCOL_TLSv1) 20 herp_derp(method=SSL.SSLv3_METHOD) 21 herp_derp(method=SSL.TLSv1_METHOD)
20 herp_derp(method=SSL.SSLv3_METHOD) 21 herp_derp(method=SSL.TLSv1_METHOD) 22
22 23 ssl.wrap_socket(ssl_version=ssl.PROTOCOL_TLSv1_1) 24 SSL.Context(method=SSL.TLSv1_1_METHOD)
23 ssl.wrap_socket(ssl_version=ssl.PROTOCOL_TLSv1_1) 24 SSL.Context(method=SSL.TLSv1_1_METHOD) 25
25 26 herp_derp(ssl_version=ssl.PROTOCOL_TLSv1_1) 27 herp_derp(method=SSL.TLSv1_1_METHOD)
26 herp_derp(ssl_version=ssl.PROTOCOL_TLSv1_1) 27 herp_derp(method=SSL.TLSv1_1_METHOD) 28
29 30 ssl.wrap_socket() 31
31 32 def open_ssl_socket(version=ssl.PROTOCOL_SSLv2): 33 pass 34
34 35 def open_ssl_socket(version=SSL.SSLv2_METHOD): 36 pass 37
37 38 def open_ssl_socket(version=SSL.SSLv23_METHOD): 39 pass 40
40 41 def open_ssl_socket(version=SSL.TLSv1_1_METHOD): 42 pass 43
1 import subprocess 2 from subprocess import Popen as pop 3
1 import subprocess 2 from subprocess import Popen as pop 3
10
11 pop('/bin/gcc --version', shell=True)
12 Popen('/bin/gcc --version', shell=True)
11 pop('/bin/gcc --version', shell=True)
12 Popen('/bin/gcc --version', shell=True)
13
13
14 subprocess.Popen('/bin/gcc --version', shell=True)
15 subprocess.Popen(['/bin/gcc', '--version'], shell=False)
14 subprocess.Popen('/bin/gcc --version', shell=True)
15 subprocess.Popen(['/bin/gcc', '--version'], shell=False)
16 subprocess.Popen(['/bin/gcc', '--version'])
15 subprocess.Popen(['/bin/gcc', '--version'], shell=False) 16 subprocess.Popen(['/bin/gcc', '--version']) 17
17
18 subprocess.call(["/bin/ls",
19 "-l"
20 ])
21 subprocess.call('/bin/ls -l', shell=True)
20 ])
21 subprocess.call('/bin/ls -l', shell=True)
22
22
23 subprocess.check_call(['/bin/ls', '-l'], shell=False)
24 subprocess.check_call('/bin/ls -l', shell=True)
23 subprocess.check_call(['/bin/ls', '-l'], shell=False)
24 subprocess.check_call('/bin/ls -l', shell=True)
25
25
26 subprocess.check_output(['/bin/ls', '-l'])
27 subprocess.check_output('/bin/ls -l', shell=True)
26 subprocess.check_output(['/bin/ls', '-l'])
27 subprocess.check_output('/bin/ls -l', shell=True)
28 subprocess.check_output([], stdout=None)
27 subprocess.check_output('/bin/ls -l', shell=True)
28 subprocess.check_output([], stdout=None)
29
29
30 subprocess.getoutput('/bin/ls -l')
31 subprocess.getstatusoutput('/bin/ls -l')
30 subprocess.getoutput('/bin/ls -l')
31 subprocess.getstatusoutput('/bin/ls -l')
32
32
33 subprocess.run(['/bin/ls', '-l'])
34 subprocess.run('/bin/ls -l', shell=True)
33 subprocess.run(['/bin/ls', '-l'])
34 subprocess.run('/bin/ls -l', shell=True)
35
35
36 subprocess.Popen('/bin/ls *', shell=True)
37 subprocess.Popen('/bin/ls %s' % ('something',), shell=True)
36 subprocess.Popen('/bin/ls *', shell=True)
37 subprocess.Popen('/bin/ls %s' % ('something',), shell=True)
38 subprocess.Popen('/bin/ls {}'.format('something'), shell=True)
37 subprocess.Popen('/bin/ls %s' % ('something',), shell=True)
38 subprocess.Popen('/bin/ls {}'.format('something'), shell=True)
39
40 command = "/bin/ls" + unknown_function() 41 subprocess.Popen(command, shell=True) 42
42
43 subprocess.Popen('/bin/ls && cat /etc/passwd', shell=True)
44
45 command = 'pwd' 46 subprocess.call(command, shell='True') 47 subprocess.call(command, shell='False')
46 subprocess.call(command, shell='True') 47 subprocess.call(command, shell='False') 48 subprocess.call(command, shell='None')
47 subprocess.call(command, shell='False') 48 subprocess.call(command, shell='None') 49 subprocess.call(command, shell=1)
48 subprocess.call(command, shell='None') 49 subprocess.call(command, shell=1) 50
50 51 subprocess.call(command, shell=Popen()) 52 subprocess.call(command, shell=[True])
51 subprocess.call(command, shell=Popen())
52 subprocess.call(command, shell=[True])
53 subprocess.call(command, shell={'IS': 'True'})
52 subprocess.call(command, shell=[True])
53 subprocess.call(command, shell={'IS': 'True'})
54 subprocess.call(command, shell=command)
53 subprocess.call(command, shell={'IS': 'True'})
54 subprocess.call(command, shell=command)
55
55 56 subprocess.call(command, shell=False) 57 subprocess.call(command, shell=0)
56 subprocess.call(command, shell=False) 57 subprocess.call(command, shell=0) 58 subprocess.call(command, shell=[])
57 subprocess.call(command, shell=0)
58 subprocess.call(command, shell=[])
59 subprocess.call(command, shell={})
58 subprocess.call(command, shell=[])
59 subprocess.call(command, shell={})
60 subprocess.call(command, shell=None)
59 subprocess.call(command, shell={})
60 subprocess.call(command, shell=None)
7 tar = tarfile.open(filename) 8 tar.extractall(path=tempfile.mkdtemp()) 9 tar.close()
13 tar = tarfile.open(filename) 14 tar.extractall(path=tempfile.mkdtemp(), members=members_filter(tar)) 15 tar.close()
25 tar = tarfile.open(filename) 26 tar.extractall(path=tempfile.mkdtemp(), filter="fully_trusted") 27 tar.close()
31 tar = tarfile.open(filename) 32 tar.extractall(path=tempfile.mkdtemp(), members=[]) 33 tar.close()
37 tar = tarfile.open(filename) 38 tarfile.extractall(path=tempfile.mkdtemp(), members=tar) 39 tar.close()
1 import telnetlib 2 import getpass 3
7 password = getpass.getpass() 8 tn = telnetlib.Telnet(host) 9
3 access_level = "user"
4 if access_level != 'none': # Check if admin ' and access_level != 'user
5 print("You are an admin.\n")
4 a = i 5 except: 6 continue 7
12 a = 1 13 except Exception: 14 continue 15
3 a = 1 4 except: 5 pass 6
10 a = 1 11 except Exception: 12 pass 13
6 # Incorrect: unverified context 7 context = ssl._create_unverified_context()
16 # Python 3
17 urllib.request.urlopen('file:///bin/ls')
18 urllib.request.urlretrieve('file:///bin/ls', '/bin/ls2')
17 urllib.request.urlopen('file:///bin/ls')
18 urllib.request.urlretrieve('file:///bin/ls', '/bin/ls2')
19 opener = urllib.request.URLopener()
18 urllib.request.urlretrieve('file:///bin/ls', '/bin/ls2')
19 opener = urllib.request.URLopener()
20 opener.open('file:///bin/ls')
21 opener.retrieve('file:///bin/ls')
22 opener = urllib.request.FancyURLopener()
23 opener.open('file:///bin/ls')
26 # Six
27 six.moves.urllib.request.urlopen('file:///bin/ls')
28 six.moves.urllib.request.urlretrieve('file:///bin/ls', '/bin/ls2')
27 six.moves.urllib.request.urlopen('file:///bin/ls')
28 six.moves.urllib.request.urlretrieve('file:///bin/ls', '/bin/ls2')
29 opener = six.moves.urllib.request.URLopener()
28 six.moves.urllib.request.urlretrieve('file:///bin/ls', '/bin/ls2')
29 opener = six.moves.urllib.request.URLopener()
30 opener.open('file:///bin/ls')
31 opener.retrieve('file:///bin/ls')
32 opener = six.moves.urllib.request.FancyURLopener()
33 opener.open('file:///bin/ls')
4 from cryptography.hazmat.primitives.asymmetric import rsa 5 from Crypto.PublicKey import DSA as pycrypto_dsa 6 from Crypto.PublicKey import RSA as pycrypto_rsa
5 from Crypto.PublicKey import DSA as pycrypto_dsa 6 from Crypto.PublicKey import RSA as pycrypto_rsa 7 from Cryptodome.PublicKey import DSA as pycryptodomex_dsa
37 # Incorrect: weak key sizes 38 dsa.generate_private_key(key_size=1024, 39 backend=backends.default_backend()) 40 ec.generate_private_key(curve=ec.SECT163R2,
39 backend=backends.default_backend()) 40 ec.generate_private_key(curve=ec.SECT163R2, 41 backend=backends.default_backend()) 42 rsa.generate_private_key(public_exponent=65537,
41 backend=backends.default_backend()) 42 rsa.generate_private_key(public_exponent=65537, 43 key_size=1024, 44 backend=backends.default_backend()) 45 pycrypto_dsa.generate(bits=1024)
44 backend=backends.default_backend()) 45 pycrypto_dsa.generate(bits=1024) 46 pycrypto_rsa.generate(bits=1024)
45 pycrypto_dsa.generate(bits=1024) 46 pycrypto_rsa.generate(bits=1024) 47 pycryptodomex_dsa.generate(bits=1024)
46 pycrypto_rsa.generate(bits=1024) 47 pycryptodomex_dsa.generate(bits=1024) 48 pycryptodomex_rsa.generate(bits=1024)
47 pycryptodomex_dsa.generate(bits=1024) 48 pycryptodomex_rsa.generate(bits=1024) 49
50 # Also incorrect: without keyword args 51 dsa.generate_private_key(512, 52 backends.default_backend()) 53 ec.generate_private_key(ec.SECT163R2,
52 backends.default_backend()) 53 ec.generate_private_key(ec.SECT163R2, 54 backends.default_backend()) 55 rsa.generate_private_key(3,
54 backends.default_backend()) 55 rsa.generate_private_key(3, 56 512, 57 backends.default_backend()) 58 pycrypto_dsa.generate(512)
57 backends.default_backend()) 58 pycrypto_dsa.generate(512) 59 pycrypto_rsa.generate(512)
58 pycrypto_dsa.generate(512) 59 pycrypto_rsa.generate(512) 60 pycryptodomex_dsa.generate(512)
59 pycrypto_rsa.generate(512) 60 pycryptodomex_dsa.generate(512) 61 pycryptodomex_rsa.generate(512)
60 pycryptodomex_dsa.generate(512) 61 pycryptodomex_rsa.generate(512) 62
1 import os as o 2 import subprocess as subp 3
4 # Vulnerable to wildcard injection
5 o.system("/bin/tar xvzf *")
6 o.system('/bin/chown *')
4 # Vulnerable to wildcard injection
5 o.system("/bin/tar xvzf *")
6 o.system('/bin/chown *')
5 o.system("/bin/tar xvzf *")
6 o.system('/bin/chown *')
7 o.popen2('/bin/chmod *')
5 o.system("/bin/tar xvzf *")
6 o.system('/bin/chown *')
7 o.popen2('/bin/chmod *')
6 o.system('/bin/chown *')
7 o.popen2('/bin/chmod *')
8 subp.Popen('/bin/chown *', shell=True)
6 o.system('/bin/chown *')
7 o.popen2('/bin/chmod *')
8 subp.Popen('/bin/chown *', shell=True)
7 o.popen2('/bin/chmod *')
8 subp.Popen('/bin/chown *', shell=True)
9
7 o.popen2('/bin/chmod *')
8 subp.Popen('/bin/chown *', shell=True)
9
10 # Not vulnerable to wildcard injection
11 subp.Popen('/bin/rsync *')
12 subp.Popen("/bin/chmod *")
11 subp.Popen('/bin/rsync *')
12 subp.Popen("/bin/chmod *")
13 subp.Popen(['/bin/chown', '*'])
12 subp.Popen("/bin/chmod *")
13 subp.Popen(['/bin/chown', '*'])
14 subp.Popen(["/bin/chmod", sys.argv[1], "*"],
13 subp.Popen(['/bin/chown', '*']) 14 subp.Popen(["/bin/chmod", sys.argv[1], "*"], 15 stdin=subprocess.PIPE, stdout=subprocess.PIPE) 16 o.spawnvp(os.P_WAIT, 'tar', ['tar', 'xvzf', '*'])
15 stdin=subprocess.PIPE, stdout=subprocess.PIPE) 16 o.spawnvp(os.P_WAIT, 'tar', ['tar', 'xvzf', '*'])
1 import xml.etree.cElementTree as badET 2 import defusedxml.cElementTree as goodET 3
6 # unsafe 7 tree = badET.fromstring(xmlString) 8 print(tree)
8 print(tree)
9 badET.parse('filethatdoesntexist.xml')
10 badET.iterparse('filethatdoesntexist.xml')
9 badET.parse('filethatdoesntexist.xml')
10 badET.iterparse('filethatdoesntexist.xml')
11 a = badET.XMLParser()
10 badET.iterparse('filethatdoesntexist.xml')
11 a = badET.XMLParser()
12
1 import xml.etree.ElementTree as badET 2 import defusedxml.ElementTree as goodET 3
6 # unsafe 7 tree = badET.fromstring(xmlString) 8 print(tree)
8 print(tree)
9 badET.parse('filethatdoesntexist.xml')
10 badET.iterparse('filethatdoesntexist.xml')
9 badET.parse('filethatdoesntexist.xml')
10 badET.iterparse('filethatdoesntexist.xml')
11 a = badET.XMLParser()
10 badET.iterparse('filethatdoesntexist.xml')
11 a = badET.XMLParser()
12
1 import xml.dom.expatbuilder as bad 2 import defusedxml.expatbuilder as good 3
3
4 bad.parse('filethatdoesntexist.xml')
5 good.parse('filethatdoesntexist.xml')
8 9 bad.parseString(xmlString) 10 good.parseString(xmlString)
1 import xml.sax.expatreader as bad 2 import defusedxml.expatreader as good 3
3 4 p = bad.create_parser() 5 b = good.create_parser()
1 from xml.dom.minidom import parseString as badParseString
2 from defusedxml.minidom import parseString as goodParseString
3 a = badParseString("<myxml>Some data some more data</myxml>")
2 from defusedxml.minidom import parseString as goodParseString
3 a = badParseString("<myxml>Some data some more data</myxml>")
4 print(a)
8 9 from xml.dom.minidom import parse as badParse 10 from defusedxml.minidom import parse as goodParse
10 from defusedxml.minidom import parse as goodParse
11 a = badParse("somfilethatdoesntexist.xml")
12 print(a)
1 from xml.dom.pulldom import parseString as badParseString
2 from defusedxml.pulldom import parseString as goodParseString
3 a = badParseString("<myxml>Some data some more data</myxml>")
2 from defusedxml.pulldom import parseString as goodParseString
3 a = badParseString("<myxml>Some data some more data</myxml>")
4 print(a)
8 9 from xml.dom.pulldom import parse as badParse 10 from defusedxml.pulldom import parse as goodParse
10 from defusedxml.pulldom import parse as goodParse
11 a = badParse("somfilethatdoesntexist.xml")
12 print(a)
1 import xml.sax 2 from xml import sax 3 import defusedxml.sax
1 import xml.sax 2 from xml import sax 3 import defusedxml.sax
20 # bad
21 xml.sax.parseString(xmlString, ExampleContentHandler())
22 xml.sax.parse('notaxmlfilethatexists.xml', ExampleContentHandler())
21 xml.sax.parseString(xmlString, ExampleContentHandler())
22 xml.sax.parse('notaxmlfilethatexists.xml', ExampleContentHandler())
23 sax.parseString(xmlString, ExampleContentHandler())
22 xml.sax.parse('notaxmlfilethatexists.xml', ExampleContentHandler())
23 sax.parseString(xmlString, ExampleContentHandler())
24 sax.parse('notaxmlfilethatexists.xml', ExampleContentHandler)
23 sax.parseString(xmlString, ExampleContentHandler())
24 sax.parse('notaxmlfilethatexists.xml', ExampleContentHandler)
25
29 # bad 30 xml.sax.make_parser() 31 sax.make_parser()
30 xml.sax.make_parser()
31 sax.make_parser()
32 print('nothing')
1 import xmlrpc 2 from SimpleXMLRPCServer import SimpleXMLRPCServer 3
8 ystr = yaml.dump({'a': 1, 'b': 2, 'c': 3})
9 y = yaml.load(ystr)
10 yaml.dump(y)
21
22 yaml.load("{}", Loader=yaml.Loader)
23