File: bandit.yaml

package info (click to toggle)
nova 2:13.1.0-2~bpo8+1
  • links: PTS, VCS
  • area: main
  • in suites: jessie-backports
  • size: 31,120 kB
  • sloc: python: 301,406; sh: 1,298; xml: 1,184; makefile: 129; sql: 43
file content (129 lines) | stat: -rw-r--r-- 5,005 bytes parent folder | download | duplicates (2)
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
# optional: after how many files to update progress
#show_progress_every: 100

# optional: plugins directory name
#plugins_dir: 'plugins'

# optional: plugins discovery name pattern
plugin_name_pattern: '*.py'

# optional: terminal escape sequences to display colors
#output_colors:
#    DEFAULT: '\033[0m'
#    HEADER: '\033[95m'
#    LOW: '\033[94m'
#    MEDIUM: '\033[93m'
#    HIGH: '\033[91m'

# optional: log format string
#log_format: "[%(module)s]\t%(levelname)s\t%(message)s"

# globs of files which should be analyzed
include:
    - '*.py'

# a list of strings, which if found in the path will cause files to be excluded
# for example /tests/ - to remove all all files in tests directory
exclude_dirs:
       - '/tests/'

profiles:
    XSS:
        include:
            - jinja2_autoescape_false
            - use_of_mako_templates

    ShellInjection:
        include:
            - subprocess_popen_with_shell_equals_true
            - subprocess_without_shell_equals_true
            - any_other_function_with_shell_equals_true
            - start_process_with_a_shell
            - start_process_with_no_shell
        exclude:

    SqlInjection:
        include:
            - hardcoded_sql_expressions

blacklist_calls:
    bad_name_sets:
        - pickle:
            qualnames: [pickle.loads, pickle.load, pickle.Unpickler,
                        cPickle.loads, cPickle.load, cPickle.Unpickler]
            message: "Pickle library appears to be in use, possible security issue."
        - marshal:
            qualnames: [marshal.load, marshal.loads]
            message: "Deserialization with the marshal module is possibly dangerous."
        - md5:
            qualnames: [hashlib.md5]
            message: "Use of insecure MD5 hash function."
        - mktemp_q:
            qualnames: [tempfile.mktemp]
            message: "Use of insecure and deprecated function (mktemp)."
        - eval:
            qualnames: [eval]
            message: "Use of possibly insecure function - consider using safer ast.literal_eval."
        - mark_safe:
            names: [mark_safe]
            message: "Use of mark_safe() may expose cross-site scripting vulnerabilities and should be reviewed."
        - httpsconnection:
            qualnames: [httplib.HTTPSConnection]
            message: "Use of HTTPSConnection does not provide security, see https://wiki.openstack.org/wiki/OSSN/OSSN-0033"
        - yaml_load:
            qualnames: [yaml.load]
            message: "Use of unsafe yaml load. Allows instantiation of arbitrary objects. Consider yaml.safe_load()."
        - urllib_urlopen:
            qualnames: [urllib.urlopen, urllib.urlretrieve, urllib.URLopener, urllib.FancyURLopener, urllib2.urlopen, urllib2.Request]
            message: "Audit url open for permitted schemes. Allowing use of file:/ or custom schemes is often unexpected."
        - paramiko_injection:
            qualnames: [paramiko.exec_command, paramiko.invoke_shell]
            message: "Paramiko exec_command() and invoke_shell() usage may expose command injection vulnerabilities and should be reviewed."

shell_injection:
    # Start a process using the subprocess module, or one of its wrappers.
    subprocess: [subprocess.Popen, subprocess.call, subprocess.check_call,
                 subprocess.check_output, utils.execute, utils.execute_with_timeout]
    # Start a process with a function vulnerable to shell injection.
    shell: [os.system, os.popen, os.popen2, os.popen3, os.popen4,
            popen2.popen2, popen2.popen3, popen2.popen4, popen2.Popen3,
            popen2.Popen4, commands.getoutput, commands.getstatusoutput]
    # Start a process with a function that is not vulnerable to shell injection.
    no_shell: [os.execl, os.execle, os.execlp, os.execlpe, os.execv,os.execve,
               os.execvp, os.execvpe, os.spawnl, os.spawnle, os.spawnlp,
               os.spawnlpe, os.spawnv, os.spawnve, os.spawnvp, os.spawnvpe,
               os.startfile]

blacklist_imports:
    bad_import_sets:
        - telnet:
            imports: [telnetlib]
            level: HIGH
            message: "Telnet is considered insecure. Use SSH or some other encrypted protocol."
        - info_libs:
            imports: [pickle, cPickle, subprocess, Crypto]
            level: LOW
            message: "Consider possible security implications associated with {module} module."

hardcoded_password:
    word_list: "wordlist/default-passwords"

ssl_with_bad_version:
    bad_protocol_versions:
        - 'PROTOCOL_SSLv2'
        - 'SSLv2_METHOD'
        - 'SSLv23_METHOD'
        - 'PROTOCOL_SSLv3'  # strict option
        - 'PROTOCOL_TLSv1'  # strict option
        - 'SSLv3_METHOD'    # strict option
        - 'TLSv1_METHOD'    # strict option

password_config_option_not_marked_secret:
    function_names:
        - oslo.config.cfg.StrOpt
        - oslo_config.cfg.StrOpt

execute_with_run_as_root_equals_true:
    function_names:
        - nova.utils.execute
        - nova.utils.trycmd