~ubuntu-branches/ubuntu/wily/bandit/wily-proposed

« back to all changes in this revision

Viewing changes to bandit/plugins/general_bad_file_permissions.py

• browse files at revision 1
• compare with another revision
• download diff
• download tarball
• view history from revision 1

Show diffs side-by-side

added

removed

bandit/plugins/general_bad_file_permissions.py

 

1

# -*- coding:utf-8 -*-

 

2

#

 

3

# Copyright 2014 Hewlett-Packard Development Company, L.P.

 

4

#

 

5

# Licensed under the Apache License, Version 2.0 (the "License"); you may

 

6

# not use this file except in compliance with the License. You may obtain

 

7

# a copy of the License at

 

8

#

 

9

#      http://www.apache.org/licenses/LICENSE-2.0

 

10

#

 

11

# Unless required by applicable law or agreed to in writing, software

 

12

# distributed under the License is distributed on an "AS IS" BASIS, WITHOUT

 

13

# WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. See the

 

14

# License for the specific language governing permissions and limitations

 

15

# under the License.

 

16

 

 

17

import stat

 

18

 

 

19

import bandit

 

20

from bandit.core.test_properties import *

 

21

 

 

22

 

 

23

@checks('Call')

 

24

def set_bad_file_permissions(context):

 

25

    if 'chmod' in context.call_function_name:

 

26

        if context.call_args_count == 2:

 

27

            mode = context.get_call_arg_at_position(1)

 

28

 

 

29

            if (

 

30

                mode is not None and type(mode) == int and

 

31

                (mode & stat.S_IWOTH or mode & stat.S_IXGRP)

 

32

            ):

 

33

                # world writable is an HIGH, group executable is a MEDIUM

 

34

                if mode & stat.S_IWOTH:

 

35

                    sev_level = bandit.HIGH

 

36

                else:

 

37

                    sev_level = bandit.MEDIUM

 

38

 

 

39

                filename = context.get_call_arg_at_position(0)

 

40

                if filename is None:

 

41

                    filename = 'NOT PARSED'

 

42

                return bandit.Issue(

 

43

                    severity=sev_level,

 

44

                    confidence=bandit.HIGH,

 

45

                    text="Chmod setting a permissive mask %s on file (%s)." %

 

46

                         (oct(mode), filename)

 

47

                )

• Older »

Loggerhead is a web-based interface for Breezy
Version: 2.0.1