← Back to branch summary

~ubuntu-branches/debian/sid/bandit/sid

« back to all changes in this revision

Viewing changes to bandit/plugins/injection_wildcard.py

  • Committer: Package Import Robot
  • Author(s): Dave Walker (Daviey)
  • Date: 2015-07-22 09:01:39 UTC
  • Revision ID: package-import@ubuntu.com-20150722090139-fl0nluy0x8m9ctx4
Tags: upstream-0.12.0
Import upstream version 0.12.0

Show diffs side-by-side

added added

removed removed

Lines of Context:
bandit/plugins/injection_wildcard.py
 
1
# -*- coding:utf-8 -*-
 
2
#
 
3
# Copyright 2014 Hewlett-Packard Development Company, L.P.
 
4
#
 
5
# Licensed under the Apache License, Version 2.0 (the "License"); you may
 
6
# not use this file except in compliance with the License. You may obtain
 
7
# a copy of the License at
 
8
#
 
9
#      http://www.apache.org/licenses/LICENSE-2.0
 
10
#
 
11
# Unless required by applicable law or agreed to in writing, software
 
12
# distributed under the License is distributed on an "AS IS" BASIS, WITHOUT
 
13
# WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. See the
 
14
# License for the specific language governing permissions and limitations
 
15
# under the License.
 
16
 
 
17
import bandit
 
18
from bandit.core.test_properties import *
 
19
 
 
20
 
 
21
@takes_config('shell_injection')
 
22
@checks('Call')
 
23
def linux_commands_wildcard_injection(context, config):
 
24
    if not ('shell' in config and 'subprocess' in config):
 
25
        return
 
26
 
 
27
    vulnerable_funcs = ['chown', 'chmod', 'tar', 'rsync']
 
28
    if context.call_function_name_qual in config['shell'] or (
 
29
            context.call_function_name_qual in config['subprocess'] and
 
30
            context.check_call_arg_value('shell', 'True')):
 
31
        if context.call_args_count >= 1:
 
32
            call_argument = context.get_call_arg_at_position(0)
 
33
            argument_string = ''
 
34
            if isinstance(call_argument, list):
 
35
                for li in call_argument:
 
36
                    argument_string = argument_string + ' %s' % li
 
37
            elif isinstance(call_argument, str):
 
38
                argument_string = call_argument
 
39
 
 
40
            if argument_string != '':
 
41
                for vulnerable_func in vulnerable_funcs:
 
42
                    if(
 
43
                            vulnerable_func in argument_string and
 
44
                            '*' in argument_string
 
45
                    ):
 
46
                        return bandit.Issue(
 
47
                            severity=bandit.HIGH,
 
48
                            confidence=bandit.MEDIUM,
 
49
                            text="Possible wildcard injection in call: %s" %
 
50
                                 context.call_function_name_qual
 
51
                        )