diff --git a/PR_11_csharp/compiled-codeql-dataset/.vscode/settings.json b/PR_11_csharp/compiled-codeql-dataset/.vscode/settings.json
new file mode 100644
index 0000000..6eea8ce
--- /dev/null
+++ b/PR_11_csharp/compiled-codeql-dataset/.vscode/settings.json
@@ -0,0 +1,3 @@
+{
+ "dotnet.defaultSolution": "codeql-dataset.sln"
+}
\ No newline at end of file
diff --git a/PR_11_csharp/compiled-codeql-dataset/codeql-dataset.csproj b/PR_11_csharp/compiled-codeql-dataset/codeql-dataset.csproj
new file mode 100644
index 0000000..283b4cb
--- /dev/null
+++ b/PR_11_csharp/compiled-codeql-dataset/codeql-dataset.csproj
@@ -0,0 +1,11 @@
+
+
+
+ Exe
+ net7.0
+ codeql_dataset
+ enable
+ enable
+
+
+
diff --git a/PR_11_csharp/compiled-codeql-dataset/codeql-dataset.sln b/PR_11_csharp/compiled-codeql-dataset/codeql-dataset.sln
new file mode 100644
index 0000000..938f93f
--- /dev/null
+++ b/PR_11_csharp/compiled-codeql-dataset/codeql-dataset.sln
@@ -0,0 +1,25 @@
+
+Microsoft Visual Studio Solution File, Format Version 12.00
+# Visual Studio Version 17
+VisualStudioVersion = 17.5.001.0
+MinimumVisualStudioVersion = 10.0.40219.1
+Project("{9A19103F-16F7-4668-BE54-9A1E7A4F7556}") = "codeql-dataset", "codeql-dataset.csproj", "{2725E48B-1276-4645-958B-DE0F4D278A5E}"
+EndProject
+Global
+ GlobalSection(SolutionConfigurationPlatforms) = preSolution
+ Debug|Any CPU = Debug|Any CPU
+ Release|Any CPU = Release|Any CPU
+ EndGlobalSection
+ GlobalSection(ProjectConfigurationPlatforms) = postSolution
+ {2725E48B-1276-4645-958B-DE0F4D278A5E}.Debug|Any CPU.ActiveCfg = Debug|Any CPU
+ {2725E48B-1276-4645-958B-DE0F4D278A5E}.Debug|Any CPU.Build.0 = Debug|Any CPU
+ {2725E48B-1276-4645-958B-DE0F4D278A5E}.Release|Any CPU.ActiveCfg = Release|Any CPU
+ {2725E48B-1276-4645-958B-DE0F4D278A5E}.Release|Any CPU.Build.0 = Release|Any CPU
+ EndGlobalSection
+ GlobalSection(SolutionProperties) = preSolution
+ HideSolutionNode = FALSE
+ EndGlobalSection
+ GlobalSection(ExtensibilityGlobals) = postSolution
+ SolutionGuid = {51B6C554-6C47-47F4-B13B-C4F0C937CA70}
+ EndGlobalSection
+EndGlobal
diff --git a/PR_11_csharp/compiled-codeql-dataset/codeql_csharp/AssemblyPathInjectionBad.cs b/PR_11_csharp/compiled-codeql-dataset/codeql_csharp/AssemblyPathInjectionBad.cs
new file mode 100644
index 0000000..6526d17
--- /dev/null
+++ b/PR_11_csharp/compiled-codeql-dataset/codeql_csharp/AssemblyPathInjectionBad.cs
@@ -0,0 +1,28 @@
+using System;
+using System.Web;
+using System.Reflection;
+
+public class AssemblyPathInjectionHandler : HttpHandler {
+ public void ProcessRequest(HttpContext ctx) {
+ string assemblyPath = (string)ctx.Request;
+
+ //{fact rule=assembly-path-injection@v1.0 defects=1}
+ // BAD: Load assembly based on user input
+ var badAssembly = Assembly.LoadFile(assemblyPath);
+
+ // Method called on loaded assembly. If the user can control the loaded assembly, then this
+ // could result in a remote code execution vulnerability
+ MethodInfo m = badAssembly.GetType("Config").GetMethod("GetCustomPath");
+ Object customPath = m.Invoke(null, null);
+ // ...
+ }
+ //{/fact}
+}
+
+public class HttpContext
+{
+ public static object? Current { get; internal set; }
+ public object? Request { get; internal set; }
+ public object? Response { get; internal set; }
+ public object? Session { get; internal set; }
+}
\ No newline at end of file
diff --git a/PR_11_csharp/compiled-codeql-dataset/codeql_csharp/AssemblyPathInjectionGood.cs b/PR_11_csharp/compiled-codeql-dataset/codeql_csharp/AssemblyPathInjectionGood.cs
new file mode 100644
index 0000000..618e7c9
--- /dev/null
+++ b/PR_11_csharp/compiled-codeql-dataset/codeql_csharp/AssemblyPathInjectionGood.cs
@@ -0,0 +1,25 @@
+using System;
+using System.Web;
+using System.Reflection;
+
+public class AssemblyPathInjectionHandler1 : IHttpHandler {
+ public void ProcessRequest(HttpContext ctx) {
+ string configType = (string)ctx.Request;
+
+ if (configType.Equals("configType1") || configType.Equals("configType2")) {
+ //{fact rule=assembly-path-injection@v1.0 defects=0}
+ // GOOD: Loaded assembly is one of the two known safe options
+ var safeAssembly = Assembly.LoadFile(@"C:\SafeLibraries\" + configType + ".dll");
+
+ // Code execution is limited to one of two known and vetted assemblies
+ MethodInfo m = safeAssembly.GetType("Config").GetMethod("GetCustomPath");
+ Object customPath = m.Invoke(null, null);
+ // ...
+ }
+ //{/fact}
+ }
+}
+
+public interface IHttpHandler
+{
+}
\ No newline at end of file
diff --git a/PR_11_csharp/compiled-codeql-dataset/codeql_csharp/CommandInjection.cs b/PR_11_csharp/compiled-codeql-dataset/codeql_csharp/CommandInjection.cs
new file mode 100644
index 0000000..5b68721
--- /dev/null
+++ b/PR_11_csharp/compiled-codeql-dataset/codeql_csharp/CommandInjection.cs
@@ -0,0 +1,14 @@
+using System;
+using System.Web;
+using System.Diagnostics;
+
+public class CommandInjectionHandler : IHttpHandler
+{
+ public void ProcessRequest(HttpContext ctx)
+ {
+ //{fact rule=os-command-injection@v1.0 defects=1}
+ string param = (string)ctx.Request;
+ Process.Start("process.exe", "/c " + param);
+ //{/fact}
+ }
+}
diff --git a/PR_11_csharp/compiled-codeql-dataset/codeql_csharp/CookieWithOverlyBroadDomain.cs b/PR_11_csharp/compiled-codeql-dataset/codeql_csharp/CookieWithOverlyBroadDomain.cs
new file mode 100644
index 0000000..2bff241
--- /dev/null
+++ b/PR_11_csharp/compiled-codeql-dataset/codeql_csharp/CookieWithOverlyBroadDomain.cs
@@ -0,0 +1,15 @@
+using System.Web;
+
+class CookieWithOverlyBroadDomain
+{
+ static public void AddCookie()
+ {
+ //{fact rule=incorrect-authentication-exploitation@v1.0 defects=1}
+ System.Web.HttpCookie cookie1 = new HttpCookie("sessionID");
+ cookie1.Domain = "online-bank.com";
+
+ HttpCookie cookie2 = new HttpCookie("sessionID");
+ cookie2.Domain = ".ebanking.online-bank.com";
+ //{/fact}
+ }
+}
diff --git a/PR_11_csharp/compiled-codeql-dataset/codeql_csharp/CookieWithOverlyBroadDomainFix.cs b/PR_11_csharp/compiled-codeql-dataset/codeql_csharp/CookieWithOverlyBroadDomainFix.cs
new file mode 100644
index 0000000..3d01028
--- /dev/null
+++ b/PR_11_csharp/compiled-codeql-dataset/codeql_csharp/CookieWithOverlyBroadDomainFix.cs
@@ -0,0 +1,14 @@
+using System.Web;
+
+class CookieWithOverlyBroadDomainFix
+{
+ //{fact rule=incorrect-authentication-exploitation@v1.0 defects=0}
+ static public void AddCookie()
+ {
+ HttpCookie cookie = new HttpCookie("sessionID")
+ {
+ Domain = "ebanking.online-bank.com"
+ };
+ }
+ //{/fact}
+}
diff --git a/PR_11_csharp/compiled-codeql-dataset/codeql_csharp/CookieWithOverlyBroadPath.cs b/PR_11_csharp/compiled-codeql-dataset/codeql_csharp/CookieWithOverlyBroadPath.cs
new file mode 100644
index 0000000..fd004e0
--- /dev/null
+++ b/PR_11_csharp/compiled-codeql-dataset/codeql_csharp/CookieWithOverlyBroadPath.cs
@@ -0,0 +1,15 @@
+using System.Web;
+
+class CookieWithOverlyBroadPath
+{
+ static public void AddCookie()
+ {
+ //{fact rule=incorrect-authentication-exploitation@v1.0 defects=1}
+ HttpCookie cookie = new HttpCookie("sessionID")
+ {
+ Path = "/"
+ };
+
+ //{/fact}
+ }
+}
diff --git a/PR_11_csharp/compiled-codeql-dataset/codeql_csharp/CookieWithOverlyBroadPathFix.cs b/PR_11_csharp/compiled-codeql-dataset/codeql_csharp/CookieWithOverlyBroadPathFix.cs
new file mode 100644
index 0000000..05185c7
--- /dev/null
+++ b/PR_11_csharp/compiled-codeql-dataset/codeql_csharp/CookieWithOverlyBroadPathFix.cs
@@ -0,0 +1,12 @@
+using System.Web;
+
+class CookieWithOverlyBroadPathFix
+{
+ //{fact rule=incorrect-authentication-exploitation@v1.0 defects=0}
+ static public void AddCookie()
+ {
+ HttpCookie cookie = new HttpCookie("sessionID");
+ cookie.Path = "/ebanking";
+ }
+ //{/fact}
+}
diff --git a/PR_11_csharp/compiled-codeql-dataset/codeql_csharp/ExposureOfPrivateInformation.cs b/PR_11_csharp/compiled-codeql-dataset/codeql_csharp/ExposureOfPrivateInformation.cs
new file mode 100644
index 0000000..586a33c
--- /dev/null
+++ b/PR_11_csharp/compiled-codeql-dataset/codeql_csharp/ExposureOfPrivateInformation.cs
@@ -0,0 +1,23 @@
+using System.Text;
+using System.Web;
+
+
+public class PrivateInformationHandler : IHttpHandler
+{
+
+ public void ProcessRequest(HttpContext ctx)
+ {
+ //{fact rule=sensitive-information-leak@v1.0 defects=0}
+ string address = (string)ctx.Request;
+ logger.Info("User has address: " + address);
+ //{/fact}
+ }
+}
+
+internal class logger
+{
+ internal static void Info(string v)
+ {
+ throw new NotImplementedException();
+ }
+}
\ No newline at end of file
diff --git a/PR_11_csharp/compiled-codeql-dataset/codeql_csharp/HardcodedEncryptionKeyBad.cs b/PR_11_csharp/compiled-codeql-dataset/codeql_csharp/HardcodedEncryptionKeyBad.cs
new file mode 100644
index 0000000..6f856d0
--- /dev/null
+++ b/PR_11_csharp/compiled-codeql-dataset/codeql_csharp/HardcodedEncryptionKeyBad.cs
@@ -0,0 +1,13 @@
+using System.Security.Cryptography;
+class D{
+public void method_D()
+{
+var b = new AesCryptoServiceProvider()
+{
+ //{fact rule=sensitive-information-leak@v1.0 defects=1}
+ // BAD: explicit key assignment, hard-coded value
+ Key = new byte[] { 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00 }
+ //{/fact}
+};
+}
+}
diff --git a/PR_11_csharp/compiled-codeql-dataset/codeql_csharp/InadequateRSAPadding.cs b/PR_11_csharp/compiled-codeql-dataset/codeql_csharp/InadequateRSAPadding.cs
new file mode 100644
index 0000000..181cc5f
--- /dev/null
+++ b/PR_11_csharp/compiled-codeql-dataset/codeql_csharp/InadequateRSAPadding.cs
@@ -0,0 +1,45 @@
+using System;
+using System.Security.Cryptography;
+
+namespace InadequateRSAPadding
+{
+ class Main
+ {
+
+ static public byte[]? EncryptWithRSAAndNoPadding(byte[] plaintext, RSAParameters key)
+ {
+ //{fact rule=insecure-cryptography@v1.0 defects=1}
+ try
+ {
+ RSACryptoServiceProvider rsa = new RSACryptoServiceProvider();
+ rsa.ImportParameters(key);
+ return rsa.Encrypt(plaintext, false); // BAD
+ }
+ catch (CryptographicException e)
+ {
+ Console.WriteLine(e.Message);
+ return null;
+ }
+ //{/fact}
+ }
+
+ static public byte[]? EncryptWithRSAAndPadding(byte[] plaintext, RSAParameters key)
+ {
+ //{fact rule=insecure-cryptography@v1.0 defects=0}
+ try
+ {
+ RSACryptoServiceProvider rsa = new RSACryptoServiceProvider();
+ rsa.ImportParameters(key);
+ return rsa.Encrypt(plaintext, true); // GOOD
+ }
+ catch (CryptographicException e)
+ {
+ Console.WriteLine(e.Message);
+ return null;
+ }
+ //{/fact}
+ }
+
+ }
+
+}
diff --git a/PR_11_csharp/compiled-codeql-dataset/codeql_csharp/InsecureRandomness.cs b/PR_11_csharp/compiled-codeql-dataset/codeql_csharp/InsecureRandomness.cs
new file mode 100644
index 0000000..9081cec
--- /dev/null
+++ b/PR_11_csharp/compiled-codeql-dataset/codeql_csharp/InsecureRandomness.cs
@@ -0,0 +1,35 @@
+using System.Security.Cryptography;
+
+string GeneratePassword()
+{
+ //{fact rule=weak-random-number-generation@v1.0 defects=1}
+ // BAD: Password is generated using a cryptographically insecure RNG
+ Random gen = new Random();
+ string password = "mypassword" + gen.Next();
+ //{/fact}
+
+ //{fact rule=weak-random-number-generation@v1.0 defects=0}
+ // GOOD: Password is generated using a cryptographically secure RNG
+ using (RNGCryptoServiceProvider crypto = new RNGCryptoServiceProvider())
+ {
+ byte[] randomBytes = new byte[sizeof(int)];
+ crypto.GetBytes(randomBytes);
+ password = "mypassword" + BitConverter.ToInt32(randomBytes);
+ }
+ //{/fact}
+
+ //{fact rule=weak-random-number-generation@v1.0 defects=1}
+ // BAD: Membership.GeneratePassword generates a password with a bias
+ password = Membership.GeneratePassword(12, 3);
+
+ return password;
+ //{/fact}
+}
+
+internal class Membership
+{
+ internal static string GeneratePassword(int v1, int v2)
+ {
+ throw new NotImplementedException();
+ }
+}
\ No newline at end of file
diff --git a/PR_11_csharp/compiled-codeql-dataset/codeql_csharp/InsufficientKeySize.cs b/PR_11_csharp/compiled-codeql-dataset/codeql_csharp/InsufficientKeySize.cs
new file mode 100644
index 0000000..82207b1
--- /dev/null
+++ b/PR_11_csharp/compiled-codeql-dataset/codeql_csharp/InsufficientKeySize.cs
@@ -0,0 +1,299 @@
+using System;
+using System.IO;
+using System.Security.Cryptography;
+
+namespace InsufficientKeySize
+{
+ class MainCrypto
+ {
+
+ static public byte[]? EncryptWithRSA(byte[] plaintext, RSAParameters key)
+ {
+ try
+ {
+ //{fact rule=cryptographic-key-generator@v1.0 defects=1}
+ RSACryptoServiceProvider rsa = new RSACryptoServiceProvider(1024); // BAD
+ rsa.ImportParameters(key);
+ return rsa.Encrypt(plaintext, true);
+ }
+ //{/fact}
+ catch (CryptographicException e)
+ {
+ Console.WriteLine(e.Message);
+ return null;
+ }
+ }
+
+ static public byte[]? EncryptWithRSA2(byte[] plaintext, RSAParameters key)
+ {
+ try
+ {
+ //{fact rule=cryptographic-key-generator@v1.0 defects=1}
+ RSACryptoServiceProvider rsa = new RSACryptoServiceProvider(); // BAD
+ //{/fact}
+
+ //{fact rule=cryptographic-key-generator@v1.0 defects=0}
+ rsa = new RSACryptoServiceProvider(2048); // GOOD
+ rsa.ImportParameters(key);
+ return rsa.Encrypt(plaintext, true);
+ //{/fact}
+ }
+ catch (CryptographicException e)
+ {
+ Console.WriteLine(e.Message);
+ return null;
+ }
+ }
+
+ static public byte[]? EncryptWithDSA(byte[] plaintext, DSAParameters key)
+ {
+ try
+ {
+ //{fact rule=cryptographic-key-generator@v1.0 defects=0}
+ DSACryptoServiceProvider dsa = new DSACryptoServiceProvider(2048); // GOOD
+ dsa.ImportParameters(key);
+ return dsa.SignData(plaintext);
+ //{/fact}
+ }
+ catch (CryptographicException e)
+ {
+ Console.WriteLine(e.Message);
+ return null;
+ }
+ }
+
+ static public byte[]? EncryptWithDSA2(byte[] plaintext, DSAParameters key)
+ {
+ try
+ {
+ //{fact rule=cryptographic-key-generator@v1.0 defects=1}
+ DSACryptoServiceProvider dsa = new DSACryptoServiceProvider(); // BAD
+ //{/fact}
+
+ //{fact rule=cryptographic-key-generator@v1.0 defects=0}
+ dsa = new DSACryptoServiceProvider(2048); // GOOD
+ dsa.ImportParameters(key);
+ return dsa.SignData(plaintext);
+ //{/fact}
+ }
+ catch (CryptographicException e)
+ {
+ Console.WriteLine(e.Message);
+ return null;
+ }
+ }
+
+ public static void Main()
+ {
+ try
+ {
+ DSAParameters privateKeyInfo;
+ DSAParameters publicKeyInfo;
+
+ // Create a new instance of DSACryptoServiceProvider to generate
+ // a new key pair.
+ using (DSACryptoServiceProvider DSA = new DSACryptoServiceProvider())
+ {
+ privateKeyInfo = DSA.ExportParameters(true);
+ publicKeyInfo = DSA.ExportParameters(false);
+ }
+
+ // The hash value to sign.
+ byte[] HashValue =
+ {
+ 59, 4, 248, 102, 77, 97, 142, 201,
+ 210, 12, 224, 93, 25, 41, 100, 197,
+ 213, 134, 130, 135
+ };
+
+ // The value to hold the signed value.
+ byte[] SignedHashValue = DSASignHash(HashValue, privateKeyInfo, "SHA1");
+
+ // Verify the hash and display the results.
+ bool verified = DSAVerifyHash(HashValue, SignedHashValue, publicKeyInfo, "SHA1");
+
+ if (verified)
+ {
+ Console.WriteLine("The hash value was verified.");
+ }
+ else
+ {
+ Console.WriteLine("The hash value was not verified.");
+ }
+ }
+ catch (ArgumentNullException e)
+ {
+ Console.WriteLine(e.Message);
+ }
+ }
+
+ public static byte[] DSASignHash(byte[] HashToSign, DSAParameters DSAKeyInfo,
+ string HashAlg)
+ {
+ byte[]? sig = null;
+
+ try
+ {
+ // Create a new instance of DSACryptoServiceProvider.
+ //{fact rule=cryptographic-key-generator@v1.0 defects=0}
+ using (DSACryptoServiceProvider DSA = new DSACryptoServiceProvider(2048)) // GOOD
+ {
+ // Import the key information.
+ DSA.ImportParameters(DSAKeyInfo);
+
+ // Create an DSASignatureFormatter object and pass it the
+ // DSACryptoServiceProvider to transfer the private key.
+ DSASignatureFormatter DSAFormatter = new DSASignatureFormatter(DSA);
+
+ // Set the hash algorithm to the passed value.
+ DSAFormatter.SetHashAlgorithm(HashAlg);
+
+ // Create a signature for HashValue and return it.
+ sig = DSAFormatter.CreateSignature(HashToSign);
+ }
+ //{/fact}
+ }
+ catch (CryptographicException e)
+ {
+ Console.WriteLine(e.Message);
+ }
+
+ return sig;
+ }
+
+ public static bool DSAVerifyHash(byte[] HashValue, byte[] SignedHashValue,
+ DSAParameters DSAKeyInfo, string HashAlg)
+ {
+ bool verified = false;
+
+ try
+ {
+ // Create a new instance of DSACryptoServiceProvider.
+ //{fact rule=cryptographic-key-generator@v1.0 defects=1}
+ using (DSACryptoServiceProvider DSA = new DSACryptoServiceProvider()) // BAD
+ {
+ // Import the key information.
+ DSA.ImportParameters(DSAKeyInfo);
+
+ // Create an DSASignatureDeformatter object and pass it the
+ // DSACryptoServiceProvider to transfer the private key.
+ DSASignatureDeformatter DSADeformatter = new DSASignatureDeformatter(DSA);
+
+ // Set the hash algorithm to the passed value.
+ DSADeformatter.SetHashAlgorithm(HashAlg);
+
+ // Verify signature and return the result.
+ verified = DSADeformatter.VerifySignature(HashValue, SignedHashValue);
+ }
+ //{/fact}
+ }
+ catch (CryptographicException e)
+ {
+ Console.WriteLine(e.Message);
+ }
+
+ return verified;
+ }
+
+ public static void Main2()
+ {
+ // Create a new DES key.
+ //{fact rule=cryptographic-key-generator@v1.0 defects=1}
+ DESCryptoServiceProvider key = new DESCryptoServiceProvider(); // BAD
+
+ // Encrypt a string to a byte array.
+ byte[] buffer = Encrypt("This is some plaintext!", key);
+
+ // Decrypt the byte array back to a string.
+ string plaintext = Decrypt(buffer, key);
+
+ // Display the plaintext value to the console.
+ Console.WriteLine(plaintext);
+ }
+ //{/fact}
+
+ // Encrypt the string.
+ public static byte[] Encrypt(string PlainText, SymmetricAlgorithm key)
+ {
+ // Create a memory stream.
+ MemoryStream ms = new MemoryStream();
+
+ // Create a CryptoStream using the memory stream and the
+ // CSP DES key.
+ CryptoStream encStream = new CryptoStream(ms, key.CreateEncryptor(), CryptoStreamMode.Write);
+
+ // Create a StreamWriter to write a string
+ // to the stream.
+ StreamWriter sw = new StreamWriter(encStream);
+
+ // Write the plaintext to the stream.
+ sw.WriteLine(PlainText);
+
+ // Close the StreamWriter and CryptoStream.
+ sw.Close();
+ encStream.Close();
+
+ // Get an array of bytes that represents
+ // the memory stream.
+ byte[] buffer = ms.ToArray();
+
+ // Close the memory stream.
+ ms.Close();
+
+ // Return the encrypted byte array.
+ return buffer;
+ }
+
+ // Decrypt the byte array.
+ public static string Decrypt(byte[] CypherText, SymmetricAlgorithm key)
+ {
+ // Create a memory stream to the passed buffer.
+ MemoryStream ms = new MemoryStream(CypherText);
+
+ // Create a CryptoStream using the memory stream and the
+ // CSP DES key.
+ CryptoStream encStream = new CryptoStream(ms, key.CreateDecryptor(), CryptoStreamMode.Read);
+
+ // Create a StreamReader for reading the stream.
+ StreamReader sr = new StreamReader(encStream);
+
+ // Read the stream as a string.
+ string val = sr.ReadLine();
+
+ // Close the streams.
+ sr.Close();
+ encStream.Close();
+ ms.Close();
+
+ return val;
+ }
+
+ const int KEY_SIZE = 64;
+
+ public static void RC2()
+ {
+
+ // Create a new instance of the RC2CryptoServiceProvider class
+ // and automatically generate a Key and IV.
+ RC2CryptoServiceProvider rc2CSP = new RC2CryptoServiceProvider();
+
+ rc2CSP.EffectiveKeySize = KEY_SIZE; // BAD
+ Console.WriteLine("Effective key size is {0} bits.", rc2CSP.EffectiveKeySize);
+
+ // Get the key and IV.
+ byte[] key = rc2CSP.Key;
+ byte[] IV = rc2CSP.IV;
+
+ // Get an encryptor.
+ ICryptoTransform encryptor = rc2CSP.CreateEncryptor(key, IV);
+
+ // Encrypt the data as an array of encrypted bytes in memory.
+ MemoryStream msEncrypt = new MemoryStream();
+ CryptoStream csEncrypt = new CryptoStream(msEncrypt, encryptor, CryptoStreamMode.Write);
+
+
+ }
+
+ }
+
+}
diff --git a/PR_11_csharp/compiled-codeql-dataset/codeql_csharp/PersistentCookie.cs b/PR_11_csharp/compiled-codeql-dataset/codeql_csharp/PersistentCookie.cs
new file mode 100644
index 0000000..b4b5bee
--- /dev/null
+++ b/PR_11_csharp/compiled-codeql-dataset/codeql_csharp/PersistentCookie.cs
@@ -0,0 +1,50 @@
+using System;
+using System.Web;
+
+namespace System.Web
+{
+ public class HttpCookie
+ {
+ public HttpCookie(string name) { }
+ public string Value { set { } }
+ public DateTime Expires { set { } }
+
+ public string Domain { get; internal set; }
+ public string Path { get; internal set; }
+ }
+}
+
+namespace PersistentCookie
+{
+ class Main
+ {
+ static public void AddCookie()
+ {
+ HttpCookie aCookie = new HttpCookie("lastVisit");
+ aCookie.Value = DateTime.Now.ToString();
+ //{fact rule=sensitive-information-leak@v1.0 defects=1}
+ aCookie.Expires = DateTime.Now.AddDays(1); // BAD
+ //{/fact}
+
+ //{fact rule=sensitive-information-leak@v1.0 defects=1}
+ aCookie.Expires = DateTime.Now.Add(new TimeSpan(1000)); // BAD
+ //{/fact}
+
+ //{fact rule=sensitive-information-leak@v1.0 defects=1}
+ aCookie.Expires = DateTime.Now.AddMinutes(10); // BAD
+ //{/fact}
+
+ //{fact rule=sensitive-information-leak@v1.0 defects=0}
+ aCookie.Expires = DateTime.Now.AddMinutes(-10.9); // GOOD
+ //{/fact}
+
+ //{fact rule=sensitive-information-leak@v1.0 defects=0}
+ aCookie.Expires = DateTime.Now.AddSeconds(109); // GOOD
+ //{/fact}
+
+ //{fact rule=sensitive-information-leak@v1.0 defects=0}
+ aCookie.Expires = DateTime.Now; // GOOD
+ //{/fact}
+ }
+ }
+}
diff --git a/PR_11_csharp/compiled-codeql-dataset/codeql_csharp/RuntimeChecksBypassBad.cs b/PR_11_csharp/compiled-codeql-dataset/codeql_csharp/RuntimeChecksBypassBad.cs
new file mode 100644
index 0000000..126b79e
--- /dev/null
+++ b/PR_11_csharp/compiled-codeql-dataset/codeql_csharp/RuntimeChecksBypassBad.cs
@@ -0,0 +1,23 @@
+using System;
+using System.Runtime.Serialization;
+
+[Serializable]
+public class PersonBad : ISerializable
+{
+ public int Age;
+
+ public PersonBad(int age)
+ {
+ if (age < 0)
+ throw new ArgumentException(nameof(age));
+ Age = age;
+ }
+
+ [OnDeserializing]
+ //{fact rule=untrusted-deserialization@v1.0 defects=1}
+ void ISerializable.GetObjectData(SerializationInfo info, StreamingContext context)
+ {
+ Age = info.GetInt32("age"); // BAD - write is unsafe
+ }
+ //{/fact}
+}
diff --git a/PR_11_csharp/compiled-codeql-dataset/codeql_csharp/RuntimeChecksBypassGood.cs b/PR_11_csharp/compiled-codeql-dataset/codeql_csharp/RuntimeChecksBypassGood.cs
new file mode 100644
index 0000000..2eae7b6
--- /dev/null
+++ b/PR_11_csharp/compiled-codeql-dataset/codeql_csharp/RuntimeChecksBypassGood.cs
@@ -0,0 +1,26 @@
+using System;
+using System.Runtime.Serialization;
+
+[Serializable]
+public class PersonGood : ISerializable
+{
+ public int Age;
+
+ public PersonGood(int age)
+ {
+ if (age < 0)
+ throw new ArgumentException(nameof(age));
+ Age = age;
+ }
+
+ [OnDeserializing]
+ //{fact rule=untrusted-deserialization@v1.0 defects=0}
+ void ISerializable.GetObjectData(SerializationInfo info, StreamingContext context)
+ {
+ int age = info.GetInt32("age");
+ if (age < 0)
+ throw new SerializationException(nameof(Age));
+ Age = age; // GOOD - write is safe
+ }
+ //{/fact}
+}
diff --git a/PR_11_csharp/compiled-codeql-dataset/codeql_csharp/UncontrolledFormatStringBad.cs b/PR_11_csharp/compiled-codeql-dataset/codeql_csharp/UncontrolledFormatStringBad.cs
new file mode 100644
index 0000000..7546834
--- /dev/null
+++ b/PR_11_csharp/compiled-codeql-dataset/codeql_csharp/UncontrolledFormatStringBad.cs
@@ -0,0 +1,16 @@
+using System.Web;
+
+public class HttpHandler : IHttpHandler
+{
+ string Surname, Forenames, FormattedName;
+
+ public void ProcessRequest(HttpContext ctx)
+ {
+ string format = (string)ctx.Request;
+
+ //{fact rule=untrusted-format-strings@v1.0 defects=1}
+ // BAD: Uncontrolled format string.
+ FormattedName = string.Format(format, Surname, Forenames);
+ //{/fact}
+ }
+}
diff --git a/PR_11_csharp/compiled-codeql-dataset/codeql_csharp/UnsafeDeserializationBad.cs b/PR_11_csharp/compiled-codeql-dataset/codeql_csharp/UnsafeDeserializationBad.cs
new file mode 100644
index 0000000..6eee387
--- /dev/null
+++ b/PR_11_csharp/compiled-codeql-dataset/codeql_csharp/UnsafeDeserializationBad.cs
@@ -0,0 +1,37 @@
+class UnsafeDeserializationBad
+{
+ public static object Deserialize(string s)
+ {
+ JavaScriptSerializer sr = new(new SimpleTypeResolver());
+ //{fact rule=untrusted-deserialization@v1.0 defects=1}
+ // BAD
+ return sr.DeserializeObject(s);
+ //{/fact}
+ }
+}
+
+internal class SimpleTypeResolver
+{
+ public SimpleTypeResolver()
+ {
+ }
+}
+
+internal class JavaScriptSerializer
+{
+ private SimpleTypeResolver simpleTypeResolver;
+
+ public JavaScriptSerializer()
+ {
+ }
+
+ public JavaScriptSerializer(SimpleTypeResolver simpleTypeResolver)
+ {
+ this.simpleTypeResolver = simpleTypeResolver;
+ }
+
+ internal object DeserializeObject(string s)
+ {
+ throw new NotImplementedException();
+ }
+}
\ No newline at end of file
diff --git a/PR_11_csharp/compiled-codeql-dataset/codeql_csharp/UnsafeDeserializationGood.cs b/PR_11_csharp/compiled-codeql-dataset/codeql_csharp/UnsafeDeserializationGood.cs
new file mode 100644
index 0000000..de11eda
--- /dev/null
+++ b/PR_11_csharp/compiled-codeql-dataset/codeql_csharp/UnsafeDeserializationGood.cs
@@ -0,0 +1,11 @@
+class Good
+{
+ public static object Deserialize(string s)
+ {
+ //{fact rule=untrusted-deserialization@v1.0 defects=0}
+ // GOOD
+ JavaScriptSerializer sr = new();
+ return sr.DeserializeObject(s);
+ //{/fact}
+ }
+}
diff --git a/PR_11_csharp/compiled-codeql-dataset/codeql_csharp/UnsafeDeserializationUntrustedInputTypeBad.cs b/PR_11_csharp/compiled-codeql-dataset/codeql_csharp/UnsafeDeserializationUntrustedInputTypeBad.cs
new file mode 100644
index 0000000..d185880
--- /dev/null
+++ b/PR_11_csharp/compiled-codeql-dataset/codeql_csharp/UnsafeDeserializationUntrustedInputTypeBad.cs
@@ -0,0 +1,15 @@
+using System.Runtime.Serialization.Json;
+using System.IO;
+using System;
+
+class BadDataContractJsonSerializer
+{
+ public static object Deserialize(string type, Stream s)
+ {
+ //{fact rule=user-object-input-stream-insecure-deserialization@v1.0 defects=1}
+ // BAD: stream and type are potentially untrusted
+ var ds = new DataContractJsonSerializer(Type.GetType(type));
+ return ds.ReadObject(s);
+ //{/fact}
+ }
+}
diff --git a/PR_11_csharp/compiled-codeql-dataset/codeql_csharp/UnsafeDeserializationUntrustedInputTypeGood.cs b/PR_11_csharp/compiled-codeql-dataset/codeql_csharp/UnsafeDeserializationUntrustedInputTypeGood.cs
new file mode 100644
index 0000000..07676ed
--- /dev/null
+++ b/PR_11_csharp/compiled-codeql-dataset/codeql_csharp/UnsafeDeserializationUntrustedInputTypeGood.cs
@@ -0,0 +1,22 @@
+using System.Runtime.Serialization.Json;
+using System.IO;
+using System;
+
+class Poco
+{
+ public int Count;
+
+ public string Comment;
+}
+
+class GoodDataContractJsonSerializer
+{
+ public static Poco Deserialize(Stream s)
+ {
+ //{fact rule=user-object-input-stream-insecure-deserialization@v1.0 defects=0}
+ // GOOD: while stream is potentially untrusted, the instantiated type is hardcoded
+ var ds = new DataContractJsonSerializer(typeof(Poco));
+ return (Poco)ds.ReadObject(s);
+ //{/fact}
+ }
+}
diff --git a/PR_11_csharp/compiled-codeql-dataset/codeql_csharp/WeakEncryption.cs b/PR_11_csharp/compiled-codeql-dataset/codeql_csharp/WeakEncryption.cs
new file mode 100644
index 0000000..4cce4f3
--- /dev/null
+++ b/PR_11_csharp/compiled-codeql-dataset/codeql_csharp/WeakEncryption.cs
@@ -0,0 +1,18 @@
+using System.Security.Cryptography;
+
+class WeakEncryption
+{
+ //{fact rule=insecure-cryptography@v1.0 defects=1}
+ public static byte[] encryptString()
+ {
+ SymmetricAlgorithm serviceProvider = new DESCryptoServiceProvider();
+ byte[] key = { 16, 22, 240, 11, 18, 150, 192, 21 };
+ serviceProvider.Key = key;
+ ICryptoTransform encryptor = serviceProvider.CreateEncryptor();
+
+ String message = "Hello World";
+ byte[] messageB = System.Text.Encoding.ASCII.GetBytes(message);
+ return encryptor.TransformFinalBlock(messageB, 0, messageB.Length);
+ }
+ //{/fact}
+}
diff --git a/PR_11_csharp/compiled-codeql-dataset/codeql_csharp/WebForms.cs b/PR_11_csharp/compiled-codeql-dataset/codeql_csharp/WebForms.cs
new file mode 100644
index 0000000..74337df
--- /dev/null
+++ b/PR_11_csharp/compiled-codeql-dataset/codeql_csharp/WebForms.cs
@@ -0,0 +1,22 @@
+class ProfilePage {
+ // BAD: No authorization is used
+ protected void btn1_Edit_Click(object sender, EventArgs e) {
+
+ }
+
+ // GOOD: `User.IsInRole` checks the current user's role.
+ protected void btn2_Delete_Click(object sender, EventArgs e) {
+ if (!User.IsInRole("admin")) {
+ return;
+ }
+
+ }
+}
+
+internal class User
+{
+ internal static bool IsInRole(string v)
+ {
+ throw new NotImplementedException();
+ }
+}
\ No newline at end of file
diff --git a/PR_11_csharp/compiled-codeql-dataset/codeql_csharp/XMLInjectionBad.cs b/PR_11_csharp/compiled-codeql-dataset/codeql_csharp/XMLInjectionBad.cs
new file mode 100644
index 0000000..91d4a58
--- /dev/null
+++ b/PR_11_csharp/compiled-codeql-dataset/codeql_csharp/XMLInjectionBad.cs
@@ -0,0 +1,23 @@
+using System;
+using System.Security;
+using System.Web;
+using System.Xml;
+
+public class XMLInjectionHandler : IHttpHandler {
+ public void ProcessRequest(HttpContext ctx) {
+ string employeeName = (string)ctx.Request;
+
+ using (XmlWriter writer = XmlWriter.Create("employees.xml"))
+ {
+ writer.WriteStartDocument();
+ //{fact rule=xml-injection@v1.0 defects=1}
+ // BAD: Insert user input directly into XML
+ writer.WriteRaw("" + employeeName + "");
+
+ writer.WriteEndElement();
+ writer.WriteEndDocument();
+
+ //{/fact}
+ }
+ }
+}
\ No newline at end of file
diff --git a/PR_11_csharp/compiled-codeql-dataset/codeql_csharp/XMLInjectionGood.cs b/PR_11_csharp/compiled-codeql-dataset/codeql_csharp/XMLInjectionGood.cs
new file mode 100644
index 0000000..c192bea
--- /dev/null
+++ b/PR_11_csharp/compiled-codeql-dataset/codeql_csharp/XMLInjectionGood.cs
@@ -0,0 +1,30 @@
+using System;
+using System.Security;
+using System.Web;
+using System.Xml;
+
+public class XMLInjectionGood: IHttpHandler {
+ public void ProcessRequest(HttpContext ctx) {
+ string employeeName = (string)ctx.Request;
+
+ using (XmlWriter writer = XmlWriter.Create("employees.xml"))
+ {
+ writer.WriteStartDocument();
+
+ //{fact rule=xml-injection@v1.0 defects=0}
+ // GOOD: Escape user input before inserting into string
+ writer.WriteRaw("" + SecurityElement.Escape(employeeName) + "");
+ //{/fact}
+
+ //{fact rule=xml-injection@v1.0 defects=0}
+ // GOOD: Use standard API, which automatically encodes values
+ writer.WriteStartElement("Employee");
+ writer.WriteElementString("Name", employeeName);
+ writer.WriteEndElement();
+
+ writer.WriteEndElement();
+ writer.WriteEndDocument();
+ //{/fact}
+ }
+ }
+}
\ No newline at end of file
diff --git a/PR_11_csharp/compiled-codeql-dataset/codeql_csharp/XPathInjection.cs b/PR_11_csharp/compiled-codeql-dataset/codeql_csharp/XPathInjection.cs
new file mode 100644
index 0000000..9cd68b5
--- /dev/null
+++ b/PR_11_csharp/compiled-codeql-dataset/codeql_csharp/XPathInjection.cs
@@ -0,0 +1,46 @@
+using System;
+using System.Web;
+using System.Xml;
+using System.Xml.XPath;
+using System.Xml.Xsl;
+
+public class XPathInjectionHandler : IHttpHandler
+{
+ public void ProcessRequest(HttpContext ctx)
+ {
+ string userName = (string)ctx.Request;
+
+ //{fact rule=xpath-injection@v1.0 defects=1}
+ // BAD: Use user-provided data directly in an XPath expression
+ string badXPathExpr = "//users/user[login/text()='" + userName + "']/home_dir/text()";
+ XPathExpression.Compile(badXPathExpr);
+ //{/fact}
+
+ //{fact rule=xpath-injection@v1.0 defects=0}
+ // GOOD: XPath expression uses variables to refer to parameters
+ string xpathExpression = "//users/user[login/text()=$username]/home_dir/text()";
+ XPathExpression xpath = XPathExpression.Compile(xpathExpression);
+ //{/fact}
+
+ // Arguments are provided as a XsltArgumentList()
+ XsltArgumentList varList = new XsltArgumentList();
+ varList.AddParam("userName", string.Empty, userName);
+
+ // CustomContext is an application specific class, that looks up variables in the
+ // expression from the varList.
+ CustomContext context = new CustomContext(new NameTable(), varList);
+ xpath.SetContext((IXmlNamespaceResolver?)context);
+ }
+}
+
+internal class CustomContext
+{
+ private NameTable nameTable;
+ private XsltArgumentList varList;
+
+ public CustomContext(NameTable nameTable, XsltArgumentList varList)
+ {
+ this.nameTable = nameTable;
+ this.varList = varList;
+ }
+}
\ No newline at end of file
diff --git a/PR_11_csharp/compiled-codeql-dataset/codeql_csharp/ZipSlipBad.cs b/PR_11_csharp/compiled-codeql-dataset/codeql_csharp/ZipSlipBad.cs
new file mode 100644
index 0000000..8ead5ff
--- /dev/null
+++ b/PR_11_csharp/compiled-codeql-dataset/codeql_csharp/ZipSlipBad.cs
@@ -0,0 +1,14 @@
+using System.IO;
+using System.IO.Compression;
+
+class ZipSlipBad
+{
+ //{fact rule=path-traversal@v1.0 defects=1}
+ public static void WriteToDirectory(ZipArchiveEntry entry,
+ string destDirectory)
+ {
+ string destFileName = Path.Combine(destDirectory, entry.FullName);
+ entry.ExtractToFile(destFileName);
+ }
+ //{/fact}
+}
diff --git a/PR_11_csharp/compiled-codeql-dataset/codeql_csharp/ZipSlipGood.cs b/PR_11_csharp/compiled-codeql-dataset/codeql_csharp/ZipSlipGood.cs
new file mode 100644
index 0000000..6c6c041
--- /dev/null
+++ b/PR_11_csharp/compiled-codeql-dataset/codeql_csharp/ZipSlipGood.cs
@@ -0,0 +1,19 @@
+using System.IO;
+using System.IO.Compression;
+
+class ZipSlipGood
+{
+ //{fact rule=path-traversal@v1.0 defects=0}
+ public static void WriteToDirectory(ZipArchiveEntry entry,
+ string destDirectory)
+ {
+ string destFileName = Path.GetFullPath(Path.Combine(destDirectory, entry.FullName));
+ string fullDestDirPath = Path.GetFullPath(destDirectory + Path.DirectorySeparatorChar);
+ if (!destFileName.StartsWith(fullDestDirPath)) {
+ throw new System.InvalidOperationException("Entry is outside the target dir: " +
+ destFileName);
+ }
+ entry.ExtractToFile(destFileName);
+ }
+ //{/fact}
+}
diff --git a/PR_11_csharp/compiled-codeql-dataset/codeql_csharp/global.asax.cs b/PR_11_csharp/compiled-codeql-dataset/codeql_csharp/global.asax.cs
new file mode 100644
index 0000000..9ddfe54
--- /dev/null
+++ b/PR_11_csharp/compiled-codeql-dataset/codeql_csharp/global.asax.cs
@@ -0,0 +1,17 @@
+using System;
+using System.Web;
+
+namespace WebApp
+{
+ public class Global : HttpApplication
+ {
+ void Application_Error(object sender, EventArgs e)
+ {
+ // Handle errors here
+ }
+ }
+
+ public class HttpApplication
+ {
+ }
+}
diff --git a/PR_11_csharp/compiled-codeql-dataset/semgrep.sarif b/PR_11_csharp/compiled-codeql-dataset/semgrep.sarif
new file mode 100644
index 0000000..35b5a1f
--- /dev/null
+++ b/PR_11_csharp/compiled-codeql-dataset/semgrep.sarif
@@ -0,0 +1,9381 @@
+{
+ "$schema": "https://docs.oasis-open.org/sarif/sarif/v2.1.0/os/schemas/sarif-schema-2.1.0.json",
+ "runs": [
+ {
+ "invocations": [
+ {
+ "executionSuccessful": true,
+ "toolExecutionNotifications": []
+ }
+ ],
+ "results": [
+ {
+ "fingerprints": {
+ "matchBasedId/v1": "454603cb4afec14621159f75954ac200353d3ebd72040881676df72331402cf572666cc9f0e293a1f31db0434a74d8197e74b9f0e2ad72a31417c3491aec3bda_0"
+ },
+ "locations": [
+ {
+ "physicalLocation": {
+ "artifactLocation": {
+ "uri": "codeql_csharp/src/CookieWithOverlyBroadDomain.cs",
+ "uriBaseId": "%SRCROOT%"
+ },
+ "region": {
+ "endColumn": 68,
+ "endLine": 8,
+ "snippet": {
+ "text": " System.Web.HttpCookie cookie1 = new HttpCookie(\"sessionID\");"
+ },
+ "startColumn": 31,
+ "startLine": 8
+ }
+ }
+ }
+ ],
+ "message": {
+ "text": "The `HttpOnly` attribute when set to `true` protects the cookie value from being accessed by\nclient side JavaScript such\nas reading the `document.cookie` values. By enabling this protection, a website that is\nvulnerable to\nCross-Site Scripting (XSS) will be able to block malicious scripts from accessing the cookie\nvalue from JavaScript.\n\nExample of protecting an HttpCookie:\n```\n// Create an HttpOnly cookie.\nHttpCookie someCookie = new HttpCookie(\"SomeCookieName\", \"SomeValue\");\nsomeCookie.HttpOnly = true;\n```\n\nFor more information see:\nhttps://learn.microsoft.com/en-us/dotnet/api/system.web.httpcookie.httponly\n\nSession cookies should be configured with the following security directives:\n\n-\n[HTTPOnly](https://developer.mozilla.org/en-US/docs/Web/HTTP/Cookies#restrict_access_to_cookies)\n-\n[Secure](https://developer.mozilla.org/en-US/docs/Web/HTTP/Cookies#restrict_access_to_cookies)\n- [SameSite](https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/Set-Cookie/SameSite)\n"
+ },
+ "properties": {},
+ "ruleId": "security_code_scan.SCS0009-1"
+ },
+ {
+ "fingerprints": {
+ "matchBasedId/v1": "454603cb4afec14621159f75954ac200353d3ebd72040881676df72331402cf572666cc9f0e293a1f31db0434a74d8197e74b9f0e2ad72a31417c3491aec3bda_1"
+ },
+ "locations": [
+ {
+ "physicalLocation": {
+ "artifactLocation": {
+ "uri": "codeql_csharp/src/CookieWithOverlyBroadDomain.cs",
+ "uriBaseId": "%SRCROOT%"
+ },
+ "region": {
+ "endColumn": 43,
+ "endLine": 9,
+ "snippet": {
+ "text": " cookie1.Domain = \"online-bank.com\";"
+ },
+ "startColumn": 9,
+ "startLine": 9
+ }
+ }
+ }
+ ],
+ "message": {
+ "text": "The `HttpOnly` attribute when set to `true` protects the cookie value from being accessed by\nclient side JavaScript such\nas reading the `document.cookie` values. By enabling this protection, a website that is\nvulnerable to\nCross-Site Scripting (XSS) will be able to block malicious scripts from accessing the cookie\nvalue from JavaScript.\n\nExample of protecting an HttpCookie:\n```\n// Create an HttpOnly cookie.\nHttpCookie someCookie = new HttpCookie(\"SomeCookieName\", \"SomeValue\");\nsomeCookie.HttpOnly = true;\n```\n\nFor more information see:\nhttps://learn.microsoft.com/en-us/dotnet/api/system.web.httpcookie.httponly\n\nSession cookies should be configured with the following security directives:\n\n-\n[HTTPOnly](https://developer.mozilla.org/en-US/docs/Web/HTTP/Cookies#restrict_access_to_cookies)\n-\n[Secure](https://developer.mozilla.org/en-US/docs/Web/HTTP/Cookies#restrict_access_to_cookies)\n- [SameSite](https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/Set-Cookie/SameSite)\n"
+ },
+ "properties": {},
+ "ruleId": "security_code_scan.SCS0009-1"
+ },
+ {
+ "fingerprints": {
+ "matchBasedId/v1": "9f06f61c2ca4ce80efba6f4ad49e25465b3b1db46b19688c6c8e7d37b00aa6711b162039eded683f321f00d2857005a55ac93772dc271865a1b3eff65c7e05d7_0"
+ },
+ "locations": [
+ {
+ "physicalLocation": {
+ "artifactLocation": {
+ "uri": "codeql_csharp/src/CookieWithOverlyBroadDomain.cs",
+ "uriBaseId": "%SRCROOT%"
+ },
+ "region": {
+ "endColumn": 57,
+ "endLine": 11,
+ "snippet": {
+ "text": " HttpCookie cookie2 = new HttpCookie(\"sessionID\");"
+ },
+ "startColumn": 20,
+ "startLine": 11
+ }
+ }
+ }
+ ],
+ "message": {
+ "text": "The `HttpOnly` attribute when set to `true` protects the cookie value from being accessed by\nclient side JavaScript such\nas reading the `document.cookie` values. By enabling this protection, a website that is\nvulnerable to\nCross-Site Scripting (XSS) will be able to block malicious scripts from accessing the cookie\nvalue from JavaScript.\n\nExample of protecting an HttpCookie:\n```\n// Create an HttpOnly cookie.\nHttpCookie someCookie = new HttpCookie(\"SomeCookieName\", \"SomeValue\");\nsomeCookie.HttpOnly = true;\n```\n\nFor more information see:\nhttps://learn.microsoft.com/en-us/dotnet/api/system.web.httpcookie.httponly\n\nSession cookies should be configured with the following security directives:\n\n-\n[HTTPOnly](https://developer.mozilla.org/en-US/docs/Web/HTTP/Cookies#restrict_access_to_cookies)\n-\n[Secure](https://developer.mozilla.org/en-US/docs/Web/HTTP/Cookies#restrict_access_to_cookies)\n- [SameSite](https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/Set-Cookie/SameSite)\n"
+ },
+ "properties": {},
+ "ruleId": "security_code_scan.SCS0009-1"
+ },
+ {
+ "fingerprints": {
+ "matchBasedId/v1": "9f06f61c2ca4ce80efba6f4ad49e25465b3b1db46b19688c6c8e7d37b00aa6711b162039eded683f321f00d2857005a55ac93772dc271865a1b3eff65c7e05d7_1"
+ },
+ "locations": [
+ {
+ "physicalLocation": {
+ "artifactLocation": {
+ "uri": "codeql_csharp/src/CookieWithOverlyBroadDomain.cs",
+ "uriBaseId": "%SRCROOT%"
+ },
+ "region": {
+ "endColumn": 53,
+ "endLine": 12,
+ "snippet": {
+ "text": " cookie2.Domain = \".ebanking.online-bank.com\";"
+ },
+ "startColumn": 9,
+ "startLine": 12
+ }
+ }
+ }
+ ],
+ "message": {
+ "text": "The `HttpOnly` attribute when set to `true` protects the cookie value from being accessed by\nclient side JavaScript such\nas reading the `document.cookie` values. By enabling this protection, a website that is\nvulnerable to\nCross-Site Scripting (XSS) will be able to block malicious scripts from accessing the cookie\nvalue from JavaScript.\n\nExample of protecting an HttpCookie:\n```\n// Create an HttpOnly cookie.\nHttpCookie someCookie = new HttpCookie(\"SomeCookieName\", \"SomeValue\");\nsomeCookie.HttpOnly = true;\n```\n\nFor more information see:\nhttps://learn.microsoft.com/en-us/dotnet/api/system.web.httpcookie.httponly\n\nSession cookies should be configured with the following security directives:\n\n-\n[HTTPOnly](https://developer.mozilla.org/en-US/docs/Web/HTTP/Cookies#restrict_access_to_cookies)\n-\n[Secure](https://developer.mozilla.org/en-US/docs/Web/HTTP/Cookies#restrict_access_to_cookies)\n- [SameSite](https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/Set-Cookie/SameSite)\n"
+ },
+ "properties": {},
+ "ruleId": "security_code_scan.SCS0009-1"
+ },
+ {
+ "fingerprints": {
+ "matchBasedId/v1": "cdf83ee5cc00894c0c55c2daaefb9ff8ebc3c0ebf4fb69f64a49d328d9fb095e2cd6dac460dfa89db55bced99e76693082bc651dea452611aa6196c3d3e70117_0"
+ },
+ "locations": [
+ {
+ "physicalLocation": {
+ "artifactLocation": {
+ "uri": "codeql_csharp/src/CookieWithOverlyBroadPathFix.cs",
+ "uriBaseId": "%SRCROOT%"
+ },
+ "region": {
+ "endColumn": 56,
+ "endLine": 8,
+ "snippet": {
+ "text": " HttpCookie cookie = new HttpCookie(\"sessionID\");"
+ },
+ "startColumn": 20,
+ "startLine": 8
+ }
+ }
+ }
+ ],
+ "message": {
+ "text": "The `HttpOnly` attribute when set to `true` protects the cookie value from being accessed by\nclient side JavaScript such\nas reading the `document.cookie` values. By enabling this protection, a website that is\nvulnerable to\nCross-Site Scripting (XSS) will be able to block malicious scripts from accessing the cookie\nvalue from JavaScript.\n\nExample of protecting an HttpCookie:\n```\n// Create an HttpOnly cookie.\nHttpCookie someCookie = new HttpCookie(\"SomeCookieName\", \"SomeValue\");\nsomeCookie.HttpOnly = true;\n```\n\nFor more information see:\nhttps://learn.microsoft.com/en-us/dotnet/api/system.web.httpcookie.httponly\n\nSession cookies should be configured with the following security directives:\n\n-\n[HTTPOnly](https://developer.mozilla.org/en-US/docs/Web/HTTP/Cookies#restrict_access_to_cookies)\n-\n[Secure](https://developer.mozilla.org/en-US/docs/Web/HTTP/Cookies#restrict_access_to_cookies)\n- [SameSite](https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/Set-Cookie/SameSite)\n"
+ },
+ "properties": {},
+ "ruleId": "security_code_scan.SCS0009-1"
+ },
+ {
+ "fingerprints": {
+ "matchBasedId/v1": "cdf83ee5cc00894c0c55c2daaefb9ff8ebc3c0ebf4fb69f64a49d328d9fb095e2cd6dac460dfa89db55bced99e76693082bc651dea452611aa6196c3d3e70117_1"
+ },
+ "locations": [
+ {
+ "physicalLocation": {
+ "artifactLocation": {
+ "uri": "codeql_csharp/src/CookieWithOverlyBroadPathFix.cs",
+ "uriBaseId": "%SRCROOT%"
+ },
+ "region": {
+ "endColumn": 34,
+ "endLine": 9,
+ "snippet": {
+ "text": " cookie.Path = \"/ebanking\";"
+ },
+ "startColumn": 9,
+ "startLine": 9
+ }
+ }
+ }
+ ],
+ "message": {
+ "text": "The `HttpOnly` attribute when set to `true` protects the cookie value from being accessed by\nclient side JavaScript such\nas reading the `document.cookie` values. By enabling this protection, a website that is\nvulnerable to\nCross-Site Scripting (XSS) will be able to block malicious scripts from accessing the cookie\nvalue from JavaScript.\n\nExample of protecting an HttpCookie:\n```\n// Create an HttpOnly cookie.\nHttpCookie someCookie = new HttpCookie(\"SomeCookieName\", \"SomeValue\");\nsomeCookie.HttpOnly = true;\n```\n\nFor more information see:\nhttps://learn.microsoft.com/en-us/dotnet/api/system.web.httpcookie.httponly\n\nSession cookies should be configured with the following security directives:\n\n-\n[HTTPOnly](https://developer.mozilla.org/en-US/docs/Web/HTTP/Cookies#restrict_access_to_cookies)\n-\n[Secure](https://developer.mozilla.org/en-US/docs/Web/HTTP/Cookies#restrict_access_to_cookies)\n- [SameSite](https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/Set-Cookie/SameSite)\n"
+ },
+ "properties": {},
+ "ruleId": "security_code_scan.SCS0009-1"
+ },
+ {
+ "fingerprints": {
+ "matchBasedId/v1": "b2df8ae3974c54db5bba9cb1646cdb10662b499a3df7e4efb66bda5399747107985d792594cf145421bfe23b401546123f6dde48441338a03e3a7ecbd3672eb4_0"
+ },
+ "locations": [
+ {
+ "physicalLocation": {
+ "artifactLocation": {
+ "uri": "codeql_csharp/src/PersistentCookie.cs",
+ "uriBaseId": "%SRCROOT%"
+ },
+ "region": {
+ "endColumn": 61,
+ "endLine": 23,
+ "snippet": {
+ "text": " HttpCookie aCookie = new HttpCookie(\"lastVisit\");"
+ },
+ "startColumn": 24,
+ "startLine": 23
+ }
+ }
+ }
+ ],
+ "message": {
+ "text": "The `HttpOnly` attribute when set to `true` protects the cookie value from being accessed by\nclient side JavaScript such\nas reading the `document.cookie` values. By enabling this protection, a website that is\nvulnerable to\nCross-Site Scripting (XSS) will be able to block malicious scripts from accessing the cookie\nvalue from JavaScript.\n\nExample of protecting an HttpCookie:\n```\n// Create an HttpOnly cookie.\nHttpCookie someCookie = new HttpCookie(\"SomeCookieName\", \"SomeValue\");\nsomeCookie.HttpOnly = true;\n```\n\nFor more information see:\nhttps://learn.microsoft.com/en-us/dotnet/api/system.web.httpcookie.httponly\n\nSession cookies should be configured with the following security directives:\n\n-\n[HTTPOnly](https://developer.mozilla.org/en-US/docs/Web/HTTP/Cookies#restrict_access_to_cookies)\n-\n[Secure](https://developer.mozilla.org/en-US/docs/Web/HTTP/Cookies#restrict_access_to_cookies)\n- [SameSite](https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/Set-Cookie/SameSite)\n"
+ },
+ "properties": {},
+ "ruleId": "security_code_scan.SCS0009-1"
+ },
+ {
+ "fingerprints": {
+ "matchBasedId/v1": "b2df8ae3974c54db5bba9cb1646cdb10662b499a3df7e4efb66bda5399747107985d792594cf145421bfe23b401546123f6dde48441338a03e3a7ecbd3672eb4_1"
+ },
+ "locations": [
+ {
+ "physicalLocation": {
+ "artifactLocation": {
+ "uri": "codeql_csharp/src/PersistentCookie.cs",
+ "uriBaseId": "%SRCROOT%"
+ },
+ "region": {
+ "endColumn": 52,
+ "endLine": 24,
+ "snippet": {
+ "text": " aCookie.Value = DateTime.Now.ToString();"
+ },
+ "startColumn": 13,
+ "startLine": 24
+ }
+ }
+ }
+ ],
+ "message": {
+ "text": "The `HttpOnly` attribute when set to `true` protects the cookie value from being accessed by\nclient side JavaScript such\nas reading the `document.cookie` values. By enabling this protection, a website that is\nvulnerable to\nCross-Site Scripting (XSS) will be able to block malicious scripts from accessing the cookie\nvalue from JavaScript.\n\nExample of protecting an HttpCookie:\n```\n// Create an HttpOnly cookie.\nHttpCookie someCookie = new HttpCookie(\"SomeCookieName\", \"SomeValue\");\nsomeCookie.HttpOnly = true;\n```\n\nFor more information see:\nhttps://learn.microsoft.com/en-us/dotnet/api/system.web.httpcookie.httponly\n\nSession cookies should be configured with the following security directives:\n\n-\n[HTTPOnly](https://developer.mozilla.org/en-US/docs/Web/HTTP/Cookies#restrict_access_to_cookies)\n-\n[Secure](https://developer.mozilla.org/en-US/docs/Web/HTTP/Cookies#restrict_access_to_cookies)\n- [SameSite](https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/Set-Cookie/SameSite)\n"
+ },
+ "properties": {},
+ "ruleId": "security_code_scan.SCS0009-1"
+ },
+ {
+ "fingerprints": {
+ "matchBasedId/v1": "b2df8ae3974c54db5bba9cb1646cdb10662b499a3df7e4efb66bda5399747107985d792594cf145421bfe23b401546123f6dde48441338a03e3a7ecbd3672eb4_2"
+ },
+ "locations": [
+ {
+ "physicalLocation": {
+ "artifactLocation": {
+ "uri": "codeql_csharp/src/PersistentCookie.cs",
+ "uriBaseId": "%SRCROOT%"
+ },
+ "region": {
+ "endColumn": 54,
+ "endLine": 26,
+ "snippet": {
+ "text": " aCookie.Expires = DateTime.Now.AddDays(1); // BAD"
+ },
+ "startColumn": 13,
+ "startLine": 26
+ }
+ }
+ }
+ ],
+ "message": {
+ "text": "The `HttpOnly` attribute when set to `true` protects the cookie value from being accessed by\nclient side JavaScript such\nas reading the `document.cookie` values. By enabling this protection, a website that is\nvulnerable to\nCross-Site Scripting (XSS) will be able to block malicious scripts from accessing the cookie\nvalue from JavaScript.\n\nExample of protecting an HttpCookie:\n```\n// Create an HttpOnly cookie.\nHttpCookie someCookie = new HttpCookie(\"SomeCookieName\", \"SomeValue\");\nsomeCookie.HttpOnly = true;\n```\n\nFor more information see:\nhttps://learn.microsoft.com/en-us/dotnet/api/system.web.httpcookie.httponly\n\nSession cookies should be configured with the following security directives:\n\n-\n[HTTPOnly](https://developer.mozilla.org/en-US/docs/Web/HTTP/Cookies#restrict_access_to_cookies)\n-\n[Secure](https://developer.mozilla.org/en-US/docs/Web/HTTP/Cookies#restrict_access_to_cookies)\n- [SameSite](https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/Set-Cookie/SameSite)\n"
+ },
+ "properties": {},
+ "ruleId": "security_code_scan.SCS0009-1"
+ },
+ {
+ "fingerprints": {
+ "matchBasedId/v1": "b2df8ae3974c54db5bba9cb1646cdb10662b499a3df7e4efb66bda5399747107985d792594cf145421bfe23b401546123f6dde48441338a03e3a7ecbd3672eb4_3"
+ },
+ "locations": [
+ {
+ "physicalLocation": {
+ "artifactLocation": {
+ "uri": "codeql_csharp/src/PersistentCookie.cs",
+ "uriBaseId": "%SRCROOT%"
+ },
+ "region": {
+ "endColumn": 20,
+ "endLine": 30,
+ "snippet": {
+ "text": " aCookie.Expires = DateTime.Now.Add(new TimeSpan(1000)); // BAD"
+ },
+ "startColumn": 13,
+ "startLine": 30
+ }
+ }
+ }
+ ],
+ "message": {
+ "text": "The `HttpOnly` attribute when set to `true` protects the cookie value from being accessed by\nclient side JavaScript such\nas reading the `document.cookie` values. By enabling this protection, a website that is\nvulnerable to\nCross-Site Scripting (XSS) will be able to block malicious scripts from accessing the cookie\nvalue from JavaScript.\n\nExample of protecting an HttpCookie:\n```\n// Create an HttpOnly cookie.\nHttpCookie someCookie = new HttpCookie(\"SomeCookieName\", \"SomeValue\");\nsomeCookie.HttpOnly = true;\n```\n\nFor more information see:\nhttps://learn.microsoft.com/en-us/dotnet/api/system.web.httpcookie.httponly\n\nSession cookies should be configured with the following security directives:\n\n-\n[HTTPOnly](https://developer.mozilla.org/en-US/docs/Web/HTTP/Cookies#restrict_access_to_cookies)\n-\n[Secure](https://developer.mozilla.org/en-US/docs/Web/HTTP/Cookies#restrict_access_to_cookies)\n- [SameSite](https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/Set-Cookie/SameSite)\n"
+ },
+ "properties": {},
+ "ruleId": "security_code_scan.SCS0009-1"
+ },
+ {
+ "fingerprints": {
+ "matchBasedId/v1": "b2df8ae3974c54db5bba9cb1646cdb10662b499a3df7e4efb66bda5399747107985d792594cf145421bfe23b401546123f6dde48441338a03e3a7ecbd3672eb4_4"
+ },
+ "locations": [
+ {
+ "physicalLocation": {
+ "artifactLocation": {
+ "uri": "codeql_csharp/src/PersistentCookie.cs",
+ "uriBaseId": "%SRCROOT%"
+ },
+ "region": {
+ "endColumn": 20,
+ "endLine": 34,
+ "snippet": {
+ "text": " aCookie.Expires = DateTime.Now.AddMinutes(10); // BAD"
+ },
+ "startColumn": 13,
+ "startLine": 34
+ }
+ }
+ }
+ ],
+ "message": {
+ "text": "The `HttpOnly` attribute when set to `true` protects the cookie value from being accessed by\nclient side JavaScript such\nas reading the `document.cookie` values. By enabling this protection, a website that is\nvulnerable to\nCross-Site Scripting (XSS) will be able to block malicious scripts from accessing the cookie\nvalue from JavaScript.\n\nExample of protecting an HttpCookie:\n```\n// Create an HttpOnly cookie.\nHttpCookie someCookie = new HttpCookie(\"SomeCookieName\", \"SomeValue\");\nsomeCookie.HttpOnly = true;\n```\n\nFor more information see:\nhttps://learn.microsoft.com/en-us/dotnet/api/system.web.httpcookie.httponly\n\nSession cookies should be configured with the following security directives:\n\n-\n[HTTPOnly](https://developer.mozilla.org/en-US/docs/Web/HTTP/Cookies#restrict_access_to_cookies)\n-\n[Secure](https://developer.mozilla.org/en-US/docs/Web/HTTP/Cookies#restrict_access_to_cookies)\n- [SameSite](https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/Set-Cookie/SameSite)\n"
+ },
+ "properties": {},
+ "ruleId": "security_code_scan.SCS0009-1"
+ },
+ {
+ "fingerprints": {
+ "matchBasedId/v1": "b2df8ae3974c54db5bba9cb1646cdb10662b499a3df7e4efb66bda5399747107985d792594cf145421bfe23b401546123f6dde48441338a03e3a7ecbd3672eb4_5"
+ },
+ "locations": [
+ {
+ "physicalLocation": {
+ "artifactLocation": {
+ "uri": "codeql_csharp/src/PersistentCookie.cs",
+ "uriBaseId": "%SRCROOT%"
+ },
+ "region": {
+ "endColumn": 20,
+ "endLine": 38,
+ "snippet": {
+ "text": " aCookie.Expires = DateTime.Now.AddMinutes(-10.9); // GOOD"
+ },
+ "startColumn": 13,
+ "startLine": 38
+ }
+ }
+ }
+ ],
+ "message": {
+ "text": "The `HttpOnly` attribute when set to `true` protects the cookie value from being accessed by\nclient side JavaScript such\nas reading the `document.cookie` values. By enabling this protection, a website that is\nvulnerable to\nCross-Site Scripting (XSS) will be able to block malicious scripts from accessing the cookie\nvalue from JavaScript.\n\nExample of protecting an HttpCookie:\n```\n// Create an HttpOnly cookie.\nHttpCookie someCookie = new HttpCookie(\"SomeCookieName\", \"SomeValue\");\nsomeCookie.HttpOnly = true;\n```\n\nFor more information see:\nhttps://learn.microsoft.com/en-us/dotnet/api/system.web.httpcookie.httponly\n\nSession cookies should be configured with the following security directives:\n\n-\n[HTTPOnly](https://developer.mozilla.org/en-US/docs/Web/HTTP/Cookies#restrict_access_to_cookies)\n-\n[Secure](https://developer.mozilla.org/en-US/docs/Web/HTTP/Cookies#restrict_access_to_cookies)\n- [SameSite](https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/Set-Cookie/SameSite)\n"
+ },
+ "properties": {},
+ "ruleId": "security_code_scan.SCS0009-1"
+ },
+ {
+ "fingerprints": {
+ "matchBasedId/v1": "b2df8ae3974c54db5bba9cb1646cdb10662b499a3df7e4efb66bda5399747107985d792594cf145421bfe23b401546123f6dde48441338a03e3a7ecbd3672eb4_6"
+ },
+ "locations": [
+ {
+ "physicalLocation": {
+ "artifactLocation": {
+ "uri": "codeql_csharp/src/PersistentCookie.cs",
+ "uriBaseId": "%SRCROOT%"
+ },
+ "region": {
+ "endColumn": 20,
+ "endLine": 42,
+ "snippet": {
+ "text": " aCookie.Expires = DateTime.Now.AddSeconds(109); // GOOD"
+ },
+ "startColumn": 13,
+ "startLine": 42
+ }
+ }
+ }
+ ],
+ "message": {
+ "text": "The `HttpOnly` attribute when set to `true` protects the cookie value from being accessed by\nclient side JavaScript such\nas reading the `document.cookie` values. By enabling this protection, a website that is\nvulnerable to\nCross-Site Scripting (XSS) will be able to block malicious scripts from accessing the cookie\nvalue from JavaScript.\n\nExample of protecting an HttpCookie:\n```\n// Create an HttpOnly cookie.\nHttpCookie someCookie = new HttpCookie(\"SomeCookieName\", \"SomeValue\");\nsomeCookie.HttpOnly = true;\n```\n\nFor more information see:\nhttps://learn.microsoft.com/en-us/dotnet/api/system.web.httpcookie.httponly\n\nSession cookies should be configured with the following security directives:\n\n-\n[HTTPOnly](https://developer.mozilla.org/en-US/docs/Web/HTTP/Cookies#restrict_access_to_cookies)\n-\n[Secure](https://developer.mozilla.org/en-US/docs/Web/HTTP/Cookies#restrict_access_to_cookies)\n- [SameSite](https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/Set-Cookie/SameSite)\n"
+ },
+ "properties": {},
+ "ruleId": "security_code_scan.SCS0009-1"
+ },
+ {
+ "fingerprints": {
+ "matchBasedId/v1": "b2df8ae3974c54db5bba9cb1646cdb10662b499a3df7e4efb66bda5399747107985d792594cf145421bfe23b401546123f6dde48441338a03e3a7ecbd3672eb4_7"
+ },
+ "locations": [
+ {
+ "physicalLocation": {
+ "artifactLocation": {
+ "uri": "codeql_csharp/src/PersistentCookie.cs",
+ "uriBaseId": "%SRCROOT%"
+ },
+ "region": {
+ "endColumn": 20,
+ "endLine": 46,
+ "snippet": {
+ "text": " aCookie.Expires = DateTime.Now; // GOOD"
+ },
+ "startColumn": 13,
+ "startLine": 46
+ }
+ }
+ }
+ ],
+ "message": {
+ "text": "The `HttpOnly` attribute when set to `true` protects the cookie value from being accessed by\nclient side JavaScript such\nas reading the `document.cookie` values. By enabling this protection, a website that is\nvulnerable to\nCross-Site Scripting (XSS) will be able to block malicious scripts from accessing the cookie\nvalue from JavaScript.\n\nExample of protecting an HttpCookie:\n```\n// Create an HttpOnly cookie.\nHttpCookie someCookie = new HttpCookie(\"SomeCookieName\", \"SomeValue\");\nsomeCookie.HttpOnly = true;\n```\n\nFor more information see:\nhttps://learn.microsoft.com/en-us/dotnet/api/system.web.httpcookie.httponly\n\nSession cookies should be configured with the following security directives:\n\n-\n[HTTPOnly](https://developer.mozilla.org/en-US/docs/Web/HTTP/Cookies#restrict_access_to_cookies)\n-\n[Secure](https://developer.mozilla.org/en-US/docs/Web/HTTP/Cookies#restrict_access_to_cookies)\n- [SameSite](https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/Set-Cookie/SameSite)\n"
+ },
+ "properties": {},
+ "ruleId": "security_code_scan.SCS0009-1"
+ },
+ {
+ "fingerprints": {
+ "matchBasedId/v1": "dcb96dc4f22897ff56b2a29b92692acb3e0040eb4b28de40d7947788acb15efd59427844991b4f254709ca7097789ac8911cc43c88cc4faf3e157ce1f8487a91_0"
+ },
+ "locations": [
+ {
+ "physicalLocation": {
+ "artifactLocation": {
+ "uri": "codeql_csharp/src/CookieWithOverlyBroadDomain.cs",
+ "uriBaseId": "%SRCROOT%"
+ },
+ "region": {
+ "endColumn": 68,
+ "endLine": 8,
+ "snippet": {
+ "text": " System.Web.HttpCookie cookie1 = new HttpCookie(\"sessionID\");"
+ },
+ "startColumn": 31,
+ "startLine": 8
+ }
+ }
+ }
+ ],
+ "message": {
+ "text": "The `Secure` attribute when set to `true` protects the cookie value from being being\ntransmitted over clear text\ncommunication paths such as HTTP. By enabling this protection, the cookie will only be sent\nover HTTPS.\n\nExample of protecting an HttpCookie:\n```\n// Create an HttpOnly cookie.\nHttpCookie someCookie = new HttpCookie(\"SomeCookieName\", \"SomeValue\");\nsomeCookie.Secure = true;\n```\n\nFor more information see:\nhttps://learn.microsoft.com/en-us/dotnet/api/system.web.httpcookie.secure\n\nSession cookies should be configured with the following security directives:\n\n-\n[HTTPOnly](https://developer.mozilla.org/en-US/docs/Web/HTTP/Cookies#restrict_access_to_cookies)\n- [SameSite](https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/Set-Cookie/SameSite)\n-\n[Secure](https://developer.mozilla.org/en-US/docs/Web/HTTP/Cookies#restrict_access_to_cookies)\n"
+ },
+ "properties": {},
+ "ruleId": "security_code_scan.SCS0008-1"
+ },
+ {
+ "fingerprints": {
+ "matchBasedId/v1": "dcb96dc4f22897ff56b2a29b92692acb3e0040eb4b28de40d7947788acb15efd59427844991b4f254709ca7097789ac8911cc43c88cc4faf3e157ce1f8487a91_1"
+ },
+ "locations": [
+ {
+ "physicalLocation": {
+ "artifactLocation": {
+ "uri": "codeql_csharp/src/CookieWithOverlyBroadDomain.cs",
+ "uriBaseId": "%SRCROOT%"
+ },
+ "region": {
+ "endColumn": 43,
+ "endLine": 9,
+ "snippet": {
+ "text": " cookie1.Domain = \"online-bank.com\";"
+ },
+ "startColumn": 9,
+ "startLine": 9
+ }
+ }
+ }
+ ],
+ "message": {
+ "text": "The `Secure` attribute when set to `true` protects the cookie value from being being\ntransmitted over clear text\ncommunication paths such as HTTP. By enabling this protection, the cookie will only be sent\nover HTTPS.\n\nExample of protecting an HttpCookie:\n```\n// Create an HttpOnly cookie.\nHttpCookie someCookie = new HttpCookie(\"SomeCookieName\", \"SomeValue\");\nsomeCookie.Secure = true;\n```\n\nFor more information see:\nhttps://learn.microsoft.com/en-us/dotnet/api/system.web.httpcookie.secure\n\nSession cookies should be configured with the following security directives:\n\n-\n[HTTPOnly](https://developer.mozilla.org/en-US/docs/Web/HTTP/Cookies#restrict_access_to_cookies)\n- [SameSite](https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/Set-Cookie/SameSite)\n-\n[Secure](https://developer.mozilla.org/en-US/docs/Web/HTTP/Cookies#restrict_access_to_cookies)\n"
+ },
+ "properties": {},
+ "ruleId": "security_code_scan.SCS0008-1"
+ },
+ {
+ "fingerprints": {
+ "matchBasedId/v1": "cc14bafcd1553c2f879e4938df4c6eab3c0679b941d4546551adc32eef7e5367fc5a8beff116e96392f0db40f6960401af54d868bde426285baec73d65f962f5_0"
+ },
+ "locations": [
+ {
+ "physicalLocation": {
+ "artifactLocation": {
+ "uri": "codeql_csharp/src/CookieWithOverlyBroadDomain.cs",
+ "uriBaseId": "%SRCROOT%"
+ },
+ "region": {
+ "endColumn": 57,
+ "endLine": 11,
+ "snippet": {
+ "text": " HttpCookie cookie2 = new HttpCookie(\"sessionID\");"
+ },
+ "startColumn": 20,
+ "startLine": 11
+ }
+ }
+ }
+ ],
+ "message": {
+ "text": "The `Secure` attribute when set to `true` protects the cookie value from being being\ntransmitted over clear text\ncommunication paths such as HTTP. By enabling this protection, the cookie will only be sent\nover HTTPS.\n\nExample of protecting an HttpCookie:\n```\n// Create an HttpOnly cookie.\nHttpCookie someCookie = new HttpCookie(\"SomeCookieName\", \"SomeValue\");\nsomeCookie.Secure = true;\n```\n\nFor more information see:\nhttps://learn.microsoft.com/en-us/dotnet/api/system.web.httpcookie.secure\n\nSession cookies should be configured with the following security directives:\n\n-\n[HTTPOnly](https://developer.mozilla.org/en-US/docs/Web/HTTP/Cookies#restrict_access_to_cookies)\n- [SameSite](https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/Set-Cookie/SameSite)\n-\n[Secure](https://developer.mozilla.org/en-US/docs/Web/HTTP/Cookies#restrict_access_to_cookies)\n"
+ },
+ "properties": {},
+ "ruleId": "security_code_scan.SCS0008-1"
+ },
+ {
+ "fingerprints": {
+ "matchBasedId/v1": "cc14bafcd1553c2f879e4938df4c6eab3c0679b941d4546551adc32eef7e5367fc5a8beff116e96392f0db40f6960401af54d868bde426285baec73d65f962f5_1"
+ },
+ "locations": [
+ {
+ "physicalLocation": {
+ "artifactLocation": {
+ "uri": "codeql_csharp/src/CookieWithOverlyBroadDomain.cs",
+ "uriBaseId": "%SRCROOT%"
+ },
+ "region": {
+ "endColumn": 53,
+ "endLine": 12,
+ "snippet": {
+ "text": " cookie2.Domain = \".ebanking.online-bank.com\";"
+ },
+ "startColumn": 9,
+ "startLine": 12
+ }
+ }
+ }
+ ],
+ "message": {
+ "text": "The `Secure` attribute when set to `true` protects the cookie value from being being\ntransmitted over clear text\ncommunication paths such as HTTP. By enabling this protection, the cookie will only be sent\nover HTTPS.\n\nExample of protecting an HttpCookie:\n```\n// Create an HttpOnly cookie.\nHttpCookie someCookie = new HttpCookie(\"SomeCookieName\", \"SomeValue\");\nsomeCookie.Secure = true;\n```\n\nFor more information see:\nhttps://learn.microsoft.com/en-us/dotnet/api/system.web.httpcookie.secure\n\nSession cookies should be configured with the following security directives:\n\n-\n[HTTPOnly](https://developer.mozilla.org/en-US/docs/Web/HTTP/Cookies#restrict_access_to_cookies)\n- [SameSite](https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/Set-Cookie/SameSite)\n-\n[Secure](https://developer.mozilla.org/en-US/docs/Web/HTTP/Cookies#restrict_access_to_cookies)\n"
+ },
+ "properties": {},
+ "ruleId": "security_code_scan.SCS0008-1"
+ },
+ {
+ "fingerprints": {
+ "matchBasedId/v1": "afbbe51c7100fbba53f83a01576d315317f027a7af33fd9ef3254a0eb3fbc2c7e6c77471419f1bd9070b53f22b24e81fc37da42a40dcd0f25502527fc4309eb0_0"
+ },
+ "locations": [
+ {
+ "physicalLocation": {
+ "artifactLocation": {
+ "uri": "codeql_csharp/src/CookieWithOverlyBroadPathFix.cs",
+ "uriBaseId": "%SRCROOT%"
+ },
+ "region": {
+ "endColumn": 56,
+ "endLine": 8,
+ "snippet": {
+ "text": " HttpCookie cookie = new HttpCookie(\"sessionID\");"
+ },
+ "startColumn": 20,
+ "startLine": 8
+ }
+ }
+ }
+ ],
+ "message": {
+ "text": "The `Secure` attribute when set to `true` protects the cookie value from being being\ntransmitted over clear text\ncommunication paths such as HTTP. By enabling this protection, the cookie will only be sent\nover HTTPS.\n\nExample of protecting an HttpCookie:\n```\n// Create an HttpOnly cookie.\nHttpCookie someCookie = new HttpCookie(\"SomeCookieName\", \"SomeValue\");\nsomeCookie.Secure = true;\n```\n\nFor more information see:\nhttps://learn.microsoft.com/en-us/dotnet/api/system.web.httpcookie.secure\n\nSession cookies should be configured with the following security directives:\n\n-\n[HTTPOnly](https://developer.mozilla.org/en-US/docs/Web/HTTP/Cookies#restrict_access_to_cookies)\n- [SameSite](https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/Set-Cookie/SameSite)\n-\n[Secure](https://developer.mozilla.org/en-US/docs/Web/HTTP/Cookies#restrict_access_to_cookies)\n"
+ },
+ "properties": {},
+ "ruleId": "security_code_scan.SCS0008-1"
+ },
+ {
+ "fingerprints": {
+ "matchBasedId/v1": "afbbe51c7100fbba53f83a01576d315317f027a7af33fd9ef3254a0eb3fbc2c7e6c77471419f1bd9070b53f22b24e81fc37da42a40dcd0f25502527fc4309eb0_1"
+ },
+ "locations": [
+ {
+ "physicalLocation": {
+ "artifactLocation": {
+ "uri": "codeql_csharp/src/CookieWithOverlyBroadPathFix.cs",
+ "uriBaseId": "%SRCROOT%"
+ },
+ "region": {
+ "endColumn": 34,
+ "endLine": 9,
+ "snippet": {
+ "text": " cookie.Path = \"/ebanking\";"
+ },
+ "startColumn": 9,
+ "startLine": 9
+ }
+ }
+ }
+ ],
+ "message": {
+ "text": "The `Secure` attribute when set to `true` protects the cookie value from being being\ntransmitted over clear text\ncommunication paths such as HTTP. By enabling this protection, the cookie will only be sent\nover HTTPS.\n\nExample of protecting an HttpCookie:\n```\n// Create an HttpOnly cookie.\nHttpCookie someCookie = new HttpCookie(\"SomeCookieName\", \"SomeValue\");\nsomeCookie.Secure = true;\n```\n\nFor more information see:\nhttps://learn.microsoft.com/en-us/dotnet/api/system.web.httpcookie.secure\n\nSession cookies should be configured with the following security directives:\n\n-\n[HTTPOnly](https://developer.mozilla.org/en-US/docs/Web/HTTP/Cookies#restrict_access_to_cookies)\n- [SameSite](https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/Set-Cookie/SameSite)\n-\n[Secure](https://developer.mozilla.org/en-US/docs/Web/HTTP/Cookies#restrict_access_to_cookies)\n"
+ },
+ "properties": {},
+ "ruleId": "security_code_scan.SCS0008-1"
+ },
+ {
+ "fingerprints": {
+ "matchBasedId/v1": "55cf2e10e1b2d0ad41a352d88abd1e23dbf691569c9b3a1c929006bb75799e94aaa2ace612c20cdc5116d8f3ca990638c7ed6bcbecd9ef34d3f1f8ead5a4fed6_0"
+ },
+ "locations": [
+ {
+ "physicalLocation": {
+ "artifactLocation": {
+ "uri": "codeql_csharp/src/PersistentCookie.cs",
+ "uriBaseId": "%SRCROOT%"
+ },
+ "region": {
+ "endColumn": 61,
+ "endLine": 23,
+ "snippet": {
+ "text": " HttpCookie aCookie = new HttpCookie(\"lastVisit\");"
+ },
+ "startColumn": 24,
+ "startLine": 23
+ }
+ }
+ }
+ ],
+ "message": {
+ "text": "The `Secure` attribute when set to `true` protects the cookie value from being being\ntransmitted over clear text\ncommunication paths such as HTTP. By enabling this protection, the cookie will only be sent\nover HTTPS.\n\nExample of protecting an HttpCookie:\n```\n// Create an HttpOnly cookie.\nHttpCookie someCookie = new HttpCookie(\"SomeCookieName\", \"SomeValue\");\nsomeCookie.Secure = true;\n```\n\nFor more information see:\nhttps://learn.microsoft.com/en-us/dotnet/api/system.web.httpcookie.secure\n\nSession cookies should be configured with the following security directives:\n\n-\n[HTTPOnly](https://developer.mozilla.org/en-US/docs/Web/HTTP/Cookies#restrict_access_to_cookies)\n- [SameSite](https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/Set-Cookie/SameSite)\n-\n[Secure](https://developer.mozilla.org/en-US/docs/Web/HTTP/Cookies#restrict_access_to_cookies)\n"
+ },
+ "properties": {},
+ "ruleId": "security_code_scan.SCS0008-1"
+ },
+ {
+ "fingerprints": {
+ "matchBasedId/v1": "55cf2e10e1b2d0ad41a352d88abd1e23dbf691569c9b3a1c929006bb75799e94aaa2ace612c20cdc5116d8f3ca990638c7ed6bcbecd9ef34d3f1f8ead5a4fed6_1"
+ },
+ "locations": [
+ {
+ "physicalLocation": {
+ "artifactLocation": {
+ "uri": "codeql_csharp/src/PersistentCookie.cs",
+ "uriBaseId": "%SRCROOT%"
+ },
+ "region": {
+ "endColumn": 52,
+ "endLine": 24,
+ "snippet": {
+ "text": " aCookie.Value = DateTime.Now.ToString();"
+ },
+ "startColumn": 13,
+ "startLine": 24
+ }
+ }
+ }
+ ],
+ "message": {
+ "text": "The `Secure` attribute when set to `true` protects the cookie value from being being\ntransmitted over clear text\ncommunication paths such as HTTP. By enabling this protection, the cookie will only be sent\nover HTTPS.\n\nExample of protecting an HttpCookie:\n```\n// Create an HttpOnly cookie.\nHttpCookie someCookie = new HttpCookie(\"SomeCookieName\", \"SomeValue\");\nsomeCookie.Secure = true;\n```\n\nFor more information see:\nhttps://learn.microsoft.com/en-us/dotnet/api/system.web.httpcookie.secure\n\nSession cookies should be configured with the following security directives:\n\n-\n[HTTPOnly](https://developer.mozilla.org/en-US/docs/Web/HTTP/Cookies#restrict_access_to_cookies)\n- [SameSite](https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/Set-Cookie/SameSite)\n-\n[Secure](https://developer.mozilla.org/en-US/docs/Web/HTTP/Cookies#restrict_access_to_cookies)\n"
+ },
+ "properties": {},
+ "ruleId": "security_code_scan.SCS0008-1"
+ },
+ {
+ "fingerprints": {
+ "matchBasedId/v1": "55cf2e10e1b2d0ad41a352d88abd1e23dbf691569c9b3a1c929006bb75799e94aaa2ace612c20cdc5116d8f3ca990638c7ed6bcbecd9ef34d3f1f8ead5a4fed6_2"
+ },
+ "locations": [
+ {
+ "physicalLocation": {
+ "artifactLocation": {
+ "uri": "codeql_csharp/src/PersistentCookie.cs",
+ "uriBaseId": "%SRCROOT%"
+ },
+ "region": {
+ "endColumn": 54,
+ "endLine": 26,
+ "snippet": {
+ "text": " aCookie.Expires = DateTime.Now.AddDays(1); // BAD"
+ },
+ "startColumn": 13,
+ "startLine": 26
+ }
+ }
+ }
+ ],
+ "message": {
+ "text": "The `Secure` attribute when set to `true` protects the cookie value from being being\ntransmitted over clear text\ncommunication paths such as HTTP. By enabling this protection, the cookie will only be sent\nover HTTPS.\n\nExample of protecting an HttpCookie:\n```\n// Create an HttpOnly cookie.\nHttpCookie someCookie = new HttpCookie(\"SomeCookieName\", \"SomeValue\");\nsomeCookie.Secure = true;\n```\n\nFor more information see:\nhttps://learn.microsoft.com/en-us/dotnet/api/system.web.httpcookie.secure\n\nSession cookies should be configured with the following security directives:\n\n-\n[HTTPOnly](https://developer.mozilla.org/en-US/docs/Web/HTTP/Cookies#restrict_access_to_cookies)\n- [SameSite](https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/Set-Cookie/SameSite)\n-\n[Secure](https://developer.mozilla.org/en-US/docs/Web/HTTP/Cookies#restrict_access_to_cookies)\n"
+ },
+ "properties": {},
+ "ruleId": "security_code_scan.SCS0008-1"
+ },
+ {
+ "fingerprints": {
+ "matchBasedId/v1": "55cf2e10e1b2d0ad41a352d88abd1e23dbf691569c9b3a1c929006bb75799e94aaa2ace612c20cdc5116d8f3ca990638c7ed6bcbecd9ef34d3f1f8ead5a4fed6_3"
+ },
+ "locations": [
+ {
+ "physicalLocation": {
+ "artifactLocation": {
+ "uri": "codeql_csharp/src/PersistentCookie.cs",
+ "uriBaseId": "%SRCROOT%"
+ },
+ "region": {
+ "endColumn": 20,
+ "endLine": 30,
+ "snippet": {
+ "text": " aCookie.Expires = DateTime.Now.Add(new TimeSpan(1000)); // BAD"
+ },
+ "startColumn": 13,
+ "startLine": 30
+ }
+ }
+ }
+ ],
+ "message": {
+ "text": "The `Secure` attribute when set to `true` protects the cookie value from being being\ntransmitted over clear text\ncommunication paths such as HTTP. By enabling this protection, the cookie will only be sent\nover HTTPS.\n\nExample of protecting an HttpCookie:\n```\n// Create an HttpOnly cookie.\nHttpCookie someCookie = new HttpCookie(\"SomeCookieName\", \"SomeValue\");\nsomeCookie.Secure = true;\n```\n\nFor more information see:\nhttps://learn.microsoft.com/en-us/dotnet/api/system.web.httpcookie.secure\n\nSession cookies should be configured with the following security directives:\n\n-\n[HTTPOnly](https://developer.mozilla.org/en-US/docs/Web/HTTP/Cookies#restrict_access_to_cookies)\n- [SameSite](https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/Set-Cookie/SameSite)\n-\n[Secure](https://developer.mozilla.org/en-US/docs/Web/HTTP/Cookies#restrict_access_to_cookies)\n"
+ },
+ "properties": {},
+ "ruleId": "security_code_scan.SCS0008-1"
+ },
+ {
+ "fingerprints": {
+ "matchBasedId/v1": "55cf2e10e1b2d0ad41a352d88abd1e23dbf691569c9b3a1c929006bb75799e94aaa2ace612c20cdc5116d8f3ca990638c7ed6bcbecd9ef34d3f1f8ead5a4fed6_4"
+ },
+ "locations": [
+ {
+ "physicalLocation": {
+ "artifactLocation": {
+ "uri": "codeql_csharp/src/PersistentCookie.cs",
+ "uriBaseId": "%SRCROOT%"
+ },
+ "region": {
+ "endColumn": 20,
+ "endLine": 34,
+ "snippet": {
+ "text": " aCookie.Expires = DateTime.Now.AddMinutes(10); // BAD"
+ },
+ "startColumn": 13,
+ "startLine": 34
+ }
+ }
+ }
+ ],
+ "message": {
+ "text": "The `Secure` attribute when set to `true` protects the cookie value from being being\ntransmitted over clear text\ncommunication paths such as HTTP. By enabling this protection, the cookie will only be sent\nover HTTPS.\n\nExample of protecting an HttpCookie:\n```\n// Create an HttpOnly cookie.\nHttpCookie someCookie = new HttpCookie(\"SomeCookieName\", \"SomeValue\");\nsomeCookie.Secure = true;\n```\n\nFor more information see:\nhttps://learn.microsoft.com/en-us/dotnet/api/system.web.httpcookie.secure\n\nSession cookies should be configured with the following security directives:\n\n-\n[HTTPOnly](https://developer.mozilla.org/en-US/docs/Web/HTTP/Cookies#restrict_access_to_cookies)\n- [SameSite](https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/Set-Cookie/SameSite)\n-\n[Secure](https://developer.mozilla.org/en-US/docs/Web/HTTP/Cookies#restrict_access_to_cookies)\n"
+ },
+ "properties": {},
+ "ruleId": "security_code_scan.SCS0008-1"
+ },
+ {
+ "fingerprints": {
+ "matchBasedId/v1": "55cf2e10e1b2d0ad41a352d88abd1e23dbf691569c9b3a1c929006bb75799e94aaa2ace612c20cdc5116d8f3ca990638c7ed6bcbecd9ef34d3f1f8ead5a4fed6_5"
+ },
+ "locations": [
+ {
+ "physicalLocation": {
+ "artifactLocation": {
+ "uri": "codeql_csharp/src/PersistentCookie.cs",
+ "uriBaseId": "%SRCROOT%"
+ },
+ "region": {
+ "endColumn": 20,
+ "endLine": 38,
+ "snippet": {
+ "text": " aCookie.Expires = DateTime.Now.AddMinutes(-10.9); // GOOD"
+ },
+ "startColumn": 13,
+ "startLine": 38
+ }
+ }
+ }
+ ],
+ "message": {
+ "text": "The `Secure` attribute when set to `true` protects the cookie value from being being\ntransmitted over clear text\ncommunication paths such as HTTP. By enabling this protection, the cookie will only be sent\nover HTTPS.\n\nExample of protecting an HttpCookie:\n```\n// Create an HttpOnly cookie.\nHttpCookie someCookie = new HttpCookie(\"SomeCookieName\", \"SomeValue\");\nsomeCookie.Secure = true;\n```\n\nFor more information see:\nhttps://learn.microsoft.com/en-us/dotnet/api/system.web.httpcookie.secure\n\nSession cookies should be configured with the following security directives:\n\n-\n[HTTPOnly](https://developer.mozilla.org/en-US/docs/Web/HTTP/Cookies#restrict_access_to_cookies)\n- [SameSite](https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/Set-Cookie/SameSite)\n-\n[Secure](https://developer.mozilla.org/en-US/docs/Web/HTTP/Cookies#restrict_access_to_cookies)\n"
+ },
+ "properties": {},
+ "ruleId": "security_code_scan.SCS0008-1"
+ },
+ {
+ "fingerprints": {
+ "matchBasedId/v1": "55cf2e10e1b2d0ad41a352d88abd1e23dbf691569c9b3a1c929006bb75799e94aaa2ace612c20cdc5116d8f3ca990638c7ed6bcbecd9ef34d3f1f8ead5a4fed6_6"
+ },
+ "locations": [
+ {
+ "physicalLocation": {
+ "artifactLocation": {
+ "uri": "codeql_csharp/src/PersistentCookie.cs",
+ "uriBaseId": "%SRCROOT%"
+ },
+ "region": {
+ "endColumn": 20,
+ "endLine": 42,
+ "snippet": {
+ "text": " aCookie.Expires = DateTime.Now.AddSeconds(109); // GOOD"
+ },
+ "startColumn": 13,
+ "startLine": 42
+ }
+ }
+ }
+ ],
+ "message": {
+ "text": "The `Secure` attribute when set to `true` protects the cookie value from being being\ntransmitted over clear text\ncommunication paths such as HTTP. By enabling this protection, the cookie will only be sent\nover HTTPS.\n\nExample of protecting an HttpCookie:\n```\n// Create an HttpOnly cookie.\nHttpCookie someCookie = new HttpCookie(\"SomeCookieName\", \"SomeValue\");\nsomeCookie.Secure = true;\n```\n\nFor more information see:\nhttps://learn.microsoft.com/en-us/dotnet/api/system.web.httpcookie.secure\n\nSession cookies should be configured with the following security directives:\n\n-\n[HTTPOnly](https://developer.mozilla.org/en-US/docs/Web/HTTP/Cookies#restrict_access_to_cookies)\n- [SameSite](https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/Set-Cookie/SameSite)\n-\n[Secure](https://developer.mozilla.org/en-US/docs/Web/HTTP/Cookies#restrict_access_to_cookies)\n"
+ },
+ "properties": {},
+ "ruleId": "security_code_scan.SCS0008-1"
+ },
+ {
+ "fingerprints": {
+ "matchBasedId/v1": "55cf2e10e1b2d0ad41a352d88abd1e23dbf691569c9b3a1c929006bb75799e94aaa2ace612c20cdc5116d8f3ca990638c7ed6bcbecd9ef34d3f1f8ead5a4fed6_7"
+ },
+ "locations": [
+ {
+ "physicalLocation": {
+ "artifactLocation": {
+ "uri": "codeql_csharp/src/PersistentCookie.cs",
+ "uriBaseId": "%SRCROOT%"
+ },
+ "region": {
+ "endColumn": 20,
+ "endLine": 46,
+ "snippet": {
+ "text": " aCookie.Expires = DateTime.Now; // GOOD"
+ },
+ "startColumn": 13,
+ "startLine": 46
+ }
+ }
+ }
+ ],
+ "message": {
+ "text": "The `Secure` attribute when set to `true` protects the cookie value from being being\ntransmitted over clear text\ncommunication paths such as HTTP. By enabling this protection, the cookie will only be sent\nover HTTPS.\n\nExample of protecting an HttpCookie:\n```\n// Create an HttpOnly cookie.\nHttpCookie someCookie = new HttpCookie(\"SomeCookieName\", \"SomeValue\");\nsomeCookie.Secure = true;\n```\n\nFor more information see:\nhttps://learn.microsoft.com/en-us/dotnet/api/system.web.httpcookie.secure\n\nSession cookies should be configured with the following security directives:\n\n-\n[HTTPOnly](https://developer.mozilla.org/en-US/docs/Web/HTTP/Cookies#restrict_access_to_cookies)\n- [SameSite](https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/Set-Cookie/SameSite)\n-\n[Secure](https://developer.mozilla.org/en-US/docs/Web/HTTP/Cookies#restrict_access_to_cookies)\n"
+ },
+ "properties": {},
+ "ruleId": "security_code_scan.SCS0008-1"
+ },
+ {
+ "fingerprints": {
+ "matchBasedId/v1": "5c74e812e7b3e239d3840bf5cbedb89bd96fa02e3f9cbb067139627e8dcd968619173b621ba157b1c81844b94565a0943ab4ea3d395daaae4e8f0d24e568f925_0"
+ },
+ "locations": [
+ {
+ "physicalLocation": {
+ "artifactLocation": {
+ "uri": "codeql_csharp/src/InsufficientKeySize.cs",
+ "uriBaseId": "%SRCROOT%"
+ },
+ "region": {
+ "endColumn": 74,
+ "endLine": 202,
+ "snippet": {
+ "text": " DESCryptoServiceProvider key = new DESCryptoServiceProvider(); // BAD"
+ },
+ "startColumn": 13,
+ "startLine": 202
+ }
+ }
+ }
+ ],
+ "message": {
+ "text": "DES, TripleDES and RC2 are all considered broken or insecure cryptographic algorithms.\nIf using .NET Framework greater than version 6.0 consider using `ChaCha20Poly1305`\ninstead as it is easier and faster than the alternatives such as `AES-256-GCM`.\n\nFor older applications, `AES-256-GCM` is recommended, however it has many drawbacks:\n- Slower than `ChaCha20Poly1305`.\n- Catastrophic failure if nonce values are reused.\n\nExample using `ChaCha20Poly1305`:\n```\n// Generate a random key\nbyte[] key = new byte[32];\nRandomNumberGenerator.Fill(key);\n\n// Note nonce values _must_ be regenerated every time they are used.\nbyte[] nonce = new byte[12];\nRandomNumberGenerator.Fill(nonce);\n\nbyte[] authTag = new byte[16];\nbyte[] cipherText;\n\nusing (ChaCha20Poly1305 encryptor = new ChaCha20Poly1305(key))\n{\n byte[] plainText = System.Text.Encoding.UTF8.GetBytes(\"Secret text to encrypt\");\n cipherText = new byte[plainText.Length];\n encryptor.Encrypt(nonce, plainText, cipherText, authTag);\n}\n\nusing (ChaCha20Poly1305 decryptor = new ChaCha20Poly1305(key))\n{\n byte[] output = new byte[cipherText.Length];\n decryptor.Decrypt(nonce, cipherText, authTag, output);\n Console.WriteLine(\"Output: {0}\", System.Text.Encoding.UTF8.GetString(output));\n}\n```\n\nExample using `AES-256-GCM`:\n```\n// Generate a random key\nbyte[] key = new byte[32];\nRandomNumberGenerator.Fill(key);\n\n// Note nonce values _must_ be regenerated every time they are used.\nbyte[] nonce = new byte[AesGcm.NonceByteSizes.MaxSize];\nRandomNumberGenerator.Fill(nonce);\n\nbyte[] authTag = new byte[AesGcm.TagByteSizes.MaxSize];\nbyte[] cipherText;\n\nusing (AesGcm encryptor = new AesGcm(key))\n{\n byte[] plainText = Encoding.UTF8.GetBytes(\"Secret text to encrypt\");\n cipherText = new byte[plainText.Length];\n encryptor.Encrypt(nonce, plainText, cipherText, authTag);\n}\n\nusing (AesGcm decryptor = new AesGcm(key))\n{\n byte[] output = new byte[cipherText.Length];\n decryptor.Decrypt(nonce, cipherText, authTag, output);\n Console.WriteLine(\"Output: {0}\", Encoding.UTF8.GetString(output));\n}\n```\n"
+ },
+ "properties": {},
+ "ruleId": "security_code_scan.SCS0010-1"
+ },
+ {
+ "fingerprints": {
+ "matchBasedId/v1": "5c74e812e7b3e239d3840bf5cbedb89bd96fa02e3f9cbb067139627e8dcd968619173b621ba157b1c81844b94565a0943ab4ea3d395daaae4e8f0d24e568f925_1"
+ },
+ "locations": [
+ {
+ "physicalLocation": {
+ "artifactLocation": {
+ "uri": "codeql_csharp/src/InsufficientKeySize.cs",
+ "uriBaseId": "%SRCROOT%"
+ },
+ "region": {
+ "endColumn": 77,
+ "endLine": 278,
+ "snippet": {
+ "text": " RC2CryptoServiceProvider rc2CSP = new RC2CryptoServiceProvider();"
+ },
+ "startColumn": 13,
+ "startLine": 278
+ }
+ }
+ }
+ ],
+ "message": {
+ "text": "DES, TripleDES and RC2 are all considered broken or insecure cryptographic algorithms.\nIf using .NET Framework greater than version 6.0 consider using `ChaCha20Poly1305`\ninstead as it is easier and faster than the alternatives such as `AES-256-GCM`.\n\nFor older applications, `AES-256-GCM` is recommended, however it has many drawbacks:\n- Slower than `ChaCha20Poly1305`.\n- Catastrophic failure if nonce values are reused.\n\nExample using `ChaCha20Poly1305`:\n```\n// Generate a random key\nbyte[] key = new byte[32];\nRandomNumberGenerator.Fill(key);\n\n// Note nonce values _must_ be regenerated every time they are used.\nbyte[] nonce = new byte[12];\nRandomNumberGenerator.Fill(nonce);\n\nbyte[] authTag = new byte[16];\nbyte[] cipherText;\n\nusing (ChaCha20Poly1305 encryptor = new ChaCha20Poly1305(key))\n{\n byte[] plainText = System.Text.Encoding.UTF8.GetBytes(\"Secret text to encrypt\");\n cipherText = new byte[plainText.Length];\n encryptor.Encrypt(nonce, plainText, cipherText, authTag);\n}\n\nusing (ChaCha20Poly1305 decryptor = new ChaCha20Poly1305(key))\n{\n byte[] output = new byte[cipherText.Length];\n decryptor.Decrypt(nonce, cipherText, authTag, output);\n Console.WriteLine(\"Output: {0}\", System.Text.Encoding.UTF8.GetString(output));\n}\n```\n\nExample using `AES-256-GCM`:\n```\n// Generate a random key\nbyte[] key = new byte[32];\nRandomNumberGenerator.Fill(key);\n\n// Note nonce values _must_ be regenerated every time they are used.\nbyte[] nonce = new byte[AesGcm.NonceByteSizes.MaxSize];\nRandomNumberGenerator.Fill(nonce);\n\nbyte[] authTag = new byte[AesGcm.TagByteSizes.MaxSize];\nbyte[] cipherText;\n\nusing (AesGcm encryptor = new AesGcm(key))\n{\n byte[] plainText = Encoding.UTF8.GetBytes(\"Secret text to encrypt\");\n cipherText = new byte[plainText.Length];\n encryptor.Encrypt(nonce, plainText, cipherText, authTag);\n}\n\nusing (AesGcm decryptor = new AesGcm(key))\n{\n byte[] output = new byte[cipherText.Length];\n decryptor.Decrypt(nonce, cipherText, authTag, output);\n Console.WriteLine(\"Output: {0}\", Encoding.UTF8.GetString(output));\n}\n```\n"
+ },
+ "properties": {},
+ "ruleId": "security_code_scan.SCS0010-1"
+ },
+ {
+ "fingerprints": {
+ "matchBasedId/v1": "f32abe09f1fcbd639a3e50717e780d20837f46da4291d9036615e19b1a577c7b84ee5859c806417b16371bfc21b977cbeb97b5c9ba2cd00e8bf0157caf98a82a_0"
+ },
+ "locations": [
+ {
+ "physicalLocation": {
+ "artifactLocation": {
+ "uri": "codeql_csharp/src/WeakEncryption.cs",
+ "uriBaseId": "%SRCROOT%"
+ },
+ "region": {
+ "endColumn": 76,
+ "endLine": 8,
+ "snippet": {
+ "text": " SymmetricAlgorithm serviceProvider = new DESCryptoServiceProvider();"
+ },
+ "startColumn": 9,
+ "startLine": 8
+ }
+ }
+ }
+ ],
+ "message": {
+ "text": "DES, TripleDES and RC2 are all considered broken or insecure cryptographic algorithms.\nIf using .NET Framework greater than version 6.0 consider using `ChaCha20Poly1305`\ninstead as it is easier and faster than the alternatives such as `AES-256-GCM`.\n\nFor older applications, `AES-256-GCM` is recommended, however it has many drawbacks:\n- Slower than `ChaCha20Poly1305`.\n- Catastrophic failure if nonce values are reused.\n\nExample using `ChaCha20Poly1305`:\n```\n// Generate a random key\nbyte[] key = new byte[32];\nRandomNumberGenerator.Fill(key);\n\n// Note nonce values _must_ be regenerated every time they are used.\nbyte[] nonce = new byte[12];\nRandomNumberGenerator.Fill(nonce);\n\nbyte[] authTag = new byte[16];\nbyte[] cipherText;\n\nusing (ChaCha20Poly1305 encryptor = new ChaCha20Poly1305(key))\n{\n byte[] plainText = System.Text.Encoding.UTF8.GetBytes(\"Secret text to encrypt\");\n cipherText = new byte[plainText.Length];\n encryptor.Encrypt(nonce, plainText, cipherText, authTag);\n}\n\nusing (ChaCha20Poly1305 decryptor = new ChaCha20Poly1305(key))\n{\n byte[] output = new byte[cipherText.Length];\n decryptor.Decrypt(nonce, cipherText, authTag, output);\n Console.WriteLine(\"Output: {0}\", System.Text.Encoding.UTF8.GetString(output));\n}\n```\n\nExample using `AES-256-GCM`:\n```\n// Generate a random key\nbyte[] key = new byte[32];\nRandomNumberGenerator.Fill(key);\n\n// Note nonce values _must_ be regenerated every time they are used.\nbyte[] nonce = new byte[AesGcm.NonceByteSizes.MaxSize];\nRandomNumberGenerator.Fill(nonce);\n\nbyte[] authTag = new byte[AesGcm.TagByteSizes.MaxSize];\nbyte[] cipherText;\n\nusing (AesGcm encryptor = new AesGcm(key))\n{\n byte[] plainText = Encoding.UTF8.GetBytes(\"Secret text to encrypt\");\n cipherText = new byte[plainText.Length];\n encryptor.Encrypt(nonce, plainText, cipherText, authTag);\n}\n\nusing (AesGcm decryptor = new AesGcm(key))\n{\n byte[] output = new byte[cipherText.Length];\n decryptor.Decrypt(nonce, cipherText, authTag, output);\n Console.WriteLine(\"Output: {0}\", Encoding.UTF8.GetString(output));\n}\n```\n"
+ },
+ "properties": {},
+ "ruleId": "security_code_scan.SCS0010-1"
+ },
+ {
+ "fingerprints": {
+ "matchBasedId/v1": "a7eecde60d33d47a9240ab7e4043b22cd7c1813394934ba8582715acf06abfac6c74a1fd13f67c1805a49e7137c499acb1b565da98a09a4a39c539588ba30dd1_0"
+ },
+ "locations": [
+ {
+ "physicalLocation": {
+ "artifactLocation": {
+ "uri": "codeql_csharp/src/InsecureRandomness.cs",
+ "uriBaseId": "%SRCROOT%"
+ },
+ "region": {
+ "endColumn": 41,
+ "endLine": 8,
+ "snippet": {
+ "text": " string password = \"mypassword\" + gen.Next();"
+ },
+ "startColumn": 38,
+ "startLine": 8
+ }
+ }
+ }
+ ],
+ "message": {
+ "text": "Depending on the context, generating weak random numbers may expose cryptographic functions\nwhich rely on these numbers to be exploitable. When generating numbers for sensitive values\nsuch as tokens, nonces, and cryptographic keys, it is recommended that the\n`RandomNumberGenerator` class be used.\n\nExample `RandomNumberGenerator` usage:\n```\nInt32 randInt = RandomNumberGenerator.GetInt32(32000);\nbyte[] randomBytes = new byte[64];\nRandomNumberGenerator.Fill(randomBytes);\nConsole.WriteLine(\"Random Int32: {0}\", randInt);\nConsole.WriteLine(\"Random Bytes: {0}\", BitConverter.ToString(randomBytes).Replace(\"-\", \"\"));\n```\n\nFor more information see:\nhttps://learn.microsoft.com/en-us/dotnet/api/system.security.cryptography.randomnumbergenerator\n"
+ },
+ "properties": {},
+ "ruleId": "security_code_scan.SCS0005-1"
+ },
+ {
+ "fingerprints": {
+ "matchBasedId/v1": "0bece680856ae076b4441f1ab257750acdce9726ea255e0b7b38355ed12d0e014535f8599b45a1270cea24368b24b104fdb6c8104255866401c7f6a20a39b1ac_0"
+ },
+ "locations": [
+ {
+ "physicalLocation": {
+ "artifactLocation": {
+ "uri": "codeql_csharp/src/UnsafeDeserializationUntrustedInputTypeBad.cs",
+ "uriBaseId": "%SRCROOT%"
+ },
+ "region": {
+ "endColumn": 32,
+ "endLine": 12,
+ "snippet": {
+ "text": " return ds.ReadObject(s);"
+ },
+ "startColumn": 16,
+ "startLine": 12
+ }
+ }
+ }
+ ],
+ "message": {
+ "text": "Deserialization attacks exploit the process of reading serialized data and turning it back\ninto an object. By constructing malicious objects and serializing them, an adversary may\nattempt to:\n\n- Inject code that is executed upon object construction, which occurs during the\ndeserialization process.\n- Exploit mass assignment by including fields that are not normally a part of the serialized\ndata but are read in during deserialization.\n\nMicrosoft recommends no longer using the following serialization formats:\n- BinaryFormatter\n- SoapFormatter\n- NetDataContractSerializer\n- LosFormatter\n- ObjectStateFormatter\n\nConsider safer alternatives such as serializing data in the JSON format. Ensure any format\nchosen allows\nthe application to specify exactly which object types are allowed to be deserialized.\nAdditionally, when\ndeserializing, never deserialize to base object types like `Object` and only cast to the exact\nobject\ntype that is expected.\n\nTo protect against mass assignment, only allow deserialization of the specific fields that are\nrequired. If this is not easily done, consider creating an intermediary type that\ncan be serialized with only the necessary fields exposed.\n\nFor more information see Microsoft's deserialization security guide:\nhttps://learn.microsoft.com/en-us/dotnet/standard/serialization/binaryformatter-security-guide\n\nFor more details on deserialization attacks in general, see OWASP's guide:\nhttps://cheatsheetseries.owasp.org/cheatsheets/Deserialization_Cheat_Sheet.html\n\nIt should be noted that [tools exist](https://github.com/pwntester/ysoserial.net) to\nautomatically create\nexploit code for these vulnerabilities.\n"
+ },
+ "properties": {},
+ "ruleId": "security_code_scan.SCS0028-1"
+ },
+ {
+ "fingerprints": {
+ "matchBasedId/v1": "dc5cedef964f16b5ba5086127e3060cd3b44c07e76790f5cb2ccdb56f6054b68c1cebeb1f49631b72d16e678c65dd5abacbceb926f1ea47207d034774860f8b7_0"
+ },
+ "locations": [
+ {
+ "physicalLocation": {
+ "artifactLocation": {
+ "uri": "codeql_csharp/src/UnsafeDeserializationUntrustedInputTypeGood.cs",
+ "uriBaseId": "%SRCROOT%"
+ },
+ "region": {
+ "endColumn": 38,
+ "endLine": 19,
+ "snippet": {
+ "text": " return (Poco)ds.ReadObject(s);"
+ },
+ "startColumn": 22,
+ "startLine": 19
+ }
+ }
+ }
+ ],
+ "message": {
+ "text": "Deserialization attacks exploit the process of reading serialized data and turning it back\ninto an object. By constructing malicious objects and serializing them, an adversary may\nattempt to:\n\n- Inject code that is executed upon object construction, which occurs during the\ndeserialization process.\n- Exploit mass assignment by including fields that are not normally a part of the serialized\ndata but are read in during deserialization.\n\nMicrosoft recommends no longer using the following serialization formats:\n- BinaryFormatter\n- SoapFormatter\n- NetDataContractSerializer\n- LosFormatter\n- ObjectStateFormatter\n\nConsider safer alternatives such as serializing data in the JSON format. Ensure any format\nchosen allows\nthe application to specify exactly which object types are allowed to be deserialized.\nAdditionally, when\ndeserializing, never deserialize to base object types like `Object` and only cast to the exact\nobject\ntype that is expected.\n\nTo protect against mass assignment, only allow deserialization of the specific fields that are\nrequired. If this is not easily done, consider creating an intermediary type that\ncan be serialized with only the necessary fields exposed.\n\nFor more information see Microsoft's deserialization security guide:\nhttps://learn.microsoft.com/en-us/dotnet/standard/serialization/binaryformatter-security-guide\n\nFor more details on deserialization attacks in general, see OWASP's guide:\nhttps://cheatsheetseries.owasp.org/cheatsheets/Deserialization_Cheat_Sheet.html\n\nIt should be noted that [tools exist](https://github.com/pwntester/ysoserial.net) to\nautomatically create\nexploit code for these vulnerabilities.\n"
+ },
+ "properties": {},
+ "ruleId": "security_code_scan.SCS0028-1"
+ }
+ ],
+ "tool": {
+ "driver": {
+ "name": "semgrep",
+ "rules": [
+ {
+ "defaultConfiguration": {
+ "level": "warning"
+ },
+ "fullDescription": {
+ "text": "The application may allow open redirects if created using user supplied input. Open redirects\nare\ncommonly\nabused in phishing attacks where the original domain or URL looks like a legitimate link, but\nthen\nredirects a user to a malicious site. An example would be\n`https://example.com/redirect?url=https://%62%61%64%2e%63%6f%6d%2f%66%61%6b%65%6c%6f%67%69%6e`\nwhich,\nwhen decoded, turns into `bad.com/fakelogin`.\n\nNever redirect a client based on user input. It is recommended that the list of target links\nto\nredirect a user to are contained server side, and retrieved using a numerical value\nas an index to return the link to be redirected to. For example, `/redirect?id=1` would cause\nthe\napplication to look up the `1` index and return a URL such as `https://example.com`. This URL\nwould\nthen be used to redirect the user, using the 301 response code and `Location` header.\n\nFor more information on open redirects see OWASP's guide:\nhttps://cheatsheetseries.owasp.org/cheatsheets/Unvalidated_Redirects_and_Forwards_Cheat_Sheet.html\n"
+ },
+ "id": "security_code_scan.SCS0027-1",
+ "name": "security_code_scan.SCS0027-1",
+ "properties": {
+ "precision": "very-high",
+ "tags": [
+ "CWE-601",
+ "security"
+ ]
+ },
+ "shortDescription": {
+ "text": "URL redirection to untrusted site 'open redirect'"
+ }
+ },
+ {
+ "defaultConfiguration": {
+ "level": "warning"
+ },
+ "fullDescription": {
+ "text": "The RC4 stream-cipher has been cryptographically broken and is unsuitable\nfor use in production. It is recommended that ChaCha20 or Advanced Encryption\nStandard (AES) be used instead. Consider using `XChaCha20Poly1305` or `AES-256-GCM`.\n\nFor older applications, `AES-256-GCM` is recommended, however it has many drawbacks:\n- Slower than `XChaCha20Poly1305`\n- Smaller nonce value size compared to `XChaCha20Poly1305`\n- Catastrophic failure if nonce values are re-used\n\nExample using\n[XChaCha20Poly1305](https://pkg.go.dev/golang.org/x/crypto/chacha20poly1305#NewX):\n```\nkey := make([]byte, chacha20poly1305.KeySize)\nif _, err := io.ReadFull(rand.Reader, key); err != nil {\n log.Fatal(err)\n}\n\n// NewX is a variant that uses longer nonce values for better security\naead, err := chacha20poly1305.NewX(key)\nif err != nil {\n log.Fatal(err)\n}\n\nvar encrypted = []byte{}\nvar nonce = []byte{}\n\n// Encryption routine\n{\n msg := []byte(\"Some secret message\")\n nonce = make([]byte, aead.NonceSize())\n if _, err := io.ReadFull(rand.Reader, nonce); err != nil {\n log.Fatal(\"failed to generate nonce\")\n }\n\n encrypted = aead.Seal(nil, nonce, msg, nil)\n}\n\n// Decryption routine\n{\n if len(encrypted) < aead.NonceSize() {\n log.Fatal(\"incorrect ciphertext length\")\n }\n\n msg, err := aead.Open(nil, nonce, encrypted, nil)\n if err != nil {\n log.Fatal(err)\n }\n fmt.Printf(\"Decrypted: %s\\n\", msg)\n}\n```\n\nExample using [AES-256-GCM](https://pkg.go.dev/crypto/cipher#NewGCM):\n```\n// 32 byte keys will configure AES-256\nkey := make([]byte, 32)\nif _, err := io.ReadFull(rand.Reader, key); err != nil {\n log.Fatal(err)\n}\n\nblockCipher, err := aes.NewCipher(key)\nif err != nil {\n log.Fatal(err)\n}\n\naead, err := cipher.NewGCM(blockCipher)\nif err != nil {\n log.Fatal(err)\n}\n\nvar encrypted = []byte{}\nvar nonce = []byte{}\n// Encryption routine\n{\n msg := []byte(\"Some secret message\")\n // note that the key must be rotated every 2^32 random nonces used otherwise\n // cipher text could be repeated\n nonce = make([]byte, 12)\n if _, err := io.ReadFull(rand.Reader, nonce); err != nil {\n log.Fatal(err)\n }\n encrypted = aead.Seal(nil, nonce, msg, nil)\n}\n\n// Decryption routine\n{\n msg, err := aead.Open(nil, nonce, encrypted, nil)\n if err != nil {\n log.Fatal(err)\n }\n fmt.Printf(\"Decrypted: %s\\n\", msg)\n}\n```\n"
+ },
+ "id": "gosec.G503-1",
+ "name": "gosec.G503-1",
+ "properties": {
+ "precision": "very-high",
+ "tags": [
+ "CWE-327",
+ "OWASP-A9:2017-Using Components with Known Vulnerabilities",
+ "security"
+ ]
+ },
+ "shortDescription": {
+ "text": "Use of a broken or risky cryptographic algorithm"
+ }
+ },
+ {
+ "defaultConfiguration": {
+ "level": "warning"
+ },
+ "fullDescription": {
+ "text": "Markup escaping disabled. This can be used with some template engines to escape\ndisabling of HTML entities, which can lead to XSS attacks.\n"
+ },
+ "id": "eslint.detect-disable-mustache-escape",
+ "name": "eslint.detect-disable-mustache-escape",
+ "properties": {
+ "precision": "very-high",
+ "tags": [
+ "CWE-79",
+ "OWASP-A7:2017-Cross-Site Scripting (XSS)",
+ "security"
+ ]
+ },
+ "shortDescription": {
+ "text": "Improper neutralization of input during web page generation (XSS)"
+ }
+ },
+ {
+ "defaultConfiguration": {
+ "level": "warning"
+ },
+ "fullDescription": {
+ "text": "\"The software uses an HTTP request parameter to construct a pathname that should be within a\nrestricted directory, but it does not properly neutralize sequences such as \"..\" that can\nresolve to a location that is outside of that directory. See\nhttp://cwe.mitre.org/data/definitions/23.html for more information.\"\n"
+ },
+ "id": "find_sec_bugs.PT_RELATIVE_PATH_TRAVERSAL-1",
+ "name": "find_sec_bugs.PT_RELATIVE_PATH_TRAVERSAL-1",
+ "properties": {
+ "precision": "very-high",
+ "tags": [
+ "CWE-22",
+ "security"
+ ]
+ },
+ "shortDescription": {
+ "text": "Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')"
+ }
+ },
+ {
+ "defaultConfiguration": {
+ "level": "warning"
+ },
+ "fullDescription": {
+ "text": "\"The software uses an HTTP request parameter to construct a pathname that should be within a\nrestricted directory, but it does not properly neutralize sequences such as \"..\" that can\nresolve to a location that is outside of that directory. See\nhttp://cwe.mitre.org/data/definitions/23.html for more information.\"\n"
+ },
+ "id": "find_sec_bugs.PT_RELATIVE_PATH_TRAVERSAL-1",
+ "name": "find_sec_bugs.PT_RELATIVE_PATH_TRAVERSAL-1",
+ "properties": {
+ "precision": "very-high",
+ "tags": [
+ "CWE-22",
+ "security"
+ ]
+ },
+ "shortDescription": {
+ "text": "Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')"
+ }
+ },
+ {
+ "defaultConfiguration": {
+ "level": "warning"
+ },
+ "fullDescription": {
+ "text": "The `RegExp` constructor was called with a non-literal variable. If an adversary were able to\nsupply a malicious regex, they could cause a Regular Expression Denial of Service (ReDoS)\nagainst the application. In Node applications, this could cause the entire application to no\nlonger\nbe responsive to other users' requests.\n\nTo remediate this issue, never allow user-supplied regular expressions. Instead, the regular\nexpression should be\nhardcoded. If this is not possible, consider using an alternative regular expression engine\nsuch as [node-re2](https://www.npmjs.com/package/re2). RE2 is a safe alternative that does not\nsupport backtracking, which is what leads to ReDoS.\n\nExample using re2 which does not support backtracking (Note: it is still recommended to\nnever use user-supplied input):\n```\n// Import the re2 module\nconst RE2 = require('re2');\n\nfunction match(userSuppliedRegex, userInput) {\n // Create a RE2 object with the user supplied regex, this is relatively safe\n // due to RE2 not supporting backtracking which can be abused to cause long running\n // queries\n var re = new RE2(userSuppliedRegex);\n // Execute the regular expression against some userInput\n var result = re.exec(userInput);\n // Work with the result\n}\n```\n\nFor more information on Regular Expression DoS see:\n- https://owasp.org/www-community/attacks/Regular_expression_Denial_of_Service_-_ReDoS\n"
+ },
+ "id": "eslint.detect-non-literal-regexp",
+ "name": "eslint.detect-non-literal-regexp",
+ "properties": {
+ "precision": "very-high",
+ "tags": [
+ "CWE-185",
+ "security"
+ ]
+ },
+ "shortDescription": {
+ "text": "Incorrect regular expression"
+ }
+ },
+ {
+ "defaultConfiguration": {
+ "level": "warning"
+ },
+ "fullDescription": {
+ "text": "Do not grant dangerous combinations of permissions.\n"
+ },
+ "id": "find_sec_bugs.DANGEROUS_PERMISSION_COMBINATION-1",
+ "name": "find_sec_bugs.DANGEROUS_PERMISSION_COMBINATION-1",
+ "properties": {
+ "precision": "very-high",
+ "tags": [
+ "CWE-269",
+ "HIGH CONFIDENCE",
+ "security"
+ ]
+ },
+ "shortDescription": {
+ "text": "Improper privilege management"
+ }
+ },
+ {
+ "defaultConfiguration": {
+ "level": "warning"
+ },
+ "fullDescription": {
+ "text": "The application was found to permit the `RuntimePermission` of `createClassLoader`,\n`ReflectPermission` of `suppressAccessChecks`, or both.\n\nBy granting the `RuntimePermission` of `createClassLoader`, a compromised application\ncould instantiate their own class loaders and load arbitrary classes.\n\nBy granting the `ReflectPermission` of `suppressAccessChecks` an application will no longer\ncheck Java language access checks on fields and methods of a class. This will effectively\ngrant access to protected and private members.\n\nFor more information on `RuntimePermission` see:\nhttps://docs.oracle.com/javase/8/docs/api/java/lang/RuntimePermission.html\n\nFor more information on `ReflectPermission` see:\nhttps://docs.oracle.com/javase/8/docs/api/java/lang/reflect/ReflectPermission.html\n"
+ },
+ "id": "find_sec_bugs.DANGEROUS_PERMISSION_COMBINATION-1",
+ "name": "find_sec_bugs.DANGEROUS_PERMISSION_COMBINATION-1",
+ "properties": {
+ "precision": "very-high",
+ "tags": [
+ "CWE-269",
+ "HIGH CONFIDENCE",
+ "security"
+ ]
+ },
+ "shortDescription": {
+ "text": "Improper privilege management"
+ }
+ },
+ {
+ "defaultConfiguration": {
+ "level": "warning"
+ },
+ "fullDescription": {
+ "text": "The application is generating an RSA key that is less than the recommended 2048 bits.\nThe National Institute of Standards and Technology (NIST) deprecated signing Digital\nCertificates that contained RSA Public Keys of 1024 bits in December 2010. While\n1024-bit RSA keys have not been factored yet, advances in compute may make it possible\nin the near future.\n\nTo generate an RSA key of 2048 pass the number of bits as the second parameter to\nthe `rsa.GenerateKey` function:\n```\nimport (\n \"crypto/rand\"\n \"crypto/rsa\"\n)\n\nfunc generate() {\n key, err := rsa.GenerateKey(rand.Reader, 2048)\n if err != nil {\n log.Fatal(err)\n }\n}\n```\n"
+ },
+ "id": "gosec.G403-1",
+ "name": "gosec.G403-1",
+ "properties": {
+ "precision": "very-high",
+ "tags": [
+ "CWE-326",
+ "OWASP-A3:2017-Sensitive Data Exposure",
+ "security"
+ ]
+ },
+ "shortDescription": {
+ "text": "Inadequate encryption strength"
+ }
+ },
+ {
+ "defaultConfiguration": {
+ "level": "warning"
+ },
+ "fullDescription": {
+ "text": "Check implementation on installation, or limit the size of all string inputs.\n"
+ },
+ "id": "flawfinder.getopt-1.getopt_long-1",
+ "name": "flawfinder.getopt-1.getopt_long-1",
+ "properties": {
+ "precision": "very-high",
+ "tags": [
+ "CWE-120",
+ "OWASP-A1:2017-Injection",
+ "security"
+ ]
+ },
+ "shortDescription": {
+ "text": "Some older implementations do not protect against internal buffer overflows (CWE-120, CWE-20)"
+ }
+ },
+ {
+ "defaultConfiguration": {
+ "level": "note"
+ },
+ "fullDescription": {
+ "text": "Consider using more secure alternatives such as `snprintf`, instead of the\n`wcsncat` family of functions.\n\nIf developing for C Runtime Library (CRT), more secure versions of these functions should be\nused, see:\nhttps://learn.microsoft.com/en-us/cpp/c-runtime-library/reference/strncat-strncat-l-wcsncat-wcsncat-l-mbsncat-mbsncat-l?view=msvc-170\n"
+ },
+ "id": "flawfinder.lstrcatn-1.wcsncat-1._tcsncat-1._mbsnbcat-1",
+ "name": "flawfinder.lstrcatn-1.wcsncat-1._tcsncat-1._mbsnbcat-1",
+ "properties": {
+ "precision": "very-high",
+ "tags": [
+ "CWE-120",
+ "OWASP-A1:2017-Injection",
+ "security"
+ ]
+ },
+ "shortDescription": {
+ "text": "Easily misused string processing functions"
+ }
+ },
+ {
+ "defaultConfiguration": {
+ "level": "error"
+ },
+ "fullDescription": {
+ "text": "The application was found using an unsafe version of `yaml` load which is vulnerable to\ndeserialization attacks. Deserialization attacks exploit the process of reading serialized\ndata and turning it back\ninto an object. By constructing malicious objects and serializing them, an adversary may\nattempt to:\n\n- Inject code that is executed upon object construction, which occurs during the\ndeserialization process.\n- Exploit mass assignment by including fields that are not normally a part of the serialized\ndata but are read in during deserialization.\n\nTo remediate this issue, use `safe_load()` or call `yaml.load()` with the `Loader` argument\nset to\n`yaml.SafeLoader`.\n\nExample loading YAML using `safe_load`:\n```\nimport yaml\n\n# Use safe_load to load data into an intermediary object\nintermediary_object = yaml.safe_load(\"\"\"user:\n name: 'test user'\"\"\"\n)\n# Create our real object, copying over only the necessary fields\nuser_object = {'user': {\n # Assign the deserialized data from intermediary object\n 'name': intermediary_object['user']['name'],\n # Add in protected data in object definition (or set it from a class constructor)\n 'is_admin': False,\n }\n}\n# Work with user_object\n# ...\n```\n\nFor more details on deserialization attacks in general, see OWASP's guide:\n- https://cheatsheetseries.owasp.org/cheatsheets/Deserialization_Cheat_Sheet.html\n"
+ },
+ "id": "bandit.B506",
+ "name": "bandit.B506",
+ "properties": {
+ "precision": "very-high",
+ "tags": [
+ "CWE-502",
+ "OWASP-A8:2017-Insecure Deserialization",
+ "security"
+ ]
+ },
+ "shortDescription": {
+ "text": "Deserialization of untrusted data"
+ }
+ },
+ {
+ "defaultConfiguration": {
+ "level": "warning"
+ },
+ "fullDescription": {
+ "text": "External XML entities are a feature of XML parsers that allow documents to contain references\nto\nother documents or data. This feature can be abused to read files, communicate with external\nhosts,\nexfiltrate data, or cause a Denial of Service (DoS).\n\nXML parsers and document loaders must be configured to not resolve entities. This can be done\nby:\n- Ensuring you are running a version of .NET Framework greater than 4.5.2 (released in 2014).\n- Using `XDocument` which disables entity resolution and is generally safe from DoS.\n- Setting `XmlDocument`'s `XmlResolver` to null.\n- Setting `XmlTextReader`'s `ProhibitDtd` to `true`\n- Setting `XmlReaderSettings` `DtdProcessing` to `DtdProcessing.Prohibit`\n\nExample of safely loading an XML file using `XmlDocument`:\n```\nXmlDocument document = new XmlDocument();\ndocument.XmlResolver = null;\ndocument.Load(\"users.xml\");\n```\n\nFor more information on XML security, see OWASP's guide:\nhttps://cheatsheetseries.owasp.org/cheatsheets/XML_External_Entity_Prevention_Cheat_Sheet.html#net\n"
+ },
+ "id": "security_code_scan.SCS0007-1",
+ "name": "security_code_scan.SCS0007-1",
+ "properties": {
+ "precision": "very-high",
+ "tags": [
+ "CWE-611",
+ "security"
+ ]
+ },
+ "shortDescription": {
+ "text": "Improper restriction of XML external entity reference ('XXE')"
+ }
+ },
+ {
+ "defaultConfiguration": {
+ "level": "error"
+ },
+ "fullDescription": {
+ "text": "The application may be vulnerable to a path traversal if it extracts untrusted archive files.\nThis vulnerability is colloquially known as 'Zip Slip'. Archive files may contain folders\nwhich,\nwhen extracted, may write outside of the intended directory. This is exploited by including\npath traversal characters such as `../../other/directory` to overwrite or place files in system\nor application directories.\n\nExtra care must be taken when extracting archive files as there are numerous concerns:\n\n- If possible, generate unique filenames instead of using the archives file names, as it may be\npossible for users to overwrite files if the filenames are the same.\n- Validate file paths are written with a prefixed, known trusted directory.\n- Only process regular files and not symbolic links, as some applications may attempt to\nread/follow\nthe symbolic link, leading to arbitrary file read / write vulnerabilities.\n\nExample of securely processing an archive file:\n```\nimport tarfile\nimport uuid\n# import os\n\ntar = tarfile.open('some.tar')\n\n# Max number of allowed files in our archive\nmax_files = 10\n# Max size for all files in archive\nmax_size = 1024 * 1024 * 10 # 10MB\n# Max size per file in archive\nmax_file_size = 1024 * 1024 # 1MB\n\n# Validate number of files in archive\nif len(tar.getmembers()) > max_files:\n raise Exception(\"Too many files in archive\")\n\ntotal_size = 0\n# Loop over all files to see if we exceed max size\n# if so, do not process any of them.\nfor f in tar.getmembers():\n total_size += f.size\n if total_size >= max_size:\n raise Exception(\"Archive files exceeded max file size\")\n\n# Iterate over files now that we know the total size is within limits\nfor f in tar.getmembers():\n # Internally this calls TarInfo.isreg() which ensures\n # the file is a regular file and not a sym link or directory\n if not f.isfile():\n continue\n\n # Optional, set a limit on each file size\n if f.size > max_file_size:\n raise Exception(f\"File {f.name} too large: {f.size}\")\n\n # If original names are required, ensure that only the\n # filename is used:\n # filename = os.path.basename(f.name)\n\n # More secure, generate a UUID4 value instead\n filename = uuid.uuid4().hex\n\n # Reset the archive filename to the basename\n # Newer versions of python (3.11.4+) should use:\n # new_tar = old_tar.replace(name=...new name...)\n f.name = filename\n\n # Extract the file into a restricted directory, with our\n # own user's attributes, not the file from the archive\n tar.extract(f, '/opt/app/restricted/', set_attrs=False)\n```\n\nFor more information on tarfile see:\n- https://docs.python.org/3/library/tarfile.html\n"
+ },
+ "id": "bandit.B202",
+ "name": "bandit.B202",
+ "properties": {
+ "precision": "very-high",
+ "tags": [
+ "CWE-22",
+ "security"
+ ]
+ },
+ "shortDescription": {
+ "text": "Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')"
+ }
+ },
+ {
+ "defaultConfiguration": {
+ "level": "warning"
+ },
+ "fullDescription": {
+ "text": "There exists a possible race condition in between the time that `tempnam` or `tmpnam`\nreturns a pathname, and the time that the program opens it, another program might create\nthat pathname using `open`, or create it as a symbolic link.\n\nConsider using the `mkstemp` function instead, but be aware it also contains possible\nrisks. Ensure the process has called the `umask` function with restricted permissions prior\nto calling `mkstemp` and validate the permissions prior to using the file descriptor.\n\nFor more information on temporary files please see:\nhttps://wiki.sei.cmu.edu/confluence/pages/viewpage.action?pageId=87152425\n"
+ },
+ "id": "flawfinder.tmpnam-1.tempnam-1",
+ "name": "flawfinder.tmpnam-1.tempnam-1",
+ "properties": {
+ "precision": "very-high",
+ "tags": [
+ "CWE-377",
+ "OWASP-A5:2017-Broken Access Control",
+ "security"
+ ]
+ },
+ "shortDescription": {
+ "text": "Potential time of check time of use vulnerability (tmpnam/tempnam)"
+ }
+ },
+ {
+ "defaultConfiguration": {
+ "level": "warning"
+ },
+ "fullDescription": {
+ "text": "The application was found using an insecure or risky digest or signature algorithm. MD2, MD4,\n MD5 and SHA1 hash algorithms have been found to be vulnerable to producing collisions.\n\nThis means\nthat two different values, when hashed, can lead to the same hash value. If the application is\ntrying\nto use these hash methods for storing passwords, then it is recommended to switch to a\npassword hashing\nalgorithm such as Argon2id or PBKDF2.\n\nNote that the `Crypto` and `Cryptodome` Python packages are no longer recommended for\nnew applications, instead consider using the [cryptography](https://cryptography.io/) package.\n\nExample of creating a SHA-384 hash using the `cryptography` package:\n```\nfrom cryptography.hazmat.primitives import hashes\n# Create a SHA384 digest\ndigest = hashes.Hash(hashes.SHA384())\n# Update the digest with some initial data\ndigest.update(b\"some data to hash\")\n# Add more data to the digest\ndigest.update(b\"some more data\")\n# Finalize the digest as bytes\nresult = digest.finalize()\n```\n\nFor more information on secure password storage see OWASP:\n- https://cheatsheetseries.owasp.org/cheatsheets/Password_Storage_Cheat_Sheet.html\n\nFor more information on the cryptography module see:\n- https://cryptography.io/en/latest/\n"
+ },
+ "id": "bandit.B303-1",
+ "name": "bandit.B303-1",
+ "properties": {
+ "precision": "very-high",
+ "tags": [
+ "CWE-327",
+ "OWASP-A3:2017-Sensitive Data Exposure",
+ "security"
+ ]
+ },
+ "shortDescription": {
+ "text": "Use of a broken or risky cryptographic algorithm"
+ }
+ },
+ {
+ "defaultConfiguration": {
+ "level": "warning"
+ },
+ "fullDescription": {
+ "text": "The highlighted API is used to execute a system command. If unfiltered input is passed to this\nAPI, it can lead to arbitrary command execution.\n"
+ },
+ "id": "find_sec_bugs.COMMAND_INJECTION-1.SCALA_COMMAND_INJECTION-1",
+ "name": "find_sec_bugs.COMMAND_INJECTION-1.SCALA_COMMAND_INJECTION-1",
+ "properties": {
+ "precision": "very-high",
+ "tags": [
+ "CWE-78",
+ "security"
+ ]
+ },
+ "shortDescription": {
+ "text": "Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')"
+ }
+ },
+ {
+ "defaultConfiguration": {
+ "level": "error"
+ },
+ "fullDescription": {
+ "text": "This specific mode of CBC with PKCS5Padding is susceptible to padding oracle attacks. An\nadversary could potentially decrypt the message if the system exposed the difference between\nplaintext with invalid padding or valid padding. The distinction between valid and invalid\npadding is usually revealed through distinct error messages being returned for each condition.\n"
+ },
+ "id": "find_sec_bugs.PADDING_ORACLE-1",
+ "name": "find_sec_bugs.PADDING_ORACLE-1",
+ "properties": {
+ "precision": "very-high",
+ "tags": [
+ "CWE-696",
+ "security"
+ ]
+ },
+ "shortDescription": {
+ "text": "Incorrect Behavior Order"
+ }
+ },
+ {
+ "defaultConfiguration": {
+ "level": "error"
+ },
+ "fullDescription": {
+ "text": "Cryptographic block ciphers can be configured to pad individual blocks if there is not enough\ninput data to match the size of the block. This specific mode of CBC used in combination with\nPKCS5Padding is susceptible to padding oracle attacks. An adversary could potentially decrypt\nthe message if the system exposed the difference between plaintext with invalid padding or\nvalid padding. The distinction between valid and invalid padding is usually revealed through\ndistinct error messages being returned for each condition.\n\nConsider switching to a more secure cipher that doesn't require padding and builds in message\nauthentication integrity directly into the algorithm.\n\nConsider using `ChaCha20Poly1305` or\n`AES-256-GCM` instead.\n\nFor older applications that don't have support for `ChaCha20Poly1305`, `AES-256-GCM` is\nrecommended, however it has many drawbacks:\n - Slower than `ChaCha20Poly1305`.\n - Catastrophic failure if nonce values are reused.\n\nExample using `ChaCha20Poly1305`:\n```\npublic encrypt() throws Exception {\n chaChaEncryption(\"Secret text to encrypt\".getBytes(StandardCharsets.UTF_8));\n}\n\npublic SecureRandom getSecureRandomDRBG() throws NoSuchAlgorithmException {\n // Use DRBG according to\nhttp://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-90Ar1.pdf\n return SecureRandom.getInstance(\"DRBG\",\n // Security strength in bits (default is 128)\n DrbgParameters.instantiation(256,\n // Set prediction resistance and re-seeding\n DrbgParameters.Capability.PR_AND_RESEED,\n // Set the personalization string (optional, not necessary)\n \"some_personalization_string\".getBytes()\n )\n );\n}\n\npublic Cipher getChaCha20Poly1305(int mode, byte[] ivKey, byte[] secretKey) throws\nNoSuchAlgorithmException, NoSuchPaddingException, InvalidKeyException,\nInvalidAlgorithmParameterException {\n // Get a DRBG random number generator instance\n SecureRandom random = getSecureRandomDRBG();\n // Create a ChaCha20-Poly1305 cipher instance\n Cipher chaChaCipher = Cipher.getInstance(\"ChaCha20-Poly1305/None/NoPadding\");\n // Create our parameterSpec using our ivKey\n AlgorithmParameterSpec parameterSpec = new IvParameterSpec(ivKey);\n // Create a SecretKeySpec using our secretKey\n SecretKeySpec secretKeySpec = new SecretKeySpec(secretKey, \"ChaCha20\");\n // Initialize and return the cipher for the provided mode\n chaChaCipher.init(mode, secretKeySpec, parameterSpec, random);\n return chaChaCipher;\n}\n\npublic void chaChaEncryption(byte[] plainText) throws NoSuchAlgorithmException,\nNoSuchPaddingException, InvalidKeyException, InvalidAlgorithmParameterException {\n // Get a DRBG random number generator instance\n SecureRandom random = getSecureRandomDRBG();\n // Create secretKey\n byte[] secretKey = new byte[32];\n random.nextBytes(secretKey);\n // Create an IV Key\n byte[] ivKey = new byte[12];\n random.nextBytes(ivKey);\n\n // Create a chaCha encryption cipher instance\n Cipher chaChaEncryptor = getChaCha20Poly1305(Cipher.ENCRYPT_MODE, ivKey, secretKey);\n\n // Encrypt the text using ChaCha20Poly1305\n byte[] cipherText = null;\n try {\n cipherText = chaChaEncryptor.doFinal(plainText);\n } catch (IllegalBlockSizeException | BadPaddingException e) {\n System.out.println(\"failed to encrypt text\");\n return;\n }\n System.out.println(\"encrypted: \" + Base64.getEncoder().encodeToString(cipherText));\n\n // Create a chaCha decryption cipher instance\n Cipher chaChaDecryptor = getChaCha20Poly1305(Cipher.DECRYPT_MODE, ivKey, secretKey);\n\n // Decrypt the text\n byte[] decryptedText = null;\n try {\n decryptedText = chaChaDecryptor.doFinal(cipherText);\n } catch (IllegalBlockSizeException | BadPaddingException e) {\n System.out.println(\"failed to decrypt text\");\n return;\n }\n System.out.println(\"decrypted: \" + new String(decryptedText, StandardCharsets.UTF_8));\n}\n```\n\nFor more information on padding oracle attacks see:\nhttps://en.wikipedia.org/wiki/Padding_oracle_attack\n\nFor more information on Java Cryptography see:\nhttps://docs.oracle.com/en/java/javase/15/security/java-cryptography-architecture-jca-reference-guide.html\n"
+ },
+ "id": "find_sec_bugs.PADDING_ORACLE-1",
+ "name": "find_sec_bugs.PADDING_ORACLE-1",
+ "properties": {
+ "precision": "very-high",
+ "tags": [
+ "CWE-327",
+ "security"
+ ]
+ },
+ "shortDescription": {
+ "text": "Use of a broken or risky cryptographic algorithm"
+ }
+ },
+ {
+ "defaultConfiguration": {
+ "level": "warning"
+ },
+ "fullDescription": {
+ "text": "The Blowfish encryption algorithm was meant as a drop-in replacement for DES and was created in\n1993. Smaller key sizes may make the ciphertext vulnerable to [birthday\nattacks](https://en.wikipedia.org/wiki/Birthday_attack). While no known attacks against\nBlowfish\nexist, it should never be used to encrypt files over 4GB in size. If possible consider\nusing ChaCha20Poly1305 or AES-GCM instead of Blowfish.\n\nFor older applications that don't have support for `ChaCha20Poly1305`, `AES-256-GCM` is\nrecommended, however it has many drawbacks:\n - Slower than `ChaCha20Poly1305`.\n - Catastrophic failure if nonce values are reused.\n\nNote that the `Crypto` and `Cryptodome` Python packages are no longer recommended for\nnew applications, instead consider using the [cryptography](https://cryptography.io/) package.\n\nExample using `ChaCha20Poly1305`:\n```\nimport os\n# Import ChaCha20Poly1305 from cryptography\nfrom cryptography.hazmat.primitives.ciphers.aead import ChaCha20Poly1305\n# Our plaintext to encrypt\nplain_text = b\"Secret text to encrypt\"\n# We do not require authenticated but unencrypted data, so set to None\naad = None\n# Generate a secure key\nkey = ChaCha20Poly1305.generate_key()\n# Create a new ChaCha20Poly1305 instance with our secure key\nchacha = ChaCha20Poly1305(key)\n# Note: nonce values _must_ be regenerated every time they are used.\nnonce = os.urandom(12)\n# Encrypt our plaintext\ncipher_text = chacha.encrypt(nonce, plain_text, aad)\n# Decrypt the plain text using the nonce and cipher_text\nchacha.decrypt(nonce, cipher_text, aad)\n```\n\nExample using `AESGCM`:\n```\nimport os\n# Import AESGCM from cryptography\nfrom cryptography.hazmat.primitives.ciphers.aead import AESGCM\n# Our plaintext to encrypt\nplain_text = b\"Secret text to encrypt\"\n# We do not require authenticated but unencrypted data, so set to None\naad = None\n# Generate a secure key\nkey = AESGCM.generate_key(bit_length=128)\n# Create a new AESGCM instance with our secure key\naesgcm = AESGCM(key)\n# Note: nonce values _must_ be regenerated every time they are used.\nnonce = os.urandom(12)\n# Encrypt our plaintext\ncipher_text = aesgcm.encrypt(nonce, plain_text, aad)\n# Decrypt the plain text using the nonce and cipher_text\naesgcm.decrypt(nonce, cipher_text, aad)\n```\n\nFor more information on the cryptography module see:\n- https://cryptography.io/en/latest/\n"
+ },
+ "id": "bandit.B304-7",
+ "name": "bandit.B304-7",
+ "properties": {
+ "precision": "very-high",
+ "tags": [
+ "CWE-327",
+ "OWASP-A3:2017-Sensitive Data Exposure",
+ "security"
+ ]
+ },
+ "shortDescription": {
+ "text": "Use of a broken or risky cryptographic algorithm"
+ }
+ },
+ {
+ "defaultConfiguration": {
+ "level": "warning"
+ },
+ "fullDescription": {
+ "text": "`getwd` does not contain a parameter to limit how many characters can be copied into the\ndestination buffer. For portability and security reasons `getwd` has been deprecated in\nfavor of `getcwd`.\n\nFor more information please see: https://linux.die.net/man/3/getcwd\n"
+ },
+ "id": "flawfinder.getwd-1",
+ "name": "flawfinder.getwd-1",
+ "properties": {
+ "precision": "very-high",
+ "tags": [
+ "CWE-120",
+ "OWASP-A1:2017-Injection",
+ "security"
+ ]
+ },
+ "shortDescription": {
+ "text": "Insufficient protection against buffer overflow (getwd)"
+ }
+ },
+ {
+ "defaultConfiguration": {
+ "level": "warning"
+ },
+ "fullDescription": {
+ "text": "Detected a dynamic value being used with urllib. urllib supports `file://` schemes, so a\ndynamic value controlled by a malicious actor may allow them to read arbitrary files. Audit\nuses of urllib calls to ensure user data cannot control the URLs, or consider using the\n`requests` library instead.\n"
+ },
+ "id": "bandit.B310-2",
+ "name": "bandit.B310-2",
+ "properties": {
+ "precision": "very-high",
+ "tags": [
+ "CWE-939",
+ "OWASP-A5:2017-Broken Access Control",
+ "security"
+ ]
+ },
+ "shortDescription": {
+ "text": "Improper Authorization in Handler for Custom URL Scheme"
+ }
+ },
+ {
+ "defaultConfiguration": {
+ "level": "warning"
+ },
+ "fullDescription": {
+ "text": "The `HttpOnly` attribute when set to `true` protects the cookie value from being accessed by\nclient side JavaScript such\nas reading the `document.cookie` values. By enabling this protection, a website that is\nvulnerable to\nCross-Site Scripting (XSS) will be able to block malicious scripts from accessing the cookie\nvalue from JavaScript.\n\nExample of protecting an HttpCookie:\n```\n// Create an HttpOnly cookie.\nHttpCookie someCookie = new HttpCookie(\"SomeCookieName\", \"SomeValue\");\nsomeCookie.HttpOnly = true;\n```\n\nFor more information see:\nhttps://learn.microsoft.com/en-us/dotnet/api/system.web.httpcookie.httponly\n\nSession cookies should be configured with the following security directives:\n\n-\n[HTTPOnly](https://developer.mozilla.org/en-US/docs/Web/HTTP/Cookies#restrict_access_to_cookies)\n-\n[Secure](https://developer.mozilla.org/en-US/docs/Web/HTTP/Cookies#restrict_access_to_cookies)\n- [SameSite](https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/Set-Cookie/SameSite)\n"
+ },
+ "id": "security_code_scan.SCS0009-1",
+ "name": "security_code_scan.SCS0009-1",
+ "properties": {
+ "precision": "very-high",
+ "tags": [
+ "CWE-1004",
+ "security"
+ ]
+ },
+ "shortDescription": {
+ "text": "Sensitive cookie without 'HttpOnly' flag"
+ }
+ },
+ {
+ "defaultConfiguration": {
+ "level": "warning"
+ },
+ "fullDescription": {
+ "text": "The NullCipher implements the Cipher interface by returning ciphertext identical to the\nsupplied plaintext. In a few contexts, such as testing, a NullCipher may be appropriate. Avoid\nusing the NullCipher. Its accidental use can introduce a significant confidentiality risk.\n"
+ },
+ "id": "find_sec_bugs.NULL_CIPHER-1",
+ "name": "find_sec_bugs.NULL_CIPHER-1",
+ "properties": {
+ "precision": "very-high",
+ "tags": [
+ "CWE-327",
+ "security"
+ ]
+ },
+ "shortDescription": {
+ "text": "Use of a Broken or Risky Cryptographic Algorithm"
+ }
+ },
+ {
+ "defaultConfiguration": {
+ "level": "warning"
+ },
+ "fullDescription": {
+ "text": "The application was found creating a `NullCipher` instance. `NullCipher` implements the\n`Cipher` interface by returning ciphertext identical to the supplied plaintext. This means\nany data passed to the `doFinal(...)` or `update(...)` methods will not actually encrypt\nthe input.\n\nRemove the NullCipher reference and replace with a legitimate `Cipher` instance such as\n`ChaCha20-Poly1305`\n\nExample using `ChaCha20Poly1305`:\n```\npublic encrypt() throws Exception {\n chaChaEncryption(\"Secret text to encrypt\".getBytes(StandardCharsets.UTF_8));\n}\n\npublic SecureRandom getSecureRandomDRBG() throws NoSuchAlgorithmException {\n // Use DRBG according to\nhttp://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-90Ar1.pdf\n return SecureRandom.getInstance(\"DRBG\",\n // Security strength in bits (default is 128)\n DrbgParameters.instantiation(256,\n // Set prediction resistance and re-seeding\n DrbgParameters.Capability.PR_AND_RESEED,\n // Set the personalization string (optional, not necessary)\n \"some_personalization_string\".getBytes()\n )\n );\n}\n\npublic Cipher getChaCha20Poly1305(int mode, byte[] ivKey, byte[] secretKey) throws\nNoSuchAlgorithmException, NoSuchPaddingException, InvalidKeyException,\nInvalidAlgorithmParameterException {\n // Get a DRBG random number generator instance\n SecureRandom random = getSecureRandomDRBG();\n // Create a ChaCha20-Poly1305 cipher instance\n Cipher chaChaCipher = Cipher.getInstance(\"ChaCha20-Poly1305/None/NoPadding\");\n // Create our parameterSpec using our ivKey\n AlgorithmParameterSpec parameterSpec = new IvParameterSpec(ivKey);\n // Create a SecretKeySpec using our secretKey\n SecretKeySpec secretKeySpec = new SecretKeySpec(secretKey, \"ChaCha20\");\n // Initialize and return the cipher for the provided mode\n chaChaCipher.init(mode, secretKeySpec, parameterSpec, random);\n return chaChaCipher;\n}\n\npublic void chaChaEncryption(byte[] plainText) throws NoSuchAlgorithmException,\nNoSuchPaddingException, InvalidKeyException, InvalidAlgorithmParameterException {\n // Get a DRBG random number generator instance\n SecureRandom random = getSecureRandomDRBG();\n // Create secretKey\n byte[] secretKey = new byte[32];\n random.nextBytes(secretKey);\n // Create an IV Key\n byte[] ivKey = new byte[12];\n random.nextBytes(ivKey);\n\n // Create a chaCha encryption cipher instance\n Cipher chaChaEncryptor = getChaCha20Poly1305(Cipher.ENCRYPT_MODE, ivKey, secretKey);\n\n // Encrypt the text using ChaCha20Poly1305\n byte[] cipherText = null;\n try {\n cipherText = chaChaEncryptor.doFinal(plainText);\n } catch (IllegalBlockSizeException | BadPaddingException e) {\n System.out.println(\"failed to encrypt text\");\n return;\n }\n System.out.println(\"encrypted: \" + Base64.getEncoder().encodeToString(cipherText));\n\n // Create a chaCha decryption cipher instance\n Cipher chaChaDecryptor = getChaCha20Poly1305(Cipher.DECRYPT_MODE, ivKey, secretKey);\n\n // Decrypt the text\n byte[] decryptedText = null;\n try {\n decryptedText = chaChaDecryptor.doFinal(cipherText);\n } catch (IllegalBlockSizeException | BadPaddingException e) {\n System.out.println(\"failed to decrypt text\");\n return;\n }\n System.out.println(\"decrypted: \" + new String(decryptedText, StandardCharsets.UTF_8));\n}\n```\n\nFor more information on Java Cryptography see:\nhttps://docs.oracle.com/en/java/javase/15/security/java-cryptography-architecture-jca-reference-guide.html\n"
+ },
+ "id": "find_sec_bugs.NULL_CIPHER-1",
+ "name": "find_sec_bugs.NULL_CIPHER-1",
+ "properties": {
+ "precision": "very-high",
+ "tags": [
+ "CWE-327",
+ "security"
+ ]
+ },
+ "shortDescription": {
+ "text": "Use of a broken or risky cryptographic algorithm"
+ }
+ },
+ {
+ "defaultConfiguration": {
+ "level": "warning"
+ },
+ "fullDescription": {
+ "text": "`mark_safe()` is used to mark a string as `safe` for HTML output.\nThis disables escaping and could therefore subject the content to\nXSS attacks. Use `django.utils.html.format_html()` to build HTML\nfor rendering instead.\n"
+ },
+ "id": "bandit.B703",
+ "name": "bandit.B703",
+ "properties": {
+ "precision": "very-high",
+ "tags": [
+ "CWE-79",
+ "OWASP-A7:2017-Cross-Site Scripting (XSS)",
+ "security"
+ ]
+ },
+ "shortDescription": {
+ "text": "Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')"
+ }
+ },
+ {
+ "defaultConfiguration": {
+ "level": "error"
+ },
+ "fullDescription": {
+ "text": "The application was found to ignore host keys. Host keys are important as\nthey provide assurance that the client can prove that the host is trusted.\nBy ignoring these host keys, it is impossible for the client to validate the\nconnection is to a trusted host.\n\nTo remediate this issue, remove the call to `set_missing_host_key_policy(...)` which\nsets the host key policy. Instead, load key files using either `load_system_host_keys`\nor `load_host_keys` to only allow known good hosts. By not setting a host key policy\nfor unknown hosts, `paramiko`'s default policy is to use `RejectPolicy`.\n\nExample configuration connecting to a known, trusted host, and not allowing connections\nto unknown hosts:\n```\nimport paramiko\n\n# Create an SSH client\nwith paramiko.SSHClient() as ssh:\n # Load the system host keys so we can confirm the\n # host we are connecting to is legitimate\n ssh.load_system_host_keys('/home/appuser/.ssh/known_hosts')\n\n # Connect to the remote host using our SSH private key\n ssh.connect(hostname='example.org',\n port=22,\n username='appuser',\n key_filename='/home/appuser/.ssh/private_key')\n```\n\nFor more information on `set_missing_host_key_policy` see:\n-\nhttps://docs.paramiko.org/en/stable/api/client.html#paramiko.client.SSHClient.set_missing_host_key_policy\n"
+ },
+ "id": "bandit.B507",
+ "name": "bandit.B507",
+ "properties": {
+ "precision": "very-high",
+ "tags": [
+ "CWE-322",
+ "OWASP-A5:2017-Broken Access Control",
+ "security"
+ ]
+ },
+ "shortDescription": {
+ "text": "Key exchange without entity authentication"
+ }
+ },
+ {
+ "defaultConfiguration": {
+ "level": "warning"
+ },
+ "fullDescription": {
+ "text": "Servlet reflected cross site scripting vulnerability\n"
+ },
+ "id": "find_sec_bugs.XSS_REQUEST_PARAMETER_TO_SERVLET_WRITER-1",
+ "name": "find_sec_bugs.XSS_REQUEST_PARAMETER_TO_SERVLET_WRITER-1",
+ "properties": {
+ "precision": "very-high",
+ "tags": [
+ "CWE-79",
+ "security"
+ ]
+ },
+ "shortDescription": {
+ "text": "Improper Neutralization of Input During Web Page Generation"
+ }
+ },
+ {
+ "defaultConfiguration": {
+ "level": "warning"
+ },
+ "fullDescription": {
+ "text": "The application is returning user-supplied data from an HTTP request directly into an HTTP\nresponse output\nwriter. This could lead to Cross Site Scripting (XSS) if the input were malicious\nscript code and the application server is not properly validating the output.\n\nXSS is an attack which exploits a web application or system to treat user input\nas markup or script code. It is important to encode the data depending on the specific context\nit is used in. There are at least six context types:\n\n- Inside HTML tags `
context 1
`\n- Inside attributes: ``\n- Inside event attributes ``\n- Inside script blocks: ``\n- Unsafe element HTML assignment: `element.innerHTML = \"context 5\"`\n- Inside URLs: `link`\n\nScript blocks alone have multiple ways they need to be encoded. Extra care must be taken if\nuser input\nis ever output inside of script tags.\n\nUser input that is displayed within the application must be encoded, sanitized or validated\nto ensure it cannot be treated as HTML or executed as Javascript code. Care must also be\ntaken\nto not mix server-side templating with client-side templating, as the server-side templating\nwill\nnot encode things like {{ 7*7 }} which may execute client-side templating features.\n\nIt is _NOT_ advised to encode user input prior to inserting into a data store. The data will\nneed to be\nencoded depending on context of where it is output. It is much safer to force the displaying\nsystem to\nhandle the encoding and not attempt to guess how it should be encoded.\n\nIf possible do not use user input directly in the output to the response writer.\n\nIf the application must output user-supplied input, it will need to encode the data depending\non\nthe output context.\n\nConsider using [Apache Commons Text](https://commons.apache.org/proper/commons-text/)\n`StringEscapeUtils` methods for various context. Please note there is no way to safely\noutput script code in most circumstances, regardless of encoding. If calling the HTTP\nresponse writer directly, ensure that the `Content-Type` is set to `text/plain` so it will\nnot be accidentally interpreted by HTML by modern browsers.\n```\n// Get user input\nString htmlInput = request.getParameter(\"userInput\");\n// Encode the input using the Html4 encoder\nString htmlEncoded = StringEscapeUtils.escapeHtml4(htmlInput);\n// Force the HTTP response to be content type of text/plain so it is not interpreted as HTML\nresponse.setContentType(\"text/plain\");\n// Ensure UTF-8\nresponse.setCharacterEncoding(\"UTF-8\");\n// Write response\nresponse.getWriter().write(htmlEncoded);\n```\n\nFor more information on XSS see OWASP:\n-\nhttps://cheatsheetseries.owasp.org/cheatsheets/Cross_Site_Scripting_Prevention_Cheat_Sheet.html\n"
+ },
+ "id": "find_sec_bugs.XSS_REQUEST_PARAMETER_TO_SERVLET_WRITER-1",
+ "name": "find_sec_bugs.XSS_REQUEST_PARAMETER_TO_SERVLET_WRITER-1",
+ "properties": {
+ "precision": "very-high",
+ "tags": [
+ "CWE-79",
+ "security"
+ ]
+ },
+ "shortDescription": {
+ "text": "Improper neutralization of input during web page generation ('Cross-site Scripting')"
+ }
+ },
+ {
+ "defaultConfiguration": {
+ "level": "error"
+ },
+ "fullDescription": {
+ "text": "Usage of the `readlink` function call hints at a potential Time Of Check Time Of Use (TOCTOU)\nvulnerability. An attacker may be able to modify the file being specified by the `readlink`\nfunction prior to the `readlink` function being called. Additionally, care must be taken\nthat the buffer provided is large enough to hold the contents of the file.\n\nInstead of using `readlink`, use `lstat` prior to opening the file and confirm the attributes\nare correct. Then use `open` to get a file descriptor to this file. Call `fstat` on the\n`open` file descriptor to confirm that `st_dev` and `st_ino` are equal between the two.\nIf they are, it is safe to read and operate on the file's contents.\n\nFor more information please see:\nhttps://wiki.sei.cmu.edu/confluence/display/c/FIO45-C.+Avoid+TOCTOU+race+conditions+while+accessing+files\n"
+ },
+ "id": "flawfinder.readlink-1",
+ "name": "flawfinder.readlink-1",
+ "properties": {
+ "precision": "very-high",
+ "tags": [
+ "CWE-20",
+ "OWASP-A5:2017-Broken Access Control",
+ "security"
+ ]
+ },
+ "shortDescription": {
+ "text": "Potential time of check time of use vulnerability (readlink)"
+ }
+ },
+ {
+ "defaultConfiguration": {
+ "level": "note"
+ },
+ "fullDescription": {
+ "text": "The `gsignal` and `ssignal` functions are obsolete and no longer recommended. Consider\nusing the `raise` or `sigaction` functions instead for process signalling.\n\nFor more information please see: https://linux.die.net/man/3/sigaction\n"
+ },
+ "id": "flawfinder.gsignal-1.ssignal-1",
+ "name": "flawfinder.gsignal-1.ssignal-1",
+ "properties": {
+ "precision": "very-high",
+ "tags": [
+ "CWE-676",
+ "security"
+ ]
+ },
+ "shortDescription": {
+ "text": "Deprecated function calls (ssignal/gsignal)"
+ }
+ },
+ {
+ "defaultConfiguration": {
+ "level": "warning"
+ },
+ "fullDescription": {
+ "text": "Go versions < 1.6.3 are vulnerable to Httpoxy attack: (CVE-2016-5386)\n"
+ },
+ "id": "gosec.G504-1",
+ "name": "gosec.G504-1",
+ "properties": {
+ "precision": "very-high",
+ "tags": [
+ "CWE-327",
+ "OWASP-A9:2017-Using Components with Known Vulnerabilities",
+ "security"
+ ]
+ },
+ "shortDescription": {
+ "text": "Use of a Broken or Risky Cryptographic Algorithm"
+ }
+ },
+ {
+ "defaultConfiguration": {
+ "level": "error"
+ },
+ "fullDescription": {
+ "text": "SQL Injection is a critical vulnerability that can lead to data or system compromise. By\ndynamically generating SQL query strings, user input may be able to influence the logic of\nthe SQL statement. This could lead to an adversary accessing information they should\nnot have access to, or in some circumstances, being able to execute OS functionality or code.\n\nReplace all dynamically generated SQL queries with parameterized queries. In situations where\ndynamic queries must be created, never use direct user input, but instead use a map or\ndictionary of valid values and resolve them using a user supplied key.\n\nFor example, some database drivers do not allow parameterized queries for `>` or `<` comparison\noperators. In these cases, do not use a user supplied `>` or `<` value, but rather have the\nuser\nsupply a `gt` or `lt` value. The alphabetical values are then used to look up the `>` and `<`\nvalues to be used in the construction of the dynamic query. The same goes for other queries\nwhere\ncolumn or table names are required but cannot be parameterized.\n\nExample using parameterized queries with `SqlCommand`:\n```\nstring userInput = \"someUserInput\";\nstring connectionString = ...;\nusing (SqlConnection connection = new SqlConnection(connectionString))\n{\n connection.Open();\n String sql = \"SELECT name, value FROM table where name=@Name\";\n\n using (SqlCommand command = new SqlCommand(sql, connection))\n {\n command.Parameters.Add(\"@Name\", System.Data.SqlDbType.NVarChar);\n command.Parameters[\"@Name\"].Value = userInput;\n using (SqlDataReader reader = command.ExecuteReader())\n {\n while (reader.Read())\n {\n Console.WriteLine(\"{0} {1}\", reader.GetString(0), reader.GetString(1));\n }\n }\n }\n}\n```\n\nFor more information on SQL Injection see OWASP:\nhttps://cheatsheetseries.owasp.org/cheatsheets/SQL_Injection_Prevention_Cheat_Sheet.html\n"
+ },
+ "id": "security_code_scan.SCS0002-1",
+ "name": "security_code_scan.SCS0002-1",
+ "properties": {
+ "precision": "very-high",
+ "tags": [
+ "CWE-89",
+ "security"
+ ]
+ },
+ "shortDescription": {
+ "text": "Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')"
+ }
+ },
+ {
+ "defaultConfiguration": {
+ "level": "error"
+ },
+ "fullDescription": {
+ "text": "Found `subprocess` function `$FUNC` with `shell=True`. This is dangerous because this call will\nspawn the command using a shell process. Doing so propagates current shell settings and\nvariables,\nwhich makes it much easier for a malicious actor to execute commands. Use `shell=False`\ninstead.\n"
+ },
+ "id": "bandit.B602",
+ "name": "bandit.B602",
+ "properties": {
+ "precision": "very-high",
+ "tags": [
+ "CWE-78",
+ "OWASP-A1:2017-Injection",
+ "security"
+ ]
+ },
+ "shortDescription": {
+ "text": "Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')"
+ }
+ },
+ {
+ "defaultConfiguration": {
+ "level": "note"
+ },
+ "fullDescription": {
+ "text": "The `strlen` family of functions does not handle strings that are not null\nterminated. This can lead to buffer over reads and cause the application to\ncrash by accessing unintended memory locations. It is recommended that `strnlen`\nbe used instead as a `maxlen` value can be provided.\n\nFor more information please see: https://linux.die.net/man/3/strnlen\n\nIf developing for C Runtime Library (CRT), more secure versions of these functions should be\nused, see:\nhttps://learn.microsoft.com/en-us/cpp/c-runtime-library/reference/strnlen-strnlen-s?view=msvc-170\n"
+ },
+ "id": "flawfinder.strlen-1.wcslen-1._tcslen-1._mbslen-1",
+ "name": "flawfinder.strlen-1.wcslen-1._tcslen-1._mbslen-1",
+ "properties": {
+ "precision": "very-high",
+ "tags": [
+ "CWE-126",
+ "OWASP-A1:2017-Injection",
+ "security"
+ ]
+ },
+ "shortDescription": {
+ "text": "Function does not handle null terminated strings properly"
+ }
+ },
+ {
+ "defaultConfiguration": {
+ "level": "note"
+ },
+ "fullDescription": {
+ "text": "Using various methods to parse untrusted XML data is known to be vulnerable to\nXML attacks. Replace vulnerable imports with the equivalent defusedxml package.\n"
+ },
+ "id": "bandit.B410",
+ "name": "bandit.B410",
+ "properties": {
+ "precision": "very-high",
+ "tags": [
+ "CWE-502",
+ "OWASP-A8:2017-Insecure Deserialization",
+ "security"
+ ]
+ },
+ "shortDescription": {
+ "text": "Deserialization of Untrusted Data"
+ }
+ },
+ {
+ "defaultConfiguration": {
+ "level": "warning"
+ },
+ "fullDescription": {
+ "text": "Both MD5 and SHA1 hash algorithms have been found to be vulnerable to producing collisions.\nThis means\nthat two different values, when hashed, can lead to the same hash value. If the application is\ntrying\nto use these hash methods for storing passwords, then it is recommended to switch to a\npassword hashing\nalgorithm such as Argon2id or PBKDF2. Currently there is no vetted Argon2id implementation for\nC# so\nit is recommended that PBKDF2 be used until one is available.\n\nExample using PBKDF2 to generate and compare passwords:\n```\nconst int SaltSize = 24;\nconst int HashSize = 24;\n// number of pbkdf2 iterations, Rfc2898DeriveBytes uses hmac-sha1\n// so set a high iteration count\nconst int Iterations = 1_300_000;\nbyte[] salt = new byte[SaltSize];\nRandomNumberGenerator.Fill(salt);\n\nRfc2898DeriveBytes pbkdf2 = new Rfc2898DeriveBytes(\"some password\", salt, Iterations);\nbyte[] hashBytes = pbkdf2.GetBytes(HashSize);\n// Store salt and hashedBytes in a data store such as database for authentication\nConsole.WriteLine(\"Hash {0}\", BitConverter.ToString(hashBytes).Replace(\"-\", \"\"));\n// Do a constant time comparison as to not leak data based on timing\nif (CryptographicOperations.FixedTimeEquals(hashBytes, hashBytes)) {\n Console.WriteLine(\"hashes are equal\");\n}\n```\nFor more information on PBKDF2 see:\nhttps://learn.microsoft.com/en-us/dotnet/api/system.security.cryptography.rfc2898derivebytes\n\nFor more information on secure password storage see OWASP:\nhttps://cheatsheetseries.owasp.org/cheatsheets/Password_Storage_Cheat_Sheet.html\n"
+ },
+ "id": "security_code_scan.SCS0006-1",
+ "name": "security_code_scan.SCS0006-1",
+ "properties": {
+ "precision": "very-high",
+ "tags": [
+ "CWE-327",
+ "security"
+ ]
+ },
+ "shortDescription": {
+ "text": "Use of a broken or risky cryptographic algorithm (SHA1/MD5)"
+ }
+ },
+ {
+ "defaultConfiguration": {
+ "level": "warning"
+ },
+ "fullDescription": {
+ "text": "Allowing external control of system settings can disrupt service or cause an application to\nbehave in unexpected, and potentially malicious ways. An attacker could cause an error by\nproviding a nonexistent catalog name or connect to an unauthorized portion of the database.\n"
+ },
+ "id": "find_sec_bugs.EXTERNAL_CONFIG_CONTROL-1",
+ "name": "find_sec_bugs.EXTERNAL_CONFIG_CONTROL-1",
+ "properties": {
+ "precision": "very-high",
+ "tags": [
+ "CWE-15",
+ "security"
+ ]
+ },
+ "shortDescription": {
+ "text": "External Control of System or Configuration Setting"
+ }
+ },
+ {
+ "defaultConfiguration": {
+ "level": "warning"
+ },
+ "fullDescription": {
+ "text": "The application was found using user-supplied input in a `java.sql.Connection`'s\n`setCatalog` call. This could allow an adversary to supply a different database for the\nlifetime of the connection. Allowing external control of system settings can disrupt service\nor cause an application to behave in unexpected, and potentially malicious ways. Most likely\nthis would only cause an error by providing a nonexistent catalog name.\n\nIt is recommended to not use user-supplied input when selecting the database for an\napplications\ndatabase connection.\n"
+ },
+ "id": "find_sec_bugs.EXTERNAL_CONFIG_CONTROL-1",
+ "name": "find_sec_bugs.EXTERNAL_CONFIG_CONTROL-1",
+ "properties": {
+ "precision": "very-high",
+ "tags": [
+ "CWE-15",
+ "security"
+ ]
+ },
+ "shortDescription": {
+ "text": "External control of system or configuration setting"
+ }
+ },
+ {
+ "defaultConfiguration": {
+ "level": "warning"
+ },
+ "fullDescription": {
+ "text": "Cross Site Scripting (XSS) is an attack which exploits a web application or system to treat\nuser input\nas markup or script code. It is important to encode the data depending on the specific context\nit\nis used in. There are at least six context types:\n\n- Inside HTML tags `
context 1
`\n- Inside attributes: ``\n- Inside event attributes ``\n- Inside script blocks: ``\n- Unsafe element HTML assignment: `element.innerHTML = \"context 5\"`\n- Inside URLs: `link`\n\nScript blocks alone have multiple ways they need to be encoded. Extra care must be taken if\nuser input\nis ever output inside of script tags.\n\nUser input that is displayed within the application must be encoded, sanitized or validated\nto ensure it cannot be treated as HTML or executed as Javascript code. Care must also be\ntaken\nto not mix server-side templating with client-side templating, as the server-side templating\nwill\nnot encode things like {{ 7*7 }} which may execute client-side templating features.\n\nIt is _NOT_ advised to encode user input prior to inserting into a data store. The data will\nneed to be\nencoded depending on context of where it is output. It is much safer to force the displaying\nsystem to\nhandle the encoding and not attempt to guess how it should be encoded.\n\nConsider using built-in framework capabilities for automatically encoding user input.\nDepending\non output context, consider using the following `System.Text.Encodings.Web` encoders:\n\n-\n[HtmlEncoder](https://learn.microsoft.com/en-us/dotnet/api/system.text.encodings.web.htmlencoder)\n-\n[JavaScriptEncoder](https://learn.microsoft.com/en-us/dotnet/api/system.text.encodings.web.javascriptencoder)\n-\n[UrlEncoder](https://learn.microsoft.com/en-us/dotnet/api/system.text.encodings.web.urlencoder)\n\nFor more information on protecting ASP.NET Core applications from XSS see:\nhttps://learn.microsoft.com/en-us/aspnet/core/security/cross-site-scripting#accessing-encoders-in-code\n"
+ },
+ "id": "security_code_scan.SCS0029-1",
+ "name": "security_code_scan.SCS0029-1",
+ "properties": {
+ "precision": "very-high",
+ "tags": [
+ "CWE-79",
+ "security"
+ ]
+ },
+ "shortDescription": {
+ "text": "Improper neutralization of input during web page generation ('Cross-site Scripting')"
+ }
+ },
+ {
+ "defaultConfiguration": {
+ "level": "error"
+ },
+ "fullDescription": {
+ "text": "An authentication cipher mode which provides better confidentiality of the encrypted data\nshould be used instead of Electronic Code Book (ECB) mode, which does not provide good\nconfidentiality. Specifically, ECB mode produces the same output for the same input each time.\nThis allows an attacker to intercept and replay the data.\n"
+ },
+ "id": "find_sec_bugs.ECB_MODE-1",
+ "name": "find_sec_bugs.ECB_MODE-1",
+ "properties": {
+ "precision": "very-high",
+ "tags": [
+ "CWE-326",
+ "security"
+ ]
+ },
+ "shortDescription": {
+ "text": "Inadequate Encryption Strength"
+ }
+ },
+ {
+ "defaultConfiguration": {
+ "level": "error"
+ },
+ "fullDescription": {
+ "text": "Cryptographic algorithms provide many different modes of operation, only some of which provide\nmessage integrity. Without message integrity it could be possible for an adversary to attempt\nto tamper with the ciphertext which could lead to compromising the encryption key. Newer\nalgorithms\napply message integrity to validate ciphertext has not been tampered with.\n\nInstead of using an algorithm that requires configuring a cipher mode, an algorithm\nthat has built-in message integrity should be used. Consider using `ChaCha20Poly1305` or\n`AES-256-GCM` instead.\n\nFor older applications that don't have support for `ChaCha20Poly1305`, `AES-256-GCM` is\nrecommended, however it has many drawbacks:\n - Slower than `ChaCha20Poly1305`.\n - Catastrophic failure if nonce values are reused.\n\nExample using `ChaCha20Poly1305`:\n```\npublic encrypt() throws Exception {\n chaChaEncryption(\"Secret text to encrypt\".getBytes(StandardCharsets.UTF_8));\n}\n\npublic SecureRandom getSecureRandomDRBG() throws NoSuchAlgorithmException {\n // Use DRBG according to\nhttp://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-90Ar1.pdf\n return SecureRandom.getInstance(\"DRBG\",\n // Security strength in bits (default is 128)\n DrbgParameters.instantiation(256,\n // Set prediction resistance and re-seeding\n DrbgParameters.Capability.PR_AND_RESEED,\n // Set the personalization string (optional, not necessary)\n \"some_personalization_string\".getBytes()\n )\n );\n}\n\npublic Cipher getChaCha20Poly1305(int mode, byte[] ivKey, byte[] secretKey) throws\nNoSuchAlgorithmException, NoSuchPaddingException, InvalidKeyException,\nInvalidAlgorithmParameterException {\n // Get a DRBG random number generator instance\n SecureRandom random = getSecureRandomDRBG();\n // Create a ChaCha20-Poly1305 cipher instance\n Cipher chaChaCipher = Cipher.getInstance(\"ChaCha20-Poly1305/None/NoPadding\");\n // Create our parameterSpec using our ivKey\n AlgorithmParameterSpec parameterSpec = new IvParameterSpec(ivKey);\n // Create a SecretKeySpec using our secretKey\n SecretKeySpec secretKeySpec = new SecretKeySpec(secretKey, \"ChaCha20\");\n // Initialize and return the cipher for the provided mode\n chaChaCipher.init(mode, secretKeySpec, parameterSpec, random);\n return chaChaCipher;\n}\n\npublic void chaChaEncryption(byte[] plainText) throws NoSuchAlgorithmException,\nNoSuchPaddingException, InvalidKeyException, InvalidAlgorithmParameterException {\n // Get a DRBG random number generator instance\n SecureRandom random = getSecureRandomDRBG();\n // Create secretKey\n byte[] secretKey = new byte[32];\n random.nextBytes(secretKey);\n // Create an IV Key\n byte[] ivKey = new byte[12];\n random.nextBytes(ivKey);\n\n // Create a chaCha encryption cipher instance\n Cipher chaChaEncryptor = getChaCha20Poly1305(Cipher.ENCRYPT_MODE, ivKey, secretKey);\n\n // Encrypt the text using ChaCha20Poly1305\n byte[] cipherText = null;\n try {\n cipherText = chaChaEncryptor.doFinal(plainText);\n } catch (IllegalBlockSizeException | BadPaddingException e) {\n System.out.println(\"failed to encrypt text\");\n return;\n }\n System.out.println(\"encrypted: \" + Base64.getEncoder().encodeToString(cipherText));\n\n // Create a chaCha decryption cipher instance\n Cipher chaChaDecryptor = getChaCha20Poly1305(Cipher.DECRYPT_MODE, ivKey, secretKey);\n\n // Decrypt the text\n byte[] decryptedText = null;\n try {\n decryptedText = chaChaDecryptor.doFinal(cipherText);\n } catch (IllegalBlockSizeException | BadPaddingException e) {\n System.out.println(\"failed to decrypt text\");\n return;\n }\n System.out.println(\"decrypted: \" + new String(decryptedText, StandardCharsets.UTF_8));\n}\n```\n\nFor more information on Java Cryptography see:\nhttps://docs.oracle.com/en/java/javase/15/security/java-cryptography-architecture-jca-reference-guide.html\n"
+ },
+ "id": "find_sec_bugs.ECB_MODE-1",
+ "name": "find_sec_bugs.ECB_MODE-1",
+ "properties": {
+ "precision": "very-high",
+ "tags": [
+ "CWE-327",
+ "security"
+ ]
+ },
+ "shortDescription": {
+ "text": "Use of a broken or risky cryptographic algorithm"
+ }
+ },
+ {
+ "defaultConfiguration": {
+ "level": "error"
+ },
+ "fullDescription": {
+ "text": "Use fchgrp( ) instead.\n"
+ },
+ "id": "flawfinder.chgrp-1",
+ "name": "flawfinder.chgrp-1",
+ "properties": {
+ "precision": "very-high",
+ "tags": [
+ "CWE-362",
+ "OWASP-A5:2017-Broken Access Control",
+ "security"
+ ]
+ },
+ "shortDescription": {
+ "text": "This accepts filename arguments; if an attacker can move those files, a race condition results. (CWE-362)"
+ }
+ },
+ {
+ "defaultConfiguration": {
+ "level": "error"
+ },
+ "fullDescription": {
+ "text": "Without proper access control, executing an LDAP statement that contains a\nuser-controlled value can allow an attacker to abuse poorly configured LDAP\ncontext\n"
+ },
+ "id": "find_sec_bugs.LDAP_ENTRY_POISONING-1",
+ "name": "find_sec_bugs.LDAP_ENTRY_POISONING-1",
+ "properties": {
+ "precision": "very-high",
+ "tags": [
+ "CWE-20",
+ "security"
+ ]
+ },
+ "shortDescription": {
+ "text": "Improper Input Validation"
+ }
+ },
+ {
+ "defaultConfiguration": {
+ "level": "error"
+ },
+ "fullDescription": {
+ "text": "Without proper access control, executing an LDAP statement that contains a\nuser-controlled value can allow an attacker to abuse poorly configured LDAP\ncontext\n"
+ },
+ "id": "find_sec_bugs.LDAP_ENTRY_POISONING-1",
+ "name": "find_sec_bugs.LDAP_ENTRY_POISONING-1",
+ "properties": {
+ "precision": "very-high",
+ "tags": [
+ "CWE-20",
+ "security"
+ ]
+ },
+ "shortDescription": {
+ "text": "Improper Input Validation"
+ }
+ },
+ {
+ "defaultConfiguration": {
+ "level": "error"
+ },
+ "fullDescription": {
+ "text": "The DES algorithm has not been recommended for over 15 years and was withdrawn from NIST (FIPS\n46-3) in 2005.\n\nConsider using libsodium's `crypto_secretbox_easy` authenticated encryption functions instead.\n\nFor more information please see:\n https://libsodium.gitbook.io/doc/secret-key_cryptography/secretbox.\n\nIf you must be FIPS compliant, consider using OpenSSLs AES or 3DES ciphers.\n"
+ },
+ "id": "flawfinder.EVP_des_ecb-1.EVP_des_cbc-1.EVP_des_cfb-1.EVP_des_ofb-1.EVP_desx_cbc-1",
+ "name": "flawfinder.EVP_des_ecb-1.EVP_des_cbc-1.EVP_des_cfb-1.EVP_des_ofb-1.EVP_desx_cbc-1",
+ "properties": {
+ "precision": "very-high",
+ "tags": [
+ "CWE-327",
+ "OWASP-A3:2017-Sensitive Data Exposure",
+ "security"
+ ]
+ },
+ "shortDescription": {
+ "text": "Insecure encryption algorithm (DES)"
+ }
+ },
+ {
+ "defaultConfiguration": {
+ "level": "warning"
+ },
+ "fullDescription": {
+ "text": "The application was found using `pickle` which is vulnerable to deserialization attacks.\nDeserialization attacks exploit the process of reading serialized data and turning it back\ninto an object. By constructing malicious objects and serializing them, an adversary may\nattempt to:\n\n- Inject code that is executed upon object construction, which occurs during the\ndeserialization process.\n- Exploit mass assignment by including fields that are not normally a part of the serialized\ndata but are read in during deserialization.\n\nConsider safer alternatives such as serializing data in the JSON format. Ensure any format\nchosen allows\nthe application to specify exactly which object types are allowed to be deserialized.\n\nTo protect against mass assignment, only allow deserialization of the specific fields that are\nrequired. If this is not easily done, consider creating an intermediary type that\ncan be serialized with only the necessary fields exposed.\n\nExample JSON deserializer using an intermediary type that is validated against a schema to\nensure\nit is safe from mass assignment:\n```\nimport jsonschema\n\n# Create a schema to validate our user-supplied input against\n# an intermediary object\nintermediary_schema = {\n \"type\" : \"object\",\n \"properties\" : {\n \"name\": {\"type\" : \"string\"}\n },\n \"required\": [\"name\"],\n # Protect against random properties being added to the object\n \"additionalProperties\": False,\n}\n# If a user attempted to add \"'is_admin': True\" it would cause a validation error\nintermediary_object = {'name': 'test user'}\n\ntry:\n # Validate the user supplied intermediary object against our schema\n jsonschema.validate(instance=intermediary_object, schema=intermediary_schema)\n user_object = {'user':\n {\n # Assign the deserialized data from intermediary object\n 'name': intermediary_object['name'],\n # Add in protected data in object definition (or set it from a class constructor)\n 'is_admin': False,\n }\n }\n # Work with the user_object\nexcept jsonschema.exceptions.ValidationError as ex:\n # Gracefully handle validation errors\n # ...\n```\n\nFor more details on deserialization attacks in general, see OWASP's guide:\n- https://cheatsheetseries.owasp.org/cheatsheets/Deserialization_Cheat_Sheet.html\n"
+ },
+ "id": "bandit.B301-1",
+ "name": "bandit.B301-1",
+ "properties": {
+ "precision": "very-high",
+ "tags": [
+ "CWE-502",
+ "OWASP-A8:2017-Insecure Deserialization",
+ "security"
+ ]
+ },
+ "shortDescription": {
+ "text": "Deserialization of untrusted data"
+ }
+ },
+ {
+ "defaultConfiguration": {
+ "level": "warning"
+ },
+ "fullDescription": {
+ "text": "The application was found using the `lxml.etree` package for processing XML.\nPython's default XML processors suffer from various XML parsing vulnerabilities\nand care must be taken when handling XML data. Additionally, depending on the\nversion of Python, more critical vulnerabilities such as eXternal XML Entity\ninjection maybe exploitable.\n\nThe `etree` package suffers from the following security risks as of Python 3.7.1:\n* Billion laughs / exponential entity expansion - May allow an adversary to cause\n a Denial of Service (DoS) against the application parsing arbitrary XML.\n* Quadratic blowup entity expansion - Similar to above, but requires a larger input\n to cause the Denial of Service.\n\nTo remediate the above issues, consider using the\n[defusedxml](https://pypi.org/project/defusedxml/)\nlibrary when processing untrusted XML.\n\nExample parsing an XML document using defusedxml:\n```\nfrom defusedxml.ElementTree import parse\n\n# Parse the inventory.xml file\net = parse('inventory.xml')\n# Get the root element\nroot = et.getroot()\n# Work with the root element\n# ...\n```\n\nFor more information on the various XML parsers and their vulnerabilities please see:\n- https://docs.python.org/3/library/xml.html#xml-vulnerabilities\n\nFor more information on XML security see OWASP's guide:\n-\nhttps://cheatsheetseries.owasp.org/cheatsheets/XML_External_Entity_Prevention_Cheat_Sheet.html#python\n"
+ },
+ "id": "bandit.B320",
+ "name": "bandit.B320",
+ "properties": {
+ "precision": "very-high",
+ "tags": [
+ "CWE-611",
+ "OWASP-A4:2017-XML External Entities (XXE)",
+ "security"
+ ]
+ },
+ "shortDescription": {
+ "text": "Improper restriction of XML external entity reference"
+ }
+ },
+ {
+ "defaultConfiguration": {
+ "level": "warning"
+ },
+ "fullDescription": {
+ "text": "The application was found setting file permissions to overly permissive values. Consider\nusing the following values if the application user is the only process to access\nthe file:\n\n- 0400 - read only access to the file\n- 0200 - write only access to the file\n- 0600 - read/write access to the file\n\nExample creating a file with read/write permissions for the application user:\n```\n# Use octal values to set 0o600 (read/write access to the file) for the current\n# user\nos.chmod('somefile.txt', 0o600)\n```\n\nFor all other values please see:\nhttps://en.wikipedia.org/wiki/File-system_permissions#Numeric_notation\n"
+ },
+ "id": "bandit.B103",
+ "name": "bandit.B103",
+ "properties": {
+ "precision": "very-high",
+ "tags": [
+ "CWE-732",
+ "OWASP-A6:2017-Security Misconfiguration",
+ "security"
+ ]
+ },
+ "shortDescription": {
+ "text": "Incorrect permission assignment for critical resource"
+ }
+ },
+ {
+ "defaultConfiguration": {
+ "level": "error"
+ },
+ "fullDescription": {
+ "text": "The `strcat` family of functions are unable to limit how many bytes are copied\nto the destination buffer. It is recommended to use more secure alternatives such as\n`snprintf`.\n\nFor more information please see: https://linux.die.net/man/3/snprintf\n\nIf developing for C Runtime Library (CRT), more secure versions of these functions should be\nused, see:\nhttps://learn.microsoft.com/en-us/cpp/c-runtime-library/reference/strcat-s-wcscat-s-mbscat-s?view=msvc-170\n"
+ },
+ "id": "flawfinder.strcat-1",
+ "name": "flawfinder.strcat-1",
+ "properties": {
+ "precision": "very-high",
+ "tags": [
+ "CWE-120",
+ "OWASP-A1:2017-Injection",
+ "security"
+ ]
+ },
+ "shortDescription": {
+ "text": "Insecure string processing function"
+ }
+ },
+ {
+ "defaultConfiguration": {
+ "level": "note"
+ },
+ "fullDescription": {
+ "text": "Using various methods to parse untrusted XML data is known to be vulnerable\nto XML attacks. Replace vulnerable imports with the equivalent defusedxml\npackage, or make sure defusedxml.defuse_stdlib() is called.\n"
+ },
+ "id": "bandit.B408",
+ "name": "bandit.B408",
+ "properties": {
+ "precision": "very-high",
+ "tags": [
+ "CWE-502",
+ "OWASP-A8:2017-Insecure Deserialization",
+ "security"
+ ]
+ },
+ "shortDescription": {
+ "text": "Deserialization of Untrusted Data"
+ }
+ },
+ {
+ "defaultConfiguration": {
+ "level": "error"
+ },
+ "fullDescription": {
+ "text": "XML External Entity (XXE) attacks can occur when an XML parser supports XML\nentities while processing XML received from an untrusted source.\n"
+ },
+ "id": "find_sec_bugs.XXE_DTD_TRANSFORM_FACTORY-1.XXE_XSLT_TRANSFORM_FACTORY-1",
+ "name": "find_sec_bugs.XXE_DTD_TRANSFORM_FACTORY-1.XXE_XSLT_TRANSFORM_FACTORY-1",
+ "properties": {
+ "precision": "very-high",
+ "tags": [
+ "CWE-611",
+ "security"
+ ]
+ },
+ "shortDescription": {
+ "text": "Improper Restriction of XML External Entity Reference ('XXE')"
+ }
+ },
+ {
+ "defaultConfiguration": {
+ "level": "error"
+ },
+ "fullDescription": {
+ "text": "XML External Entity (XXE) attacks can occur when an XML parser supports XML\nentities while processing XML received from an untrusted source.\n"
+ },
+ "id": "find_sec_bugs.XXE_DTD_TRANSFORM_FACTORY-1.XXE_XSLT_TRANSFORM_FACTORY-1",
+ "name": "find_sec_bugs.XXE_DTD_TRANSFORM_FACTORY-1.XXE_XSLT_TRANSFORM_FACTORY-1",
+ "properties": {
+ "precision": "very-high",
+ "tags": [
+ "CWE-611",
+ "security"
+ ]
+ },
+ "shortDescription": {
+ "text": "Improper Restriction of XML External Entity Reference ('XXE')"
+ }
+ },
+ {
+ "defaultConfiguration": {
+ "level": "warning"
+ },
+ "fullDescription": {
+ "text": "The application was found using an insecure or risky digest or signature algorithm. MD2, MD4,\n MD5 and SHA1 hash algorithms have been found to be vulnerable to producing collisions.\n\nThis means\nthat two different values, when hashed, can lead to the same hash value. If the application is\ntrying\nto use these hash methods for storing passwords, then it is recommended to switch to a\npassword hashing\nalgorithm such as Argon2id or PBKDF2.\n\nNote that the `Crypto` and `Cryptodome` Python packages are no longer recommended for\nnew applications, instead consider using the [cryptography](https://cryptography.io/) package.\n\nExample of creating a SHA-384 hash using the `cryptography` package:\n```\nfrom cryptography.hazmat.primitives import hashes\n# Create a SHA384 digest\ndigest = hashes.Hash(hashes.SHA384())\n# Update the digest with some initial data\ndigest.update(b\"some data to hash\")\n# Add more data to the digest\ndigest.update(b\"some more data\")\n# Finalize the digest as bytes\nresult = digest.finalize()\n```\n\nFor more information on secure password storage see OWASP:\n- https://cheatsheetseries.owasp.org/cheatsheets/Password_Storage_Cheat_Sheet.html\n\nFor more information on the cryptography module see:\n- https://cryptography.io/en/latest/\n"
+ },
+ "id": "bandit.B304-2",
+ "name": "bandit.B304-2",
+ "properties": {
+ "precision": "very-high",
+ "tags": [
+ "CWE-327",
+ "OWASP-A3:2017-Sensitive Data Exposure",
+ "security"
+ ]
+ },
+ "shortDescription": {
+ "text": "Use of a broken or risky cryptographic algorithm"
+ }
+ },
+ {
+ "defaultConfiguration": {
+ "level": "error"
+ },
+ "fullDescription": {
+ "text": "It is generally not recommended to call out to the operating system to execute commands.\nWhen the application is executing file system based commands, user input should never be used\nin\nconstructing commands or command arguments. If possible, determine if a library can be used\ninstead to provide the same functionality. Otherwise, consider hard coding both the command\nand arguments to be used, or at the very least restricting which arguments can be passed\nto the command execution function.\n\nFor more information please see:\nhttps://wiki.sei.cmu.edu/confluence/pages/viewpage.action?pageId=87152177\n"
+ },
+ "id": "flawfinder.system-1",
+ "name": "flawfinder.system-1",
+ "properties": {
+ "precision": "very-high",
+ "tags": [
+ "CWE-78",
+ "OWASP-A1:2017-Injection",
+ "security"
+ ]
+ },
+ "shortDescription": {
+ "text": "Potential for OS command injection"
+ }
+ },
+ {
+ "defaultConfiguration": {
+ "level": "warning"
+ },
+ "fullDescription": {
+ "text": "SQL Injection is a critical vulnerability that can lead to data or system compromise. By\ndynamically generating SQL query strings, user input may be able to influence the logic of\nthe SQL statement. This could lead to an adversary accessing information they should\nnot have access to, or in some circumstances, being able to execute OS functionality or code.\n\nReplace all dynamically generated SQL queries with parameterized queries. In situations where\ndynamic queries must be created, never use direct user input, but instead use a map or\ndictionary of valid values and resolve them using a user supplied key.\n\nFor example, some database drivers do not allow parameterized queries for `>` or `<` comparison\noperators. In these cases, do not use a user supplied `>` or `<` value, but rather have the\nuser\nsupply a `gt` or `lt` value. The alphabetical values are then used to look up the `>` and `<`\nvalues to be used in the construction of the dynamic query. The same goes for other queries\nwhere\ncolumn or table names are required but cannot be parameterized.\n\nThe `QuerySet.extra` API method will be deprecated as it a source of SQL Injection\nvulnerabilities and other problems. This method is especially risky as callers\nwill need to do their own escaping of any parameters that come from user-supplied\ninformation.\n\nTo remediate this issue, do not use `extra` but use other `QuerySet` methods to achieve\nthe same goals. If for some reason this is not feasible, consider using the `RawSQL` method\nand making sure that all arguments, including user-supplied ones, are only used in\n`params`\n\n\nWhile not recommended due to [potential SQL\nInjection](https://docs.djangoproject.com/en/4.2/ref/models/expressions/#raw-sql-expressions),\nbelow is an example using `RawSQL`,\npassing in user-supplied data as a `param` which will escape the input:\n```\n# If dealing with integer based user input, restrict the values to integers only using the\n# path configuration: path('/someview/', views.some_view,\nname='someview'),\n\n# views.py\ndef some_view(request, user_supplied_id):\n # Never use string interpolation in the `sql` parameter.\n # Never quote the `%s` string format such as `... where id='%s'` as this could lead to SQL\nInjection.\n # Pass the user supplied data only in the `params` parameter.\n for obj in DBObject.objects.all().annotate(\n val=RawSQL(sql=\"select id from some_secondary_table where id=%s\",\nparams=[user_supplied_id])):\n # Work with the results from the query\n # ...\n```\n\nFor more information on QuerySet see:\n- https://docs.djangoproject.com/en/4.2/ref/models/querysets/#queryset-api\n\nFor more information on SQL Injection see OWASP:\n- https://cheatsheetseries.owasp.org/cheatsheets/SQL_Injection_Prevention_Cheat_Sheet.html\n"
+ },
+ "id": "bandit.B610",
+ "name": "bandit.B610",
+ "properties": {
+ "precision": "very-high",
+ "tags": [
+ "CWE-89",
+ "OWASP-A1:2017-Injection",
+ "security"
+ ]
+ },
+ "shortDescription": {
+ "text": "Improper neutralization of special elements used in an SQL Command ('SQL Injection')"
+ }
+ },
+ {
+ "defaultConfiguration": {
+ "level": "warning"
+ },
+ "fullDescription": {
+ "text": "The application was found using Jinja2 `Environment` without autoescaping enabled. If using in\nthe context of HTML this could lead to Cross-Site Scripting (XSS) attacks when rendering with\nuser-supplied input.\n\nUnfortunately, Jinja2 does not support context-aware escaping, meaning it is insufficient to\nprotect against\nXSS for the various web contexts. It is important to encode the data depending on the specific\ncontext\nit\nis used in. There are at least six context types:\n\n- Inside HTML tags `
context 1
`\n- Inside attributes: ``\n- Inside event attributes ``\n- Inside script blocks: ``\n- Unsafe element HTML assignment: `element.innerHTML = \"context 5\"`\n- Inside URLs: `link`\n\nScript blocks alone have multiple ways they need to be encoded. Extra care must be taken if\nuser input\nis ever output inside of script tags.\n\nUser input that is displayed within the application must be encoded, sanitized or validated\nto ensure it cannot be treated as HTML or executed as Javascript code. Care must also be\ntaken\nto not mix server-side templating with client-side templating, as the server-side templating\nwill\nnot encode things like {{ 7*7 }} which may execute client-side templating features.\n\nIt is _NOT_ advised to encode user input prior to inserting into a data store. The data will\nneed to be\nencoded depending on context of where it is output. It is much safer to force the displaying\nsystem to\nhandle the encoding and not attempt to guess how it should be encoded.\n\nTo handle different contexts, one approach would be to write custom Jinja2 filters. Below is\nan example\nthat escapes or encodes links and potentially malicious script, note this does not include\nother contexts\nsuch as CSS or attributes:\n```\nfrom jinja2 import Environment, select_autoescape, FileSystemLoader\nfrom jinja2 import pass_eval_context\nfrom markupsafe import Markup, escape\n\n@pass_eval_context\ndef escape_link(eval_ctx, value):\n bad_link = \"#JinjatmplZ\"\n # Block any values that start with // as that could be used to inject\n # links to third party pages see:\nhttps://en.wikipedia.org/wiki/Wikipedia:Protocol-relative_URL\n if value.startswith('//'):\n return bad_link\n\n # Only allow relative links\n # if you want to allow links that start with http or ws replace with below:\n # if not value.startswith('/'): and not value.startswith('http') and not\nvalue.startswith('ws')\n if not value.startswith('/'):\n return bad_link\n\n # Alternatively, you could only call escape if autoescape is true\n # if eval_ctx.autoescape:\n # return escape(value)\n # else\n # return value\n\n return escape(value)\n\n# Create a replacement table\njs_replacement = str.maketrans({\n '\\0': \"\\\\u0000\",\n '\\t': \"\\\\t\",\n '\\n': \"\\\\n\",\n '\\v': \"\\\\u000b\",\n '\\f': \"\\\\f`\",\n '\\r': \"\\\\r\",\n '\"': \"\\\\u0022\",\n '`': \"\\\\u0060\",\n '&': \"\\\\u0026\",\n '\\'': \"\\\\u0027\",\n '+': \"\\\\u002b\",\n '/': \"\\\\/\",\n '<': \"\\\\u003c\",\n '>': \"\\\\u003e\",\n '\\\\': \"\\\\\\\\\",\n '(': \"\\\\u0028\",\n ')': \"\\\\u0029\",\n })\n\n@pass_eval_context\ndef escape_js(eval_ctx, value):\n \"\"\"\n Escape the input for use in \",\n script_context=\"alert(1);alert`1`\",)\n)\n\n# Sample template:\n\"\"\"\n\n\n\n My Webpage\n\n\n
My Webpage
\n {{ html_context }}\n link\n \n\n\n\"\"\"\n```\n\nFor more information on autoescape see:\n- https://jinja.palletsprojects.com/en/3.1.x/api/#autoescaping\n\nFor more information on XSS see OWASP:\n-\nhttps://cheatsheetseries.owasp.org/cheatsheets/Cross_Site_Scripting_Prevention_Cheat_Sheet.html\n"
+ },
+ "id": "bandit.B701",
+ "name": "bandit.B701",
+ "properties": {
+ "precision": "very-high",
+ "tags": [
+ "CWE-116",
+ "OWASP-A7:2017-Cross-Site Scripting (XSS)",
+ "security"
+ ]
+ },
+ "shortDescription": {
+ "text": "Improper encoding or escaping of output"
+ }
+ },
+ {
+ "defaultConfiguration": {
+ "level": "warning"
+ },
+ "fullDescription": {
+ "text": "Ignoring XML comments in SAML may lead to authentication bypass\n"
+ },
+ "id": "find_sec_bugs.SAML_IGNORE_COMMENTS-1",
+ "name": "find_sec_bugs.SAML_IGNORE_COMMENTS-1",
+ "properties": {
+ "precision": "very-high",
+ "tags": [
+ "CWE-287",
+ "security"
+ ]
+ },
+ "shortDescription": {
+ "text": "Improper Authentication"
+ }
+ },
+ {
+ "defaultConfiguration": {
+ "level": "warning"
+ },
+ "fullDescription": {
+ "text": "SAML parses attestations as an XML document. By processing XML comments,\ncomment fields can end up modifying the interpretation of input fields.\nThis could allow an adversary to insert an XML comment to break up the attestation's\nusername or other fields, allowing an attacker to bypass authorization or authentication\nchecks.\n\nTo remediate this issue, when using `org.opensaml.xml.parse.BasicParserPool` ensure\n`setIgnoreComments(true)` is called.\n\nFor more information on how this issue can be exploited see:\nhttps://developer.okta.com/blog/2018/02/27/a-breakdown-of-the-new-saml-authentication-bypass-vulnerability\n\nFor more information on SAML security see OWASP:\nhttps://cheatsheetseries.owasp.org/cheatsheets/SAML_Security_Cheat_Sheet.html\n"
+ },
+ "id": "find_sec_bugs.SAML_IGNORE_COMMENTS-1",
+ "name": "find_sec_bugs.SAML_IGNORE_COMMENTS-1",
+ "properties": {
+ "precision": "very-high",
+ "tags": [
+ "CWE-287",
+ "security"
+ ]
+ },
+ "shortDescription": {
+ "text": "Improper authentication"
+ }
+ },
+ {
+ "defaultConfiguration": {
+ "level": "note"
+ },
+ "fullDescription": {
+ "text": "The ulimit function is obsolete and no longer recommended. Use `getrlimit(2)`,\n`setrlimit`, or `sysconf` instead.\n\nFor more information please see: https://linux.die.net/man/3/setrlimit\n"
+ },
+ "id": "flawfinder.ulimit-1",
+ "name": "flawfinder.ulimit-1",
+ "properties": {
+ "precision": "very-high",
+ "tags": [
+ "CWE-676",
+ "security"
+ ]
+ },
+ "shortDescription": {
+ "text": "Usage of deprecated function (ulimit)"
+ }
+ },
+ {
+ "defaultConfiguration": {
+ "level": "error"
+ },
+ "fullDescription": {
+ "text": "When `SetSecurityDescriptorDacl` is called with a null `pDacl` parameter and the\n`bDaclPresent` flag is `TRUE`, all access to the object is allowed. An attacker\ncould set the object to Deny all, which would include even the Administrator user(s).\n\nEither call `SetSecurityDescriptorDacl` with bDaclPresent as `FALSE`, or supply a valid\nnon-null `pDacl` parameter value.\n\nFor more information please see:\nhttps://learn.microsoft.com/en-us/windows/win32/api/securitybaseapi/nf-securitybaseapi-setsecuritydescriptordacl#remarks\n"
+ },
+ "id": "flawfinder.SetSecurityDescriptorDacl-1",
+ "name": "flawfinder.SetSecurityDescriptorDacl-1",
+ "properties": {
+ "precision": "very-high",
+ "tags": [
+ "CWE-732",
+ "OWASP-A5:2017-Broken Access Control",
+ "security"
+ ]
+ },
+ "shortDescription": {
+ "text": "Null ACL when calling SetSecurityDescriptorDacl may allow all access to objects"
+ }
+ },
+ {
+ "defaultConfiguration": {
+ "level": "warning"
+ },
+ "fullDescription": {
+ "text": "Possible hardcoded password\n"
+ },
+ "id": "bandit.B106",
+ "name": "bandit.B106",
+ "properties": {
+ "precision": "very-high",
+ "tags": [
+ "CWE-259",
+ "OWASP-A3:2017-Sensitive Data Exposure",
+ "security"
+ ]
+ },
+ "shortDescription": {
+ "text": "Use of Hard-coded Password"
+ }
+ },
+ {
+ "defaultConfiguration": {
+ "level": "warning"
+ },
+ "fullDescription": {
+ "text": "The Blowfish encryption algorithm was meant as a drop-in replacement for DES and was created in\n1993. Smaller key sizes may make the ciphertext vulnerable to [birthday\nattacks](https://en.wikipedia.org/wiki/Birthday_attack). While no known attacks against\nBlowfish\nexist, it should never be used to encrypt files over 4GB in size. If possible consider\nusing ChaCha20Poly1305 or AES-GCM instead of Blowfish.\n\nFor older applications that don't have support for `ChaCha20Poly1305`, `AES-256-GCM` is\nrecommended, however it has many drawbacks:\n - Slower than `ChaCha20Poly1305`.\n - Catastrophic failure if nonce values are reused.\n\nExample using `ChaCha20Poly1305`:\n```\nimport os\n# Import ChaCha20Poly1305 from cryptography\nfrom cryptography.hazmat.primitives.ciphers.aead import ChaCha20Poly1305\n# Our plaintext to encrypt\nplain_text = b\"Secret text to encrypt\"\n# We do not require authenticated but unencrypted data, so set to None\naad = None\n# Generate a secure key\nkey = ChaCha20Poly1305.generate_key()\n# Create a new ChaCha20Poly1305 instance with our secure key\nchacha = ChaCha20Poly1305(key)\n# Note: nonce values _must_ be regenerated every time they are used.\nnonce = os.urandom(12)\n# Encrypt our plaintext\ncipher_text = chacha.encrypt(nonce, plain_text, aad)\n# Decrypt the plain text using the nonce and cipher_text\nchacha.decrypt(nonce, cipher_text, aad)\n```\n\nExample using `AESGCM`:\n```\nimport os\n# Import AESGCM from cryptography\nfrom cryptography.hazmat.primitives.ciphers.aead import AESGCM\n# Our plaintext to encrypt\nplain_text = b\"Secret text to encrypt\"\n# We do not require authenticated but unencrypted data, so set to None\naad = None\n# Generate a secure key\nkey = AESGCM.generate_key(bit_length=128)\n# Create a new AESGCM instance with our secure key\naesgcm = AESGCM(key)\n# Note: nonce values _must_ be regenerated every time they are used.\nnonce = os.urandom(12)\n# Encrypt our plaintext\ncipher_text = aesgcm.encrypt(nonce, plain_text, aad)\n# Decrypt the plain text using the nonce and cipher_text\naesgcm.decrypt(nonce, cipher_text, aad)\n```\n\nFor more information on the cryptography module see:\n- https://cryptography.io/en/latest/\n"
+ },
+ "id": "bandit.B304-11",
+ "name": "bandit.B304-11",
+ "properties": {
+ "precision": "very-high",
+ "tags": [
+ "CWE-327",
+ "OWASP-A3:2017-Sensitive Data Exposure",
+ "security"
+ ]
+ },
+ "shortDescription": {
+ "text": "Use of a broken or risky cryptographic algorithm"
+ }
+ },
+ {
+ "defaultConfiguration": {
+ "level": "warning"
+ },
+ "fullDescription": {
+ "text": "CERT: IDS11-J. Perform any string modifications before validation\n"
+ },
+ "id": "find_sec_bugs.MODIFICATION_AFTER_VALIDATION-1",
+ "name": "find_sec_bugs.MODIFICATION_AFTER_VALIDATION-1",
+ "properties": {
+ "precision": "very-high",
+ "tags": [
+ "CWE-182",
+ "HIGH CONFIDENCE",
+ "security"
+ ]
+ },
+ "shortDescription": {
+ "text": "Collapse of data into unsafe value"
+ }
+ },
+ {
+ "defaultConfiguration": {
+ "level": "warning"
+ },
+ "fullDescription": {
+ "text": "The application was found matching a variable during a regular expression\npattern match, and then calling string modification functions after validation has occurred.\nThis is usually indicative of a poor input validation strategy as an adversary may attempt to\nexploit the removal of characters.\n\nFor example a common mistake in attempting to remove path characters to protect against path\ntraversal is to match '../' and then remove any matches. However, if an adversary were to\ninclude in their input: '....//' then the `replace` method would replace the first `../` but\ncause the leading `..` and trailing `/` to join into the final string of `../`, effectively\nbypassing the check.\n\nTo remediate this issue always perform string modifications before any validation of a string.\nIt is strongly recommended that strings be encoded instead of replaced or removed prior to\nvalidation.\n\n\nExample replaces `..` before validation. Do note this is still not a recommended method for\nprotecting against directory traversal, always use randomly generated IDs or filenames instead:\n```\n// This is ONLY for demonstration purpose, never use untrusted input\n// in paths, always use randomly generated filenames or IDs.\nString input = \"test../....//dir\";\n// Use replaceAll _not_ replace\ninput = input.replaceAll(\"\\\\.\\\\.\", \"\");\n// Input would be test///dir at this point\n// Create a pattern to match on\nPattern pattern = Pattern.compile(\"\\\\.\\\\.\");\n// Create a matcher\nMatcher match = pattern.matcher(input);\n// Call find to see if .. is still in our string\nif (match.find()) {\n throw new Exception(\".. detected\");\n}\n// Use the input (but do not modify the string)\nSystem.out.println(input + \" safe\");\n```\n\nFor more information see Carnegie Mellon University's Secure Coding Guide:\nhttps://wiki.sei.cmu.edu/confluence/display/java/IDS11-J.+Perform+any+string+modifications+before+validation\n\n"
+ },
+ "id": "find_sec_bugs.MODIFICATION_AFTER_VALIDATION-1",
+ "name": "find_sec_bugs.MODIFICATION_AFTER_VALIDATION-1",
+ "properties": {
+ "precision": "very-high",
+ "tags": [
+ "CWE-182",
+ "HIGH CONFIDENCE",
+ "security"
+ ]
+ },
+ "shortDescription": {
+ "text": "Collapse of data into unsafe value"
+ }
+ },
+ {
+ "defaultConfiguration": {
+ "level": "error"
+ },
+ "fullDescription": {
+ "text": "Format specifiers can take optional field widths, which should be\nused to limit how many characters are copied into the target buffer.\n\nFor more information please see: https://linux.die.net/man/3/scanf\n\nExample:\n```\n char buf[11] = {0};\n scanf(\"%10s\", &buf); // buf = AAAAAAAAAA\\0\n```\n\nIf developing for C Runtime Library (CRT), more secure versions of these functions should be\nused, see:\nhttps://learn.microsoft.com/en-us/cpp/c-runtime-library/reference/scanf-s-scanf-s-l-wscanf-s-wscanf-s-l?view=msvc-170\n"
+ },
+ "id": "flawfinder.scanf-1.vscanf-1.wscanf-1._tscanf-1.vwscanf-1",
+ "name": "flawfinder.scanf-1.vscanf-1.wscanf-1._tscanf-1.vwscanf-1",
+ "properties": {
+ "precision": "very-high",
+ "tags": [
+ "CWE-120",
+ "OWASP-A1:2017-Injection",
+ "security"
+ ]
+ },
+ "shortDescription": {
+ "text": "scanf() functions may allow format string based overflows"
+ }
+ },
+ {
+ "defaultConfiguration": {
+ "level": "error"
+ },
+ "fullDescription": {
+ "text": "A file is opened to write to its contents. The filename comes from an input parameter. If an\nunfiltered parameter is passed to this file API, files at an arbitrary filesystem location\ncould be modified. This rule identifies potential path traversal vulnerabilities. In many\ncases, the constructed file path cannot be controlled by the user.\n"
+ },
+ "id": "find_sec_bugs.PATH_TRAVERSAL_OUT-1.PATH_TRAVERSAL_OUT-1",
+ "name": "find_sec_bugs.PATH_TRAVERSAL_OUT-1.PATH_TRAVERSAL_OUT-1",
+ "properties": {
+ "precision": "very-high",
+ "tags": [
+ "CWE-22",
+ "security"
+ ]
+ },
+ "shortDescription": {
+ "text": "Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')"
+ }
+ },
+ {
+ "defaultConfiguration": {
+ "level": "warning"
+ },
+ "fullDescription": {
+ "text": "The application was found passing in a non-literal value to the `urllib` methods which issue\nrequests. `urllib` supports the `file://` scheme, which may allow an adversary who can control\nthe URL value to read arbitrary files on the file system.\n\nTo remediate this issue either hardcode the URLs being used in urllib or use the `requests`\nmodule instead.\n\nExample using the `requests` module to issue an HTTPS request:\n```\nimport requests\n# Issue a GET request to https://example.com with a timeout of 10 seconds\nresponse = requests.get('https://example.com', timeout=10)\n# Work with the response object\n# ...\n```\n"
+ },
+ "id": "bandit.B310-1",
+ "name": "bandit.B310-1",
+ "properties": {
+ "precision": "very-high",
+ "tags": [
+ "CWE-939",
+ "OWASP-A5:2017-Broken Access Control",
+ "security"
+ ]
+ },
+ "shortDescription": {
+ "text": "Improper Authorization in Handler for Custom URL Scheme"
+ }
+ },
+ {
+ "defaultConfiguration": {
+ "level": "warning"
+ },
+ "fullDescription": {
+ "text": "The `ServicePointManager.ServerCertificateValidationCallback` event has been set\nto always return `true`, which effectively disables the validation of server\ncertificates.\n\nThis allows for an adversary who is in between the application and the target host to intercept\npotentially sensitive information or transmit malicious data.\n\nRemove the callback function that is returning true to allow normal certificate validation to\nproceed.\nWhen no callback is provided, the client will validate that the certificate name matches the\nhostname\nthat was used when creating the request.\n\nFor more information on the `ServerCertificateValidationCallback` property see:\nhttps://learn.microsoft.com/en-us/dotnet/api/system.net.servicepointmanager.servercertificatevalidationcallback\n"
+ },
+ "id": "security_code_scan.SCS0004-1",
+ "name": "security_code_scan.SCS0004-1",
+ "properties": {
+ "precision": "very-high",
+ "tags": [
+ "CWE-295",
+ "security"
+ ]
+ },
+ "shortDescription": {
+ "text": "Certificate validation disabled"
+ }
+ },
+ {
+ "defaultConfiguration": {
+ "level": "error"
+ },
+ "fullDescription": {
+ "text": "The application was found calling an SSL module with SSL or TLS protocols that have known\ndeficiencies.\nIt is strongly recommended that newer applications use TLS 1.2 or 1.3 and\n`SSLContext.wrap_socket`.\n\nIf using the `pyOpenSSL` module, please note that it has been deprecated and the Python\nCryptographic Authority\nstrongly suggests moving to use the [pyca/cryptography](https://github.com/pyca/cryptography)\nmodule instead.\n\nTo remediate this issue for the `ssl` module, create a new TLS context and pass in\n`ssl.PROTOCOL_TLS_CLIENT` for clients or `ssl.PROTOCOL_TLS_SERVER` for servers to the\n`ssl.SSLContext(...)` `protocol=`\nargument. When converting the socket to a TLS socket, use the new `SSLContext.wrap_socket`\nmethod instead.\n\nExample creating a TLS 1.3 client socket connection by using a newer version of Python\n(3.11.4) and\nthe SSL module:\n```\nimport ssl\nimport socket\n\n# Create our initial socket\nwith socket.socket(socket.AF_INET, socket.SOCK_STREAM) as sock:\n # Connect the socket\n sock.connect(('www.example.org', 443))\n\n # Create a new SSLContext with protocol set to ssl.PROTOCOL_TLS_CLIENT\n # This will auto-select the highest grade TLS protocol version (1.3)\n context = ssl.SSLContext(protocol=ssl.PROTOCOL_TLS_CLIENT)\n # Load our a certificates for server certificate authentication\n context.load_verify_locations('cert.pem')\n # Create our TLS socket, and validate the server hostname matches\n with context.wrap_socket(sock, server_hostname=\"www.example.org\") as tls_sock:\n # Send some bytes over the socket (HTTP request in this case)\\\n data = bytes('GET / HTTP/1.1\\r\\nHost: example.org\\r\\n\\r\\n', 'utf-8')\n sent_bytes = tls_sock.send(data)\n # Validate number of sent bytes\n # ...\n # Read the response\n resp = tls_sock.recv()\n # Work with the response\n # ...\n```\n\nFor more information on the ssl module see:\n- https://docs.python.org/3/library/ssl.html\n\nFor more information on pyca/cryptography and openssl see:\n- https://cryptography.io/en/latest/openssl/\n"
+ },
+ "id": "bandit.B502",
+ "name": "bandit.B502",
+ "properties": {
+ "precision": "very-high",
+ "tags": [
+ "CWE-326",
+ "OWASP-A3:2017-Sensitive Data Exposure",
+ "security"
+ ]
+ },
+ "shortDescription": {
+ "text": "Inadequate Encryption Strength"
+ }
+ },
+ {
+ "defaultConfiguration": {
+ "level": "warning"
+ },
+ "fullDescription": {
+ "text": "The application was found calling `ssl.wrap_socket` without a TLS protocol version specified.\nAdditionally, `ssl.wrap_socket` has been deprecated since Python 3.7. It is strongly\nrecommended\nthat newer applications use TLS 1.2 or 1.3 and `SSLContext.wrap_socket`.\n\nTo remediate this issue, create a new TLS context and pass in `ssl.PROTOCOL_TLS_CLIENT`\nfor clients or `ssl.PROTOCOL_TLS_SERVER` for servers to the `ssl.SSLContext(...)` `protocol=`\nargument. When converting the socket to a TLS socket, use the new `SSLContext.wrap_socket`\nmethod instead.\n\n\nExample creating a TLS 1.3 client socket connection by using a newer version of Python\n(3.11.4) and\nthe SSL module:\n```\nimport ssl\nimport socket\n\n# Create our initial socket\nwith socket.socket(socket.AF_INET, socket.SOCK_STREAM) as sock:\n # Connect the socket\n sock.connect(('www.example.org', 443))\n\n # Create a new SSLContext with protocol set to ssl.PROTOCOL_TLS_CLIENT\n # This will auto-select the highest grade TLS protocol version (1.3)\n context = ssl.SSLContext(protocol=ssl.PROTOCOL_TLS_CLIENT)\n # Load our a certificates for server certificate authentication\n context.load_verify_locations('cert.pem')\n # Create our TLS socket, and validate the server hostname matches\n with context.wrap_socket(sock, server_hostname=\"www.example.org\") as tls_sock:\n # Send some bytes over the socket (HTTP request in this case)\\\n data = bytes('GET / HTTP/1.1\\r\\nHost: example.org\\r\\n\\r\\n', 'utf-8')\n sent_bytes = tls_sock.send(data)\n # Validate number of sent bytes\n # ...\n # Read the response\n resp = tls_sock.recv()\n # Work with the response\n # ...\n```\n\nFor more information on the ssl module see:\n- https://docs.python.org/3/library/ssl.html\n"
+ },
+ "id": "bandit.B504",
+ "name": "bandit.B504",
+ "properties": {
+ "precision": "very-high",
+ "tags": [
+ "CWE-326",
+ "OWASP-A3:2017-Sensitive Data Exposure",
+ "security"
+ ]
+ },
+ "shortDescription": {
+ "text": "Inadequate encryption strength"
+ }
+ },
+ {
+ "defaultConfiguration": {
+ "level": "warning"
+ },
+ "fullDescription": {
+ "text": "The application is potentially exposing the entire filesystem by mounting the root\ndirectory `/` to an HTTP handler function. Anyone who is able to access this HTTP\nserver may be able to access any file that the HTTP server has access to.\n\nRestrict the `http.Dir` path to only a specific folder instead of the entire\nfilesystem.\n\nExample server only allowing directory listing on a public directory:\n```\nconst path = \"/var/www/html/public\"\nfs := http.FileServer(http.Dir(path))\nlog.Fatal(http.ListenAndServe(\":9000\", fs))\n```\n"
+ },
+ "id": "gosec.G111-1",
+ "name": "gosec.G111-1",
+ "properties": {
+ "precision": "very-high",
+ "tags": [
+ "CWE-23",
+ "security"
+ ]
+ },
+ "shortDescription": {
+ "text": "Relative path traversal"
+ }
+ },
+ {
+ "defaultConfiguration": {
+ "level": "warning"
+ },
+ "fullDescription": {
+ "text": "The sensitive information may be valuable information on its own (such as a password), or it\nmay be useful for launching other, more deadly attacks. If an attack fails, an attacker may use\nerror information provided by the server to launch another more focused attack. For example, an\nattempt to exploit a path traversal weakness (CWE-22) might yield the full pathname of the\ninstalled application.\n"
+ },
+ "id": "find_sec_bugs.INFORMATION_EXPOSURE_THROUGH_AN_ERROR_MESSAGE-1",
+ "name": "find_sec_bugs.INFORMATION_EXPOSURE_THROUGH_AN_ERROR_MESSAGE-1",
+ "properties": {
+ "precision": "very-high",
+ "tags": [
+ "CWE-209",
+ "security"
+ ]
+ },
+ "shortDescription": {
+ "text": "Information Exposure Through an Error Message"
+ }
+ },
+ {
+ "defaultConfiguration": {
+ "level": "warning"
+ },
+ "fullDescription": {
+ "text": "The application was found printing stack information to the default system output.\nAs stack trace data may contain sensitive information, it is recommended that the\noutput be logged using a secure logging framework. Log files should also be protected\nwith proper operating system permission levels.\n"
+ },
+ "id": "find_sec_bugs.INFORMATION_EXPOSURE_THROUGH_AN_ERROR_MESSAGE-1",
+ "name": "find_sec_bugs.INFORMATION_EXPOSURE_THROUGH_AN_ERROR_MESSAGE-1",
+ "properties": {
+ "precision": "very-high",
+ "tags": [
+ "CWE-209",
+ "security"
+ ]
+ },
+ "shortDescription": {
+ "text": "Information exposure through an error message"
+ }
+ },
+ {
+ "defaultConfiguration": {
+ "level": "warning"
+ },
+ "fullDescription": {
+ "text": "This function is synonymous with `getenv(\"TMP\")` and should be treated\nas untrusted input as it could be modified by an attacker. Possible risks\ninclude:\n\n- The value being too large and causing buffer overflows\n- Files under the attacker's control being used maliciously\n- Files outside of an attacker's control becoming accessible, depending on\naccess privileges.\n"
+ },
+ "id": "flawfinder.g_get_tmp_dir-1",
+ "name": "flawfinder.g_get_tmp_dir-1",
+ "properties": {
+ "precision": "very-high",
+ "tags": [
+ "CWE-20",
+ "OWASP-A1:2017-Injection",
+ "security"
+ ]
+ },
+ "shortDescription": {
+ "text": "Possible use of untrusted environment variable"
+ }
+ },
+ {
+ "defaultConfiguration": {
+ "level": "note"
+ },
+ "fullDescription": {
+ "text": "CWE-20: Check buffer boundaries if used in a loop including recursive loops\n"
+ },
+ "id": "flawfinder.getchar-1.fgetc-1.getc-1.read-1._gettc-1",
+ "name": "flawfinder.getchar-1.fgetc-1.getc-1.read-1._gettc-1",
+ "properties": {
+ "precision": "very-high",
+ "tags": [
+ "CWE-20",
+ "OWASP-A1:2017-Injection",
+ "security"
+ ]
+ },
+ "shortDescription": {
+ "text": "Check buffer boundaries if used in a loop including recursive loops (CWE-120, CWE-20)"
+ }
+ },
+ {
+ "defaultConfiguration": {
+ "level": "note"
+ },
+ "fullDescription": {
+ "text": "Starting a process with a shell; seems safe, but may be changed in the future, consider\nrewriting without shell\n"
+ },
+ "id": "bandit.B605",
+ "name": "bandit.B605",
+ "properties": {
+ "precision": "very-high",
+ "tags": [
+ "CWE-78",
+ "OWASP-A1:2017-Injection",
+ "security"
+ ]
+ },
+ "shortDescription": {
+ "text": "Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')"
+ }
+ },
+ {
+ "defaultConfiguration": {
+ "level": "warning"
+ },
+ "fullDescription": {
+ "text": "The HTTPSConnection API has changed frequently with minor releases of Python.Ensure you are\nusing the API for your version of Python securely. For example, Python 3 versions prior to\n3.4.3\nwill not verify SSL certificates by default.\n"
+ },
+ "id": "bandit.B309",
+ "name": "bandit.B309",
+ "properties": {
+ "precision": "very-high",
+ "tags": [
+ "CWE-295",
+ "OWASP-A3:2017-Sensitive Data Exposure",
+ "security"
+ ]
+ },
+ "shortDescription": {
+ "text": "Improper Certificate Validation"
+ }
+ },
+ {
+ "defaultConfiguration": {
+ "level": "note"
+ },
+ "fullDescription": {
+ "text": "The `atoi` family of functions can potentially overflow or underflow integer values. Consider\nusing `stroul` instead.\n\nFor more information please see:\nhttps://wiki.sei.cmu.edu/confluence/display/c/ERR34-C.+Detect+errors+when+converting+a+string+to+a+number\n"
+ },
+ "id": "flawfinder.atoi-1.atol-1._wtoi-1._wtoi64-1",
+ "name": "flawfinder.atoi-1.atol-1._wtoi-1._wtoi64-1",
+ "properties": {
+ "precision": "very-high",
+ "tags": [
+ "CWE-190",
+ "OWASP-A1:2017-Injection",
+ "security"
+ ]
+ },
+ "shortDescription": {
+ "text": "Possible integer overflow or underflow"
+ }
+ },
+ {
+ "defaultConfiguration": {
+ "level": "warning"
+ },
+ "fullDescription": {
+ "text": "Detected an insufficient key size for DSA. NIST recommends a key size\nof 2048 or higher.\n"
+ },
+ "id": "find_sec_bugs.RSA_KEY_SIZE-1",
+ "name": "find_sec_bugs.RSA_KEY_SIZE-1",
+ "properties": {
+ "precision": "very-high",
+ "tags": [
+ "CWE-326",
+ "security"
+ ]
+ },
+ "shortDescription": {
+ "text": "Inadequate Encryption Strength"
+ }
+ },
+ {
+ "defaultConfiguration": {
+ "level": "warning"
+ },
+ "fullDescription": {
+ "text": "The application is generating an RSA key that is less than the recommended 2048 bits.\nThe National Institute of Standards and Technology (NIST) deprecated signing Digital\nCertificates that contained RSA Public Keys of 1024 bits in December 2010. While\n1024-bit RSA keys have not been factored yet, advances in compute may make it possible\nin the near future.\n\nConsider upgrading to the newer asymmetric algorithm such as `Ed25519` which handles\nthe complexities of generating key pairs and choosing correct key sizes for you:\n```\npublic static KeyPair generateEd25519() throws NoSuchAlgorithmException {\n // Choose Ed25519 for KeyPairGenerator Instance\n KeyPairGenerator keyPairGenerator = KeyPairGenerator.getInstance(\"Ed25519\");\n // Generate a KeyPair and return\n return keyPairGenerator.generateKeyPair();\n}\n```\n\nOtherwise use a key size greater than 2048 when generating RSA keys:\n```\npublic static KeyPair generateRSA() throws NoSuchAlgorithmException {\n // Choose RSA for KeyPairGenerator Instance\n KeyPairGenerator keyPairGenerator = KeyPairGenerator.getInstance(\"RSA\");\n // Initialize with 2048 key size\n keyPairGenerator.initialize(2048);\n // Generate a KeyPair and return\n return keyPairGenerator.generateKeyPair();\n}\n```\n\nFor more information on Ed25519 see: http://ed25519.cr.yp.to/\n\nFor more information on Java Cryptography see:\nhttps://docs.oracle.com/en/java/javase/15/security/java-cryptography-architecture-jca-reference-guide.html\n"
+ },
+ "id": "find_sec_bugs.RSA_KEY_SIZE-1",
+ "name": "find_sec_bugs.RSA_KEY_SIZE-1",
+ "properties": {
+ "precision": "very-high",
+ "tags": [
+ "CWE-326",
+ "security"
+ ]
+ },
+ "shortDescription": {
+ "text": "Inadequate encryption strength"
+ }
+ },
+ {
+ "defaultConfiguration": {
+ "level": "warning"
+ },
+ "fullDescription": {
+ "text": "Go's `for ... range` statements create an iteration variable for each iteration of the loop.\nBy taking the address of this iteration variable, the value of the address will be re-used\nand always point to the same location in memory. This can have unexpected behavior if the\naddress is stored or re-used.\n\nThis can be fixed by:\n- Not referencing the address of the variable\n- Re-assigning the iteration variable to a new variable\n- Using the address of the indexed variable\n\nExample not referencing the address:\n```\ntype someStruct struct {\n x int\n}\n\nfor _, n := range []someStruct{{1}, {2}, {3}, {4}} {\n fmt.Printf(\"%d\\n\", n.x)\n}\n```\n\nExample reassigning the iteration variable to a new variable:\n```\ntype someStruct struct {\n x int\n}\n\nfor _, n := range []someStruct{{1}, {2}, {3}, {4}} {\n p := n\n fmt.Printf(\"%p\\n\", &p)\n}\n```\n\nExample using the address of the indexed variable:\n```\ntype someStruct struct {\n x int\n}\n\nstructData := []someStruct{{1}, {2}, {3}, {4}}\nfor idx := range structData {\n fmt.Printf(\"%p\\n\", &structData[idx])\n}\n```\n\nFor more information on how the `for ... range` statement works see:\nhttps://go.dev/ref/spec#For_statements\n"
+ },
+ "id": "gosec.G601-1",
+ "name": "gosec.G601-1",
+ "properties": {
+ "precision": "very-high",
+ "tags": [
+ "CWE-118",
+ "security"
+ ]
+ },
+ "shortDescription": {
+ "text": "Incorrect access of indexable resource ('Range Error')"
+ }
+ },
+ {
+ "defaultConfiguration": {
+ "level": "note"
+ },
+ "fullDescription": {
+ "text": "Some older Unix-like systems, `mkstemp` would create temp files with 0666 permissions,\nmeaning the file created would be read/write access for all users.\n\nEnsure the process has called the `umask` function with restricted permissions prior\nto calling `mkstemp` and validate the permissions prior to using the file descriptor.\n\nFor more information on temporary files please see:\nhttps://wiki.sei.cmu.edu/confluence/pages/viewpage.action?pageId=87152425\n"
+ },
+ "id": "flawfinder.mkstemp-1",
+ "name": "flawfinder.mkstemp-1",
+ "properties": {
+ "precision": "very-high",
+ "tags": [
+ "CWE-377",
+ "OWASP-A5:2017-Broken Access Control",
+ "security"
+ ]
+ },
+ "shortDescription": {
+ "text": "Potential file permissions issue (mkstemp)"
+ }
+ },
+ {
+ "defaultConfiguration": {
+ "level": "warning"
+ },
+ "fullDescription": {
+ "text": "Implementing a custom MessageDigest is error-prone. National Institute of Standards and\nTechnology(NIST) recommends the use of SHA-224, SHA-256, SHA-384, SHA-512, SHA-512/224, or\nSHA-512/256.\n"
+ },
+ "id": "find_sec_bugs.CUSTOM_MESSAGE_DIGEST-1",
+ "name": "find_sec_bugs.CUSTOM_MESSAGE_DIGEST-1",
+ "properties": {
+ "precision": "very-high",
+ "tags": [
+ "CWE-327",
+ "security"
+ ]
+ },
+ "shortDescription": {
+ "text": "Use of a Broken or Risky Cryptographic Algorithm"
+ }
+ },
+ {
+ "defaultConfiguration": {
+ "level": "warning"
+ },
+ "fullDescription": {
+ "text": "The application was found implementing a custom `java.security.MessageDigest`. It is\nstrongly recommended that a standard Digest algorithm be chosen instead as implementing\na digest by hand is error-prone. The National Institute of Standards and\nTechnology (NIST) recommends the use of SHA-224, SHA-256, SHA-384, SHA-512, SHA-512/224, or\nSHA-512/256.\n\nExample of creating a SHA-384 hash:\n```\n// Create a MessageDigest using the SHA-384 algorithm\nMessageDigest sha384Digest = MessageDigest.getInstance(\"SHA-384\");\n// Call update with your data\nsha384Digest.update(input);\n// Only call digest once all data has been fed into the update sha384digest instance\nbyte[] output = sha384Digest.digest();\n// output base64 encoded version of the hash\nSystem.out.println(\"hash: \" + Base64.getEncoder().encodeToString(output));\n```\n"
+ },
+ "id": "find_sec_bugs.CUSTOM_MESSAGE_DIGEST-1",
+ "name": "find_sec_bugs.CUSTOM_MESSAGE_DIGEST-1",
+ "properties": {
+ "precision": "very-high",
+ "tags": [
+ "CWE-327",
+ "security"
+ ]
+ },
+ "shortDescription": {
+ "text": "Use of a broken or risky cryptographic algorithm"
+ }
+ },
+ {
+ "defaultConfiguration": {
+ "level": "warning"
+ },
+ "fullDescription": {
+ "text": "SQL Injection is a critical vulnerability that can lead to data or system compromise. By\ndynamically generating SQL query strings, user input may be able to influence the logic of\nthe SQL statement. This could lead to an adversary accessing information they should\nnot have access to or in some circumstances, being able to execute OS functionality or code.\n\nReplace all dynamically generated SQL queries with parameterized queries. In situations where\ndynamic queries must be created, never use direct user input, but instead use a map or\ndictionary of valid values and resolve them using a user supplied key.\n\nFor example, some database drivers do not allow parameterized queries for `>` or `<` comparison\noperators. In these cases, do not use a user supplied `>` or `<` value, but rather have the\nuser\nsupply a `gt` or `lt` value. The alphabetical values are then used to look up the `>` and `<`\nvalues to be used in the construction of the dynamic query. The same goes for other queries\nwhere\ncolumn or table names are required but cannot be parameterized.\n\nExample using parameterized queries with `sql.Query`:\n```\nrows, err := db.Query(\"SELECT * FROM users WHERE userName = ?\", userName)\nif err != nil {\n return nil, err\n}\ndefer rows.Close()\nfor rows.Next() {\n // ... process rows\n}\n```\n\nFor more information on SQL Injection see OWASP:\nhttps://cheatsheetseries.owasp.org/cheatsheets/SQL_Injection_Prevention_Cheat_Sheet.html\n"
+ },
+ "id": "gosec.G201-1",
+ "name": "gosec.G201-1",
+ "properties": {
+ "precision": "very-high",
+ "tags": [
+ "CWE-89",
+ "security"
+ ]
+ },
+ "shortDescription": {
+ "text": "Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')"
+ }
+ },
+ {
+ "defaultConfiguration": {
+ "level": "warning"
+ },
+ "fullDescription": {
+ "text": "The application was found enabling insecure TLS protocol versions. When enabling protocol\nversions for an `SSLContext`, only the following versions should be allowed:\n- TLSv1.2\n- TLSv1.3\n- DTLSv1.2\n- DTLSv1.3\n\nTo mitigate potential security risks, it is strongly advised to enforce TLS 1.2 as the minimum\nprotocol version and disallow older versions such as TLS 1.0. Do note that newer versions of\nJava do not even support TLS 1.0 and will throw `NoSuchAlgorithmException`. Versions of TLS\nprior to 1.2 could expose the connection to downgrade attacks, where an adversary intercepts\nthe\nconnection and alters the requested protocol version to be a less secure one.\n\nIn many scenarios, relying on the default system configuration does not meet compliance\nstandards. This is due to the application being deployed across diverse systems with varying\nconfigurations and Java versions. While the default value may be secure on modern and\nup-to-date systems, it may not hold true for older systems. Consequently, it is highly\nrecommended to explicitly define a secure configuration in all cases.\n\nExample configuring an SSLContext with TLSv1.2:\n```\n// Create an SSLContext with TLSv1.2 explicitly\nSSLContext tlsContext = SSLContext.getInstance(\"TLSv1.2\"); // or TLSv1.3, DTLSv1.2, DTLSv1.3\n\n// Alternatively, set the enabled protocols\nSSLContext serverSslContext = SSLContext.getInstance(\"TLS\");\nSSLEngine serverEngine = serverSslContext.createSSLEngine();\n// Calling setEnabledProtocols will override the original context's configured protocol version\nserverEngine.setEnabledProtocols(new String[]{ \"TLSv1.2\" });\n```\n\nFor more information on `SSLContext` see:\n- https://docs.oracle.com/en/java/javase/11/docs/api/java.base/javax/net/ssl/SSLContext.html\n\nFor more information on MiTM attacks see:\n- https://owasp.org/www-community/attacks/Manipulator-in-the-middle_attack\n"
+ },
+ "id": "find_sec_bugs.SSL_CONTEXT-2",
+ "name": "find_sec_bugs.SSL_CONTEXT-2",
+ "properties": {
+ "precision": "very-high",
+ "tags": [
+ "CWE-326",
+ "security"
+ ]
+ },
+ "shortDescription": {
+ "text": "Inadequate encryption strength"
+ }
+ },
+ {
+ "defaultConfiguration": {
+ "level": "warning"
+ },
+ "fullDescription": {
+ "text": "This function is synonymous with `getenv(\"HOME\")` and should be treated\nas untrusted input as it could be modified by an attacker. Possible risks\ninclude:\n\n- The value being too large and causing buffer overflows\n- Files under the attacker's control being used maliciously\n- Files outside of an attacker's control becoming accessible, depending on\naccess privileges.\n"
+ },
+ "id": "flawfinder.g_get_home_dir-1",
+ "name": "flawfinder.g_get_home_dir-1",
+ "properties": {
+ "precision": "very-high",
+ "tags": [
+ "CWE-20",
+ "OWASP-A1:2017-Injection",
+ "security"
+ ]
+ },
+ "shortDescription": {
+ "text": "Possible use of untrusted environment variable"
+ }
+ },
+ {
+ "defaultConfiguration": {
+ "level": "error"
+ },
+ "fullDescription": {
+ "text": "The application was found creating a SSL context using the `_create_unverified_context`.\nThis effectively disables the validation of server certificates.\n\nThis allows for an adversary who is in between the application and the target host to intercept\npotentially sensitive information or transmit malicious data.\n\nTo remediate this issue remove the call to `_create_unverified_context` and either create a\ndefault\ncontext using `ssl.create_default_context` or create a context with TLS 1.3.\n\nExample creating a TLS 1.3 client socket connection by using a newer version of Python\n(3.11.4) and\nthe SSL module:\n```\nimport ssl\nimport socket\n\n# Create our initial socket\nwith socket.socket(socket.AF_INET, socket.SOCK_STREAM) as sock:\n # Connect the socket\n sock.connect(('www.example.org', 443))\n\n # Create a new SSLContext with protocol set to ssl.PROTOCOL_TLS_CLIENT\n # This will auto-select the highest grade TLS protocol version (1.3)\n context = ssl.SSLContext(protocol=ssl.PROTOCOL_TLS_CLIENT)\n # Load our a certificates for server certificate authentication\n context.load_verify_locations('cert.pem')\n # Create our TLS socket, and validate the server hostname matches\n with context.wrap_socket(sock, server_hostname=\"www.example.org\") as tls_sock:\n # Send some bytes over the socket (HTTP request in this case)\\\n data = bytes('GET / HTTP/1.1\\r\\nHost: example.org\\r\\n\\r\\n', 'utf-8')\n sent_bytes = tls_sock.send(data)\n # Validate number of sent bytes\n # ...\n # Read the response\n resp = tls_sock.recv()\n # Work with the response\n # ...\n```\n\nUnverified SSL context detected. This will permit insecure connections without `verifyingSSL`\ncertificates. Use `ssl.create_default_context()` instead.\n"
+ },
+ "id": "bandit.B323",
+ "name": "bandit.B323",
+ "properties": {
+ "precision": "very-high",
+ "tags": [
+ "CWE-295",
+ "OWASP-A3:2017-Sensitive Data Exposure",
+ "security"
+ ]
+ },
+ "shortDescription": {
+ "text": "Improper certificate validation"
+ }
+ },
+ {
+ "defaultConfiguration": {
+ "level": "warning"
+ },
+ "fullDescription": {
+ "text": "The method identified is susceptible to injection. The input should be validated and properly\nescaped.\n"
+ },
+ "id": "find_sec_bugs.CUSTOM_INJECTION-2",
+ "name": "find_sec_bugs.CUSTOM_INJECTION-2",
+ "properties": {
+ "precision": "very-high",
+ "tags": [
+ "CWE-89",
+ "security"
+ ]
+ },
+ "shortDescription": {
+ "text": "Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')"
+ }
+ },
+ {
+ "defaultConfiguration": {
+ "level": "warning"
+ },
+ "fullDescription": {
+ "text": "The method identified is susceptible to injection. The input should be validated and properly\nescaped.\n"
+ },
+ "id": "find_sec_bugs.CUSTOM_INJECTION-2",
+ "name": "find_sec_bugs.CUSTOM_INJECTION-2",
+ "properties": {
+ "precision": "very-high",
+ "tags": [
+ "CWE-89",
+ "security"
+ ]
+ },
+ "shortDescription": {
+ "text": "Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')"
+ }
+ },
+ {
+ "defaultConfiguration": {
+ "level": "warning"
+ },
+ "fullDescription": {
+ "text": "DES, TripleDES and RC2 are all considered broken or insecure cryptographic algorithms.\nIf using .NET Framework greater than version 6.0 consider using `ChaCha20Poly1305`\ninstead as it is easier and faster than the alternatives such as `AES-256-GCM`.\n\nFor older applications, `AES-256-GCM` is recommended, however it has many drawbacks:\n- Slower than `ChaCha20Poly1305`.\n- Catastrophic failure if nonce values are reused.\n\nExample using `ChaCha20Poly1305`:\n```\n// Generate a random key\nbyte[] key = new byte[32];\nRandomNumberGenerator.Fill(key);\n\n// Note nonce values _must_ be regenerated every time they are used.\nbyte[] nonce = new byte[12];\nRandomNumberGenerator.Fill(nonce);\n\nbyte[] authTag = new byte[16];\nbyte[] cipherText;\n\nusing (ChaCha20Poly1305 encryptor = new ChaCha20Poly1305(key))\n{\n byte[] plainText = System.Text.Encoding.UTF8.GetBytes(\"Secret text to encrypt\");\n cipherText = new byte[plainText.Length];\n encryptor.Encrypt(nonce, plainText, cipherText, authTag);\n}\n\nusing (ChaCha20Poly1305 decryptor = new ChaCha20Poly1305(key))\n{\n byte[] output = new byte[cipherText.Length];\n decryptor.Decrypt(nonce, cipherText, authTag, output);\n Console.WriteLine(\"Output: {0}\", System.Text.Encoding.UTF8.GetString(output));\n}\n```\n\nExample using `AES-256-GCM`:\n```\n// Generate a random key\nbyte[] key = new byte[32];\nRandomNumberGenerator.Fill(key);\n\n// Note nonce values _must_ be regenerated every time they are used.\nbyte[] nonce = new byte[AesGcm.NonceByteSizes.MaxSize];\nRandomNumberGenerator.Fill(nonce);\n\nbyte[] authTag = new byte[AesGcm.TagByteSizes.MaxSize];\nbyte[] cipherText;\n\nusing (AesGcm encryptor = new AesGcm(key))\n{\n byte[] plainText = Encoding.UTF8.GetBytes(\"Secret text to encrypt\");\n cipherText = new byte[plainText.Length];\n encryptor.Encrypt(nonce, plainText, cipherText, authTag);\n}\n\nusing (AesGcm decryptor = new AesGcm(key))\n{\n byte[] output = new byte[cipherText.Length];\n decryptor.Decrypt(nonce, cipherText, authTag, output);\n Console.WriteLine(\"Output: {0}\", Encoding.UTF8.GetString(output));\n}\n```\n"
+ },
+ "id": "security_code_scan.SCS0010-1",
+ "name": "security_code_scan.SCS0010-1",
+ "properties": {
+ "precision": "very-high",
+ "tags": [
+ "CWE-327",
+ "security"
+ ]
+ },
+ "shortDescription": {
+ "text": "Use of a broken or risky cryptographic algorithm"
+ }
+ },
+ {
+ "defaultConfiguration": {
+ "level": "warning"
+ },
+ "fullDescription": {
+ "text": "The network communications for Hazelcast is configured to use a symmetric cipher (probably DES\nor Blowfish). Those ciphers alone do not provide integrity or secure authentication. The use of\nasymmetric encryption is preferred.\n"
+ },
+ "id": "find_sec_bugs.HAZELCAST_SYMMETRIC_ENCRYPTION-1",
+ "name": "find_sec_bugs.HAZELCAST_SYMMETRIC_ENCRYPTION-1",
+ "properties": {
+ "precision": "very-high",
+ "tags": [
+ "CWE-326",
+ "security"
+ ]
+ },
+ "shortDescription": {
+ "text": "Inadequate Encryption Strength"
+ }
+ },
+ {
+ "defaultConfiguration": {
+ "level": "warning"
+ },
+ "fullDescription": {
+ "text": "The network communications for Hazelcast is configured to use a deprecated symmetric cipher.\nConsider using TLS/SSL when establishing communications across the Hazelcast cluster.\n\nFor more information on configuring TLS/SSL for Hazelcast see:\nhttps://docs.hazelcast.com/imdg/4.2/security/tls-ssl\n"
+ },
+ "id": "find_sec_bugs.HAZELCAST_SYMMETRIC_ENCRYPTION-1",
+ "name": "find_sec_bugs.HAZELCAST_SYMMETRIC_ENCRYPTION-1",
+ "properties": {
+ "precision": "very-high",
+ "tags": [
+ "CWE-326",
+ "security"
+ ]
+ },
+ "shortDescription": {
+ "text": "Inadequate encryption strength"
+ }
+ },
+ {
+ "defaultConfiguration": {
+ "level": "error"
+ },
+ "fullDescription": {
+ "text": "The application was found using the `requests` module without configuring a timeout value for\nconnections. The `verify=False` argument has been set, which effectively disables the\nvalidation\nof server certificates.\n\nThis allows for an adversary who is in between the application and the target host to intercept\npotentially sensitive information or transmit malicious data.\n\nTo remediate this issue either remove the `verify=False` argument, or set `verify=True`to each\n`requests` call.\n\nExample verifying server certificates for an HTTP GET request:\n```\n# Issue a GET request to https://example.com with a timeout of 10 seconds and verify the\n# server certificate explicitly.\nresponse = requests.get('https://example.com', timeout=10, verify=True)\n# Work with the response object\n# ...\n```\n\nFor more information on using the requests module see:\n- https://requests.readthedocs.io/en/latest/api/\n"
+ },
+ "id": "bandit.B501",
+ "name": "bandit.B501",
+ "properties": {
+ "precision": "very-high",
+ "tags": [
+ "CWE-295",
+ "OWASP-A3:2017-Sensitive Data Exposure",
+ "security"
+ ]
+ },
+ "shortDescription": {
+ "text": "Improper certificate validation"
+ }
+ },
+ {
+ "defaultConfiguration": {
+ "level": "warning"
+ },
+ "fullDescription": {
+ "text": "Possible hardcoded password\n"
+ },
+ "id": "bandit.B105",
+ "name": "bandit.B105",
+ "properties": {
+ "precision": "very-high",
+ "tags": [
+ "CWE-259",
+ "OWASP-A3:2017-Sensitive Data Exposure",
+ "security"
+ ]
+ },
+ "shortDescription": {
+ "text": "Use of Hard-coded Password"
+ }
+ },
+ {
+ "defaultConfiguration": {
+ "level": "warning"
+ },
+ "fullDescription": {
+ "text": "The endpoint is potentially accessible to not authorized users. If it contains sensitive\ninformation, like log files for example, it may lead to privilege escalation.\n"
+ },
+ "id": "security_code_scan.SCS0012-1",
+ "name": "security_code_scan.SCS0012-1",
+ "properties": {
+ "precision": "very-high",
+ "tags": [
+ "CWE-284",
+ "security"
+ ]
+ },
+ "shortDescription": {
+ "text": "Improper Access Control"
+ }
+ },
+ {
+ "defaultConfiguration": {
+ "level": "error"
+ },
+ "fullDescription": {
+ "text": "XML External Entity (XXE) attacks can occur when an XML parser supports XML\nentities while processing XML received from an untrusted source.\n"
+ },
+ "id": "find_sec_bugs.XXE_XMLSTREAMREADER-1",
+ "name": "find_sec_bugs.XXE_XMLSTREAMREADER-1",
+ "properties": {
+ "precision": "very-high",
+ "tags": [
+ "CWE-611",
+ "security"
+ ]
+ },
+ "shortDescription": {
+ "text": "Improper Restriction of XML External Entity Reference ('XXE')"
+ }
+ },
+ {
+ "defaultConfiguration": {
+ "level": "warning"
+ },
+ "fullDescription": {
+ "text": "DES is considered strong ciphers for modern applications. Currently, NIST recommends the usage\nof AES block ciphers instead of DES.\n"
+ },
+ "id": "find_sec_bugs.DES_USAGE-1",
+ "name": "find_sec_bugs.DES_USAGE-1",
+ "properties": {
+ "precision": "very-high",
+ "tags": [
+ "CWE-326",
+ "security"
+ ]
+ },
+ "shortDescription": {
+ "text": "Inadequate Encryption Strength"
+ }
+ },
+ {
+ "defaultConfiguration": {
+ "level": "warning"
+ },
+ "fullDescription": {
+ "text": "DES, TripleDES and RC2 are all considered broken or insecure cryptographic algorithms.\nNewer algorithms apply message integrity to validate ciphertext has not been tampered\nwith. Consider using `ChaCha20Poly1305` instead as it is easier and faster than the\nalternatives such as `AES-256-GCM`.\n\nFor older applications that don't have support for `ChaCha20Poly1305`,\n`AES-256-GCM` is recommended, however it has many drawbacks:\n- Slower than `ChaCha20Poly1305`.\n- Catastrophic failure if nonce values are reused.\n\nExample using `ChaCha20Poly1305`:\n```\npublic encrypt() throws Exception {\n chaChaEncryption(\"Secret text to encrypt\".getBytes(StandardCharsets.UTF_8));\n}\n\npublic SecureRandom getSecureRandomDRBG() throws NoSuchAlgorithmException {\n // Use DRBG according to\nhttp://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-90Ar1.pdf\n return SecureRandom.getInstance(\"DRBG\",\n // Security strength in bits (default is 128)\n DrbgParameters.instantiation(256,\n // Set prediction resistance and re-seeding\n DrbgParameters.Capability.PR_AND_RESEED,\n // Set the personalization string (optional, not necessary)\n \"some_personalization_string\".getBytes()\n )\n );\n}\n\npublic Cipher getChaCha20Poly1305(int mode, byte[] ivKey, byte[] secretKey) throws\nNoSuchAlgorithmException, NoSuchPaddingException, InvalidKeyException,\nInvalidAlgorithmParameterException {\n // Get a DRBG random number generator instance\n SecureRandom random = getSecureRandomDRBG();\n // Create a ChaCha20-Poly1305 cipher instance\n Cipher chaChaCipher = Cipher.getInstance(\"ChaCha20-Poly1305/None/NoPadding\");\n // Create our parameterSpec using our ivKey\n AlgorithmParameterSpec parameterSpec = new IvParameterSpec(ivKey);\n // Create a SecretKeySpec using our secretKey\n SecretKeySpec secretKeySpec = new SecretKeySpec(secretKey, \"ChaCha20\");\n // Initialize and return the cipher for the provided mode\n chaChaCipher.init(mode, secretKeySpec, parameterSpec, random);\n return chaChaCipher;\n}\n\npublic void chaChaEncryption(byte[] plainText) throws NoSuchAlgorithmException,\nNoSuchPaddingException, InvalidKeyException, InvalidAlgorithmParameterException {\n // Get a DRBG random number generator instance\n SecureRandom random = getSecureRandomDRBG();\n // Create secretKey\n byte[] secretKey = new byte[32];\n random.nextBytes(secretKey);\n // Create an IV Key\n byte[] ivKey = new byte[12];\n random.nextBytes(ivKey);\n\n // Create a chaCha encryption cipher instance\n Cipher chaChaEncryptor = getChaCha20Poly1305(Cipher.ENCRYPT_MODE, ivKey, secretKey);\n\n // Encrypt the text using ChaCha20Poly1305\n byte[] cipherText = null;\n try {\n cipherText = chaChaEncryptor.doFinal(plainText);\n } catch (IllegalBlockSizeException | BadPaddingException e) {\n System.out.println(\"failed to encrypt text\");\n return;\n }\n System.out.println(\"encrypted: \" + Base64.getEncoder().encodeToString(cipherText));\n\n // Create a chaCha decryption cipher instance\n Cipher chaChaDecryptor = getChaCha20Poly1305(Cipher.DECRYPT_MODE, ivKey, secretKey);\n\n // Decrypt the text\n byte[] decryptedText = null;\n try {\n decryptedText = chaChaDecryptor.doFinal(cipherText);\n } catch (IllegalBlockSizeException | BadPaddingException e) {\n System.out.println(\"failed to decrypt text\");\n return;\n }\n System.out.println(\"decrypted: \" + new String(decryptedText, StandardCharsets.UTF_8));\n}\n```\n\nFor more information on Java Cryptography see:\nhttps://docs.oracle.com/en/java/javase/15/security/java-cryptography-architecture-jca-reference-guide.html\n"
+ },
+ "id": "find_sec_bugs.DES_USAGE-1",
+ "name": "find_sec_bugs.DES_USAGE-1",
+ "properties": {
+ "precision": "very-high",
+ "tags": [
+ "CWE-326",
+ "security"
+ ]
+ },
+ "shortDescription": {
+ "text": "Inadequate encryption strength"
+ }
+ },
+ {
+ "defaultConfiguration": {
+ "level": "error"
+ },
+ "fullDescription": {
+ "text": "External XML entities are a feature of XML parsers that allow documents to contain references\nto\nother documents or data. This feature can be abused to read files, communicate with external\nhosts,\nexfiltrate data, or cause a Denial of Service (DoS).\n\nIn most XML parsers, the recommendation to protect against XXE is to disable the doctype\nfeature.\nUnfortunately use of the `XMLInputFactory` requires that the doctypes feature be enabled.\nInstead\nthe application can set the `ACCESS_EXTERNAL_DTD` to an empty string and disable\n`javax.xml.stream.isSupportingExternalEntities`.\n\n\nCreates an `XMLInputFactory` stream parser, but disables accessing external DTD or entities:\n```\n// Create an XMLInputFactory\nXMLInputFactory factory = XMLInputFactory.newFactory();\n// Set the ACCESS_EXTERNAL_DTD property to an empty string so it won't access\n// entities using protocols\n// (ref:\nhttps://docs.oracle.com/javase/8/docs/api/javax/xml/XMLConstants.html#ACCESS_EXTERNAL_DTD)\nfactory.setProperty(XMLConstants.ACCESS_EXTERNAL_DTD, \"\");\n// Additionally, disable support for resolving external entities\nfactory.setProperty(\"javax.xml.stream.isSupportingExternalEntities\", false);\n// Continue to work with the factory/stream parser\n```\n\nFor more information on XML security see OWASP's guide:\nhttps://cheatsheetseries.owasp.org/cheatsheets/XML_External_Entity_Prevention_Cheat_Sheet.html#java\n"
+ },
+ "id": "find_sec_bugs.XXE_XMLSTREAMREADER-1",
+ "name": "find_sec_bugs.XXE_XMLSTREAMREADER-1",
+ "properties": {
+ "precision": "very-high",
+ "tags": [
+ "CWE-611",
+ "security"
+ ]
+ },
+ "shortDescription": {
+ "text": "Improper restriction of XML external entity reference ('XXE')"
+ }
+ },
+ {
+ "defaultConfiguration": {
+ "level": "warning"
+ },
+ "fullDescription": {
+ "text": "The SHA-1 message-digest algorithm has been cryptographically broken and\nis unsuitable for further use. It is\nrecommended that the SHA-3, or BLAKE2 family of algorithms be used for non-password based\ncryptographic hashes instead. For password based cryptographic hashes, consider using the\nbcrypt or Argon2id family of cryptographic hashes.\n\nHashing values using [BLAKE2](https://pkg.go.dev/golang.org/x/crypto/blake2b):\n```\nfileContents := []byte(\"some file contents to create hash for\")\nblake2bHasher, err := blake2b.New512(nil)\nif err != nil {\n log.Fatal(err)\n}\nhashedValue := blake2bHasher.Sum(fileContents)\nfmt.Printf(\"%s\\n\", hex.EncodeToString(hashedValue))\n```\n\nHashing and securely comparing passwords using\n[Argon2id](https://pkg.go.dev/golang.org/x/crypto/argon2#hdr-Argon2id):\n```\ntype argonParameters struct {\n variant string\n version int\n memory uint32\n iterations uint32\n parallelism uint8\n saltLength uint32\n keyLength uint32\n}\n\nfunc (a argonParameters) StringFormat(salt, derivedKey []byte) string {\n encodedSalt := base64.RawStdEncoding.EncodeToString(salt)\n encodedKey := base64.RawStdEncoding.EncodeToString(derivedKey)\n\n return fmt.Sprintf(\"$argon2id$v=%d$m=%d,t=%d,p=%d$%s$%s\",\n argon2.Version,\n a.memory,\n a.iterations,\n a.parallelism,\n encodedSalt,\n encodedKey,\n )\n}\n\nfunc main() {\n // Initialize Argon2id parameters\n p := argonParameters{\n memory: 64 * 1024,\n iterations: 3,\n parallelism: 2,\n saltLength: 16,\n keyLength: 32,\n }\n\n // Generate random salt (to be stored alongside derived hash key)\n salt := make([]byte, p.saltLength)\n if _, err := io.ReadFull(rand.Reader, salt); err != nil {\n log.Fatal(err)\n }\n\n usersPassword := []byte(\"User's Very S3cur3P4ss@rd@#$%\")\n\n var derivedKey []byte\n // Create key hash derived from user's password\n {\n derivedKey = argon2.IDKey(usersPassword, salt, p.iterations, p.memory, p.parallelism,\np.keyLength)\n // store p.StringFormat(...) result in a data store...\n fmt.Printf(\"%s\\n\", p.StringFormat(salt, derivedKey))\n }\n\n // Verify a user's password against key\n {\n keyToCompare := argon2.IDKey(usersPassword, salt, p.iterations, p.memory, p.parallelism,\np.keyLength)\n\n // Use subtle.ConstantTimeCompare(..., ...) to ensure no side channel leaks used in timing\nattacks\n if subtle.ConstantTimeCompare(derivedKey, keyToCompare) == 1 {\n fmt.Printf(\"Passwords match\\n\")\n } else {\n fmt.Printf(\"Passwords do not match\\n\")\n }\n }\n}\n```\n\nFor more information on password storage see OWASP's guide:\nhttps://cheatsheetseries.owasp.org/cheatsheets/Password_Storage_Cheat_Sheet.html\n"
+ },
+ "id": "gosec.G505-1",
+ "name": "gosec.G505-1",
+ "properties": {
+ "precision": "very-high",
+ "tags": [
+ "CWE-327",
+ "OWASP-A9:2017-Using Components with Known Vulnerabilities",
+ "security"
+ ]
+ },
+ "shortDescription": {
+ "text": "Use of a broken or risky cryptographic algorithm"
+ }
+ },
+ {
+ "defaultConfiguration": {
+ "level": "warning"
+ },
+ "fullDescription": {
+ "text": "Disabling HTML escaping put the application at risk for Cross-Site Scripting (XSS).\n"
+ },
+ "id": "find_sec_bugs.WICKET_XSS1-1",
+ "name": "find_sec_bugs.WICKET_XSS1-1",
+ "properties": {
+ "precision": "very-high",
+ "tags": [
+ "CWE-79",
+ "security"
+ ]
+ },
+ "shortDescription": {
+ "text": "Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')"
+ }
+ },
+ {
+ "defaultConfiguration": {
+ "level": "warning"
+ },
+ "fullDescription": {
+ "text": "The application is disabling Wicket's string escaping functionality by calling\n`setEscapeModelStrings(false)`.\nThis could lead to Cross Site Scripting (XSS) if used with user-supplied input. XSS is an\nattack which exploits\n a web application or system to treat user input\nas markup or script code. It is important to encode the data depending on the specific context\nit\nis used in. There are at least six context types:\n\n- Inside HTML tags `
context 1
`\n- Inside attributes: ``\n- Inside event attributes ``\n- Inside script blocks: ``\n- Unsafe element HTML assignment: `element.innerHTML = \"context 5\"`\n- Inside URLs: `link`\n\nScript blocks alone have multiple ways they need to be encoded. Extra care must be taken if\nuser input\nis ever output inside of script tags.\n\nUser input that is displayed within the application must be encoded, sanitized or validated\nto ensure it cannot be treated as HTML or executed as JavaScript code. Care must also be\ntaken\nto not mix server-side templating with client-side templating, as the server-side templating\nwill\nnot encode things like {{ 7*7 }} which may execute client-side templating features.\n\nIt is _NOT_ advised to encode user input prior to inserting into a data store. The data will\nneed to be\nencoded depending on context of where it is output. It is much safer to force the displaying\nsystem to\nhandle the encoding and not attempt to guess how it should be encoded.\n\nUse Wicket's built in escaping feature by calling `Component.setEscapeModelStrings(true);`\n\nFor more information on Wicket components see:\n- https://nightlies.apache.org/wicket/apidocs/9.x/org/apache/wicket/Component.html\n\nFor more information on XSS see OWASP:\n-\nhttps://cheatsheetseries.owasp.org/cheatsheets/Cross_Site_Scripting_Prevention_Cheat_Sheet.html\n"
+ },
+ "id": "find_sec_bugs.WICKET_XSS1-1",
+ "name": "find_sec_bugs.WICKET_XSS1-1",
+ "properties": {
+ "precision": "very-high",
+ "tags": [
+ "CWE-79",
+ "security"
+ ]
+ },
+ "shortDescription": {
+ "text": "Improper neutralization of input during web page generation ('Cross-site Scripting')"
+ }
+ },
+ {
+ "defaultConfiguration": {
+ "level": "warning"
+ },
+ "fullDescription": {
+ "text": "Without proper access control, executing an LDAP statement that contains a\nuser-controlled value can allow an attacker to abuse poorly configured LDAP\ncontext\n"
+ },
+ "id": "find_sec_bugs.LDAP_ANONYMOUS-1",
+ "name": "find_sec_bugs.LDAP_ANONYMOUS-1",
+ "properties": {
+ "precision": "very-high",
+ "tags": [
+ "CWE-20",
+ "security"
+ ]
+ },
+ "shortDescription": {
+ "text": "Improper Input Validation"
+ }
+ },
+ {
+ "defaultConfiguration": {
+ "level": "warning"
+ },
+ "fullDescription": {
+ "text": "The application does not provide authentication when communicating an LDAP\nserver. It is strongly recommended that the LDAP server be configured with\nauthentication and restrict what queries users can execute.\n\nExample code that authenticates with a remote LDAP server and encodes any\nuser-supplied input:\n```\n// Create a properties to hold the ldap connection details\nProperties props = new Properties();\n// Use the com.sun.jndi.ldap.LdapCtxFactory factory provider\nprops.put(Context.INITIAL_CONTEXT_FACTORY, \"com.sun.jndi.ldap.LdapCtxFactory\");\n// The LDAP server URL\nprops.put(Context.PROVIDER_URL, \"ldap://ldap.example.org:3889\");\n// User details for the connection\nprops.put(Context.SECURITY_PRINCIPAL, \"cn=admin,dc=example,dc=org\");\n// LDAP account password\nString ldapAccountPassword = getAccountPasswordFromSecureStoreOrKMS();\n// Pass in the LDAP password\nprops.put(Context.SECURITY_CREDENTIALS, ldapAccountPassword);\n\n// Create the LDAPContext\nInitialDirContext ldapContext = new InitialDirContext(props);\n// Example using SUBTREE_SCOPE SearchControls\nSearchControls searchControls = new SearchControls();\nsearchControls.setSearchScope(SearchControls.SUBTREE_SCOPE);\n\n// Get user input for query\nString userQuery = someUserInput;\n// Use searchArguments to hold the user-supplied input\nObject[] searchArguments = new Object[]{userQuery};\n// Hardcode the BaseDN, use the {0} format specifier to use the searchArguments array value,\nand pass in the search controls.\n// searchArguments automatically encode\nNamingEnumeration answer = ldapContext.search(\"dc=example,dc=org\", \"(cn={0})\",\nsearchArguments, searchControls);\n// Process the response answer\nwhile (answer.hasMoreElements()) {\n ...\n}\n```\n\nFor information on enabling authentication, please see your LDAP server's\ndocumentation.\n\nFor more information on LDAP Injection see OWASP:\nhttps://cheatsheetseries.owasp.org/cheatsheets/LDAP_Injection_Prevention_Cheat_Sheet.html\n"
+ },
+ "id": "find_sec_bugs.LDAP_ANONYMOUS-1",
+ "name": "find_sec_bugs.LDAP_ANONYMOUS-1",
+ "properties": {
+ "precision": "very-high",
+ "tags": [
+ "CWE-306",
+ "security"
+ ]
+ },
+ "shortDescription": {
+ "text": "Missing authentication for critical function (LDAP)"
+ }
+ },
+ {
+ "defaultConfiguration": {
+ "level": "error"
+ },
+ "fullDescription": {
+ "text": "XML External Entity (XXE) attacks can occur when an XML parser supports XML\nentities while processing XML received from an untrusted source.\n"
+ },
+ "id": "find_sec_bugs.XXE_DOCUMENT-1",
+ "name": "find_sec_bugs.XXE_DOCUMENT-1",
+ "properties": {
+ "precision": "very-high",
+ "tags": [
+ "CWE-611",
+ "security"
+ ]
+ },
+ "shortDescription": {
+ "text": "Improper Restriction of XML External Entity Reference ('XXE')"
+ }
+ },
+ {
+ "defaultConfiguration": {
+ "level": "note"
+ },
+ "fullDescription": {
+ "text": "The `strncat` family of functions are easy to use incorrectly when calculating destination\nbuffer\nsizes. It is recommended to use more secure alternatives such as `snprintf`.\n\nFor more information please see: https://linux.die.net/man/3/snprintf\n\nIf developing for C Runtime Library (CRT), more secure versions of these functions should be\nused, see:\nhttps://learn.microsoft.com/en-us/cpp/c-runtime-library/reference/strncat-s-strncat-s-l-wcsncat-s-wcsncat-s-l-mbsncat-s-mbsncat-s-l?view=msvc-170\n"
+ },
+ "id": "flawfinder.strncat-1",
+ "name": "flawfinder.strncat-1",
+ "properties": {
+ "precision": "very-high",
+ "tags": [
+ "CWE-120",
+ "OWASP-A1:2017-Injection",
+ "security"
+ ]
+ },
+ "shortDescription": {
+ "text": "Function does not handle null terminated strings or invalid pointers properly"
+ }
+ },
+ {
+ "defaultConfiguration": {
+ "level": "error"
+ },
+ "fullDescription": {
+ "text": "Passwords should not be kept in the source code. The source code can be widely shared in an\nenterprise environment, and is certainly shared in open source. To be managed safely, passwords\nand secret keys should be stored in separate configuration files or keystores.\n"
+ },
+ "id": "find_sec_bugs.HARD_CODE_PASSWORD-1",
+ "name": "find_sec_bugs.HARD_CODE_PASSWORD-1",
+ "properties": {
+ "precision": "very-high",
+ "tags": [
+ "CWE-259",
+ "security"
+ ]
+ },
+ "shortDescription": {
+ "text": "Use of Hard-coded Password"
+ }
+ },
+ {
+ "defaultConfiguration": {
+ "level": "error"
+ },
+ "fullDescription": {
+ "text": "Improper Handling of Unicode Encoding\n"
+ },
+ "id": "find_sec_bugs.IMPROPER_UNICODE-1",
+ "name": "find_sec_bugs.IMPROPER_UNICODE-1",
+ "properties": {
+ "precision": "very-high",
+ "tags": [
+ "CWE-176",
+ "HIGH CONFIDENCE",
+ "security"
+ ]
+ },
+ "shortDescription": {
+ "text": "Improper Handling of Unicode Encoding"
+ }
+ },
+ {
+ "defaultConfiguration": {
+ "level": "error"
+ },
+ "fullDescription": {
+ "text": "A potential hard-coded password was identified in a hard-coded string.\nPasswords should not be stored directly in code\nbut loaded from secure locations such as a Key Management System (KMS).\n\nThe purpose of using a Key Management System is so access can be audited and keys easily\nrotated\nin the event of a breach. By hardcoding passwords, it will be extremely difficult to determine\nwhen or if, a key is compromised.\n\nThe recommendation on which KMS to use depends on the environment the application is running\nin:\n\n- For Google Cloud Platform consider [Cloud Key Management](https://cloud.google.com/kms/docs)\n- For Amazon Web Services consider [AWS Key Management](https://aws.amazon.com/kms/)\n- For on premise or other alternatives to cloud providers, consider [Hashicorp's\nVault](https://www.vaultproject.io/)\n- For other cloud providers, please see their documentation\n"
+ },
+ "id": "find_sec_bugs.HARD_CODE_PASSWORD-1",
+ "name": "find_sec_bugs.HARD_CODE_PASSWORD-1",
+ "properties": {
+ "precision": "very-high",
+ "tags": [
+ "CWE-259",
+ "security"
+ ]
+ },
+ "shortDescription": {
+ "text": "Use of hard-coded password"
+ }
+ },
+ {
+ "defaultConfiguration": {
+ "level": "error"
+ },
+ "fullDescription": {
+ "text": "Improper Handling of Unicode Encoding\n"
+ },
+ "id": "find_sec_bugs.IMPROPER_UNICODE-1",
+ "name": "find_sec_bugs.IMPROPER_UNICODE-1",
+ "properties": {
+ "precision": "very-high",
+ "tags": [
+ "CWE-176",
+ "HIGH CONFIDENCE",
+ "security"
+ ]
+ },
+ "shortDescription": {
+ "text": "Improper Handling of Unicode Encoding"
+ }
+ },
+ {
+ "defaultConfiguration": {
+ "level": "warning"
+ },
+ "fullDescription": {
+ "text": "The application was found calling the `logging.config.listen`` function, which provides the\nability to listen for\nexternal configuration files over a socket server. This listen socket parses part of the\nconfiguration and calls\n`eval` on the supplied configuration file. A local user, or an adversary who is able to\nexploit\na Server Side Request Forgery (SSRF) attack to communicate over localhost, would be able to\nexecute arbitrary\ncode by passing in a logging config that contains python code.\n\nTo remediate the issue, remove the call to `logging.config.listen` method.\n\nFor more information on the listen functionality see:\n- https://docs.python.org/3/library/logging.config.html#logging.config.listen\n"
+ },
+ "id": "bandit.B612",
+ "name": "bandit.B612",
+ "properties": {
+ "precision": "very-high",
+ "tags": [
+ "CWE-94",
+ "security"
+ ]
+ },
+ "shortDescription": {
+ "text": "Improper control of generation of code ('Code Injection')"
+ }
+ },
+ {
+ "defaultConfiguration": {
+ "level": "warning"
+ },
+ "fullDescription": {
+ "text": "When converting a byte array containing a hash signature to a human readable string, a\nconversion mistake can be made if the array is read byte by byte.\n"
+ },
+ "id": "find_sec_bugs.BAD_HEXA_CONVERSION-1",
+ "name": "find_sec_bugs.BAD_HEXA_CONVERSION-1",
+ "properties": {
+ "precision": "very-high",
+ "tags": [
+ "CWE-704",
+ "HIGH CONFIDENCE",
+ "security"
+ ]
+ },
+ "shortDescription": {
+ "text": "Incorrect Type Conversion or Cast"
+ }
+ },
+ {
+ "defaultConfiguration": {
+ "level": "warning"
+ },
+ "fullDescription": {
+ "text": "The application is using `Integer.toHexString` on a digest array buffer which\nmay lead to an incorrect version of values.\n\nConsider using the `HexFormat` object introduced in Java 17. For older Java applications\nconsider using the `javax.xml.bind.DatatypeConverter`.\n\nExample using `HexFormat` to create a human-readable string:\n```\n// Create a MessageDigest using the SHA-384 algorithm\nMessageDigest sha384Digest = MessageDigest.getInstance(\"SHA-384\");\n// Call update with your data\nsha384Digest.update(\"some input\".getBytes(StandardCharsets.UTF_8));\n// Only call digest once all data has been fed into the update sha384digest instance\nbyte[] output = sha384Digest.digest();\n// Create a JDK 17 HexFormat object\nHexFormat hex = HexFormat.of();\n// Use formatHex on the byte array to create a string (note that alphabet characters are\nlowercase)\nString hexString = hex.formatHex(output);\n```\n\nFor more information on DatatypeConverter see:\nhttps://docs.oracle.com/javase/9/docs/api/javax/xml/bind/DatatypeConverter.html#printHexBinary-byte:A-\n"
+ },
+ "id": "find_sec_bugs.BAD_HEXA_CONVERSION-1",
+ "name": "find_sec_bugs.BAD_HEXA_CONVERSION-1",
+ "properties": {
+ "precision": "very-high",
+ "tags": [
+ "CWE-704",
+ "HIGH CONFIDENCE",
+ "security"
+ ]
+ },
+ "shortDescription": {
+ "text": "Incorrect type conversion or cast"
+ }
+ },
+ {
+ "defaultConfiguration": {
+ "level": "note"
+ },
+ "fullDescription": {
+ "text": "Try, Except, Continue\n"
+ },
+ "id": "bandit.B112",
+ "name": "bandit.B112",
+ "properties": {
+ "precision": "very-high",
+ "tags": [
+ "CWE-703",
+ "security"
+ ]
+ },
+ "shortDescription": {
+ "text": "Improper Check or Handling of Exceptional Conditions"
+ }
+ },
+ {
+ "defaultConfiguration": {
+ "level": "error"
+ },
+ "fullDescription": {
+ "text": "Format string vulnerabilities allow an attacker to read or in some cases,\npotentially write data to\nand from locations in the processes' memory. To prevent against format\nstring attacks, do not allow\nusers or un-validated input to provide the format specification.\nConsider using a constant for the format specification, or only allow specific\ncharacters to be provided to the format argument for the `fprintf` family of functions.\n\nFor more information please see: https://linux.die.net/man/3/fprintf\n\nFor more information on format string attacks please see OWASP's attack\nguide: https://owasp.org/www-community/attacks/Format_string_attack\n"
+ },
+ "id": "flawfinder.fprintf-1.vfprintf-1._ftprintf-1._vftprintf-1.fwprintf-1.fvwprintf-1",
+ "name": "flawfinder.fprintf-1.vfprintf-1._ftprintf-1._vftprintf-1.fwprintf-1.fvwprintf-1",
+ "properties": {
+ "precision": "very-high",
+ "tags": [
+ "CWE-134",
+ "OWASP-A1:2017-Injection",
+ "security"
+ ]
+ },
+ "shortDescription": {
+ "text": "Potential format string vulnerability"
+ }
+ },
+ {
+ "defaultConfiguration": {
+ "level": "warning"
+ },
+ "fullDescription": {
+ "text": "\"A new cookie is created without the Secure flag set. The Secure flag is a\n directive to the browser to make sure that the cookie is not sent for insecure communication\n(http://)\"\n"
+ },
+ "id": "find_sec_bugs.INSECURE_COOKIE-1",
+ "name": "find_sec_bugs.INSECURE_COOKIE-1",
+ "properties": {
+ "precision": "very-high",
+ "tags": [
+ "CWE-539",
+ "security"
+ ]
+ },
+ "shortDescription": {
+ "text": "Information Exposure Through Persistent Cookies"
+ }
+ },
+ {
+ "defaultConfiguration": {
+ "level": "warning"
+ },
+ "fullDescription": {
+ "text": "The `Secure` attribute when set to `true` protects the cookie value from being being\ntransmitted over clear text\ncommunication paths such as HTTP. By enabling this protection, the cookie will only be sent\nover HTTPS.\n\nExample of protecting a `Cookie`:\n```\n// Create an Secure cookie.\nCookie someCookie = new Cookie(\"SomeCookieName\", \"SomeValue\");\n// Set Secure flag to true\nsomeCookie.setSecure(true);\n```\n\nFor more information see:\nhttps://jakarta.ee/specifications/servlet/4.0/apidocs/javax/servlet/http/cookie#setSecure-boolean-\n\nSession cookies should be configured with the following security directives:\n\n-\n[HTTPOnly](https://developer.mozilla.org/en-US/docs/Web/HTTP/Cookies#restrict_access_to_cookies)\n- [SameSite](https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/Set-Cookie/SameSite)\n-\n[Secure](https://developer.mozilla.org/en-US/docs/Web/HTTP/Cookies#restrict_access_to_cookies)\n"
+ },
+ "id": "find_sec_bugs.INSECURE_COOKIE-1",
+ "name": "find_sec_bugs.INSECURE_COOKIE-1",
+ "properties": {
+ "precision": "very-high",
+ "tags": [
+ "CWE-614",
+ "security"
+ ]
+ },
+ "shortDescription": {
+ "text": "Sensitive cookie in HTTPS session without 'Secure' attribute"
+ }
+ },
+ {
+ "defaultConfiguration": {
+ "level": "warning"
+ },
+ "fullDescription": {
+ "text": "The application was found using the `xml.dom.expatbuilder` which calls the `xml.dom.minidom`\npackage for processing XML. Python's default XML processors suffer from various XML parsing\nvulnerabilities\nand care must be taken when handling XML data. Additionally, depending on the\nversion of Python, more critical vulnerabilities such as eXternal XML Entity\ninjection maybe exploitable.\n\nThe `xml.dom.minidom` package suffers from the following security risks as of Python 3.7.1:\n* Billion laughs / exponential entity expansion - May allow an adversary to cause\n a Denial of Service (DoS) against the application parsing arbitrary XML.\n* Quadratic blowup entity expansion - Similar to above, but requires a larger input\n to cause the Denial of Service.\n\nTo remediate the above issues, consider using the\n[defusedxml](https://pypi.org/project/defusedxml/)\nlibrary when processing untrusted XML.\n\nExample parsing an XML document using defusedxml:\n```\nfrom defusedxml.ElementTree import parse\n\n# Parse the inventory.xml file\net = parse('inventory.xml')\n# Get the root element\nroot = et.getroot()\n# Work with the root element\n# ...\n```\n\nFor more information on the various XML parsers and their vulnerabilities please see:\n- https://docs.python.org/3/library/xml.html#xml-vulnerabilities\n\nFor more information on XML security see OWASP's guide:\n-\nhttps://cheatsheetseries.owasp.org/cheatsheets/XML_External_Entity_Prevention_Cheat_Sheet.html#python\n"
+ },
+ "id": "bandit.B316",
+ "name": "bandit.B316",
+ "properties": {
+ "precision": "very-high",
+ "tags": [
+ "CWE-611",
+ "OWASP-A4:2017-XML External Entities (XXE)",
+ "security"
+ ]
+ },
+ "shortDescription": {
+ "text": "Improper restriction of XML external entity reference"
+ }
+ },
+ {
+ "defaultConfiguration": {
+ "level": "error"
+ },
+ "fullDescription": {
+ "text": "XML External Entity (XXE) attacks can occur when an XML parser supports XML\nentities while processing XML received from an untrusted source.\n"
+ },
+ "id": "find_sec_bugs.XXE_XPATH-1",
+ "name": "find_sec_bugs.XXE_XPATH-1",
+ "properties": {
+ "precision": "very-high",
+ "tags": [
+ "CWE-611",
+ "security"
+ ]
+ },
+ "shortDescription": {
+ "text": "Improper Restriction of XML External Entity Reference ('XXE')"
+ }
+ },
+ {
+ "defaultConfiguration": {
+ "level": "error"
+ },
+ "fullDescription": {
+ "text": "The gets() function reads a line from stdin into the provided buffer\nuntil either a terminating newline or EOF. This terminating newline or\nEOF is replaced with a null byte `'\\0'`. No check for buffer overruns are\nperformed so it is recommended to use `fgets()` instead. Do note\nthat some platforms will continue reading data after a `'\\0'` is encountered.\n\nUsage of `fgets()` is not recommended for reading binary based files or inputs,\ninstead the `read` or `fread` functions should be used.\n\nFor more information please see: https://linux.die.net/man/3/fgets\n"
+ },
+ "id": "flawfinder.gets-1._getts-1",
+ "name": "flawfinder.gets-1._getts-1",
+ "properties": {
+ "precision": "very-high",
+ "tags": [
+ "CWE-120",
+ "OWASP-A1:2017-Injection",
+ "security"
+ ]
+ },
+ "shortDescription": {
+ "text": "Use of deprecated function (gets)"
+ }
+ },
+ {
+ "defaultConfiguration": {
+ "level": "error"
+ },
+ "fullDescription": {
+ "text": "The input values included in SQL queries need to be passed in safely. Bind\nvariables in prepared statements can be used to easily mitigate the risk of\nSQL injection.\n"
+ },
+ "id": "find_sec_bugs.SQL_INJECTION_SPRING_JDBC-1.SQL_INJECTION_JPA-1.SQL_INJECTION_JDO-1.SQL_INJECTION_JDBC-1.SQL_NONCONSTANT_STRING_PASSED_TO_EXECUTE-1.SCALA_SQL_INJECTION_SLICK-1",
+ "name": "find_sec_bugs.SQL_INJECTION_SPRING_JDBC-1.SQL_INJECTION_JPA-1.SQL_INJECTION_JDO-1.SQL_INJECTION_JDBC-1.SQL_NONCONSTANT_STRING_PASSED_TO_EXECUTE-1.SCALA_SQL_INJECTION_SLICK-1",
+ "properties": {
+ "precision": "very-high",
+ "tags": [
+ "CWE-89",
+ "OWASP-A1:2017-Injection",
+ "security"
+ ]
+ },
+ "shortDescription": {
+ "text": "Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')"
+ }
+ },
+ {
+ "defaultConfiguration": {
+ "level": "error"
+ },
+ "fullDescription": {
+ "text": "The software constructs all or part of a code segment using externally-influenced\ninput from an upstream component, but it does not neutralize or incorrectly\nneutralizes special elements that could modify the syntax or behavior of the\nintended code segment.\n"
+ },
+ "id": "find_sec_bugs.SCRIPT_ENGINE_INJECTION-2",
+ "name": "find_sec_bugs.SCRIPT_ENGINE_INJECTION-2",
+ "properties": {
+ "precision": "very-high",
+ "tags": [
+ "CWE-94",
+ "security"
+ ]
+ },
+ "shortDescription": {
+ "text": "Improper Control of Generation of Code ('Code Injection')"
+ }
+ },
+ {
+ "defaultConfiguration": {
+ "level": "error"
+ },
+ "fullDescription": {
+ "text": "The application was found calling SpringFramework's `SpelExpressionParser.parseExpression`.\nCalling this method directly with user-supplied input may allow an adversary to\nexecute arbitrary Java code including OS system commands.\n\nNever call `parseExpression` or `parseRaw` directly with user-supplied input. Consider\nalternate\nmethods such as a lookup table to take user input and resolve hardcoded values.\n\nLater versions of SpringFramework introduced a `SimpleEvaluationContext` which can be\nused to access bound data when calling the `getValue` result of `parseExpression`. This\n`SimpleEvaluationContext` has a reduced set of functionality and can restrict data binding\nto read-only or read-write contexts. An adversary could still access public properties\nor fields on custom types that have been provided to the evaluation context. Use with caution.\n\nExample using `SimpleEvaluationContext` with a read-write data binding context:\n```\n@RequestMapping(value=\"/spel\", method=RequestMethod.POST)\npublic String spel(@Validated User user, Model model) {\n // Create the Expression Parser\n SpelExpressionParser parser = new SpelExpressionParser();\n // Parse the expression\n Expression parsedExpression = parser.parseExpression(model.getPossiblyUnsafeData());\n // Create the read-write data binding context\n SimpleEvaluationContext context = SimpleEvaluationContext.forReadWriteDataBinding().build();\n // Execute the expression, passing in the read-write context\n Object result = parsedExpression.getValue(context);\n // work with the result\n // ...\n return \"user\";\n}\n```\n\nFor more information on SimpleEvaluationContext see:\nhttps://docs.spring.io/spring-framework/docs/current/javadoc-api/org/springframework/expression/spel/support/SimpleEvaluationContext.html\n"
+ },
+ "id": "find_sec_bugs.SCRIPT_ENGINE_INJECTION-2",
+ "name": "find_sec_bugs.SCRIPT_ENGINE_INJECTION-2",
+ "properties": {
+ "precision": "very-high",
+ "tags": [
+ "CWE-917",
+ "security"
+ ]
+ },
+ "shortDescription": {
+ "text": "Improper neutralization of special elements used in an expression language statement ('Expression Language Injection')"
+ }
+ },
+ {
+ "defaultConfiguration": {
+ "level": "warning"
+ },
+ "fullDescription": {
+ "text": "Overly permissive file permission\n"
+ },
+ "id": "find_sec_bugs.OVERLY_PERMISSIVE_FILE_PERMISSION-1",
+ "name": "find_sec_bugs.OVERLY_PERMISSIVE_FILE_PERMISSION-1",
+ "properties": {
+ "precision": "very-high",
+ "tags": [
+ "CWE-732",
+ "HIGH CONFIDENCE",
+ "security"
+ ]
+ },
+ "shortDescription": {
+ "text": "Incorrect Permission Assignment for Critical Resource"
+ }
+ },
+ {
+ "defaultConfiguration": {
+ "level": "warning"
+ },
+ "fullDescription": {
+ "text": "The application was found setting file permissions to overly permissive values. Consider\nusing the following values if the application user is the only process to access\nthe file:\n\n- `r--` - read only access to the file\n- `w--` - write only access to the file\n- `rw-` - read/write access to the file\n\nExample setting read/write permissions for only the owner of a `Path`:\n```\n// Get a reference to the path\nPath path = Paths.get(\"/tmp/somefile\");\n// Create a PosixFilePermission set from java.nio.file.attribute\nSet permissions =\njava.nio.file.attribute.PosixFilePermissions.fromString(\"rw-------\");\n// Set the permissions\njava.nio.file.Files.setPosixFilePermissions(path, permissions);\n```\n\nFor all other values please see:\nhttps://en.wikipedia.org/wiki/File-system_permissions#Symbolic_notation\n"
+ },
+ "id": "find_sec_bugs.OVERLY_PERMISSIVE_FILE_PERMISSION-1",
+ "name": "find_sec_bugs.OVERLY_PERMISSIVE_FILE_PERMISSION-1",
+ "properties": {
+ "precision": "very-high",
+ "tags": [
+ "CWE-732",
+ "HIGH CONFIDENCE",
+ "OWASP-A6:2017-Security Misconfiguration",
+ "security"
+ ]
+ },
+ "shortDescription": {
+ "text": "Incorrect permission assignment for critical resource"
+ }
+ },
+ {
+ "defaultConfiguration": {
+ "level": "error"
+ },
+ "fullDescription": {
+ "text": "functions are being called. FTP is considered insecure. Use SSH/SFTP/SCP orsome other encrypted\nprotocol\n"
+ },
+ "id": "bandit.B402",
+ "name": "bandit.B402",
+ "properties": {
+ "precision": "very-high",
+ "tags": [
+ "CWE-319",
+ "OWASP-A3:2017-Sensitive Data Exposure",
+ "security"
+ ]
+ },
+ "shortDescription": {
+ "text": "Cleartext Transmission of Sensitive Information"
+ }
+ },
+ {
+ "defaultConfiguration": {
+ "level": "warning"
+ },
+ "fullDescription": {
+ "text": "The application fails to protect against Cross-Site Request Forgery (CSRF)\ndue to disabling Spring's CSRF protection features.\n\nThe vulnerability can be exploited by an adversary creating a link or form on a third\nparty site and tricking an authenticated victim to access them.\n\nTo remediate this issue, remove the call to `HttpSecurity.csrf().disable()` or remove\nthe custom `CsrfConfigurer`.\n\nFor more information on CSRF protection in Spring see:\nhttps://docs.spring.io/spring-security/reference/servlet/exploits/csrf.html#servlet-csrf\n\nAdditionally, consider setting all session cookies to have the `SameSite=Strict` attribute.\nIt should be noted that this may impact usability when sharing links across other mediums.\nIt is recommended that a two cookie based approach is taken, as outlined in the\n[Top level\nnavigations](https://datatracker.ietf.org/doc/html/draft-ietf-httpbis-rfc6265bis-08#section-8.8.2)\nsection\nof the SameSite RFC.\n\nFor more information on CSRF see OWASP's guide:\nhttps://owasp.org/www-community/attacks/csrf\n"
+ },
+ "id": "find_sec_bugs.SPRING_CSRF_PROTECTION_DISABLED-1",
+ "name": "find_sec_bugs.SPRING_CSRF_PROTECTION_DISABLED-1",
+ "properties": {
+ "precision": "very-high",
+ "tags": [
+ "CWE-352",
+ "security"
+ ]
+ },
+ "shortDescription": {
+ "text": "Cross-Site Request Forgery (CSRF)"
+ }
+ },
+ {
+ "defaultConfiguration": {
+ "level": "warning"
+ },
+ "fullDescription": {
+ "text": "By setting `XsltSettings.EnableScript` to true, an adversary who is able to influence the\nloaded\nXSL document could directly inject code to compromise the system. It is strongly\nrecommended that an alternative approach is used to work with XML data.\n\nFor increased security:\n\n- Never process user-supplied XSL style sheets\n- Ensure `XsltSettings.EnableScript` is set to false\n- Ensure `XsltSettings.EnableDocumentFunction` is set to false\n\nIf the application must calculate values from XML input, instead of using XSL scripts to\nexecute functions, modify the XML document prior to running the\n`XslCompiledTransform.Transform` method.\n\nExample of modifying the XML prior to running `Transform`:\n```\nconst String filename = \"number.xml\";\nconst String stylesheet = \"calc.xsl\";\n\n// Compile the style sheet.\nXsltSettings xslt_settings = new XsltSettings();\nxslt_settings.EnableScript = false; // disable script\nxslt_settings.EnableDocumentFunction = false; // disable document() function\nXslCompiledTransform xslt = new XslCompiledTransform();\nXmlResolver resolver = null; // set a null entity resolver\nxslt.Load(stylesheet, xslt_settings, resolver);\n\n// Load the XML source file, using XDocument for safety\nXDocument doc = XDocument.Load(filename);\n\n// do our modifications to the document before the transformation\n// instead of inside of a script.\ndoc.Element(\"data\").Add(new XElement(\"circle\", new XElement(\"radius\", 12)));\n\n// Create an XmlWriter.\nXmlWriterSettings settings = new XmlWriterSettings();\nsettings.OmitXmlDeclaration = true;\nsettings.Indent = true;\nXmlWriter writer = XmlWriter.Create(\"output.xml\", settings);\n// Finally, execute the transformation.\nxslt.Transform(doc.CreateReader(), writer);\nwriter.Close();\n```\n\nFor more information on security considerations when using XSL see the following URLs:\n- https://learn.microsoft.com/en-us/dotnet/standard/data/xml/xslt-security-considerations\n-\nhttps://learn.microsoft.com/en-us/dotnet/api/system.xml.xsl.xslcompiledtransform?view=net-7.0#security-considerations\n"
+ },
+ "id": "security_code_scan.SCS0011-1",
+ "name": "security_code_scan.SCS0011-1",
+ "properties": {
+ "precision": "very-high",
+ "tags": [
+ "CWE-611",
+ "security"
+ ]
+ },
+ "shortDescription": {
+ "text": "Improper restriction of XML external entity reference"
+ }
+ },
+ {
+ "defaultConfiguration": {
+ "level": "warning"
+ },
+ "fullDescription": {
+ "text": "SQL Injection is a critical vulnerability that can lead to data or system compromise. By\ndynamically generating SQL query strings, user input may be able to influence the logic of\nthe SQL statement. This could lead to an adversary accessing information they should\nnot have access to or in some circumstances, being able to execute OS functionality or code.\n\nReplace all dynamically generated SQL queries with parameterized queries. In situations where\ndynamic queries must be created, never use direct user input, but instead use a map or\ndictionary of valid values and resolve them using a user supplied key.\n\nFor example, some database drivers do not allow parameterized queries for `>` or `<` comparison\noperators. In these cases, do not use a user supplied `>` or `<` value, but rather have the\nuser\nsupply a `gt` or `lt` value. The alphabetical values are then used to look up the `>` and `<`\nvalues to be used in the construction of the dynamic query. The same goes for other queries\nwhere\ncolumn or table names are required but cannot be parameterized.\n\nExample using parameterized queries with `sql.Query`:\n```\nrows, err := db.Query(\"SELECT * FROM users WHERE userName = ?\", userName)\nif err != nil {\n return nil, err\n}\ndefer rows.Close()\nfor rows.Next() {\n // ... process rows\n}\n```\n\nFor more information on SQL Injection see OWASP:\nhttps://cheatsheetseries.owasp.org/cheatsheets/SQL_Injection_Prevention_Cheat_Sheet.html\n"
+ },
+ "id": "gosec.G202-1",
+ "name": "gosec.G202-1",
+ "properties": {
+ "precision": "very-high",
+ "tags": [
+ "CWE-89",
+ "security"
+ ]
+ },
+ "shortDescription": {
+ "text": "Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')"
+ }
+ },
+ {
+ "defaultConfiguration": {
+ "level": "error"
+ },
+ "fullDescription": {
+ "text": "Prior to HTML5, Web browsers enforced the Same Origin Policy which ensures that in order for\nJavaScript to access the contents of a Web page, both the JavaScript and the Web page must\noriginate from the same domain. Without the Same Origin Policy, a malicious website could serve\nup JavaScript that loads sensitive information from other websites using a client's\ncredentials, cull through it, and communicate it back to the attacker. HTML5 makes it possible\nfor JavaScript to access data across domains if a new HTTP header called\nAccess-Control-Allow-Origin is defined. With this header, a Web server defines which other\ndomains are allowed to access its domain using cross-origin requests. However, caution should\nbe taken when defining the header because an overly permissive CORS policy will allow a\nmalicious application to communicate with the victim application in an inappropriate way,\nleading to spoofing, data theft, relay and other attacks.\n"
+ },
+ "id": "find_sec_bugs.PERMISSIVE_CORS-1",
+ "name": "find_sec_bugs.PERMISSIVE_CORS-1",
+ "properties": {
+ "precision": "very-high",
+ "tags": [
+ "CWE-942",
+ "security"
+ ]
+ },
+ "shortDescription": {
+ "text": "Permissive Cross-domain Policy with Untrusted Domains"
+ }
+ },
+ {
+ "defaultConfiguration": {
+ "level": "error"
+ },
+ "fullDescription": {
+ "text": "Prior to HTML5, Web browsers enforced the Same Origin Policy which ensures that in order for\nJavaScript to access the contents of a Web page, both the JavaScript and the Web page must\noriginate from the same domain. Without the Same Origin Policy, a malicious website could serve\nup JavaScript that loads sensitive information from other websites using a client's\ncredentials, cull through it, and communicate it back to the attacker. HTML5 makes it possible\nfor JavaScript to access data across domains if a new HTTP header called\nAccess-Control-Allow-Origin is defined. With this header, a Web server defines which other\ndomains are allowed to access its domain using cross-origin requests. However, caution should\nbe taken when defining the header because an overly permissive CORS policy will allow a\nmalicious application to communicate with the victim application in an inappropriate way,\nleading to spoofing, data theft, relay and other attacks.\n"
+ },
+ "id": "find_sec_bugs.PERMISSIVE_CORS-1",
+ "name": "find_sec_bugs.PERMISSIVE_CORS-1",
+ "properties": {
+ "precision": "very-high",
+ "tags": [
+ "CWE-942",
+ "security"
+ ]
+ },
+ "shortDescription": {
+ "text": "Permissive Cross-domain Policy with Untrusted Domains"
+ }
+ },
+ {
+ "defaultConfiguration": {
+ "level": "note"
+ },
+ "fullDescription": {
+ "text": "The `strncpy` family of functions do not properly handle strings that are not null terminated.\nIt is recommended to use more secure alternatives such as `snprintf`.\n\nFor more information please see: https://linux.die.net/man/3/snprintf\n\nIf developing for C Runtime Library (CRT), more secure versions of these functions should be\nused, see:\nhttps://learn.microsoft.com/en-us/cpp/c-runtime-library/reference/strncpy-s-strncpy-s-l-wcsncpy-s-wcsncpy-s-l-mbsncpy-s-mbsncpy-s-l?view=msvc-170\n"
+ },
+ "id": "flawfinder.strncpy-1",
+ "name": "flawfinder.strncpy-1",
+ "properties": {
+ "precision": "very-high",
+ "tags": [
+ "CWE-120",
+ "OWASP-A6:2017-Security Misconfiguration",
+ "security"
+ ]
+ },
+ "shortDescription": {
+ "text": "Function does not handle null terminated strings or invalid pointers properly"
+ }
+ },
+ {
+ "defaultConfiguration": {
+ "level": "warning"
+ },
+ "fullDescription": {
+ "text": "A potential XSS was found. It could be used to execute unwanted JavaScript in a\nclient's browser.\n"
+ },
+ "id": "find_sec_bugs.XSS_SERVLET-1",
+ "name": "find_sec_bugs.XSS_SERVLET-1",
+ "properties": {
+ "precision": "very-high",
+ "tags": [
+ "CWE-79",
+ "security"
+ ]
+ },
+ "shortDescription": {
+ "text": "Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')"
+ }
+ },
+ {
+ "defaultConfiguration": {
+ "level": "warning"
+ },
+ "fullDescription": {
+ "text": "A potential XSS was found. It could be used to execute unwanted JavaScript in a\nclient's browser.\n"
+ },
+ "id": "find_sec_bugs.XSS_SERVLET-1",
+ "name": "find_sec_bugs.XSS_SERVLET-1",
+ "properties": {
+ "precision": "very-high",
+ "tags": [
+ "CWE-79",
+ "security"
+ ]
+ },
+ "shortDescription": {
+ "text": "Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')"
+ }
+ },
+ {
+ "defaultConfiguration": {
+ "level": "warning"
+ },
+ "fullDescription": {
+ "text": "Potential Slowloris Attack because `ReadHeaderTimeout` is not configured in the `http.Server`.\nThis application may\nbe vulnerable to resource consumption attacks if timeouts are not properly configured\nprior to starting the HTTP server. An adversary may open up thousands of connections but never\ncomplete sending all data,\nor never terminate the connections. This may lead to the server no longer accepting new\nconnections.\n\nTo protect against this style of resource consumption attack, timeouts should be set in the\n`net/http` server prior to calling\nthe listen or serve functions. The default `http.ListenAndServe` and\n`http.Serve` functions should not\nbe used in a production setting as they are unable to have timeouts configured. Instead a\ncustom `http.Server` object must be\ncreated with the timeouts configured.\n\nExample setting timeouts on a `net/http` server:\n```\n// All values chosen below are dependent on application logic and\n// should be tailored per use-case\nsrv := &http.Server{\n Addr: \"localhost:8000\",\n // ReadHeaderTimeout is the amount of time allowed to read\n // request headers. The connection's read deadline is reset\n // after reading the headers and the Handler can decide what\n // is considered too slow for the body. If ReadHeaderTimeout\n // is zero, the value of ReadTimeout is used. If both are\n // zero, there is no timeout.\n ReadHeaderTimeout: 15 * time.Second,\n\n // ReadTimeout is the maximum duration for reading the entire\n // request, including the body. A zero or negative value means\n // there will be no timeout.\n //\n // Because ReadTimeout does not let Handlers make per-request\n // decisions on each request body's acceptable deadline or\n // upload rate, most users will prefer to use\n // ReadHeaderTimeout. It is valid to use them both.\n ReadTimeout: 15 * time.Second,\n\n // WriteTimeout is the maximum duration before timing out\n // writes of the response. It is reset whenever a new\n // request's header is read. Like ReadTimeout, it does not\n // let Handlers make decisions on a per-request basis.\n // A zero or negative value means there will be no timeout.\n WriteTimeout: 10 * time.Second,\n\n // IdleTimeout is the maximum amount of time to wait for the\n // next request when keep-alives are enabled. If IdleTimeout\n // is zero, the value of ReadTimeout is used. If both are\n // zero, there is no timeout.\n IdleTimeout: 30 * time.Second,\n}\n\n// For per request timeouts applications can wrap all `http.HandlerFunc(...)` in\n// `http.TimeoutHandler`` and specify a timeout, but note the TimeoutHandler does not\n// start ticking until all headers have been read.\n\n// Listen with our custom server with timeouts configured\nif err := srv.ListenAndServe(); err != nil {\n log.Fatal(err)\n}\n```\nFor more information on the `http.Server` timeouts, see: https://pkg.go.dev/net/http#Server\n\nFor information on setting request based timeouts, see:\nhttps://pkg.go.dev/net/http#TimeoutHandler\n\nFor more information on the Slowloris attack see:\nhttps://en.wikipedia.org/wiki/Slowloris_(computer_security)\n"
+ },
+ "id": "gosec.G112-1",
+ "name": "gosec.G112-1",
+ "properties": {
+ "precision": "very-high",
+ "tags": [
+ "CWE-400",
+ "security"
+ ]
+ },
+ "shortDescription": {
+ "text": "Uncontrolled resource consumption (Slowloris)"
+ }
+ },
+ {
+ "defaultConfiguration": {
+ "level": "note"
+ },
+ "fullDescription": {
+ "text": "This function is often discouraged by most C++ coding standards in favor of its safer\nalternatives provided since C++14. Consider using a form of this function:\n(std::equal, std::mismatch or std::is_permutation) that checks the second iterator\nbefore potentially reading past its bounds.\n\nFor more information please see: https://en.cppreference.com/w/cpp/algorithm\n"
+ },
+ "id": "flawfinder.equal-1.mismatch-1.is_permutation-1",
+ "name": "flawfinder.equal-1.mismatch-1.is_permutation-1",
+ "properties": {
+ "precision": "very-high",
+ "tags": [
+ "CWE-126",
+ "security"
+ ]
+ },
+ "shortDescription": {
+ "text": "Function does not check the second iterator for over-read conditions"
+ }
+ },
+ {
+ "defaultConfiguration": {
+ "level": "error"
+ },
+ "fullDescription": {
+ "text": "A file is opened to read its content. The filename comes from an input parameter. If an\nunfiltered parameter is passed to this file API, files from an arbitrary filesystem location\ncould be read. This rule identifies potential path traversal vulnerabilities. In many cases,\nthe constructed file path cannot be controlled by the user.\n"
+ },
+ "id": "find_sec_bugs.PATH_TRAVERSAL_IN-1.SCALA_PATH_TRAVERSAL_IN-1",
+ "name": "find_sec_bugs.PATH_TRAVERSAL_IN-1.SCALA_PATH_TRAVERSAL_IN-1",
+ "properties": {
+ "precision": "very-high",
+ "tags": [
+ "CWE-22",
+ "security"
+ ]
+ },
+ "shortDescription": {
+ "text": "Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')"
+ }
+ },
+ {
+ "defaultConfiguration": {
+ "level": "error"
+ },
+ "fullDescription": {
+ "text": "The application is generating an RSA key that is less than the recommended 2048 bits.\nThe National Institute of Standards and Technology (NIST) deprecated signing Digital\nCertificates that contained RSA Public Keys of 1024 bits in December 2010. While\n1024-bit RSA keys have not been factored yet, advances in compute may make it possible\nin the near future.\n\nConsider upgrading to the newer asymmetric algorithm such as `X25519` which handles\nthe complexities of generating key pairs and choosing correct key sizes for you:\n```\nfrom cryptography.hazmat.primitives.asymmetric.x25519 import X25519PrivateKey\n\n# Generate a private key for use in the exchange.\nprivate_key = X25519PrivateKey.generate()\n# Work with private key/exchange with a peer's\n# public key to created a shared and derived key\n# ...\n```\n\nOtherwise use a key size greater than 2048 when generating RSA keys:\n```\nfrom cryptography.hazmat.primitives.asymmetric import rsa\n# Generate a private key of 4096 bits\nprivate_key = rsa.generate_private_key(\n # do not change the exponent value from 65537\n public_exponent=65537,\n key_size=4096,\n)\n# Work with the private key to sign/encrypt data\n# ...\n```\n\nFor more information on using the cryptography module see:\n- https://cryptography.io/en/latest\n"
+ },
+ "id": "bandit.B505-1",
+ "name": "bandit.B505-1",
+ "properties": {
+ "precision": "very-high",
+ "tags": [
+ "CWE-326",
+ "OWASP-A3:2017-Sensitive Data Exposure",
+ "security"
+ ]
+ },
+ "shortDescription": {
+ "text": "Inadequate encryption strength"
+ }
+ },
+ {
+ "defaultConfiguration": {
+ "level": "warning"
+ },
+ "fullDescription": {
+ "text": "The application was found calling the `exec` function with a non-literal variable. If the\nvariable comes from user-supplied input, an adversary could compromise the entire system by\nexecuting arbitrary python code.\n\nTo remediate this issue, remove all calls to `exec` and consider alternative methods for\nexecuting\nthe necessary business logic. There is almost no safe method of calling `eval` with\nuser-supplied input.\n\nIf the application only needs to convert strings into objects, consider using `json.loads`.\nIn some cases `ast.literal_eval` is recommended, but this should be avoided as it can still\nsuffer from other issues such as the ability for malicious code to crash the python\ninterpreter or application.\n\nExample using `json.loads`` to load in arbitrary data to create data structures:\n```\n# User supplied data as a blob of JSON\nuser_supplied_data = \"\"\"{\"user\": \"test\", \"metadata\": [1,2,3]}\"\"\"\n# Load the JSON\nuser_object = json.loads(user_supplied_data)\n# Manually add protected properties _after_ loading, never before\nuser_object[\"is_admin\"] = False\n# Work with the object\n```\n"
+ },
+ "id": "bandit.B102",
+ "name": "bandit.B102",
+ "properties": {
+ "precision": "very-high",
+ "tags": [
+ "CWE-78",
+ "OWASP-A1:2017-Injection",
+ "security"
+ ]
+ },
+ "shortDescription": {
+ "text": "Improper neutralization of special elements used in an OS command ('OS Command Injection')"
+ }
+ },
+ {
+ "defaultConfiguration": {
+ "level": "error"
+ },
+ "fullDescription": {
+ "text": "The `StrCat` family of functions do not guarantee the final string to be null terminated.\nConsider using one of the following alternatives: `StringCbCat`, `StringCbCatEx`,\n`StringCbCatN`, `StringCbCatNEx`, `StringCchCat`, `StringCchCatEx`, `StringCchCatN`, or\n`StringCchCatNEx`.\n\nFor more information please see: https://learn.microsoft.com/en-us/windows/win32/api/strsafe/\n"
+ },
+ "id": "flawfinder.StrCat-1.StrCatA-1.StrcatW-1.lstrcatA-1.lstrcatW-1.strCatBuff-1.StrCatBuffA-1.StrCatBuffW-1.StrCatChainW-1._tccat-1._mbccat-1._ftcscat-1.StrCatN-1.StrCatNA-1.StrCatNW-1.StrNCat-1.StrNCatA-1.StrNCatW-1.lstrncat-1.lstrcatnA-1.lstrcatnW-1",
+ "name": "flawfinder.StrCat-1.StrCatA-1.StrcatW-1.lstrcatA-1.lstrcatW-1.strCatBuff-1.StrCatBuffA-1.StrCatBuffW-1.StrCatChainW-1._tccat-1._mbccat-1._ftcscat-1.StrCatN-1.StrCatNA-1.StrCatNW-1.StrNCat-1.StrNCatA-1.StrNCatW-1.lstrncat-1.lstrcatnA-1.lstrcatnW-1",
+ "properties": {
+ "precision": "very-high",
+ "tags": [
+ "CWE-120",
+ "OWASP-A1:2017-Injection",
+ "security"
+ ]
+ },
+ "shortDescription": {
+ "text": "Insecure string processing function"
+ }
+ },
+ {
+ "defaultConfiguration": {
+ "level": "note"
+ },
+ "fullDescription": {
+ "text": "The input buffer is the number of bytes in the string, but the size\nof the output buffer is the number of characters. To avoid overflows, the\napplication must determine the correct buffer size which depends on the data type\nthe buffer receives.\n\nFor more information see:\nhttps://learn.microsoft.com/en-us/windows/win32/intl/security-considerations--international-features\n"
+ },
+ "id": "flawfinder.MultiByteToWideChar-1",
+ "name": "flawfinder.MultiByteToWideChar-1",
+ "properties": {
+ "precision": "very-high",
+ "tags": [
+ "CWE-120",
+ "OWASP-A1:2017-Injection",
+ "security"
+ ]
+ },
+ "shortDescription": {
+ "text": "Easily misused function may lead to buffer overflows"
+ }
+ },
+ {
+ "defaultConfiguration": {
+ "level": "warning"
+ },
+ "fullDescription": {
+ "text": "The application was found calling `dangerouslySetInnerHTML` which may lead to Cross Site\nScripting (XSS). By default, React components will encode the data properly before rendering.\nCalling `dangerouslySetInnerHTML` disables this encoding and allows raw markup\nand JavaScript to be executed.\n\nXSS is an attack which exploits a web application or system to treat\nuser input as markup or script code. It is important to encode the data, depending on the\nspecific context it is used in. There are at least six context types:\n\n- Inside HTML tags `
context 1
`\n- Inside attributes: ``\n- Inside event attributes ``\n- Inside script blocks: ``\n- Unsafe element HTML assignment: `element.innerHTML = \"context 5\"`\n- Inside URLs: `link`\n\nScript blocks alone have multiple ways they need to be encoded. Extra care must be taken if\nuser input\nis ever output inside of script tags.\n\nUser input that is displayed within the application must be encoded, sanitized or validated\nto ensure it cannot be treated as HTML or executed as Javascript code. Care must also be\ntaken\nto not mix server-side templating with client-side templating, as the server-side templating\nwill\nnot encode things like {{ 7*7 }} which may execute client-side templating features.\n\nIt is _NOT_ advised to encode user input prior to inserting into a data store. The data will\nneed to be\nencoded depending on context of where it is output. It is much safer to force the displaying\nsystem to\nhandle the encoding and not attempt to guess how it should be encoded.\n\nRemove the call to `dangerouslySetInnerHTML` or ensure that the data used in this call does\nnot come from user-supplied input.\n\nFor more information on dangerously setting inner HTML see:\n- https://react.dev/reference/react-dom/components/common#dangerously-setting-the-inner-html\n"
+ },
+ "id": "eslint.react-dangerouslysetinnerhtml",
+ "name": "eslint.react-dangerouslysetinnerhtml",
+ "properties": {
+ "precision": "very-high",
+ "tags": [
+ "CWE-79",
+ "OWASP-A7:2017-Cross-Site Scripting (XSS)",
+ "security"
+ ]
+ },
+ "shortDescription": {
+ "text": "Improper neutralization of input during web page generation ('Cross-site Scripting')"
+ }
+ },
+ {
+ "defaultConfiguration": {
+ "level": "error"
+ },
+ "fullDescription": {
+ "text": "A file is opened to read its content. The filename comes from an input parameter. If an\nunfiltered parameter is passed to this file API, files from an arbitrary filesystem location\ncould be read. This rule identifies potential path traversal vulnerabilities. In many cases,\nthe constructed file path cannot be controlled by the user.\n"
+ },
+ "id": "find_sec_bugs.PATH_TRAVERSAL_IN-1",
+ "name": "find_sec_bugs.PATH_TRAVERSAL_IN-1",
+ "properties": {
+ "precision": "very-high",
+ "tags": [
+ "CWE-22",
+ "security"
+ ]
+ },
+ "shortDescription": {
+ "text": "Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')"
+ }
+ },
+ {
+ "defaultConfiguration": {
+ "level": "warning"
+ },
+ "fullDescription": {
+ "text": "IDS01-J. Normalize strings before validating them\n"
+ },
+ "id": "find_sec_bugs.NORMALIZATION_AFTER_VALIDATION-1",
+ "name": "find_sec_bugs.NORMALIZATION_AFTER_VALIDATION-1",
+ "properties": {
+ "precision": "very-high",
+ "tags": [
+ "CWE-182",
+ "HIGH CONFIDENCE",
+ "security"
+ ]
+ },
+ "shortDescription": {
+ "text": "Collapse of data into unsafe value"
+ }
+ },
+ {
+ "defaultConfiguration": {
+ "level": "warning"
+ },
+ "fullDescription": {
+ "text": "The application was found matching a variable during a regular expression\npattern match, and then calling a Unicode normalize function after validation has occurred.\nThis is usually indicative of a poor input validation strategy as an adversary may attempt to\nexploit the normalization process.\n\nTo remediate this issue, always perform Unicode normalization before any validation of a\nstring.\n\nExample of normalizing a string before validation:\n```\n// User input possibly containing malicious unicode\nString userInput = \"\\uFE64\" + \"tag\" + \"\\uFE65\";\n// Normalize the input\nuserInput = Normalizer.normalize(userInput, Normalizer.Form.NFKC);\n// Compile our regex pattern looking for < or > charcters\nPattern pattern = Pattern.compile(\"[<>]\");\n// Create a matcher from the userInput\nMatcher matcher = pattern.matcher(userInput);\n// See if the matcher matches\nif (matcher.find()) {\n // It did so throw an error\n throw new Exception(\"found banned characters in input\");\n}\n```\n\nFor more information see Carnegie Mellon University's Secure Coding Guide:\nhttps://wiki.sei.cmu.edu/confluence/display/java/IDS01-J.+Normalize+strings+before+validating+them\n"
+ },
+ "id": "find_sec_bugs.NORMALIZATION_AFTER_VALIDATION-1",
+ "name": "find_sec_bugs.NORMALIZATION_AFTER_VALIDATION-1",
+ "properties": {
+ "precision": "very-high",
+ "tags": [
+ "CWE-180",
+ "HIGH CONFIDENCE",
+ "security"
+ ]
+ },
+ "shortDescription": {
+ "text": "Incorrect behavior order: validate before canonicalize"
+ }
+ },
+ {
+ "defaultConfiguration": {
+ "level": "note"
+ },
+ "fullDescription": {
+ "text": "The `vfork` function is suffers from portability issues and is not recommended. In\nsome Linux systems `vfork` is vulnerable to a race condition while the child process\nis running as the user's UID but hasn't executed `execve`. The user may be able to send\nsignals to this process, which in `vfork` would not be sent to the parent process. As\na result a user may be able to cause a denial of service against the privileged process.\n\nUse `fork` instead and be aware of other potential Time Of Check Time Of Use (TOCTOU)\nvulnerabilities.\n\nFor more information please see:\nhttps://wiki.sei.cmu.edu/confluence/display/c/POS38-C.+Beware+of+race+conditions+when+using+fork+and+file+descriptors\n"
+ },
+ "id": "flawfinder.vfork-1",
+ "name": "flawfinder.vfork-1",
+ "properties": {
+ "precision": "very-high",
+ "tags": [
+ "CWE-362",
+ "security"
+ ]
+ },
+ "shortDescription": {
+ "text": "Potential time of check time of use vulnerability (vfork)"
+ }
+ },
+ {
+ "defaultConfiguration": {
+ "level": "warning"
+ },
+ "fullDescription": {
+ "text": "The application was found calling the `eval` function with a non-literal variable. If the\nvariable comes from user-supplied input, an adversary could compromise the entire system by\nexecuting arbitrary python code.\n\nTo remediate this issue, remove all calls to `eval` and consider alternative methods for\nexecuting\nthe necessary business logic. There is almost no safe method of calling `eval` with\nuser-supplied input.\n\nIf the application only needs to convert strings into objects, consider using `json.loads`.\nIn some cases `ast.literal_eval` is recommended, but this should be avoided as it can still\nsuffer from other issues such as the ability for malicious code to crash the python\ninterpreter or application.\n\nExample using `json.loads`` to load in arbitrary data to create data structures:\n```\n# User supplied data as a blob of JSON\nuser_supplied_data = \"\"\"{\"user\": \"test\", \"metadata\": [1,2,3]}\"\"\"\n# Load the JSON\nuser_object = json.loads(user_supplied_data)\n# Manually add protected properties _after_ loading, never before\nuser_object[\"is_admin\"] = False\n# Work with the object\n```\n"
+ },
+ "id": "bandit.B307",
+ "name": "bandit.B307",
+ "properties": {
+ "precision": "very-high",
+ "tags": [
+ "CWE-95",
+ "OWASP-A1:2017-Injection",
+ "security"
+ ]
+ },
+ "shortDescription": {
+ "text": "Improper neutralization of directives in dynamically evaluated code ('Eval Injection')"
+ }
+ },
+ {
+ "defaultConfiguration": {
+ "level": "warning"
+ },
+ "fullDescription": {
+ "text": "Deserialization attacks exploit the process of reading serialized data and turning it back\ninto an object. By constructing malicious objects and serializing them, an adversary may\nattempt to:\n\n- Inject code that is executed upon object construction, which occurs during the\ndeserialization process.\n- Exploit mass assignment by including fields that are not normally a part of the serialized\ndata but are read in during deserialization.\n\nMicrosoft recommends no longer using the following serialization formats:\n- BinaryFormatter\n- SoapFormatter\n- NetDataContractSerializer\n- LosFormatter\n- ObjectStateFormatter\n\nConsider safer alternatives such as serializing data in the JSON format. Ensure any format\nchosen allows\nthe application to specify exactly which object types are allowed to be deserialized.\nAdditionally, when\ndeserializing, never deserialize to base object types like `Object` and only cast to the exact\nobject\ntype that is expected.\n\nTo protect against mass assignment, only allow deserialization of the specific fields that are\nrequired. If this is not easily done, consider creating an intermediary type that\ncan be serialized with only the necessary fields exposed.\n\nFor more information see Microsoft's deserialization security guide:\nhttps://learn.microsoft.com/en-us/dotnet/standard/serialization/binaryformatter-security-guide\n\nFor more details on deserialization attacks in general, see OWASP's guide:\nhttps://cheatsheetseries.owasp.org/cheatsheets/Deserialization_Cheat_Sheet.html\n\nIt should be noted that [tools exist](https://github.com/pwntester/ysoserial.net) to\nautomatically create\nexploit code for these vulnerabilities.\n"
+ },
+ "id": "security_code_scan.SCS0028-1",
+ "name": "security_code_scan.SCS0028-1",
+ "properties": {
+ "precision": "very-high",
+ "tags": [
+ "CWE-502",
+ "security"
+ ]
+ },
+ "shortDescription": {
+ "text": "Deserialization of potentially untrusted data"
+ }
+ },
+ {
+ "defaultConfiguration": {
+ "level": "warning"
+ },
+ "fullDescription": {
+ "text": "Python possesses many mechanisms to invoke an external executable. However,\ndoing so may present a security issue if appropriate care is not taken to\nsanitize any user provided or variable input. This plugin test is part of a\nfamily of tests built to check for process spawning and warn appropriately.\nSpecifically, this test looks for the spawning of a subprocess without the\nuse of a command shell. This type of subprocess invocation is not\nvulnerable to shell injection attacks, but care should still be taken to\nensure validity of input.\n"
+ },
+ "id": "bandit.B603",
+ "name": "bandit.B603",
+ "properties": {
+ "precision": "very-high",
+ "tags": [
+ "CWE-78",
+ "OWASP-A1:2017-Injection",
+ "security"
+ ]
+ },
+ "shortDescription": {
+ "text": "Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')"
+ }
+ },
+ {
+ "defaultConfiguration": {
+ "level": "warning"
+ },
+ "fullDescription": {
+ "text": "Due to how `CreateProcess` parses spaces, an attacker may be able to exploit this function\nby creating a binary with the same name that is loaded first, depending on the search path\norder.\n\nEnsure that quotation marks around the executable path are used, such as:\n```\nCreateProcessAsUser(hToken, NULL, \"\\\"C:\\\\Program Files\\\\MyApp.exe\\\"\", ...)\n```\nFor more information, please see MSDNs documentation at:\nhttps://learn.microsoft.com/en-us/windows/win32/api/processthreadsapi/nf-processthreadsapi-createprocessasusera#security-remarks\n"
+ },
+ "id": "flawfinder.CreateProcessAsUser-1.CreateProcessWithLogon-1",
+ "name": "flawfinder.CreateProcessAsUser-1.CreateProcessWithLogon-1",
+ "properties": {
+ "precision": "very-high",
+ "tags": [
+ "CWE-78",
+ "OWASP-A1:2017-Injection",
+ "security"
+ ]
+ },
+ "shortDescription": {
+ "text": "Possible executable path hijacking (CreateProcessAsUser/CreateProcessWithLogon)"
+ }
+ },
+ {
+ "defaultConfiguration": {
+ "level": "error"
+ },
+ "fullDescription": {
+ "text": "OS command injection is a critical vulnerability that can lead to a full system\ncompromise as it may allow an adversary to pass in arbitrary commands or arguments\nto be executed.\n\nUser input should never be used in constructing commands or command arguments\nto functions which execute OS commands. This includes filenames supplied by\nuser uploads or downloads.\n\nEnsure your application does not:\n\n- Use user-supplied information in the process name to execute.\n- Use user-supplied information in an OS command execution function which does\nnot escape shell meta-characters.\n- Use user-supplied information in arguments to OS commands.\n\nThe application should have a hardcoded set of arguments that are to be passed\nto OS commands. If filenames are being passed to these functions, it is\nrecommended that a hash of the filename be used instead, or some other unique\nidentifier. It is strongly recommended that a native library that implements\nthe same functionality be used instead of using OS system commands, due to the\nrisk of unknown attacks against third party commands.\n\nWhen specifying the OS command, ensure the application uses the full path\ninformation, otherwise the OS may attempt to look up which process to execute\nand could be vulnerable to untrusted search path vulnerabilities (CWE-426).\n\nExample of safely executing an OS command:\n```\npublic void ExecuteCommand(string userFileData) {\n // generate a random filename, do not using user input\n string fileName = \"C:\\\\Temp\\\\\" + Guid.NewGuid();\n File.WriteAllText(fileName, userFileData);\n\n using (Process process = new Process())\n {\n // hardcode the full process path\n ProcessStartInfo processInfo = new ProcessStartInfo(\"C:\\\\App\\\\FileReader.exe\");\n // only pass in trust arguments, and never direct user input.\n processInfo.Arguments = fileName;\n processInfo.UseShellExecute = false;\n process.StartInfo = processInfo;\n process.Start();\n }\n}\n```\n\nFor more information on OS command injection, see OWASP's guide:\nhttps://cheatsheetseries.owasp.org/cheatsheets/OS_Command_Injection_Defense_Cheat_Sheet.html\n"
+ },
+ "id": "security_code_scan.SCS0001-1",
+ "name": "security_code_scan.SCS0001-1",
+ "properties": {
+ "precision": "very-high",
+ "tags": [
+ "CWE-78",
+ "security"
+ ]
+ },
+ "shortDescription": {
+ "text": "Improper neutralization of special elements used in an OS command ('OS Command Injection')"
+ }
+ },
+ {
+ "defaultConfiguration": {
+ "level": "warning"
+ },
+ "fullDescription": {
+ "text": "Cryptographic algorithms provide many different modes of operation, only some of which provide\nmessage integrity. Without message integrity it could be possible for an adversary to attempt\nto tamper with the ciphertext which could lead to compromising the encryption key. Newer\nalgorithms\napply message integrity to validate ciphertext has not been tampered with.\n\nInstead of using an algorithm that requires configuring a cipher mode, an algorithm\nthat has built-in message integrity should be used. Consider using `ChaCha20Poly1305` or\n`AES-256-GCM` instead.\n\nFor older applications that don't have support for `ChaCha20Poly1305`, `AES-256-GCM` is\nrecommended, however it has many drawbacks:\n - Slower than `ChaCha20Poly1305`.\n - Catastrophic failure if nonce values are reused.\n\nExample using `ChaCha20Poly1305`:\n```\nimport os\n# Import ChaCha20Poly1305 from cryptography\nfrom cryptography.hazmat.primitives.ciphers.aead import ChaCha20Poly1305\n# Our plaintext to encrypt\nplain_text = b\"Secret text to encrypt\"\n# We do not require authenticated but unencrypted data, so set to None\naad = None\n# Generate a secure key\nkey = ChaCha20Poly1305.generate_key()\n# Create a new ChaCha20Poly1305 instance with our secure key\nchacha = ChaCha20Poly1305(key)\n# Note: nonce values _must_ be regenerated every time they are used.\nnonce = os.urandom(12)\n# Encrypt our plaintext\ncipher_text = chacha.encrypt(nonce, plain_text, aad)\n# Decrypt the plain text using the nonce and cipher_text\nchacha.decrypt(nonce, cipher_text, aad)\n```\n\nExample using `AESGCM`:\n```\nimport os\n# Import AESGCM from cryptography\nfrom cryptography.hazmat.primitives.ciphers.aead import AESGCM\n# Our plaintext to encrypt\nplain_text = b\"Secret text to encrypt\"\n# We do not require authenticated but unencrypted data, so set to None\naad = None\n# Generate a secure key\nkey = AESGCM.generate_key(bit_length=128)\n# Create a new AESGCM instance with our secure key\naesgcm = AESGCM(key)\n# Note: nonce values _must_ be regenerated every time they are used.\nnonce = os.urandom(12)\n# Encrypt our plaintext\ncipher_text = aesgcm.encrypt(nonce, plain_text, aad)\n# Decrypt the plain text using the nonce and cipher_text\naesgcm.decrypt(nonce, cipher_text, aad)\n```\n\nFor more information on the cryptography module see:\n- https://cryptography.io/en/latest/\n"
+ },
+ "id": "bandit.B305",
+ "name": "bandit.B305",
+ "properties": {
+ "precision": "very-high",
+ "tags": [
+ "CWE-327",
+ "OWASP-A3:2017-Sensitive Data Exposure",
+ "security"
+ ]
+ },
+ "shortDescription": {
+ "text": "Use of a broken or risky cryptographic algorithm"
+ }
+ },
+ {
+ "defaultConfiguration": {
+ "level": "note"
+ },
+ "fullDescription": {
+ "text": "Using various methods to parse untrusted XML data is known to be vulnerable to\nXML attacks. Replace vulnerable imports with the equivalent defusedxml package,\nor make sure defusedxml.defuse_stdlib() is called.\n"
+ },
+ "id": "bandit.B409",
+ "name": "bandit.B409",
+ "properties": {
+ "precision": "very-high",
+ "tags": [
+ "CWE-502",
+ "OWASP-A8:2017-Insecure Deserialization",
+ "security"
+ ]
+ },
+ "shortDescription": {
+ "text": "Deserialization of Untrusted Data"
+ }
+ },
+ {
+ "defaultConfiguration": {
+ "level": "error"
+ },
+ "fullDescription": {
+ "text": "Constructing a server-side redirect path with user input could allow an\nattacker to download application binaries (including application classes or\njar files) or view arbitrary files within protected directories.\n"
+ },
+ "id": "find_sec_bugs.REQUESTDISPATCHER_FILE_DISCLOSURE-1.STRUTS_FILE_DISCLOSURE-1.SPRING_FILE_DISCLOSURE-1",
+ "name": "find_sec_bugs.REQUESTDISPATCHER_FILE_DISCLOSURE-1.STRUTS_FILE_DISCLOSURE-1.SPRING_FILE_DISCLOSURE-1",
+ "properties": {
+ "precision": "very-high",
+ "tags": [
+ "CWE-552",
+ "security"
+ ]
+ },
+ "shortDescription": {
+ "text": "Files or Directories Accessible to External Parties"
+ }
+ },
+ {
+ "defaultConfiguration": {
+ "level": "error"
+ },
+ "fullDescription": {
+ "text": "The `org.springframework.web.servlet.ModelAndView` class and\n`HttpRequest.getRequestDispatcher()`'s `include` and `forward` methods may\npotentially allow access to restricted files if called with user-supplied input.\n\nFor Spring MVC, the ModelAndView class looks up a view by name to resolve a `.jsp`\nfile. If this view name comes from user-supplied input, it could be abused to attempt\nto return a JSP view that the user should not have access to.\n\nThe `HttpRequest.getRequestDispatcher()`'s `include` and `forward` methods will return\nany file that is resolvable within the web application context. This includes the `web.xml`\nfile, any compiled classes, `jsp` files, and additional JAR or WAR libraries that are\naccessible.\n\nNever pass user-supplied input directly to any of these methods. Use a lookup table or\nhardcode\nwhich views or paths the user should be directed to. Another option is to use a simple HTTP\nredirect by returning an empty response body with a 301 status code and a `Location` redirect\nheader. In Java servlets, this can be done by using the `response.sendRedirect(...)` method.\n\nExample using a lookup table to resolve a view from a Spring MVC application:\n```\n@RequestMapping(value=\"/mvc\", method=RequestMethod.GET)\npublic ModelAndView mvc(HttpServletRequest request, HttpServletResponse response, Model model)\n {\n // Create a look up table or pull from a data source\n HashMap lookupTable = new HashMap<>();\n lookupTable.put(\"key1\", \"view1\");\n lookupTable.put(\"key2\", \"view2\");\n // Get user input\n String userInput = request.getParameter(\"key\");\n // Look up view from the user input\n String viewValue = lookupTable.getOrDefault(userInput, userInput);\n // return the new model and view\n return new ModelAndView(viewValue);\n}\n```\n\nExample using a redirect instead of a `RequestDispatcher`:\n```\n// Create a look up table or pull from a data source\nHashMap lookupTable = new HashMap<>();\nlookupTable.put(\"key1\", \"/Resource1\");\nlookupTable.put(\"key2\", \"/Resource2\");\n// Get user input\nString userInput = request.getParameter(\"key\");\n// Look up resource to redirect to from the user input\nString redirectValue = lookupTable.getOrDefault(userInput, \"/Resource1\");\n// Redirect the user\nresponse.sendRedirect(redirectValue);\n```\n"
+ },
+ "id": "find_sec_bugs.REQUESTDISPATCHER_FILE_DISCLOSURE-1.STRUTS_FILE_DISCLOSURE-1.SPRING_FILE_DISCLOSURE-1",
+ "name": "find_sec_bugs.REQUESTDISPATCHER_FILE_DISCLOSURE-1.STRUTS_FILE_DISCLOSURE-1.SPRING_FILE_DISCLOSURE-1",
+ "properties": {
+ "precision": "very-high",
+ "tags": [
+ "CWE-552",
+ "security"
+ ]
+ },
+ "shortDescription": {
+ "text": "Files or directories accessible to external parties"
+ }
+ },
+ {
+ "defaultConfiguration": {
+ "level": "warning"
+ },
+ "fullDescription": {
+ "text": "The application was found creating files in shared system temporary directories\n(`/tmp` or `/var/tmp`) without using the `tempfile.TemporaryFile` function. Depending\non how the application uses this temporary file, an attacker may be able to create\nsymlinks that point to other files prior to the application creating or writing\nto the target file, leading to unintended files being created or overwritten.\n\nExample using `tempfile.TemporaryFile` to write a file:\n```\nimport tempfile\n\n# Open a new temporary file using a context manager\nwith tempfile.TemporaryFile() as fp:\n # Write some data to the temporary file\n fp.write(b'Some data')\n # Seek back to beginning of file\n fp.seek(0)\n # Read it\n data = fp.read()\n# File is automatically closed/removed once we exit the with context\n```\n\nFor more information on alternative tempfile functions see:\n- https://docs.python.org/3/library/tempfile.html\n"
+ },
+ "id": "bandit.B108",
+ "name": "bandit.B108",
+ "properties": {
+ "precision": "very-high",
+ "tags": [
+ "CWE-377",
+ "security"
+ ]
+ },
+ "shortDescription": {
+ "text": "Insecure temporary file"
+ }
+ },
+ {
+ "defaultConfiguration": {
+ "level": "error"
+ },
+ "fullDescription": {
+ "text": "A file is opened to read its content. The filename comes from an input\nparameter. If an unfiltered parameter is passed to this file API, files from an\narbitrary filesystem location could be read.\n"
+ },
+ "id": "find_sec_bugs.WEAK_FILENAMEUTILS-1",
+ "name": "find_sec_bugs.WEAK_FILENAMEUTILS-1",
+ "properties": {
+ "precision": "very-high",
+ "tags": [
+ "CWE-22",
+ "security"
+ ]
+ },
+ "shortDescription": {
+ "text": "Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')"
+ }
+ },
+ {
+ "defaultConfiguration": {
+ "level": "error"
+ },
+ "fullDescription": {
+ "text": "A file is opened to read its content. The filename comes from an input\nparameter. If an unfiltered parameter is passed to this file API, files from an\narbitrary filesystem location could be read.\n"
+ },
+ "id": "find_sec_bugs.WEAK_FILENAMEUTILS-1",
+ "name": "find_sec_bugs.WEAK_FILENAMEUTILS-1",
+ "properties": {
+ "precision": "very-high",
+ "tags": [
+ "CWE-22",
+ "security"
+ ]
+ },
+ "shortDescription": {
+ "text": "Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')"
+ }
+ },
+ {
+ "defaultConfiguration": {
+ "level": "warning"
+ },
+ "fullDescription": {
+ "text": "Due to how `CreateProcess` parses spaces, an attacker may be able to exploit this function\nby creating a binary with the same name that is loaded first, depending on the search path\norder.\n\nEnsure that quotation marks around the executable path are used, such as:\n```\nCreateProcessA(NULL, \"\\\"C:\\\\Program Files\\\\MyApp.exe\\\"\", ...)\n```\nFor more information, please see MSDNs documentation at:\nhttps://learn.microsoft.com/en-us/windows/win32/api/processthreadsapi/nf-processthreadsapi-createprocessa#security-remarks\n"
+ },
+ "id": "flawfinder.CreateProcess-1",
+ "name": "flawfinder.CreateProcess-1",
+ "properties": {
+ "precision": "very-high",
+ "tags": [
+ "CWE-78",
+ "OWASP-A1:2017-Injection",
+ "security"
+ ]
+ },
+ "shortDescription": {
+ "text": "Possible executable path hijacking (CreateProcess)"
+ }
+ },
+ {
+ "defaultConfiguration": {
+ "level": "note"
+ },
+ "fullDescription": {
+ "text": "The `memcpy` family of functions require the developer to validate that the destination buffer\nis the same size or larger than the source buffer. Buffer overflows could be introduced if care\nis not taken to validate buffer sizes.\n\nIf developing for C Runtime Library (CRT), more secure versions of these functions should be\nused, see:\nhttps://learn.microsoft.com/en-us/cpp/c-runtime-library/reference/memcpy-s-wmemcpy-s?view=msvc-170\n"
+ },
+ "id": "flawfinder.memcpy-1.CopyMemory-1.bcopy-1",
+ "name": "flawfinder.memcpy-1.CopyMemory-1.bcopy-1",
+ "properties": {
+ "precision": "very-high",
+ "tags": [
+ "CWE-120",
+ "OWASP-A1:2017-Injection",
+ "security"
+ ]
+ },
+ "shortDescription": {
+ "text": "Function does not check for buffer overflows when copying"
+ }
+ },
+ {
+ "defaultConfiguration": {
+ "level": "warning"
+ },
+ "fullDescription": {
+ "text": "OS command injection is a critical vulnerability that can lead to a full system\ncompromise as it may allow an adversary to pass in arbitrary commands or arguments\nto be executed.\n\nUser input should never be used in constructing commands or command arguments\nto functions which execute OS commands. This includes filenames supplied by\nuser uploads or downloads.\n\nEnsure your application does not:\n\n- Use user-supplied information in the process name to execute.\n- Use user-supplied information in an OS command execution function which does\nnot escape shell meta-characters.\n- Use user-supplied information in arguments to OS commands.\n\nThe application should have a hardcoded set of arguments that are to be passed\nto OS commands. If filenames are being passed to these functions, it is\nrecommended that a hash of the filename be used instead, or some other unique\nidentifier. It is strongly recommended that a native library that implements\nthe same functionality be used instead of using OS system commands, due to the\nrisk of unknown attacks against third-party commands.\n\nWhen specifying the OS command, ensure the application uses the full path\ninformation, otherwise the OS may attempt to look up which process to execute\nand could be vulnerable to untrusted search path vulnerabilities (CWE-426).\n\nExample of safely executing an OS command:\n```\nconst child_process = require('child_process');\nconst fs = require('fs');\nconst crypto = require('node:crypto');\nconst { mkdtempSync } = require('node:fs');\n\nfunction executeCommand(userFileData) {\n // Create a temporary directory, preferably in an application directory\n // that only the application has access to.\n const fileDir = mkdtempSync('/tmp/tmpdir-');\n // Generate a random filename, do not use user input\n const filePath = fileDir + path.sep + crypto.randomUUID();\n // Write the user-supplied data to the temporary file.\n fs.writeFileSync(filePath, userFileData);\n // Execute a program with a hardcoded path to the binary\n child_process.exec(`/bin/cat ${filePath}`, (error, stdout, stderr) => {\n // Delete the temporary directory and file if no longer needed\n fs.rmSync(fileDir, { recursive: true, force: true });\n if (error) {\n console.error(`exec error: ${error}`);\n return;\n }\n console.log(`stdout: ${stdout}`);\n console.error(`stderr: ${stderr}`);\n });\n}\n```\n\nFor more information on OS command injection, see OWASP's guide:\nhttps://cheatsheetseries.owasp.org/cheatsheets/OS_Command_Injection_Defense_Cheat_Sheet.html\n\nDetected non-literal calls to child_process.exec(). This could lead to a command\ninjection vulnerability.\n"
+ },
+ "id": "eslint.detect-child-process",
+ "name": "eslint.detect-child-process",
+ "properties": {
+ "precision": "very-high",
+ "tags": [
+ "CWE-95",
+ "OWASP-A1:2017-Injection",
+ "security"
+ ]
+ },
+ "shortDescription": {
+ "text": "Improper Neutralization of Directives in Dynamically Evaluated Code ('Eval Injection')"
+ }
+ },
+ {
+ "defaultConfiguration": {
+ "level": "warning"
+ },
+ "fullDescription": {
+ "text": "Cross Site Scripting (XSS) is an attack which exploits a web application or system to treat\nuser input\nas markup or script code. It is important to encode the data depending on the specific context\nit\nis used in. There are at least six context types:\n\n- Inside HTML tags `
context 1
`\n- Inside attributes: ``\n- Inside event attributes ``\n- Inside script blocks: ``\n- Unsafe element HTML assignment: `element.innerHTML = \"context 5\"`\n- Inside URLs: `link`\n\nScript blocks alone have multiple ways they need to be encoded. Extra care must be taken if\nuser input\nis ever output inside of script tags.\n\nUser input that is displayed within the application must be encoded, sanitized or validated\nto ensure it cannot be treated as HTML or executed as Javascript code. Care must also be\ntaken\nto not mix server-side templating with client-side templating, as the server-side templating\nwill\nnot encode things like {{ 7*7 }} which may execute client-side templating features.\n\nIt is _NOT_ advised to encode user input prior to inserting into a data store. The data will\nneed to be\nencoded depending on context of where it is output. It is much safer to force the displaying\nsystem to\nhandle the encoding and not attempt to guess how it should be encoded.\n\nUse of the following template types with user input denotes a security risk:\n\n- [template.HTML](https://pkg.go.dev/html/template#HTML)\n- [template.JS](https://pkg.go.dev/html/template#JS)\n- [template.URL](https://pkg.go.dev/html/template#URL)\n- [template.HTMLAttr](https://pkg.go.dev/html/template#HTMLAttr)\n\nEither remove these types from the application or hardcode as const strings prior\nto conversion:\n```\ntestTemplate, err := template.New(\"testTemplate\").Funcs(template.FuncMap{\n \"SafeHTML\": func() template.HTML {\n const safeHTML = \"
hardcoded, safe html
\"\n return template.HTML(safeHTML)\n },\n}).Parse(`{{ SafeHTML }}`)\nif err != nil {\n log.Fatal(err)\n}\n\nif err := testTemplate.Execute(os.Stdout, nil); err != nil {\n log.Fatal(err)\n}\n```\n"
+ },
+ "id": "gosec.G203-1",
+ "name": "gosec.G203-1",
+ "properties": {
+ "precision": "very-high",
+ "tags": [
+ "CWE-79",
+ "security"
+ ]
+ },
+ "shortDescription": {
+ "text": "Improper neutralization of input during web page generation ('Cross-site Scripting')"
+ }
+ },
+ {
+ "defaultConfiguration": {
+ "level": "note"
+ },
+ "fullDescription": {
+ "text": "Usage of the `open` family of functions may hint at a potential Time Of Check Time Of Use\n(TOCTOU)\nvulnerability. An attacker may be able to modify the file being specified by the `open`\nfunction prior to the `open` function being called.\n\nPrior to calling `open`, use `lstat` to open the file and confirm the attributes\nare correct. Then use `open` to get a file descriptor to this file. Call `fstat` on the\n`open` file descriptor to confirm that `st_dev` and `st_ino` are equal between the two.\nIf they are, it is safe to read and operate on the file's contents.\n\nFor more information please see:\nhttps://wiki.sei.cmu.edu/confluence/display/c/FIO45-C.+Avoid+TOCTOU+race+conditions+while+accessing+files\n"
+ },
+ "id": "flawfinder.fopen-1.open-1",
+ "name": "flawfinder.fopen-1.open-1",
+ "properties": {
+ "precision": "very-high",
+ "tags": [
+ "CWE-362",
+ "OWASP-A5:2017-Broken Access Control",
+ "security"
+ ]
+ },
+ "shortDescription": {
+ "text": "Potential time of check time of use vulnerability (open/fopen)"
+ }
+ },
+ {
+ "defaultConfiguration": {
+ "level": "warning"
+ },
+ "fullDescription": {
+ "text": "The application was found using the `xml.sax.expatreader` package for processing XML. Python's\ndefault XML processors suffer from various XML parsing vulnerabilities\nand care must be taken when handling XML data. Additionally, depending on the\nversion of Python, more critical vulnerabilities such as eXternal XML Entity\ninjection maybe exploitable.\n\nThe `xml.sax` package suffers from the following security risks as of Python 3.7.1:\n* Billion laughs / exponential entity expansion - May allow an adversary to cause\n a Denial of Service (DoS) against the application parsing arbitrary XML.\n* Quadratic blowup entity expansion - Similar to above, but requires a larger input\n to cause the Denial of Service.\n\nTo remediate the above issues, consider using the\n[defusedxml](https://pypi.org/project/defusedxml/)\nlibrary when processing untrusted XML.\n\nExample parsing an XML document using defusedxml:\n```\nfrom defusedxml.ElementTree import parse\n\n# Parse the inventory.xml file\net = parse('inventory.xml')\n# Get the root element\nroot = et.getroot()\n# Work with the root element\n# ...\n```\n\nFor more information on the various XML parsers and their vulnerabilities please see:\n- https://docs.python.org/3/library/xml.html#xml-vulnerabilities\n\nFor more information on XML security see OWASP's guide:\n-\nhttps://cheatsheetseries.owasp.org/cheatsheets/XML_External_Entity_Prevention_Cheat_Sheet.html#python\n"
+ },
+ "id": "bandit.B315",
+ "name": "bandit.B315",
+ "properties": {
+ "precision": "very-high",
+ "tags": [
+ "CWE-611",
+ "OWASP-A4:2017-XML External Entities (XXE)",
+ "security"
+ ]
+ },
+ "shortDescription": {
+ "text": "Improper restriction of XML external entity reference"
+ }
+ },
+ {
+ "defaultConfiguration": {
+ "level": "warning"
+ },
+ "fullDescription": {
+ "text": "The application was found calling the `eval` function with a non-literal variable. If the\nvariable comes from user-supplied input, an adversary could attempt to execute arbitrary\nJavaScript\ncode. This could lead to a full system compromise in Node applications or Cross-site Scripting\n(XSS) in web applications.\n\nTo remediate this issue, remove all calls to `eval` and consider alternative methods for\nexecuting\nthe necessary business logic. There is almost no safe method of calling `eval` with\nuser-supplied input.\nInstead, consider alternative methods such as using property accessors to dynamically access\nvalues.\n\nExample using property accessors to dynamically access an object's property:\n```\n// Define an object\nconst obj = {key1: 'value1', key2: 'value2'};\n// Get key dynamically from user input\nconst key = getUserInput();\n// Check if the key exists in our object and return it, or a default empty string\nconst value = (obj.hasOwnProperty(key)) ? obj[key] : '';\n// Work with the value\n```\n\nFor more information on why not to use `eval`, and alternatives see:\n-\nhttps://developer.mozilla.org/en-US/docs/Web/JavaScript/Reference/Global_Objects/eval#never_use_eval!\n"
+ },
+ "id": "eslint.detect-eval-with-expression",
+ "name": "eslint.detect-eval-with-expression",
+ "properties": {
+ "precision": "very-high",
+ "tags": [
+ "CWE-95",
+ "OWASP-A1:2017-Injection",
+ "security"
+ ]
+ },
+ "shortDescription": {
+ "text": "Improper neutralization of directives in dynamically evaluated code ('Eval Injection')"
+ }
+ },
+ {
+ "defaultConfiguration": {
+ "level": "error"
+ },
+ "fullDescription": {
+ "text": "This code directly writes an HTTP parameter to an HTTP header, which allows for a HTTP\nresponse splitting vulnerability. See http://en.wikipedia.org/wiki/HTTP_response_splitting for\nmore information.\n"
+ },
+ "id": "find_sec_bugs.HRS_REQUEST_PARAMETER_TO_HTTP_HEADER-1",
+ "name": "find_sec_bugs.HRS_REQUEST_PARAMETER_TO_HTTP_HEADER-1",
+ "properties": {
+ "precision": "very-high",
+ "tags": [
+ "CWE-113",
+ "security"
+ ]
+ },
+ "shortDescription": {
+ "text": "Improper Neutralization of CRLF Sequences in HTTP Headers ('HTTP Response Splitting')"
+ }
+ },
+ {
+ "defaultConfiguration": {
+ "level": "error"
+ },
+ "fullDescription": {
+ "text": "HTTP Response Splitting is a vulnerability where Carriage Return (CR `\\r`) and Line Feed (LF\n`\\n`)\ncharacters are introduced into an HTTP header from user-supplied input. By injecting the\n`\\r\\n`\ncharacter sequence, an adversary could potentially modify how the response is interpreted by\nthe\nclient or any down stream caching services. This could allow an adversary to poison the cache\ndata or execute Cross-Site Scripting (XSS) attacks.\n\nSome Java application servers such as [Apache Tomcat](https://tomcat.apache.org/) will\nautomatically encode\ncharacters from being set in response headers as a space `0x20` character. If your application\nserver does\nnot automatically provide this functionality, user-supplied input that is used in header keys\nor values must be\nvalidated.\n\nExample of validating headers to only allow valid characters:\n```\n// throws an IllegalArgumentException if the provided value contains invalid characters\npublic void validateHeader(String value) throws IllegalArgumentException {\n char[] chars = value.toCharArray();\n\n // iterate over every character\n for (int i = 0; i < chars.length; i++) {\n char c = chars[i];\n\n // check for any characters below 0x21 as well as: '\"' ',' ';' '\\' and 0x7f.\n if (c < 0x21 || c == '\"' || c == ',' || c == ';' || c == '\\\\' || c == 0x7f) {\n throw new IllegalArgumentException(\"Invalid character in cookie detected:\n{0}\".format(Integer.toString(c)));\n }\n }\n}\n```\n\nAlternatively, you could use a string escape package such as\n[Apache Commons Text](https://commons.apache.org/proper/commons-text/) to escape the input:\n```\npublic String escapeValue(String value) {\n return StringEscapeUtils.escapeJava(value);\n}\n```\n\nFor more information on response splitting attacks see OWASP:\nhttps://owasp.org/www-community/attacks/HTTP_Response_Splitting\n"
+ },
+ "id": "find_sec_bugs.HRS_REQUEST_PARAMETER_TO_HTTP_HEADER-1",
+ "name": "find_sec_bugs.HRS_REQUEST_PARAMETER_TO_HTTP_HEADER-1",
+ "properties": {
+ "precision": "very-high",
+ "tags": [
+ "CWE-113",
+ "security"
+ ]
+ },
+ "shortDescription": {
+ "text": "Improper neutralization of CRLF sequences in HTTP headers ('HTTP Response Splitting')"
+ }
+ },
+ {
+ "defaultConfiguration": {
+ "level": "warning"
+ },
+ "fullDescription": {
+ "text": "The application was found to dynamically import a module by calling `require` using a\nnon-literal string. An adversary might be able to read the first line of\narbitrary files. If they had write access to the file system, they may also be able to\nexecute arbitrary code.\n\nTo remediate this issue, use a hardcoded string literal when calling `require`. Never call it\nit with dynamically created variables or user-supplied data.\n"
+ },
+ "id": "eslint.detect-non-literal-require",
+ "name": "eslint.detect-non-literal-require",
+ "properties": {
+ "precision": "very-high",
+ "tags": [
+ "CWE-95",
+ "OWASP-A1:2017-Injection",
+ "security"
+ ]
+ },
+ "shortDescription": {
+ "text": "Improper neutralization of directives in dynamically evaluated code ('Eval Injection')"
+ }
+ },
+ {
+ "defaultConfiguration": {
+ "level": "error"
+ },
+ "fullDescription": {
+ "text": "Format specifiers can take optional field widths, which should be\nused to limit how many characters are copied into the target buffer.\n\nExample:\n```\n const char str[20] = \"AAAAAAAAAAAAAAAAAAA\";\n char buf[11] = {0};\n sscanf(str, \"%10s\", &buf); // buf = AAAAAAAAAA\\0\n```\n"
+ },
+ "id": "flawfinder.fscanf-1.sscanf-1.vsscanf-1.vfscanf-1._ftscanf-1.fwscanf-1.vfwscanf-1.vswscanf-1",
+ "name": "flawfinder.fscanf-1.sscanf-1.vsscanf-1.vfscanf-1._ftscanf-1.fwscanf-1.vfwscanf-1.vswscanf-1",
+ "properties": {
+ "precision": "very-high",
+ "tags": [
+ "CWE-120",
+ "OWASP-A1:2017-Injection",
+ "security"
+ ]
+ },
+ "shortDescription": {
+ "text": "sscanf() functions may allow format string based overflows"
+ }
+ },
+ {
+ "defaultConfiguration": {
+ "level": "error"
+ },
+ "fullDescription": {
+ "text": "The getpw() function is dangerous as it may overflow the provided\nbuffer when reading from the `/etc/passwd` file. While the passwd file\nis not generally writeable, there are no protections offered by this function\nto protect from reading past the bounds of the destination buffer. This function\nis obsoleted by `getpwuid`.\n\nFor more information please see: https://linux.die.net/man/3/getpwuid\n"
+ },
+ "id": "flawfinder.getpw-1",
+ "name": "flawfinder.getpw-1",
+ "properties": {
+ "precision": "very-high",
+ "tags": [
+ "CWE-120",
+ "OWASP-A1:2017-Injection",
+ "security"
+ ]
+ },
+ "shortDescription": {
+ "text": "Use of deprecated function (getpwd)"
+ }
+ },
+ {
+ "defaultConfiguration": {
+ "level": "note"
+ },
+ "fullDescription": {
+ "text": "The `strccpy` and `strcadd` functions do not allow the caller to check that the destination\nsize\nof the buffer will fit the input buffer prior to copying.\n\nFor more information please see:\nhttps://docs.oracle.com/cd/E18752_01/html/816-5172/streadd-3gen.html\n"
+ },
+ "id": "flawfinder.strccpy-1.strcadd-1",
+ "name": "flawfinder.strccpy-1.strcadd-1",
+ "properties": {
+ "precision": "very-high",
+ "tags": [
+ "CWE-120",
+ "OWASP-A1:2017-Injection",
+ "security"
+ ]
+ },
+ "shortDescription": {
+ "text": "Insecure string processing functions"
+ }
+ },
+ {
+ "defaultConfiguration": {
+ "level": "warning"
+ },
+ "fullDescription": {
+ "text": "Make sure that you set inheritance by hand if you wish it to inherit.\n"
+ },
+ "id": "flawfinder.AddAccessAllowedAce-1",
+ "name": "flawfinder.AddAccessAllowedAce-1",
+ "properties": {
+ "precision": "very-high",
+ "tags": [
+ "CWE-732",
+ "OWASP-A5:2017-Broken Access Control",
+ "security"
+ ]
+ },
+ "shortDescription": {
+ "text": "This doesn't set the inheritance bits in the access control entry (ACE) header (CWE-732)"
+ }
+ },
+ {
+ "defaultConfiguration": {
+ "level": "warning"
+ },
+ "fullDescription": {
+ "text": "The application was found using an insecure or risky digest or signature algorithm. MD2, MD4,\n MD5 and SHA1 hash algorithms have been found to be vulnerable to producing collisions.\n\nThis means\nthat two different values, when hashed, can lead to the same hash value. If the application is\ntrying\nto use these hash methods for storing passwords, then it is recommended to switch to a\npassword hashing\nalgorithm such as Argon2id or PBKDF2.\n\nNote that the `Crypto` and `Cryptodome` Python packages are no longer recommended for\nnew applications, instead consider using the [cryptography](https://cryptography.io/) package.\n\nExample of creating a SHA-384 hash using the `cryptography` package:\n```\nfrom cryptography.hazmat.primitives import hashes\n# Create a SHA384 digest\ndigest = hashes.Hash(hashes.SHA384())\n# Update the digest with some initial data\ndigest.update(b\"some data to hash\")\n# Add more data to the digest\ndigest.update(b\"some more data\")\n# Finalize the digest as bytes\nresult = digest.finalize()\n```\n\nFor more information on secure password storage see OWASP:\n- https://cheatsheetseries.owasp.org/cheatsheets/Password_Storage_Cheat_Sheet.html\n\nFor more information on the cryptography module see:\n- https://cryptography.io/en/latest/\n"
+ },
+ "id": "bandit.B303-2",
+ "name": "bandit.B303-2",
+ "properties": {
+ "precision": "very-high",
+ "tags": [
+ "CWE-327",
+ "OWASP-A3:2017-Sensitive Data Exposure",
+ "security"
+ ]
+ },
+ "shortDescription": {
+ "text": "Use of a broken or risky cryptographic algorithm"
+ }
+ },
+ {
+ "defaultConfiguration": {
+ "level": "error"
+ },
+ "fullDescription": {
+ "text": "Format string vulnerabilities allow an attacker to read or in some cases, potentially write\ndata to\nand from locations in the processes' memory. To prevent against format string attacks, do not\nallow\nusers or un-validated input to provide the format specification.\nConsider using a constant for the format specification, or strip all format\nspecifiers from the input prior to calling the `syslog` function.\n\nFor more information please see: https://capec.mitre.org/data/definitions/67.html\n"
+ },
+ "id": "flawfinder.syslog-1",
+ "name": "flawfinder.syslog-1",
+ "properties": {
+ "precision": "very-high",
+ "tags": [
+ "CWE-134",
+ "OWASP-A1:2017-Injection",
+ "security"
+ ]
+ },
+ "shortDescription": {
+ "text": "Potential format string vulnerability in syslog call"
+ }
+ },
+ {
+ "defaultConfiguration": {
+ "level": "note"
+ },
+ "fullDescription": {
+ "text": "The `lstrcpyn` family of functions do not always check for invalid pointers or check if there\nis sufficient space prior to copying. The count argument limits the number of characters copied\nbut does validate if the count will fit within the size of the destination buffer, leading to\npotential overflows.\n\nIf developing for C Runtime Library (CRT), more secure versions of these functions should be\nused, see:\nhttps://learn.microsoft.com/en-us/cpp/c-runtime-library/reference/strncpy-s-strncpy-s-l-wcsncpy-s-wcsncpy-s-l-mbsncpy-s-mbsncpy-s-l?view=msvc-170\n"
+ },
+ "id": "flawfinder.lstrcpyn-1.wcsncpy-1._tcsncpy-1._mbsnbcpy-1",
+ "name": "flawfinder.lstrcpyn-1.wcsncpy-1._tcsncpy-1._mbsnbcpy-1",
+ "properties": {
+ "precision": "very-high",
+ "tags": [
+ "CWE-120",
+ "OWASP-A1:2017-Injection",
+ "security"
+ ]
+ },
+ "shortDescription": {
+ "text": "Insecure functions do not always null terminate or check invalid pointers"
+ }
+ },
+ {
+ "defaultConfiguration": {
+ "level": "warning"
+ },
+ "fullDescription": {
+ "text": "The application was found using the `xml.etree` package for processing XML.\nPythons default xml processors suffer from various XML parsing vulnerabilities\nand care must be taken when handling XML data. Additionally, depending on the\nversion of Python, more critical vulnerabilities such as eXternal XML Entity\ninjection maybe exploitable.\n\nThe `etree` package suffers from the following security risks as of Python 3.7.1:\n* Billion laughs / exponential entity expansion - May allow an adversary to cause\n a Denial of Service (DoS) against the application parsing arbitrary XML.\n* Quadratic blowup entity expansion - Similar to above, but requires a larger input\n to cause the Denial of Service.\n\nTo remediate the above issues, consider using the\n[defusedxml](https://pypi.org/project/defusedxml/)\nlibrary when processing untrusted XML.\n\nExample parsing an XML document using defusedxml:\n```\nfrom defusedxml.ElementTree import parse\n\n# Parse the inventory.xml file\net = parse('inventory.xml')\n# Get the root element\nroot = et.getroot()\n# Work with the root element\n# ...\n```\n\nFor more information on the various XML parsers and their vulnerabilities please see:\n- https://docs.python.org/3/library/xml.html#xml-vulnerabilities\n\nFor more information on XML security see OWASP's guide:\n-\nhttps://cheatsheetseries.owasp.org/cheatsheets/XML_External_Entity_Prevention_Cheat_Sheet.html#python\n"
+ },
+ "id": "bandit.B314",
+ "name": "bandit.B314",
+ "properties": {
+ "precision": "very-high",
+ "tags": [
+ "CWE-611",
+ "OWASP-A4:2017-XML External Entities (XXE)",
+ "security"
+ ]
+ },
+ "shortDescription": {
+ "text": "Improper restriction of XML external entity reference"
+ }
+ },
+ {
+ "defaultConfiguration": {
+ "level": "warning"
+ },
+ "fullDescription": {
+ "text": "The application was found using the `xml.dom.pulldom` package for processing XML. Python's\ndefault XML processors suffer from various XML parsing vulnerabilities\nand care must be taken when handling XML data. Additionally, depending on the\nversion of Python, more critical vulnerabilities such as eXternal XML Entity\ninjection maybe exploitable.\n\nThe `xml.dom.pulldom` package suffers from the following security risks as of Python 3.7.1:\n* Billion laughs / exponential entity expansion - May allow an adversary to cause\n a Denial of Service (DoS) against the application parsing arbitrary XML.\n* Quadratic blowup entity expansion - Similar to above, but requires a larger input\n to cause the Denial of Service.\n\nTo remediate the above issues, consider using the\n[defusedxml](https://pypi.org/project/defusedxml/)\nlibrary when processing untrusted XML.\n\nExample parsing an XML document using defusedxml:\n```\nfrom defusedxml.ElementTree import parse\n\n# Parse the inventory.xml file\net = parse('inventory.xml')\n# Get the root element\nroot = et.getroot()\n# Work with the root element\n# ...\n```\n\nFor more information on the various XML parsers and their vulnerabilities please see:\n- https://docs.python.org/3/library/xml.html#xml-vulnerabilities\n\nFor more information on XML security see OWASP's guide:\n-\nhttps://cheatsheetseries.owasp.org/cheatsheets/XML_External_Entity_Prevention_Cheat_Sheet.html#python\n"
+ },
+ "id": "bandit.B319",
+ "name": "bandit.B319",
+ "properties": {
+ "precision": "very-high",
+ "tags": [
+ "CWE-611",
+ "OWASP-A4:2017-XML External Entities (XXE)",
+ "security"
+ ]
+ },
+ "shortDescription": {
+ "text": "Improper Restriction of XML External Entity Reference"
+ }
+ },
+ {
+ "defaultConfiguration": {
+ "level": "warning"
+ },
+ "fullDescription": {
+ "text": "This function's return value should be treated as untrusted input as it could be\nmodified by an attacker. Possible risks include:\n\n- The value being too large and causing buffer overflows\n- Files under the attacker's control being used maliciously\n- Files outside of an attacker's control becoming accessible, depending on\naccess privileges.\n"
+ },
+ "id": "flawfinder.getenv-1.curl_getenv-1",
+ "name": "flawfinder.getenv-1.curl_getenv-1",
+ "properties": {
+ "precision": "very-high",
+ "tags": [
+ "CWE-20",
+ "OWASP-A1:2017-Injection",
+ "security"
+ ]
+ },
+ "shortDescription": {
+ "text": "Possible use of untrusted environment variable"
+ }
+ },
+ {
+ "defaultConfiguration": {
+ "level": "warning"
+ },
+ "fullDescription": {
+ "text": "The Python `os` `tempnam|tmpnam` functions are vulnerable to symlink attacks\n"
+ },
+ "id": "bandit.B325",
+ "name": "bandit.B325",
+ "properties": {
+ "precision": "very-high",
+ "tags": [
+ "CWE-377",
+ "security"
+ ]
+ },
+ "shortDescription": {
+ "text": "Insecure Temporary File"
+ }
+ },
+ {
+ "defaultConfiguration": {
+ "level": "warning"
+ },
+ "fullDescription": {
+ "text": "The application is returning user-supplied data from an HTTP request to an HTTP response's\n`sendError` method. This could lead to Cross Site Scripting (XSS) if the input were malicious\nscript code and the application server is not properly validating the output. Note that Apache\nTomcat 9 and above automatically encode the output and are not vulnerable.\n\nXSS is an attack which exploits a web application or system to treat user input\nas markup or script code. It is important to encode the data depending on the specific context\nit is used in. There are at least six context types:\n\n- Inside HTML tags `
context 1
`\n- Inside attributes: ``\n- Inside event attributes ``\n- Inside script blocks: ``\n- Unsafe element HTML assignment: `element.innerHTML = \"context 5\"`\n- Inside URLs: `link`\n\nScript blocks alone have multiple ways they need to be encoded. Extra care must be taken if\nuser input\nis ever output inside of script tags.\n\nUser input that is displayed within the application must be encoded, sanitized or validated\nto ensure it cannot be treated as HTML or executed as Javascript code. Care must also be\ntaken\nto not mix server-side templating with client-side templating, as the server-side templating\nwill\nnot encode things like {{ 7*7 }} which may execute client-side templating features.\n\nIt is _NOT_ advised to encode user input prior to inserting into a data store. The data will\nneed to be\nencoded depending on context of where it is output. It is much safer to force the displaying\nsystem to\nhandle the encoding and not attempt to guess how it should be encoded.\n\nIf possible do not use user input directly in the output to the `sendError` message parameter.\n\nRegardless if the application server handles output encoding, consider encoding any\nuser-supplied\ninput\nthat is used in the sendError method:\n\nExample using [Apache Commons Text](https://commons.apache.org/proper/commons-text/)\n`StringEscapeUtils.escapeHtml4`:\n```\n// Get user input\nString userInput = request.getParameter(\"key\");\n// Encode the input using the Html4 encoder\nString encoded = StringEscapeUtils.escapeHtml4(userInput);\n// Respond with the error code and value\nresponse.sendError(401, encoded);\n```\n\nFor more information on XSS see OWASP:\n-\nhttps://cheatsheetseries.owasp.org/cheatsheets/Cross_Site_Scripting_Prevention_Cheat_Sheet.html\n"
+ },
+ "id": "find_sec_bugs.XSS_REQUEST_PARAMETER_TO_SEND_ERROR-1",
+ "name": "find_sec_bugs.XSS_REQUEST_PARAMETER_TO_SEND_ERROR-1",
+ "properties": {
+ "precision": "very-high",
+ "tags": [
+ "CWE-79",
+ "security"
+ ]
+ },
+ "shortDescription": {
+ "text": "Improper neutralization of input during web page generation ('Cross-site Scripting')"
+ }
+ },
+ {
+ "defaultConfiguration": {
+ "level": "warning"
+ },
+ "fullDescription": {
+ "text": "The IDEA encryption algorithm was meant as a drop-in replacement for DES and was created in\n1991. A number of [vulnerabilities and\nexploits](https://en.wikipedia.org/wiki/International_Data_Encryption_Algorithm#Security) have\nbeen identified to work against IDEA and\nit is no longer recommended. If possible consider\nusing ChaCha20Poly1305 or AES-GCM instead of Blowfish.\n\nFor older applications that don't have support for `ChaCha20Poly1305`, `AES-256-GCM` is\nrecommended, however it has many drawbacks:\n - Slower than `ChaCha20Poly1305`.\n - Catastrophic failure if nonce values are reused.\n\nExample using `ChaCha20Poly1305`:\n```\nimport os\n# Import ChaCha20Poly1305 from cryptography\nfrom cryptography.hazmat.primitives.ciphers.aead import ChaCha20Poly1305\n# Our plaintext to encrypt\nplain_text = b\"Secret text to encrypt\"\n# We do not require authenticated but unencrypted data, so set to None\naad = None\n# Generate a secure key\nkey = ChaCha20Poly1305.generate_key()\n# Create a new ChaCha20Poly1305 instance with our secure key\nchacha = ChaCha20Poly1305(key)\n# Note: nonce values _must_ be regenerated every time they are used.\nnonce = os.urandom(12)\n# Encrypt our plaintext\ncipher_text = chacha.encrypt(nonce, plain_text, aad)\n# Decrypt the plain text using the nonce and cipher_text\nchacha.decrypt(nonce, cipher_text, aad)\n```\n\nExample using `AESGCM`:\n```\nimport os\n# Import AESGCM from cryptography\nfrom cryptography.hazmat.primitives.ciphers.aead import AESGCM\n# Our plaintext to encrypt\nplain_text = b\"Secret text to encrypt\"\n# We do not require authenticated but unencrypted data, so set to None\naad = None\n# Generate a secure key\nkey = AESGCM.generate_key(bit_length=128)\n# Create a new AESGCM instance with our secure key\naesgcm = AESGCM(key)\n# Note: nonce values _must_ be regenerated every time they are used.\nnonce = os.urandom(12)\n# Encrypt our plaintext\ncipher_text = aesgcm.encrypt(nonce, plain_text, aad)\n# Decrypt the plain text using the nonce and cipher_text\naesgcm.decrypt(nonce, cipher_text, aad)\n```\n\nFor more information on the cryptography module see:\n- https://cryptography.io/en/latest/\n"
+ },
+ "id": "bandit.B304-12",
+ "name": "bandit.B304-12",
+ "properties": {
+ "precision": "very-high",
+ "tags": [
+ "CWE-327",
+ "OWASP-A3:2017-Sensitive Data Exposure",
+ "security"
+ ]
+ },
+ "shortDescription": {
+ "text": "Use of a Broken or Risky Cryptographic Algorithm"
+ }
+ },
+ {
+ "defaultConfiguration": {
+ "level": "warning"
+ },
+ "fullDescription": {
+ "text": "Depending on the context, generating weak random numbers may expose cryptographic functions\nwhich rely on these numbers, to be exploitable. When generating numbers for sensitive values\nsuch as tokens, nonces, and cryptographic keys, it is recommended that the `DRBG` instance\nof `SecureRandom` be used.\n\nExample using `DRBG` with `SecureRandom`:\n```\npublic SecureRandom getSecureRandomDRBG() throws NoSuchAlgorithmException {\n// Use DRBG according to\nhttp://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-90Ar1.pdf\n return SecureRandom.getInstance(\"DRBG\",\n // Security strength in bits (default is 128)\n DrbgParameters.instantiation(256,\n // Set prediction resistance and re-seeding\n DrbgParameters.Capability.PR_AND_RESEED,\n // Set the personalization string (optional, not necessary)\n \"some_personalization_string\".getBytes()\n )\n );\n}\n```\n\nFor more information on Java Cryptography see:\nhttps://docs.oracle.com/en/java/javase/15/security/java-cryptography-architecture-jca-reference-guide.html\n"
+ },
+ "id": "find_sec_bugs.PREDICTABLE_RANDOM-1",
+ "name": "find_sec_bugs.PREDICTABLE_RANDOM-1",
+ "properties": {
+ "precision": "very-high",
+ "tags": [
+ "CWE-330",
+ "security"
+ ]
+ },
+ "shortDescription": {
+ "text": "Use of insufficiently random values"
+ }
+ },
+ {
+ "defaultConfiguration": {
+ "level": "warning"
+ },
+ "fullDescription": {
+ "text": "Use InitializeCriticalSectionAndSpinCount instead.\n"
+ },
+ "id": "flawfinder.InitializeCriticalSection-1",
+ "name": "flawfinder.InitializeCriticalSection-1",
+ "properties": {
+ "precision": "very-high",
+ "tags": [
+ "CWE-754",
+ "security"
+ ]
+ },
+ "shortDescription": {
+ "text": "Exceptions can be thrown in low-memory situations"
+ }
+ },
+ {
+ "defaultConfiguration": {
+ "level": "error"
+ },
+ "fullDescription": {
+ "text": "XML External Entity (XXE) attacks can occur when an XML parser supports XML\nentities while processing XML received from an untrusted source.\n"
+ },
+ "id": "find_sec_bugs.XXE_XPATH-1.XXE_DOCUMENT-1",
+ "name": "find_sec_bugs.XXE_XPATH-1.XXE_DOCUMENT-1",
+ "properties": {
+ "precision": "very-high",
+ "tags": [
+ "CWE-611",
+ "security"
+ ]
+ },
+ "shortDescription": {
+ "text": "Improper Restriction of XML External Entity Reference ('XXE')"
+ }
+ },
+ {
+ "defaultConfiguration": {
+ "level": "error"
+ },
+ "fullDescription": {
+ "text": "The application allows user input to control format string parameters. By passing invalid\nformat\nstring specifiers an adversary could cause the application to throw exceptions or possibly\nleak\ninternal information depending on application logic.\n\nNever allow user-supplied input to be used to create a format string. Replace all format\nstring\narguments with hardcoded format strings containing the necessary specifiers.\n\nExample of using `String.format` safely:\n```\n// Get untrusted user input\nString userInput = request.getParameter(\"someInput\");\n// Ensure that user input is not included in the first argument to String.format\nString.format(\"Hardcoded string expecting a string: %s\", userInput);\n// ...\n```\n"
+ },
+ "id": "find_sec_bugs.FORMAT_STRING_MANIPULATION-1",
+ "name": "find_sec_bugs.FORMAT_STRING_MANIPULATION-1",
+ "properties": {
+ "precision": "very-high",
+ "tags": [
+ "CWE-134",
+ "HIGH CONFIDENCE",
+ "security"
+ ]
+ },
+ "shortDescription": {
+ "text": "Use of externally-controlled format string"
+ }
+ },
+ {
+ "defaultConfiguration": {
+ "level": "error"
+ },
+ "fullDescription": {
+ "text": "Allowing user input to control format parameters could enable an attacker to cause exceptions\nto be thrown or leak information.Attackers may be able to modify the format string argument,\nsuch that an exception is thrown. If this exception is left uncaught, it may crash the\napplication. Alternatively, if sensitive information is used within the unused arguments,\nattackers may change the format string to reveal this information.\n"
+ },
+ "id": "find_sec_bugs.FORMAT_STRING_MANIPULATION-1",
+ "name": "find_sec_bugs.FORMAT_STRING_MANIPULATION-1",
+ "properties": {
+ "precision": "very-high",
+ "tags": [
+ "CWE-134",
+ "HIGH CONFIDENCE",
+ "security"
+ ]
+ },
+ "shortDescription": {
+ "text": "Use of Externally-Controlled Format String"
+ }
+ },
+ {
+ "defaultConfiguration": {
+ "level": "warning"
+ },
+ "fullDescription": {
+ "text": "Applications can unintentionally leak information about their configuration, internal\nworkings, or violate privacy through a variety of application problems. Pages that provide\ndifferent responses based on the validity of the data can lead to Information Leakage;\nspecifically when data deemed confidential is being revealed as a result of the web\napplication's design.\n"
+ },
+ "id": "find_sec_bugs.SCALA_SENSITIVE_DATA_EXPOSURE-1",
+ "name": "find_sec_bugs.SCALA_SENSITIVE_DATA_EXPOSURE-1",
+ "properties": {
+ "precision": "very-high",
+ "tags": [
+ "CWE-200",
+ "security"
+ ]
+ },
+ "shortDescription": {
+ "text": "Information Exposure"
+ }
+ },
+ {
+ "defaultConfiguration": {
+ "level": "note"
+ },
+ "fullDescription": {
+ "text": "Having the annotation [OutputCache] will disable the annotation [Authorize] for\nthe requests following the first one.\n"
+ },
+ "id": "security_code_scan.SCS0019-1",
+ "name": "security_code_scan.SCS0019-1",
+ "properties": {
+ "precision": "very-high",
+ "tags": [
+ "CWE-524",
+ "security"
+ ]
+ },
+ "shortDescription": {
+ "text": "Use of cache containing sensitive information"
+ }
+ },
+ {
+ "defaultConfiguration": {
+ "level": "note"
+ },
+ "fullDescription": {
+ "text": "The application was found using `assert` in non-test code. Usually reserved for debug and test\ncode, the `assert`\nfunction is commonly used to test conditions before continuing execution. However, enclosed\ncode will be removed\nwhen compiling Python code to optimized byte code. Depending on the assertion and subsequent\nlogic, this could\nlead to undefined behavior of the application or application crashes.\n\nTo remediate this issue, remove the `assert` calls. If necessary, replace them with either `if`\nconditions or\n`try/except` blocks.\n\nExample using `try/except` instead of `assert`:\n```\n# Below try/except is equal to the assert statement of:\n# assert user.is_authenticated(), \"user must be authenticated\"\ntry:\n if not user.is_authenticated():\n raise AuthError(\"user must be authenticated\")\nexcept AuthError as e:\n # Handle error\n # ...\n # Return, do not continue processing\n return\n```\n"
+ },
+ "id": "bandit.B101",
+ "name": "bandit.B101",
+ "properties": {
+ "precision": "very-high",
+ "tags": [
+ "CWE-754",
+ "security"
+ ]
+ },
+ "shortDescription": {
+ "text": "Improper check for unusual or exceptional conditions"
+ }
+ },
+ {
+ "defaultConfiguration": {
+ "level": "error"
+ },
+ "fullDescription": {
+ "text": "The crypt functions are not recommended due to the significantly small\nkey space. Modern hardware can crack crypt produced passwords relatively quickly.\n\nConsider using the Argon2id password hashing algorithm provided by libsodium.\nFor more information please see: https://libsodium.gitbook.io/doc/password_hashing.\n"
+ },
+ "id": "flawfinder.crypt-1.crypt_r-1",
+ "name": "flawfinder.crypt-1.crypt_r-1",
+ "properties": {
+ "precision": "very-high",
+ "tags": [
+ "CWE-327",
+ "OWASP-A3:2017-Sensitive Data Exposure",
+ "security"
+ ]
+ },
+ "shortDescription": {
+ "text": "Insecure hashing algorithm"
+ }
+ },
+ {
+ "defaultConfiguration": {
+ "level": "error"
+ },
+ "fullDescription": {
+ "text": "SQL Injection is a critical vulnerability that can lead to data or system compromise. By\ndynamically generating SQL query strings, user input may be able to influence the logic of\nthe SQL statement. This could lead to an adversary accessing information they should\nnot have access to, or in some circumstances, being able to execute OS functionality or code.\n\nReplace all dynamically generated SQL queries with parameterized queries. In situations where\ndynamic queries must be created, never use direct user input, but instead use a map or\ndictionary of valid values and resolve them using a user supplied key.\n\nFor example, some database drivers do not allow parameterized queries for `>` or `<` comparison\noperators. In these cases, do not use a user supplied `>` or `<` value, but rather have the\nuser\nsupply a `gt` or `lt` value. The alphabetical values are then used to look up the `>` and `<`\nvalues to be used in the construction of the dynamic query. The same goes for other queries\nwhere\ncolumn or table names are required but cannot be parameterized.\n\nExample using `PreparedStatement` queries:\n```\n// Some userInput\nString userInput = \"someUserInput\";\n// Your connection string\nString url = \"...\";\n// Get a connection from the DB via the DriverManager\nConnection conn = DriverManager.getConnection(url);\n// Create a prepared statement\nPreparedStatement st = conn.prepareStatement(\"SELECT name FROM table where name=?\");\n// Set each parameters value by the index (starting from 1)\nst.setString(1, userInput);\n// Execute query and get the result set\nResultSet rs = st.executeQuery();\n// Iterate over results\nwhile (rs.next()) {\n // Get result for this row at the provided column number (starting from 1)\n String result = rs.getString(1);\n // ...\n}\n// Close the ResultSet\nrs.close();\n// Close the PreparedStatement\nst.close();\n```\n\nFor more information on SQL Injection see OWASP:\nhttps://cheatsheetseries.owasp.org/cheatsheets/SQL_Injection_Prevention_Cheat_Sheet.html\n"
+ },
+ "id": "find_sec_bugs.SQL_INJECTION_SPRING_JDBC-1.SQL_INJECTION_JPA-1.SQL_INJECTION_JDO-1.SQL_INJECTION_JDBC-1.SQL_NONCONSTANT_STRING_PASSED_TO_EXECUTE-1.SQL_INJECTION-1.SQL_INJECTION_HIBERNATE-1.SQL_INJECTION_VERTX-1.SQL_PREPARED_STATEMENT_GENERATED_FROM_NONCONSTANT_STRING-1",
+ "name": "find_sec_bugs.SQL_INJECTION_SPRING_JDBC-1.SQL_INJECTION_JPA-1.SQL_INJECTION_JDO-1.SQL_INJECTION_JDBC-1.SQL_NONCONSTANT_STRING_PASSED_TO_EXECUTE-1.SQL_INJECTION-1.SQL_INJECTION_HIBERNATE-1.SQL_INJECTION_VERTX-1.SQL_PREPARED_STATEMENT_GENERATED_FROM_NONCONSTANT_STRING-1",
+ "properties": {
+ "precision": "very-high",
+ "tags": [
+ "CWE-89",
+ "security"
+ ]
+ },
+ "shortDescription": {
+ "text": "Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')"
+ }
+ },
+ {
+ "defaultConfiguration": {
+ "level": "error"
+ },
+ "fullDescription": {
+ "text": "The application was found using a telnet library. As telnet does not provide encryption, it is\nstrongly recommended that communications use a more secure transport such as\nSSH.\n\nThe [paramiko](https://www.paramiko.org/) library can be used to initiate SSH connections.\n\nExample using `paramiko` SSH client:\n```\nimport paramiko\nimport scp\n\n# Create an SSH client\nwith paramiko.SSHClient() as ssh:\n # Load the system host keys so we can confirm the\n # host we are connecting to is legitimate\n ssh.load_system_host_keys('/home/appuser/.ssh/known_hosts')\n\n # Connect to the remote host using our SSH private key\n ssh.connect(hostname='example.org',\n port=22,\n username='appuser',\n key_filename='/home/appuser/.ssh/private_key')\n # Work with the connection\n```\n\nFor more information on the paramiko module see:\n- https://www.paramiko.org/\n"
+ },
+ "id": "bandit.B401",
+ "name": "bandit.B401",
+ "properties": {
+ "precision": "very-high",
+ "tags": [
+ "CWE-319",
+ "OWASP-A3:2017-Sensitive Data Exposure",
+ "security"
+ ]
+ },
+ "shortDescription": {
+ "text": "Cleartext transmission of sensitive information"
+ }
+ },
+ {
+ "defaultConfiguration": {
+ "level": "error"
+ },
+ "fullDescription": {
+ "text": "Potential Integer overflow made by strconv.Atoi result conversion to int16/32\n"
+ },
+ "id": "gosec.G113-1",
+ "name": "gosec.G113-1",
+ "properties": {
+ "precision": "very-high",
+ "tags": [
+ "CWE-190",
+ "security"
+ ]
+ },
+ "shortDescription": {
+ "text": "Integer Overflow or Wraparound"
+ }
+ },
+ {
+ "defaultConfiguration": {
+ "level": "error"
+ },
+ "fullDescription": {
+ "text": "The application was found creating temporary files with the insecure `mktemp` method.\nDepending on how the application uses this temporary file, an attacker may be able to create\nsymlinks that point to other files prior to the application creating or writing\nto the target file, leading to unintended files being created or overwritten.\n\nTo remediate this issue consider using `tempfile.TemporaryFile` instead.\n\nExample using `tempfile.TemporaryFile` to write a file:\n```\nimport tempfile\n\n# Open a new temporary file using a context manager\nwith tempfile.TemporaryFile() as fp:\n # Write some data to the temporary file\n fp.write(b'Some data')\n # Seek back to beginning of file\n fp.seek(0)\n # Read it\n data = fp.read()\n# File is automatically closed/removed once we exit the with context\n```\n\nFor more information on alternative tempfile functions see:\n- https://docs.python.org/3/library/tempfile.html\n"
+ },
+ "id": "bandit.B306",
+ "name": "bandit.B306",
+ "properties": {
+ "precision": "very-high",
+ "tags": [
+ "CWE-377",
+ "OWASP-A3:2017-Sensitive Data Exposure",
+ "security"
+ ]
+ },
+ "shortDescription": {
+ "text": "Insecure temporary file"
+ }
+ },
+ {
+ "defaultConfiguration": {
+ "level": "warning"
+ },
+ "fullDescription": {
+ "text": "The application was found using `dill` which is vulnerable to deserialization attacks.\nDeserialization attacks exploit the process of reading serialized data and turning it back\ninto an object. By constructing malicious objects and serializing them, an adversary may\nattempt to:\n\n- Inject code that is executed upon object construction, which occurs during the\ndeserialization process.\n- Exploit mass assignment by including fields that are not normally a part of the serialized\ndata but are read in during deserialization.\n\nConsider safer alternatives such as serializing data in the JSON format. Ensure any format\nchosen allows\nthe application to specify exactly which object types are allowed to be deserialized.\n\nTo protect against mass assignment, only allow deserialization of the specific fields that are\nrequired. If this is not easily done, consider creating an intermediary type that\ncan be serialized with only the necessary fields exposed.\n\nExample JSON deserializer using an intermediary type that is validated against a schema to\nensure\nit is safe from mass assignment:\n```\nimport jsonschema\n\n# Create a schema to validate our user-supplied input against\n# an intermediary object\nintermediary_schema = {\n \"type\" : \"object\",\n \"properties\" : {\n \"name\": {\"type\" : \"string\"}\n },\n \"required\": [\"name\"],\n # Protect against random properties being added to the object\n \"additionalProperties\": False,\n}\n# If a user attempted to add \"'is_admin': True\" it would cause a validation error\nintermediary_object = {'name': 'test user'}\n\ntry:\n # Validate the user supplied intermediary object against our schema\n jsonschema.validate(instance=intermediary_object, schema=intermediary_schema)\n user_object = {'user':\n {\n # Assign the deserialized data from intermediary object\n 'name': intermediary_object['name'],\n # Add in protected data in object definition (or set it from a class constructor)\n 'is_admin': False,\n }\n }\n # Work with the user_object\nexcept jsonschema.exceptions.ValidationError as ex:\n # Gracefully handle validation errors\n # ...\n```\n\nFor more details on deserialization attacks in general, see OWASP's guide:\n- https://cheatsheetseries.owasp.org/cheatsheets/Deserialization_Cheat_Sheet.html\n"
+ },
+ "id": "bandit.B302",
+ "name": "bandit.B302",
+ "properties": {
+ "precision": "very-high",
+ "tags": [
+ "CWE-502",
+ "OWASP-A8:2017-Insecure Deserialization",
+ "security"
+ ]
+ },
+ "shortDescription": {
+ "text": "Deserialization of untrusted data"
+ }
+ },
+ {
+ "defaultConfiguration": {
+ "level": "warning"
+ },
+ "fullDescription": {
+ "text": "Usage of a cryptographically insecure cipher suite has been detected. It is recommended that\nalternative ciphers be used instead. It is strongly recommended that all TLS connections\nuse TLS 1.3 as Go will automatically choose the most secure cipher when negotiating the\nTLS handshake with client or servers. TLS 1.3 cipher suites are configured to require Perfect\nForward Secrecy (PFS).\nPFS is an important property as it will ensure that past encrypted transmissions could not be\ndecrypted\nif the TLS certificate was compromised.\n\nExample using TLS 1.3 for a Go server:\n```\ncert, err := tls.LoadX509KeyPair(\"server.crt\", \"server.key\")\nif err != nil {\n log.Fatal(err)\n}\n\ncfg := &tls.Config{Certificates: []tls.Certificate{cert}, MinVersion: tls.VersionTLS13}\nsrv := &http.Server{\n Addr: \":8999\",\n TLSConfig: cfg,\n ReadTimeout: time.Minute,\n WriteTimeout: time.Minute,\n}\nlog.Fatal(srv.ListenAndServeTLS(\"\", \"\"))\n```\n\nIf TLS 1.0-1.2 must be used, then the following list of ciphers should be chosen as they\nsupport\nPerfect Forward Secrecy (PFS):\n\n- TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384\n- TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256\n- TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256\n- TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384\n- TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305\n- TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305\n\n\nExample `tls.Config` using the recommended cipher suites:\n```\ncfg := &tls.Config{\n MinVersion: tls.VersionTLS12,\n CipherSuites: []uint16{\n tls.TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384,\n tls.TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256,\n tls.TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384,\n tls.TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256,\n tls.TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305,\n tls.TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305,\n },\n}\n```\n\nFor more information on cipher suites in Go see: https://go.dev/blog/tls-cipher-suites\n"
+ },
+ "id": "gosec.G402-1",
+ "name": "gosec.G402-1",
+ "properties": {
+ "precision": "very-high",
+ "tags": [
+ "CWE-327",
+ "OWASP-A9:2017-Using Components with Known Vulnerabilities",
+ "security"
+ ]
+ },
+ "shortDescription": {
+ "text": "Use of a broken or risky cryptographic algorithm"
+ }
+ },
+ {
+ "defaultConfiguration": {
+ "level": "warning"
+ },
+ "fullDescription": {
+ "text": "The application was found using an insecure or risky digest or signature algorithm. MD2, MD5\nand SHA1 hash algorithms have been found to be vulnerable to producing collisions.\n\nThis means\nthat two different values, when hashed, can lead to the same hash value. If the application is\ntrying\nto use these hash methods for storing passwords, then it is recommended to switch to a\npassword hashing\nalgorithm such as Argon2id or PBKDF2.\n\nNote that the `Crypto` and `Cryptodome` Python packages are no longer recommended for\nnew applications, instead consider using the [cryptography](https://cryptography.io/) package.\n\nExample of creating a SHA-384 hash using the `cryptography` package:\n```\nfrom cryptography.hazmat.primitives import hashes\n# Create a SHA384 digest\ndigest = hashes.Hash(hashes.SHA384())\n# Update the digest with some initial data\ndigest.update(b\"some data to hash\")\n# Add more data to the digest\ndigest.update(b\"some more data\")\n# Finalize the digest as bytes\nresult = digest.finalize()\n```\n\nFor more information on secure password storage see OWASP:\n- https://cheatsheetseries.owasp.org/cheatsheets/Password_Storage_Cheat_Sheet.html\n\nFor more information on the cryptography module see:\n- https://cryptography.io/en/latest/\n"
+ },
+ "id": "bandit.B304-1",
+ "name": "bandit.B304-1",
+ "properties": {
+ "precision": "very-high",
+ "tags": [
+ "CWE-327",
+ "OWASP-A3:2017-Sensitive Data Exposure",
+ "security"
+ ]
+ },
+ "shortDescription": {
+ "text": "Use of a broken or risky cryptographic algorithm"
+ }
+ },
+ {
+ "defaultConfiguration": {
+ "level": "error"
+ },
+ "fullDescription": {
+ "text": "Format string vulnerabilities allow an attacker to read or in some cases, potentially write\ndata to\nand from locations in the processes' memory. To prevent against format string attacks, do not\nallow\nusers or un-validated input to provide the format specification.\nConsider using a constant for the format specification, or only allow specific\ncharacters to be provided to the format argument for the `printf` family of functions.\n\nFor more information please see: https://linux.die.net/man/3/fprintf\n\nFor more information on format string attacks please see OWASP's attack guide:\nhttps://owasp.org/www-community/attacks/Format_string_attack\n"
+ },
+ "id": "flawfinder.printf-1.vprintf-1.vwprintf-1.vfwprintf-1._vtprintf-1.wprintf-1",
+ "name": "flawfinder.printf-1.vprintf-1.vwprintf-1.vfwprintf-1._vtprintf-1.wprintf-1",
+ "properties": {
+ "precision": "very-high",
+ "tags": [
+ "CWE-134",
+ "OWASP-A1:2017-Injection",
+ "security"
+ ]
+ },
+ "shortDescription": {
+ "text": "Potential format string vulnerability"
+ }
+ },
+ {
+ "defaultConfiguration": {
+ "level": "error"
+ },
+ "fullDescription": {
+ "text": "The `getlogin` function suffers from many bugs or unknown behaviors depending on the\nsystem. Often, it gives only the first 8 characters of the login name. The user\ncurrently logged in on the controlling TTY of our program does not necessarily mean\nit is the user who started the process.\n\nUse getpwuid(geteuid()) and extract the desired information instead.\n\nFor more information please see: https://linux.die.net/man/3/getpwuid\n"
+ },
+ "id": "flawfinder.getlogin-1",
+ "name": "flawfinder.getlogin-1",
+ "properties": {
+ "precision": "very-high",
+ "tags": [
+ "CWE-807",
+ "security"
+ ]
+ },
+ "shortDescription": {
+ "text": "Usage of deprecated function (getlogin)"
+ }
+ },
+ {
+ "defaultConfiguration": {
+ "level": "warning"
+ },
+ "fullDescription": {
+ "text": "Missing 'noopener' on an anchor tag where target='_blank'. This could introduce\na reverse tabnabbing vulnerability. Include 'noopener' when using target='_blank'.\n"
+ },
+ "help": {
+ "markdown": "Missing 'noopener' on an anchor tag where target='_blank'. This could introduce\na reverse tabnabbing vulnerability. Include 'noopener' when using target='_blank'.\n\n\nReferences:\n - [https://html.spec.whatwg.org/multipage/links.html#link-type-noreferrer](https://html.spec.whatwg.org/multipage/links.html#link-type-noreferrer)\n - [https://web.dev/external-anchors-use-rel-noopener/](https://web.dev/external-anchors-use-rel-noopener/)\n - [https://owasp.org/www-community/attacks/Reverse_Tabnabbing](https://owasp.org/www-community/attacks/Reverse_Tabnabbing)\n",
+ "text": "Missing 'noopener' on an anchor tag where target='_blank'. This could introduce\na reverse tabnabbing vulnerability. Include 'noopener' when using target='_blank'.\n"
+ },
+ "id": "eslint.react-missing-noopener",
+ "name": "eslint.react-missing-noopener",
+ "properties": {
+ "precision": "very-high",
+ "tags": [
+ "CWE-200",
+ "OWASP-A3:2017-Sensitive Data Exposure",
+ "security"
+ ]
+ },
+ "shortDescription": {
+ "text": "Exposure of Sensitive Information to an Unauthorized Actor"
+ }
+ },
+ {
+ "defaultConfiguration": {
+ "level": "error"
+ },
+ "fullDescription": {
+ "text": "The input values included in SQL queries need to be passed in safely. Bind\nvariables in prepared statements can be used to easily mitigate the risk of\nSQL injection.\n"
+ },
+ "id": "find_sec_bugs.XPATH_INJECTION-1",
+ "name": "find_sec_bugs.XPATH_INJECTION-1",
+ "properties": {
+ "precision": "very-high",
+ "tags": [
+ "CWE-611",
+ "security"
+ ]
+ },
+ "shortDescription": {
+ "text": "Improper Restriction of XML External Entity Reference ('XXE')"
+ }
+ },
+ {
+ "defaultConfiguration": {
+ "level": "error"
+ },
+ "fullDescription": {
+ "text": "The application processes `XPath` queries with potentially malicious input.\nAn adversary who is able to control the XPath query could potentially influence the logic\nof how data is retrieved, processed or even bypass protections.\n\nTo protect against XPath injection, user input should be parameterized using a variable\nresolver.\nBy creating a class that implements the `XPathVariableResolver` the application can ensure\nthat\nthe xpath query and user-supplied input are treated separately.\n\nExample implementation of an XPathVariableResolver:\n```\n// Create a class which implements the XPathVariableResolver interface\npublic static class SimpleXPathVariableResolver implements XPathVariableResolver {\n // Use a map or lookup table to store variables for resolution\n private HashMap variables = new HashMap<>();\n // Allow caller to set variables\n public void setVariable(QName name, String value) {\n variables.put(name, value);\n }\n // Implement the resolveVariable to return the value\n @Override\n public Object resolveVariable(QName name) {\n return variables.getOrDefault(name, \"\");\n }\n}\n\npublic static void xpathQuery(String userInput) throws ParseException,\nParserConfigurationException,\n SAXException, IOException, XPathExpressionException {\n\n // Create our DocumentFactory\n DocumentBuilderFactory domFactory = DocumentBuilderFactory.newInstance();\n // Enable namespace awareness\n domFactory.setNamespaceAware(true);\n // Enable secure processing\n domFactory.setFeature(XMLConstants.FEATURE_SECURE_PROCESSING, true);\n // Create our DocumentBuilder\n DocumentBuilder builder = domFactory.newDocumentBuilder();\n // Parse our XML document\n Document doc = builder.parse(\"inventory.xml\");\n\n // Create a new instance of an XPath object\n XPath xpathProcessor = XPathFactory.newInstance().newXPath();\n // Create our XPathVariableResolver\n SimpleXPathVariableResolver resolver = new SimpleXPathVariableResolver();\n // Add user input as a variable value\n resolver.setVariable(new QName(\"author\"), userInput);\n // Configure the processor to use our variable resolver\n xpathProcessor.setXPathVariableResolver(resolver);\n // Evaluate the XPath query\n String result = xpathProcessor.compile(\"//author[contains(., $author)]\").evaluate(doc);\n // Work with the result\n // ...\n}\n```\n\nFor more information on XPath Injection see:\n- https://owasp.org/www-community/attacks/XPATH_Injection\n"
+ },
+ "id": "find_sec_bugs.XPATH_INJECTION-1",
+ "name": "find_sec_bugs.XPATH_INJECTION-1",
+ "properties": {
+ "precision": "very-high",
+ "tags": [
+ "CWE-643",
+ "security"
+ ]
+ },
+ "shortDescription": {
+ "text": "Improper neutralization of data within XPath expressions ('XPath Injection')"
+ }
+ },
+ {
+ "defaultConfiguration": {
+ "level": "note"
+ },
+ "fullDescription": {
+ "text": "The `unsafe` package in Go allows low-level access to memory management features.\nThis includes pointers and direct access to memory. The Go compiler will no longer\nbe able to enforce type safety when working with the `unsafe` pointer types.\n\nWhile powerful, access to these functions can lead to many security related issues\n such as:\n\n- [Buffer overflows](https://owasp.org/www-community/vulnerabilities/Buffer_Overflow) which\ncan lead to code execution.\ncan lead to code execution\n- [Use after free](https://owasp.org/www-community/vulnerabilities/Using_freed_memory) which\ncan lead to code execution.\ncan lead to code execution\n- [Information/Memory leaks](https://owasp.org/www-community/vulnerabilities/Memory_leak)\nwhich can leak sensitive information, including data which can\ndefeat other protection mechanisms or cause the system to run out of memory.\n\nUnless required, all calls to the `unsafe` package should be removed.\n"
+ },
+ "id": "gosec.G103-1",
+ "name": "gosec.G103-1",
+ "properties": {
+ "precision": "very-high",
+ "tags": [
+ "CWE-242",
+ "security"
+ ]
+ },
+ "shortDescription": {
+ "text": "Use of inherently dangerous function (unsafe package)"
+ }
+ },
+ {
+ "defaultConfiguration": {
+ "level": "warning"
+ },
+ "fullDescription": {
+ "text": "The application dynamically constructs file or path information. If the path\ninformation comes from user input, it could be abused to read sensitive files,\naccess other users data, or aid in exploitation to gain further system access.\n\nUser input should never be used in constructing paths or files for interacting\nwith the filesystem. This includes filenames supplied by user uploads or downloads.\nIf possible consider hashing user input or replacing it with unique values and\nuse `System.IO.Path.GetFullPath` to resolve and validate the path information\nprior to processing any file functionality.\n\nExample using `Path.GetFullPath` and not allowing direct user input:\n```\n// store user input alongside an ID we control\nstruct userData\n{\n public string userFilename;\n public Guid id;\n}\n\nclass Program\n{\n public static void Main()\n {\n userData data = new userData();\n // user input, saved only as a reference\n data.userFilename = \"..\\\\test.txt\";\n\n // random id as the filename\n data.id = Guid.NewGuid();\n\n // restrict all file processing to this directory only\n string basePath = \"C:\\\\Restricted\\\\\";\n\n // resolve the full path, but only use our random generated id\n string fullPath = Path.GetFullPath(basePath + data.id);\n\n // verify the path is contained within our basePath\n if (!fullPath.StartsWith(basePath)) {\n Console.WriteLine(\"Invalid path specified!\");\n return;\n }\n // process / work with file\n }\n}\n```\n\nFor more information on path traversal issues see OWASP:\nhttps://owasp.org/www-community/attacks/Path_Traversal\n"
+ },
+ "id": "security_code_scan.SCS0018-1",
+ "name": "security_code_scan.SCS0018-1",
+ "properties": {
+ "precision": "very-high",
+ "tags": [
+ "CWE-22",
+ "security"
+ ]
+ },
+ "shortDescription": {
+ "text": "Improper limitation of a pathname to a restricted directory ('Path Traversal')"
+ }
+ },
+ {
+ "defaultConfiguration": {
+ "level": "warning"
+ },
+ "fullDescription": {
+ "text": "Found dynamic content when spawning a process. This is dangerous if externaldata can reach this\nfunction call because it allows a malicious actor toexecute commands. Ensure no external data\nreaches here.\n"
+ },
+ "id": "bandit.B606",
+ "name": "bandit.B606",
+ "properties": {
+ "precision": "very-high",
+ "tags": [
+ "CWE-78",
+ "OWASP-A1:2017-Injection",
+ "security"
+ ]
+ },
+ "shortDescription": {
+ "text": "Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')"
+ }
+ },
+ {
+ "defaultConfiguration": {
+ "level": "error"
+ },
+ "fullDescription": {
+ "text": "Constructing SimpleDB queries containing user input can allow an attacker to view unauthorized\nrecords.\n"
+ },
+ "id": "find_sec_bugs.AWS_QUERY_INJECTION-1",
+ "name": "find_sec_bugs.AWS_QUERY_INJECTION-1",
+ "properties": {
+ "precision": "very-high",
+ "tags": [
+ "CWE-943",
+ "security"
+ ]
+ },
+ "shortDescription": {
+ "text": "Improper Neutralization of Special Elements in Data Query Logic"
+ }
+ },
+ {
+ "defaultConfiguration": {
+ "level": "error"
+ },
+ "fullDescription": {
+ "text": "Constructing SimpleDB queries containing user input can allow an attacker to view unauthorized\nrecords.\n"
+ },
+ "id": "find_sec_bugs.AWS_QUERY_INJECTION-1",
+ "name": "find_sec_bugs.AWS_QUERY_INJECTION-1",
+ "properties": {
+ "precision": "very-high",
+ "tags": [
+ "CWE-943",
+ "security"
+ ]
+ },
+ "shortDescription": {
+ "text": "Improper Neutralization of Special Elements in Data Query Logic"
+ }
+ },
+ {
+ "defaultConfiguration": {
+ "level": "warning"
+ },
+ "fullDescription": {
+ "text": "A trust boundary can be thought of as line drawn through a program. On one side\nof the line, data is untrusted. On the other side of the line, data is assumed\nto be trustworthy. The purpose of validation logic is to allow data to safely\ncross the trust boundary - to move from untrusted to trusted. A trust boundary\nviolation occurs when a program blurs the line between what is trusted and what\nis untrusted. By combining trusted and untrusted data in the same data\nstructure, it becomes easier for programmers to mistakenly trust unvalidated\ndata.\n"
+ },
+ "id": "find_sec_bugs.TRUST_BOUNDARY_VIOLATION-1",
+ "name": "find_sec_bugs.TRUST_BOUNDARY_VIOLATION-1",
+ "properties": {
+ "precision": "very-high",
+ "tags": [
+ "CWE-501",
+ "security"
+ ]
+ },
+ "shortDescription": {
+ "text": "Trust Boundary Violation"
+ }
+ },
+ {
+ "defaultConfiguration": {
+ "level": "warning"
+ },
+ "fullDescription": {
+ "text": "A trust boundary can be thought of as line drawn through a program. On one side\nof the line, data is untrusted. On the other side of the line, data is assumed\nto be trustworthy. The purpose of validation logic is to allow data to safely\ncross the trust boundary - to move from untrusted to trusted. A trust boundary\nviolation occurs when a program blurs the line between what is trusted and what\nis untrusted. By combining trusted and untrusted data in the same data\nstructure, it becomes easier for programmers to mistakenly trust unvalidated\ndata.\n"
+ },
+ "id": "find_sec_bugs.TRUST_BOUNDARY_VIOLATION-1",
+ "name": "find_sec_bugs.TRUST_BOUNDARY_VIOLATION-1",
+ "properties": {
+ "precision": "very-high",
+ "tags": [
+ "CWE-501",
+ "security"
+ ]
+ },
+ "shortDescription": {
+ "text": "Trust Boundary Violation"
+ }
+ },
+ {
+ "defaultConfiguration": {
+ "level": "warning"
+ },
+ "fullDescription": {
+ "text": "Form inputs should have minimal input validation. Preventive validation helps provide defense\nin depth against a variety of risks.\n"
+ },
+ "id": "find_sec_bugs.STRUTS_FORM_VALIDATION-1",
+ "name": "find_sec_bugs.STRUTS_FORM_VALIDATION-1",
+ "properties": {
+ "precision": "very-high",
+ "tags": [
+ "CWE-20",
+ "security"
+ ]
+ },
+ "shortDescription": {
+ "text": "Improper Input Validation"
+ }
+ },
+ {
+ "defaultConfiguration": {
+ "level": "warning"
+ },
+ "fullDescription": {
+ "text": "Form inputs should have minimal input validation. Preventive validation helps\nprovide defense in depth against a variety of risks.\n"
+ },
+ "id": "find_sec_bugs.STRUTS_FORM_VALIDATION-1",
+ "name": "find_sec_bugs.STRUTS_FORM_VALIDATION-1",
+ "properties": {
+ "precision": "very-high",
+ "tags": [
+ "CWE-20",
+ "security"
+ ]
+ },
+ "shortDescription": {
+ "text": "Improper Input Validation"
+ }
+ },
+ {
+ "defaultConfiguration": {
+ "level": "warning"
+ },
+ "fullDescription": {
+ "text": "OS command injection is a critical vulnerability that can lead to a full system\ncompromise as it may allow an adversary to pass in arbitrary commands or arguments\nto be executed.\n\nUser input should never be used in constructing commands or command arguments\nto functions which execute OS commands. This includes filenames supplied by\nuser uploads or downloads.\n\nEnsure your application does not:\n\n- Use user-supplied information in the process name to execute.\n- Use user-supplied information in an OS command execution function which does\nnot escape shell meta-characters.\n- Use user-supplied information in arguments to OS commands.\n\nThe application should have a hardcoded set of arguments that are to be passed\nto OS commands. If filenames are being passed to these functions, it is\nrecommended that a hash of the filename be used instead, or some other unique\nidentifier. It is strongly recommended that a native library that implements\nthe same functionality be used instead of using OS system commands, due to the\nrisk of unknown attacks against third party commands.\n\nIf operating in Windows environments, when specifying the OS command, ensure\nthe application uses the full path\ninformation, otherwise the OS may attempt to look up which process to execute\nand could be vulnerable to untrusted search path vulnerabilities (CWE-426).\n\nExample of safely executing an OS command:\n```\nuserData := []byte(\"user data\")\n// create a temporary file in the application specific directory\nf, err := ioutil.TempFile(\"/var/app/restricted\", \"temp-*.dat\")\nif err != nil {\n log.Fatal(err)\n}\n\nif _, err := f.Write(userData); err != nil {\n log.Fatal(err)\n}\n\nif err := f.Close(); err != nil {\n log.Fatal(err)\n}\n\n// pass the full path to the binary and the name of the temporary file\n// instead of any user supplied filename\nout, err := exec.Command(\"/bin/cat\", f.Name()).Output()\nif err != nil {\n log.Fatal(err)\n}\n```\n\nFor more information on OS command injection, see OWASP's guide:\nhttps://cheatsheetseries.owasp.org/cheatsheets/OS_Command_Injection_Defense_Cheat_Sheet.html\n"
+ },
+ "id": "gosec.G204-1",
+ "name": "gosec.G204-1",
+ "properties": {
+ "precision": "very-high",
+ "tags": [
+ "CWE-95",
+ "OWASP-A1:2017-Injection",
+ "security"
+ ]
+ },
+ "shortDescription": {
+ "text": "Improper Neutralization of Directives in Dynamically Evaluated Code ('Eval Injection')"
+ }
+ },
+ {
+ "defaultConfiguration": {
+ "level": "note"
+ },
+ "fullDescription": {
+ "text": "Consider possible security implications associated with etree module.\n"
+ },
+ "id": "bandit.B405",
+ "name": "bandit.B405",
+ "properties": {
+ "precision": "very-high",
+ "tags": [
+ "CWE-502",
+ "OWASP-A8:2017-Insecure Deserialization",
+ "security"
+ ]
+ },
+ "shortDescription": {
+ "text": "Deserialization of Untrusted Data"
+ }
+ },
+ {
+ "defaultConfiguration": {
+ "level": "warning"
+ },
+ "fullDescription": {
+ "text": "Server-Side-Request-Forgery (SSRF) exploits backend systems that initiate requests to third\nparties.\nIf user input is used in constructing or sending these requests, an attacker could supply\nmalicious\ndata to force the request to other systems or modify request data to cause unwanted actions.\n\nEnsure user input is not used directly in constructing URLs or URIs when initiating requests\nto third party\nsystems from back end systems. Care must also be taken when constructing payloads using user\ninput. Where\npossible restrict to known URIs or payloads. Consider using a server side map where key's are\nused to return\nURLs such as `https://site/goto?key=1` where `{key: 1, url: 'http://some.url/', key: 2, url:\n'http://...'}`.\n\nIf you must use user supplied input for requesting URLs, it is strongly recommended that the\nHTTP client\nchosen allows you to customize and block certain IP ranges at the network level. By blocking\nRFC 1918\naddresses or other network address ranges, you can limit the severity of a successful SSRF\nattack. Care must\nalso be taken to block certain protocol or address formatting such as IPv6.\n\nIf you can not block address ranges at the client level, you may want to run the HTTP client\nas a protected\nuser, or in a protected network where you can apply IP Table or firewall rules to block access\nto dangerous\naddresses. Finally, if none of the above protections are available, you could also run a\ncustom HTTP proxy\nand force all requests through it to handle blocking dangerous addresses.\n\nExample HTTP client that disallows access to loopback and RFC-1918 addresses\n```\n// IsDisallowedIP parses the ip to determine if we should allow the HTTP client to continue\nfunc IsDisallowedIP(hostIP string) bool {\n ip := net.ParseIP(hostIP)\n return ip.IsMulticast() || ip.IsUnspecified() || ip.IsLoopback() || ip.IsPrivate()\n}\n\n// SafeTransport uses the net.Dial to connect, then if successful check if the resolved\n// ip address is disallowed. We do this due to hosts such as localhost.lol being resolvable to\n// potentially malicious URLs. We allow connection only for resolution purposes.\nfunc SafeTransport(timeout time.Duration) *http.Transport {\n return &http.Transport{\n DialContext: func(ctx context.Context, network, addr string) (net.Conn, error) {\n c, err := net.DialTimeout(network, addr, timeout)\n if err != nil {\n return nil, err\n }\n ip, _, _ := net.SplitHostPort(c.RemoteAddr().String())\n if IsDisallowedIP(ip) {\n return nil, errors.New(\"ip address is not allowed\")\n }\n return c, err\n },\n DialTLS: func(network, addr string) (net.Conn, error) {\n dialer := &net.Dialer{Timeout: timeout}\n c, err := tls.DialWithDialer(dialer, network, addr, &tls.Config{})\n if err != nil {\n return nil, err\n }\n\n ip, _, _ := net.SplitHostPort(c.RemoteAddr().String())\n if IsDisallowedIP(ip) {\n return nil, errors.New(\"ip address is not allowed\")\n }\n\n err = c.Handshake()\n if err != nil {\n return c, err\n }\n\n return c, c.Handshake()\n },\n TLSHandshakeTimeout: timeout,\n }\n}\n\nfunc httpRequest(requestUrl string) {\n const clientConnectTimeout = time.Second * 10\n httpClient := &http.Client{\n Transport: SafeTransport(clientConnectTimeout),\n }\n resp, err := httpClient.Get(requestUrl)\n if err != nil {\n log.Fatal(err)\n }\n defer resp.Body.Close()\n // work with resp\n}\n```\n\nFor more information on SSRF see OWASP:\nhttps://owasp.org/www-community/attacks/Server_Side_Request_Forgery\n"
+ },
+ "id": "gosec.G107-1",
+ "name": "gosec.G107-1",
+ "properties": {
+ "precision": "very-high",
+ "tags": [
+ "CWE-918",
+ "security"
+ ]
+ },
+ "shortDescription": {
+ "text": "Server Side Request Forgery (SSRF)"
+ }
+ },
+ {
+ "defaultConfiguration": {
+ "level": "warning"
+ },
+ "fullDescription": {
+ "text": "The application was found using an insecure or risky digest or signature algorithm. MD5\nand SHA1 hash algorithms have been found to be vulnerable to producing collisions.\n\nThis means\nthat two different values, when hashed, can lead to the same hash value. If the application is\ntrying\nto use these hash methods for storing passwords, then it is recommended to switch to a\npassword hashing\nalgorithm such as Argon2id or PBKDF2.\nIt is strongly recommended that a standard digest algorithm be chosen instead as implementing\na custom algorithm is prone to errors.\n\nNote that the `Crypto` and `Cryptodome` Python packages are no longer recommended for\nnew applications, instead consider using the [cryptography](https://cryptography.io/) package.\n\nExample of creating a SHA-384 hash using the `cryptography` package:\n```\nfrom cryptography.hazmat.primitives import hashes\n# Create a SHA384 digest\ndigest = hashes.Hash(hashes.SHA384())\n# Update the digest with some initial data\ndigest.update(b\"some data to hash\")\n# Add more data to the digest\ndigest.update(b\"some more data\")\n# Finalize the digest as bytes\nresult = digest.finalize()\n```\n\nFor more information on secure password storage see OWASP:\n- https://cheatsheetseries.owasp.org/cheatsheets/Password_Storage_Cheat_Sheet.html\n\nFor more information on the cryptography module see:\n- https://cryptography.io/en/latest/\n"
+ },
+ "id": "bandit.B304-3",
+ "name": "bandit.B304-3",
+ "properties": {
+ "precision": "very-high",
+ "tags": [
+ "CWE-327",
+ "OWASP-A3:2017-Sensitive Data Exposure",
+ "security"
+ ]
+ },
+ "shortDescription": {
+ "text": "Use of a broken or risky cryptographic algorithm"
+ }
+ },
+ {
+ "defaultConfiguration": {
+ "level": "warning"
+ },
+ "fullDescription": {
+ "text": "The application was found using `noAssert` when calling the Buffer API. The `noAssert`\nargument has\nbeen deprecated since Node 10. Calling the Buffer API with this argument allows the offset\nspecified to\nbe beyond the end of the buffer. This could result in writing or reading beyond the end of the\nbuffer and\ncause a segmentation fault, leading to the application crashing.\n\nTo remediate this issue, remove the `true` argument when calling any of the Buffer read or\nwrite methods.\nThe application should still handle `RangeError` exception cases where the offset is beyond\nthe end of the\nbuffer.\n\nExample reading from a Buffer without the `noAssert` argument and gracefully handling errors:\n```\n// Create a new buffer\nconst buf = Buffer.from([1, 2, 3, 4]);\ntry {\n // Read a single byte from it, starting at offset 1\n const b = buf.readInt8(1);\n // Work with b\n} catch (e) {\n if (e instanceof RangeError) {\n console.log('Invalid offset: %s', e.message);\n }\n // handle other errors\n}\n```\n"
+ },
+ "id": "eslint.detect-buffer-noassert",
+ "name": "eslint.detect-buffer-noassert",
+ "properties": {
+ "precision": "very-high",
+ "tags": [
+ "CWE-119",
+ "security"
+ ]
+ },
+ "shortDescription": {
+ "text": "Improper restriction of operations within the bounds of a memory buffer"
+ }
+ },
+ {
+ "defaultConfiguration": {
+ "level": "warning"
+ },
+ "fullDescription": {
+ "text": "DES is considered strong ciphers for modern applications. Currently, NIST recommends the usage\nof AES block ciphers instead of DES.\n"
+ },
+ "id": "find_sec_bugs.WEAK_MESSAGE_DIGEST_MD5-1.WEAK_MESSAGE_DIGEST_SHA1-1",
+ "name": "find_sec_bugs.WEAK_MESSAGE_DIGEST_MD5-1.WEAK_MESSAGE_DIGEST_SHA1-1",
+ "properties": {
+ "precision": "very-high",
+ "tags": [
+ "CWE-326",
+ "security"
+ ]
+ },
+ "shortDescription": {
+ "text": "Inadequate Encryption Strength"
+ }
+ },
+ {
+ "defaultConfiguration": {
+ "level": "warning"
+ },
+ "fullDescription": {
+ "text": "\"The software uses an HTTP request parameter to construct a pathname that should be within a\nrestricted directory, but it does not properly neutralize absolute path sequences such as\n\"/abs/path\" that can resolve to a location that is outside of that directory. See\nhttp://cwe.mitre.org/data/definitions/36.html for more information.\"\n"
+ },
+ "id": "find_sec_bugs.PT_ABSOLUTE_PATH_TRAVERSAL-1",
+ "name": "find_sec_bugs.PT_ABSOLUTE_PATH_TRAVERSAL-1",
+ "properties": {
+ "precision": "very-high",
+ "tags": [
+ "CWE-22",
+ "security"
+ ]
+ },
+ "shortDescription": {
+ "text": "Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')"
+ }
+ },
+ {
+ "defaultConfiguration": {
+ "level": "warning"
+ },
+ "fullDescription": {
+ "text": "The application was found using an insecure or risky digest or signature algorithm. Both MD5\nand SHA1 hash algorithms have been found to be vulnerable to producing collisions.\nThis means\nthat two different values, when hashed, can lead to the same hash value. If the application is\ntrying\nto use these hash methods for storing passwords, then it is recommended to switch to a\npassword hashing\nalgorithm such as Argon2id or PBKDF2.\nstrongly recommended that a standard Digest algorithm be chosen instead as implementing\na digest by hand is error-prone.\n\nExample of creating a SHA-384 hash:\n```\n// Create a MessageDigest using the SHA-384 algorithm\nMessageDigest sha384Digest = MessageDigest.getInstance(\"SHA-384\");\n// Call update with your data\nsha384Digest.update(input);\n// Only call digest once all data has been fed into the update sha384digest instance\nbyte[] output = sha384Digest.digest();\n// output base64 encoded version of the hash\nSystem.out.println(\"hash: \" + Base64.getEncoder().encodeToString(output));\n```\n\nFor more information on secure password storage see OWASP:\nhttps://cheatsheetseries.owasp.org/cheatsheets/Password_Storage_Cheat_Sheet.html\n"
+ },
+ "id": "find_sec_bugs.WEAK_MESSAGE_DIGEST_MD5-1.WEAK_MESSAGE_DIGEST_SHA1-1",
+ "name": "find_sec_bugs.WEAK_MESSAGE_DIGEST_MD5-1.WEAK_MESSAGE_DIGEST_SHA1-1",
+ "properties": {
+ "precision": "very-high",
+ "tags": [
+ "CWE-327",
+ "security"
+ ]
+ },
+ "shortDescription": {
+ "text": "Use of a broken or risky cryptographic algorithm (SHA1/MD5)"
+ }
+ },
+ {
+ "defaultConfiguration": {
+ "level": "warning"
+ },
+ "fullDescription": {
+ "text": "The application dynamically constructs file or path information. If the path\ninformation comes from user input, it could be abused to read sensitive files,\naccess other users' data, or aid in exploitation to gain further system access.\n\nUser input should never be used in constructing paths or files for interacting\nwith the filesystem. This includes filenames supplied by user uploads or downloads.\nIf possible, consider hashing user input or replacing it with unique values and\nuse `Path.resolve` to resolve and validate the path information\nprior to processing any file functionality.\n\nExample using `Path.resolve` and not allowing direct user input:\n```\n// Class to store our user data along with a randomly generated file name\npublic static class UserData {\n private String userFileNameUnsafe;\n private String fileName;\n public UserData(String userFileName) {\n this.userFileNameUnsafe = userFileName;\n // Generate a random ID for the filename\n this.fileName = UUID.randomUUID().toString();\n }\n public String getUserFileNameUnsafe() { return userFileNameUnsafe; };\n public String getFileName() { return fileName; };\n}\n\npublic static void main(String[] args) throws Exception {\n // User input, saved only as a reference\n UserData userData = new UserData(\"..\\\\test.txt\");\n // Restrict all file processing to this directory only\n String base = \"/var/app/restricted\";\n Path basePath = Paths.get(base);\n // Resolve the full path, but only use our random generated filename\n Path fullPath = basePath.resolve(userData.getFileName());\n // verify the path is contained within our basePath\n if (!fullPath.startsWith(base)) {\n throw new Exception(\"Invalid path specified!\");\n }\n // process / work with file\n}\n```\n\nFor more information on path traversal issues see OWASP:\nhttps://owasp.org/www-community/attacks/Path_Traversal\n"
+ },
+ "id": "find_sec_bugs.PT_ABSOLUTE_PATH_TRAVERSAL-1",
+ "name": "find_sec_bugs.PT_ABSOLUTE_PATH_TRAVERSAL-1",
+ "properties": {
+ "precision": "very-high",
+ "tags": [
+ "CWE-22",
+ "security"
+ ]
+ },
+ "shortDescription": {
+ "text": "Improper limitation of a pathname to a restricted directory ('Path Traversal')"
+ }
+ },
+ {
+ "defaultConfiguration": {
+ "level": "warning"
+ },
+ "fullDescription": {
+ "text": "The Flask application is running with `debug=True` configured. By enabling this option, certain\nexceptions or errors could cause sensitive information to be leaked in HTTP responses.\n\nAdditionally, it is not recommended to run a Flask application using `Flask.run(...)` in\nproduction. Instead, a WSGI server such as\n[gunicorn](https://flask.palletsprojects.com/en/2.3.x/deploying/gunicorn/)\nor [waitress](https://flask.palletsprojects.com/en/2.3.x/deploying/waitress/) be used instead.\n\nFor more information on deployment options for Flask applications see:\n- https://flask.palletsprojects.com/en/2.3.x/deploying/\n"
+ },
+ "id": "bandit.B201",
+ "name": "bandit.B201",
+ "properties": {
+ "precision": "very-high",
+ "tags": [
+ "CWE-489",
+ "OWASP-A6:2017-Security Misconfiguration",
+ "security"
+ ]
+ },
+ "shortDescription": {
+ "text": "Active debug code"
+ }
+ },
+ {
+ "defaultConfiguration": {
+ "level": "error"
+ },
+ "fullDescription": {
+ "text": "It is generally not recommended to call out to the operating system to execute commands.\nWhen the application is executing file system based commands, user input should never be used\nin\nconstructing commands or command arguments. If possible, determine if a library can be used\ninstead to provide the same functionality. Otherwise, consider hard coding both the command\nand arguments to be used, or at the very least restricting which arguments can be passed\nto the command execution function.\n\nPlease see the compliant solutions in the following page:\nhttps://wiki.sei.cmu.edu/confluence/pages/viewpage.action?pageId=87152177\n"
+ },
+ "id": "flawfinder.execl-1.execlp-1.execle-1.execv-1.execvp-1.popen-1.WinExec-1.ShellExecute-1",
+ "name": "flawfinder.execl-1.execlp-1.execle-1.execv-1.execvp-1.popen-1.WinExec-1.ShellExecute-1",
+ "properties": {
+ "precision": "very-high",
+ "tags": [
+ "CWE-78",
+ "OWASP-A1:2017-Injection",
+ "security"
+ ]
+ },
+ "shortDescription": {
+ "text": "Potential for OS command injection"
+ }
+ },
+ {
+ "defaultConfiguration": {
+ "level": "error"
+ },
+ "fullDescription": {
+ "text": "Server-Side Request Forgery occur when a web server executes a request to a user supplied\ndestination parameter that is not validated. Such vulnerabilities could allow an attacker to\naccess internal services or to launch attacks from your web server.\n"
+ },
+ "id": "find_sec_bugs.SCALA_PLAY_SSRF-1",
+ "name": "find_sec_bugs.SCALA_PLAY_SSRF-1",
+ "properties": {
+ "precision": "very-high",
+ "tags": [
+ "CWE-918",
+ "security"
+ ]
+ },
+ "shortDescription": {
+ "text": "Server-Side Request Forgery (SSRF)"
+ }
+ },
+ {
+ "defaultConfiguration": {
+ "level": "warning"
+ },
+ "fullDescription": {
+ "text": "The `realpath` function should not be called with a destination buffer as it could\nlead to overflowing if the path is greater than PATH_LEN. It is instead recommended\nto call `realpath` with the destination buffer set to NULL and use the return value\nas the resolved path. Be sure to free the returned pointer as realpath will allocate\nthe buffer internally using `malloc`.\n\nFor more information see: https://linux.die.net/man/3/realpath\n\nExample:\n\n```\nchar const *symlink_path = \"/tmp/symlink\";\nchar *resolved_path = NULL;\n\nresolved_path = realpath(symlink_path, NULL);\nif (errno == 0) {\n // ... use resolved_path...\n free(resolved_path);\n}\n```\n"
+ },
+ "id": "flawfinder.realpath-1",
+ "name": "flawfinder.realpath-1",
+ "properties": {
+ "precision": "very-high",
+ "tags": [
+ "CWE-120",
+ "OWASP-A1:2017-Injection",
+ "security"
+ ]
+ },
+ "shortDescription": {
+ "text": "Function does not ensure destination buffer length is sufficient before copying"
+ }
+ },
+ {
+ "defaultConfiguration": {
+ "level": "warning"
+ },
+ "fullDescription": {
+ "text": "The application was found using `dill` which is vulnerable to deserialization attacks.\nDeserialization attacks exploit the process of reading serialized data and turning it back\ninto an object. By constructing malicious objects and serializing them, an adversary may\nattempt to:\n\n- Inject code that is executed upon object construction, which occurs during the\ndeserialization process.\n- Exploit mass assignment by including fields that are not normally a part of the serialized\ndata but are read in during deserialization.\n\nConsider safer alternatives such as serializing data in the JSON format. Ensure any format\nchosen allows\nthe application to specify exactly which object types are allowed to be deserialized.\n\nTo protect against mass assignment, only allow deserialization of the specific fields that are\nrequired. If this is not easily done, consider creating an intermediary type that\ncan be serialized with only the necessary fields exposed.\n\nExample JSON deserializer using an intermediary type that is validated against a schema to\nensure\nit is safe from mass assignment:\n```\nimport jsonschema\n\n# Create a schema to validate our user-supplied input against\n# an intermediary object\nintermediary_schema = {\n \"type\" : \"object\",\n \"properties\" : {\n \"name\": {\"type\" : \"string\"}\n },\n \"required\": [\"name\"],\n # Protect against random properties being added to the object\n \"additionalProperties\": False,\n}\n# If a user attempted to add \"'is_admin': True\" it would cause a validation error\nintermediary_object = {'name': 'test user'}\n\ntry:\n # Validate the user supplied intermediary object against our schema\n jsonschema.validate(instance=intermediary_object, schema=intermediary_schema)\n user_object = {'user':\n {\n # Assign the deserialized data from intermediary object\n 'name': intermediary_object['name'],\n # Add in protected data in object definition (or set it from a class constructor)\n 'is_admin': False,\n }\n }\n # Work with the user_object\nexcept jsonschema.exceptions.ValidationError as ex:\n # Gracefully handle validation errors\n # ...\n```\n\nFor more details on deserialization attacks in general, see OWASP's guide:\n- https://cheatsheetseries.owasp.org/cheatsheets/Deserialization_Cheat_Sheet.html\n"
+ },
+ "id": "bandit.B301-3",
+ "name": "bandit.B301-3",
+ "properties": {
+ "precision": "very-high",
+ "tags": [
+ "CWE-502",
+ "OWASP-A8:2017-Insecure Deserialization",
+ "security"
+ ]
+ },
+ "shortDescription": {
+ "text": "Deserialization of untrusted data"
+ }
+ },
+ {
+ "defaultConfiguration": {
+ "level": "warning"
+ },
+ "fullDescription": {
+ "text": "The `LoadLibrary` function is used to load DLLs dynamically. Depending on the filepath\nparameter,\nthe OS version, and the modes set for the process prior to calling LoadLibrary, DLL hijacking\nmay\nbe possible. Attackers can exploit this by placing DLL files with the same name in directories\nthat\nare searched before the legitimate DLL is.\n\nTo assist in preventing against this class of vulnerability consider:\n- Specifying a fully qualified path when using LoadLibraryEx.\n- Use the `LOAD_LIBRARY_SEARCH` flags with LoadLibraryEx or with SetDefaultDllDirectories.\n- If you use SetDefaultDllDirectories, be sure to use the AddDllDirectory or SetDllDirectory\n functions to modify the list of directories.\n- Only use `SearchPath` if the `SetSearchPathMode` function is called with\n `BASE_SEARCH_PATH_ENABLE_SAFE_SEARCHMODE`. (Note: this only moves the current directory to\n the end of the SearchPath search list.)\n\nFor more information see the security remarks section of the MSDN documentation:\nhttps://learn.microsoft.com/en-us/windows/win32/api/libloaderapi/nf-libloaderapi-loadlibrarya#security-remarks\n\nFor general information securely loading dynamic link libraries, see the MSDN documentation:\nhttps://learn.microsoft.com/en-us/windows/win32/dlls/dynamic-link-library-security\n"
+ },
+ "id": "flawfinder.LoadLibrary-1",
+ "name": "flawfinder.LoadLibrary-1",
+ "properties": {
+ "precision": "very-high",
+ "tags": [
+ "CWE-20",
+ "OWASP-A1:2017-Injection",
+ "security"
+ ]
+ },
+ "shortDescription": {
+ "text": "Potential for DLL hijacking (LoadLibrary)"
+ }
+ },
+ {
+ "defaultConfiguration": {
+ "level": "note"
+ },
+ "fullDescription": {
+ "text": "Depending on the context, generating weak random numbers may expose cryptographic functions,\nwhich rely on these numbers, to be exploitable. When generating numbers for sensitive values\nsuch as tokens, nonces, and cryptographic keys, it is recommended that the `secrets` module\nbe used instead.\n\nExample using the secrets module:\n```\nimport secrets\n\n# Generate a secure random 64 byte array\nrandom_bytes = secrets.token_bytes(64)\nprint(random_bytes)\n\n# Generate a secure random 64 byte array as a hex string\nrandom_bytes_hex = secrets.token_hex(64)\n\n# Generate a secure random 64 byte array base64 encoded for use in URLs\nrandom_string = secrets.token_urlsafe(64)\n```\n\nFor more information on the `secrets` module see:\n- https://docs.python.org/3/library/secrets.html\n"
+ },
+ "id": "bandit.B311",
+ "name": "bandit.B311",
+ "properties": {
+ "precision": "very-high",
+ "tags": [
+ "CWE-330",
+ "OWASP-A3:2017-Sensitive Data Exposure",
+ "security"
+ ]
+ },
+ "shortDescription": {
+ "text": "Use of insufficiently random values"
+ }
+ },
+ {
+ "defaultConfiguration": {
+ "level": "note"
+ },
+ "fullDescription": {
+ "text": "The umask function call sets the process's file mode creation mask. umask values determine\nwhat permissions a file should be created with and who can read or write to these files.\nEnsure that umask is given most restrictive possible setting depending on the context,\nusually 066 or 077, for more information please see:\nhttps://en.wikipedia.org/wiki/Umask#Mask_effect.\n"
+ },
+ "id": "flawfinder.umask-1",
+ "name": "flawfinder.umask-1",
+ "properties": {
+ "precision": "very-high",
+ "tags": [
+ "CWE-732",
+ "OWASP-A6:2017-Security Misconfiguration",
+ "security"
+ ]
+ },
+ "shortDescription": {
+ "text": "Ensure restrictive umask values"
+ }
+ },
+ {
+ "defaultConfiguration": {
+ "level": "warning"
+ },
+ "fullDescription": {
+ "text": "SQL Injection is a critical vulnerability that can lead to data or system compromise. By\ndynamically generating SQL query strings, user input may be able to influence the logic of\nthe SQL statement. This could lead to an adversary accessing information they should\nnot have access to, or in some circumstances, being able to execute OS functionality or code.\n\nReplace all dynamically generated SQL queries with parameterized queries. In situations where\ndynamic queries must be created, never use direct user input, but instead use a map or\ndictionary of valid values and resolve them using a user supplied key.\n\nFor example, some database drivers do not allow parameterized queries for `>` or `<` comparison\noperators. In these cases, do not use a user supplied `>` or `<` value, but rather have the\nuser\nsupply a `gt` or `lt` value. The alphabetical values are then used to look up the `>` and `<`\nvalues to be used in the construction of the dynamic query. The same goes for other queries\nwhere\ncolumn or table names are required but cannot be parameterized.\n\nExample using `PreparedStatement` queries:\n```\nimport sqlite3\n\n# Create a new database (in memory)\ncon = sqlite3.connect(\":memory:\")\n# Get a cursor from the connection\ncur = con.cursor()\n# Create a tuple of the value to be used in the parameterized query\nparams = ('user-input',)\n# execute the statement, passing in the params for the value\ncur.execute(\"select name from sqlite_master where name = ?\", params)\n# work with the result\nresult = cur.fetchall()\n```\n\nFor more information on SQL Injection see OWASP:\nhttps://cheatsheetseries.owasp.org/cheatsheets/SQL_Injection_Prevention_Cheat_Sheet.html\n"
+ },
+ "id": "bandit.B608",
+ "name": "bandit.B608",
+ "properties": {
+ "precision": "very-high",
+ "tags": [
+ "CWE-89",
+ "OWASP-A1:2017-Injection",
+ "security"
+ ]
+ },
+ "shortDescription": {
+ "text": "Improper neutralization of special elements used in an SQL Command ('SQL Injection')"
+ }
+ },
+ {
+ "defaultConfiguration": {
+ "level": "warning"
+ },
+ "fullDescription": {
+ "text": "The application's `PasswordValidator.RequiredLength` property allows passwords\nto be less than 8 characters. Consider requiring a length of at least 8 or more\ncharacters to reduce the chance of passwords being brute forced.\n\nExample of setting the RequiredLength to 8 in ASP.NET Core Identity:\n```\nbuilder.Services.Configure(options =>\n{\n // Default Password settings.\n options.Password.RequireDigit = true;\n options.Password.RequireLowercase = true;\n options.Password.RequireNonAlphanumeric = true;\n options.Password.RequireUppercase = true;\n options.Password.RequiredLength = 8;\n options.Password.RequiredUniqueChars = 1;\n});\n```\n\nFor more information on configuring ASP.NET Core Identity see:\nhttps://learn.microsoft.com/en-us/aspnet/core/security/authentication/identity-configuration\n"
+ },
+ "id": "security_code_scan.SCS0032-1.SCS0033-1.SCS0034-1",
+ "name": "security_code_scan.SCS0032-1.SCS0033-1.SCS0034-1",
+ "properties": {
+ "precision": "very-high",
+ "tags": [
+ "CWE-521",
+ "security"
+ ]
+ },
+ "shortDescription": {
+ "text": "Weak password requirements"
+ }
+ },
+ {
+ "defaultConfiguration": {
+ "level": "warning"
+ },
+ "fullDescription": {
+ "text": "The application was found using the `xml.etree` package for processing XML.\nPythons default xml processors suffer from various XML parsing vulnerabilities\nand care must be taken when handling XML data. Additionally, depending on the\nversion of Python, more critical vulnerabilities such as eXternal XML Entity\ninjection maybe exploitable.\n\nThe `etree` package suffers from the following security risks as of Python 3.7.1:\n* Billion laughs / exponential entity expansion - May allow an adversary to cause\n a Denial of Service (DoS) against the application parsing arbitrary XML.\n* Quadratic blowup entity expansion - Similar to above, but requires a larger input\n to cause the Denial of Service.\n\nTo remediate the above issues, consider using the\n[defusedxml](https://pypi.org/project/defusedxml/)\nlibrary when processing untrusted XML.\n\nExample parsing an XML document using defusedxml:\n```\nfrom defusedxml.ElementTree import parse\n\n# Parse the inventory.xml file\net = parse('inventory.xml')\n# Get the root element\nroot = et.getroot()\n# Work with the root element\n# ...\n```\n\nFor more information on the various XML parsers and their vulnerabilities please see:\n- https://docs.python.org/3/library/xml.html#xml-vulnerabilities\n\nFor more information on XML security see OWASP's guide:\n-\nhttps://cheatsheetseries.owasp.org/cheatsheets/XML_External_Entity_Prevention_Cheat_Sheet.html#python\n"
+ },
+ "id": "bandit.B313",
+ "name": "bandit.B313",
+ "properties": {
+ "precision": "very-high",
+ "tags": [
+ "CWE-611",
+ "OWASP-A4:2017-XML External Entities (XXE)",
+ "security"
+ ]
+ },
+ "shortDescription": {
+ "text": "Improper restriction of XML external entity reference"
+ }
+ },
+ {
+ "defaultConfiguration": {
+ "level": "note"
+ },
+ "fullDescription": {
+ "text": "Try, Except, Pass\n"
+ },
+ "id": "bandit.B110",
+ "name": "bandit.B110",
+ "properties": {
+ "precision": "very-high",
+ "tags": [
+ "CWE-703",
+ "security"
+ ]
+ },
+ "shortDescription": {
+ "text": "Improper Check or Handling of Exceptional Conditions"
+ }
+ },
+ {
+ "defaultConfiguration": {
+ "level": "warning"
+ },
+ "fullDescription": {
+ "text": "Make sure the program immediately chdir(\"/\"), closes file descriptors, and drops root\nprivileges, and that all necessary files (and no more!) are in the new root.\n"
+ },
+ "id": "flawfinder.chroot-1",
+ "name": "flawfinder.chroot-1",
+ "properties": {
+ "precision": "very-high",
+ "tags": [
+ "CWE-22",
+ "OWASP-A5:2017-Broken Access Control",
+ "security"
+ ]
+ },
+ "shortDescription": {
+ "text": "chroot can be very helpful, but is hard to use correctly (CWE-250, CWE-22)"
+ }
+ },
+ {
+ "defaultConfiguration": {
+ "level": "warning"
+ },
+ "fullDescription": {
+ "text": "The application was found using the `requests` module without configuring a timeout value for\nconnections. This could lead to uncontrolled resource consumption where the application could\nrun out of\nsocket descriptors, effectively causing a Denial of Service (DoS).\n\nTo remediate this issue, pass in a `timeout=` argument to each `requests` call.\n\nExample using a timeout for an HTTP GET request:\n```\n# Issue a GET request to https://example.com with a timeout of 10 seconds\nresponse = requests.get('https://example.com', timeout=10)\n# Work with the response object\n# ...\n```\n\nFor more information on using the requests module see:\n- https://requests.readthedocs.io/en/latest/api/\n"
+ },
+ "id": "bandit.B113",
+ "name": "bandit.B113",
+ "properties": {
+ "precision": "very-high",
+ "tags": [
+ "CWE-400",
+ "security"
+ ]
+ },
+ "shortDescription": {
+ "text": "Uncontrolled resource consumption"
+ }
+ },
+ {
+ "defaultConfiguration": {
+ "level": "warning"
+ },
+ "fullDescription": {
+ "text": "Pysnmp was detected using versions SNMPv1 or SNMPv2. SNPMv1 and SNMPv2 are insecure\nand should no longer be used as they do not offer encryption.\n\nIf possible, query SNMP devices using SNMPv3 instead.\n\nExample querying a device using SNMPv3 with SHA-AES:\n```\nfrom pysnmp.hlapi import *\n# Create the snpm iterator\niterator = getCmd(\n SnmpEngine(),\n # Configure using SHA AES\n UsmUserData('usr-sha-aes', 'authkey1', 'privkey1',\n authProtocol=USM_AUTH_HMAC96_SHA,\n privProtocol=USM_PRIV_CFB128_AES),\n UdpTransportTarget(('demo.snmplabs.com', 161)),\n ContextData(),\n ObjectType(ObjectIdentity('SNMPv2-MIB', 'sysDescr', 0))\n)\n```\n\nFor more information on using SNMPv3 with `Pysnmp` see:\n-\nhttps://pysnmp.readthedocs.io/en/latest/examples/hlapi/v3arch/asyncore/sync/manager/cmdgen/snmp-versions.html#snmpv3-auth-sha-privacy-aes128\n"
+ },
+ "id": "bandit.B508",
+ "name": "bandit.B508",
+ "properties": {
+ "precision": "very-high",
+ "tags": [
+ "CWE-319",
+ "security"
+ ]
+ },
+ "shortDescription": {
+ "text": "Cleartext transmission of sensitive information"
+ }
+ },
+ {
+ "defaultConfiguration": {
+ "level": "error"
+ },
+ "fullDescription": {
+ "text": "The `strecpy` and `streadd` functions require that the destination buffer size be at least\nfour\ntimes the size of the source due to each character potentially becoming a `\\` and 3 digits.\n\nFor more information please see:\nhttps://docs.oracle.com/cd/E18752_01/html/816-5172/streadd-3gen.html\n"
+ },
+ "id": "flawfinder.streadd-1.strecpy-1",
+ "name": "flawfinder.streadd-1.strecpy-1",
+ "properties": {
+ "precision": "very-high",
+ "tags": [
+ "CWE-120",
+ "OWASP-A1:2017-Injection",
+ "security"
+ ]
+ },
+ "shortDescription": {
+ "text": "Insecure string processing functions"
+ }
+ },
+ {
+ "defaultConfiguration": {
+ "level": "error"
+ },
+ "fullDescription": {
+ "text": "A file is opened to write to its contents. The filename comes from an input parameter. If an\nunfiltered parameter is passed to this file API, files at an arbitrary filesystem location\ncould be modified. This rule identifies potential path traversal vulnerabilities. In many\ncases, the constructed file path cannot be controlled by the user.\n"
+ },
+ "id": "find_sec_bugs.PATH_TRAVERSAL_OUT-1",
+ "name": "find_sec_bugs.PATH_TRAVERSAL_OUT-1",
+ "properties": {
+ "precision": "very-high",
+ "tags": [
+ "CWE-22",
+ "security"
+ ]
+ },
+ "shortDescription": {
+ "text": "Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')"
+ }
+ },
+ {
+ "defaultConfiguration": {
+ "level": "warning"
+ },
+ "fullDescription": {
+ "text": "DES, TripleDES, RC2 and RC4 are all considered broken or insecure cryptographic algorithms.\nNewer algorithms apply message integrity to validate ciphertext has not been tampered\nwith. Consider using `ChaCha20Poly1305` instead as it is easier and faster than the\nalternatives such as `AES-256-GCM`.\n\nFor older applications that don't have support for `ChaCha20Poly1305`,\n`AES-256-GCM` is recommended, however it has many drawbacks:\n- Slower than `ChaCha20Poly1305`.\n- Catastrophic failure if nonce values are reused.\n\nExample using `ChaCha20Poly1305`:\n```\nimport os\n# Import ChaCha20Poly1305 from cryptography\nfrom cryptography.hazmat.primitives.ciphers.aead import ChaCha20Poly1305\n# Our plaintext to encrypt\nplain_text = b\"Secret text to encrypt\"\n# We do not require authenticated but unencrypted data, so set to None\naad = None\n# Generate a secure key\nkey = ChaCha20Poly1305.generate_key()\n# Create a new ChaCha20Poly1305 instance with our secure key\nchacha = ChaCha20Poly1305(key)\n# Note: nonce values _must_ be regenerated every time they are used.\nnonce = os.urandom(12)\n# Encrypt our plaintext\ncipher_text = chacha.encrypt(nonce, plain_text, aad)\n# Decrypt the plain text using the nonce and cipher_text\nchacha.decrypt(nonce, cipher_text, aad)\n```\n\nExample using `AESGCM`:\n```\nimport os\n# Import AESGCM from cryptography\nfrom cryptography.hazmat.primitives.ciphers.aead import AESGCM\n# Our plaintext to encrypt\nplain_text = b\"Secret text to encrypt\"\n# We do not require authenticated but unencrypted data, so set to None\naad = None\n# Generate a secure key\nkey = AESGCM.generate_key(bit_length=128)\n# Create a new AESGCM instance with our secure key\naesgcm = AESGCM(key)\n# Note: nonce values _must_ be regenerated every time they are used.\nnonce = os.urandom(12)\n# Encrypt our plaintext\ncipher_text = aesgcm.encrypt(nonce, plain_text, aad)\n# Decrypt the plain text using the nonce and cipher_text\naesgcm.decrypt(nonce, cipher_text, aad)\n```\n\nFor more information on the cryptography module see:\n- https://cryptography.io/en/latest/\n"
+ },
+ "id": "bandit.B304-10",
+ "name": "bandit.B304-10",
+ "properties": {
+ "precision": "very-high",
+ "tags": [
+ "CWE-327",
+ "OWASP-A3:2017-Sensitive Data Exposure",
+ "security"
+ ]
+ },
+ "shortDescription": {
+ "text": "Use of a broken or risky cryptographic algorithm"
+ }
+ },
+ {
+ "defaultConfiguration": {
+ "level": "warning"
+ },
+ "fullDescription": {
+ "text": "The application was found using the `xml.dom.minidom` package for processing XML. Python's\ndefault XML processors suffer from various XML parsing vulnerabilities\nand care must be taken when handling XML data. Additionally, depending on the\nversion of Python, more critical vulnerabilities such as eXternal XML Entity\ninjection maybe exploitable.\n\nThe `xml.dom.minidom` package suffers from the following security risks as of Python 3.7.1:\n* Billion laughs / exponential entity expansion - May allow an adversary to cause\n a Denial of Service (DoS) against the application parsing arbitrary XML.\n* Quadratic blowup entity expansion - Similar to above, but requires a larger input\n to cause the Denial of Service.\n\nTo remediate the above issues, consider using the\n[defusedxml](https://pypi.org/project/defusedxml/)\nlibrary when processing untrusted XML.\n\nExample parsing an XML document using defusedxml:\n```\nfrom defusedxml.ElementTree import parse\n\n# Parse the inventory.xml file\net = parse('inventory.xml')\n# Get the root element\nroot = et.getroot()\n# Work with the root element\n# ...\n```\n\nFor more information on the various XML parsers and their vulnerabilities please see:\n- https://docs.python.org/3/library/xml.html#xml-vulnerabilities\n\nFor more information on XML security see OWASP's guide:\n-\nhttps://cheatsheetseries.owasp.org/cheatsheets/XML_External_Entity_Prevention_Cheat_Sheet.html#python\n"
+ },
+ "id": "bandit.B318",
+ "name": "bandit.B318",
+ "properties": {
+ "precision": "very-high",
+ "tags": [
+ "CWE-611",
+ "OWASP-A4:2017-XML External Entities (XXE)",
+ "security"
+ ]
+ },
+ "shortDescription": {
+ "text": "Improper restriction of XML external entity reference"
+ }
+ },
+ {
+ "defaultConfiguration": {
+ "level": "warning"
+ },
+ "fullDescription": {
+ "text": "Directly decompressing files or buffers may lead to a potential Denial of Service (DoS)\ndue to a decompression bomb. Decompression bombs are maliciously compressed files\nor data that decompresses to extremely large sizes. This can cause the process to run\nout of memory, or the disk to fill up.\n\nTo protect against decompression bombs, an\n[io.LimitReader(...)](https://pkg.go.dev/io#LimitReader)\nshould be used to limit how much can be read during the decompression routine.\n\nExample using `io.LimitReader` to protect against a decompression bomb:\n```\nf, err := os.Open(\"some.gz\")\nif err != nil {\n log.Fatal(err)\n}\n\nr, err := gzip.NewReader(f)\nif err != nil {\n log.Fatal(err)\n}\n\nconst oneMegabyte = 1024 * 1024\nlimitedReader := io.LimitReader(r, oneMegabyte)\n\n// use limitedReader to stop copying after 1 MB\nif _, err := io.Copy(os.Stdout, limitedReader); err != nil {\n log.Fatal(err)\n}\n```\n"
+ },
+ "id": "gosec.G110-1",
+ "name": "gosec.G110-1",
+ "properties": {
+ "precision": "very-high",
+ "tags": [
+ "CWE-409",
+ "security"
+ ]
+ },
+ "shortDescription": {
+ "text": "Improper handling of highly compressed data"
+ }
+ },
+ {
+ "defaultConfiguration": {
+ "level": "error"
+ },
+ "fullDescription": {
+ "text": "The ciphertext produced is susceptible to alteration by an adversary. This mean that the\ncipher provides no way to detect that the data has been tampered with. If the ciphertext can be\ncontrolled by an attacker, it could be altered without detection.\n"
+ },
+ "id": "find_sec_bugs.CIPHER_INTEGRITY-1",
+ "name": "find_sec_bugs.CIPHER_INTEGRITY-1",
+ "properties": {
+ "precision": "very-high",
+ "tags": [
+ "CWE-353",
+ "security"
+ ]
+ },
+ "shortDescription": {
+ "text": "Missing Support for Integrity Check"
+ }
+ },
+ {
+ "defaultConfiguration": {
+ "level": "error"
+ },
+ "fullDescription": {
+ "text": "Cryptographic algorithms provide many different modes of operation, only some of which provide\nmessage integrity. Without message integrity it could be possible for an adversary to attempt\nto tamper with the ciphertext which could lead to compromising the encryption key. Newer\nalgorithms\napply message integrity to validate ciphertext has not been tampered with.\n\nInstead of using an algorithm that requires configuring a cipher mode, an algorithm\nthat has built-in message integrity should be used. Consider using `ChaCha20Poly1305` or\n`AES-256-GCM` instead.\n\nFor older applications that don't have support for `ChaCha20Poly1305`, `AES-256-GCM` is\nrecommended, however it has many drawbacks:\n - Slower than `ChaCha20Poly1305`.\n - Catastrophic failure if nonce values are reused.\n\nExample using `ChaCha20Poly1305`:\n```\npublic encrypt() throws Exception {\n chaChaEncryption(\"Secret text to encrypt\".getBytes(StandardCharsets.UTF_8));\n}\n\npublic SecureRandom getSecureRandomDRBG() throws NoSuchAlgorithmException {\n// Use DRBG according to\nhttp://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-90Ar1.pdf\n return SecureRandom.getInstance(\"DRBG\",\n // Security strength in bits (default is 128)\n DrbgParameters.instantiation(256,\n // Set prediction resistance and re-seeding\n DrbgParameters.Capability.PR_AND_RESEED,\n // Set the personalization string (optional, not necessary)\n \"some_personalization_string\".getBytes()\n )\n );\n}\n\npublic Cipher getChaCha20Poly1305(int mode, byte[] ivKey, byte[] secretKey) throws\nNoSuchAlgorithmException, NoSuchPaddingException, InvalidKeyException,\nInvalidAlgorithmParameterException {\n // Get a DRBG random number generator instance\n SecureRandom random = getSecureRandomDRBG();\n // Create a ChaCha20-Poly1305 cipher instance\n Cipher chaChaCipher = Cipher.getInstance(\"ChaCha20-Poly1305/None/NoPadding\");\n // Create our parameterSpec using our ivKey\n AlgorithmParameterSpec parameterSpec = new IvParameterSpec(ivKey);\n // Create a SecretKeySpec using our secretKey\n SecretKeySpec secretKeySpec = new SecretKeySpec(secretKey, \"ChaCha20\");\n // Initialize and return the cipher for the provided mode\n chaChaCipher.init(mode, secretKeySpec, parameterSpec, random);\n return chaChaCipher;\n}\n\npublic void chaChaEncryption(byte[] plainText) throws NoSuchAlgorithmException,\nNoSuchPaddingException, InvalidKeyException, InvalidAlgorithmParameterException {\n // Get a DRBG random number generator instance\n SecureRandom random = getSecureRandomDRBG();\n // Create secretKey\n byte[] secretKey = new byte[32];\n random.nextBytes(secretKey);\n // Create an IV Key\n byte[] ivKey = new byte[12];\n random.nextBytes(ivKey);\n\n // Create a chaCha encryption cipher instance\n Cipher chaChaEncryptor = getChaCha20Poly1305(Cipher.ENCRYPT_MODE, ivKey, secretKey);\n\n // Encrypt the text using ChaCha20Poly1305\n byte[] cipherText = null;\n try {\n cipherText = chaChaEncryptor.doFinal(plainText);\n } catch (IllegalBlockSizeException | BadPaddingException e) {\n System.out.println(\"failed to encrypt text\");\n return;\n }\n System.out.println(\"encrypted: \" + Base64.getEncoder().encodeToString(cipherText));\n\n // Create a chaCha decryption cipher instance\n Cipher chaChaDecryptor = getChaCha20Poly1305(Cipher.DECRYPT_MODE, ivKey, secretKey);\n\n // Decrypt the text\n byte[] decryptedText = null;\n try {\n decryptedText = chaChaDecryptor.doFinal(cipherText);\n } catch (IllegalBlockSizeException | BadPaddingException e) {\n System.out.println(\"failed to decrypt text\");\n return;\n }\n System.out.println(\"decrypted: \" + new String(decryptedText, StandardCharsets.UTF_8));\n}\n```\n\nFor more information on Java Cryptography see:\nhttps://docs.oracle.com/en/java/javase/15/security/java-cryptography-architecture-jca-reference-guide.html\n"
+ },
+ "id": "find_sec_bugs.CIPHER_INTEGRITY-1",
+ "name": "find_sec_bugs.CIPHER_INTEGRITY-1",
+ "properties": {
+ "precision": "very-high",
+ "tags": [
+ "CWE-327",
+ "security"
+ ]
+ },
+ "shortDescription": {
+ "text": "Use of a broken or risky cryptographic algorithm"
+ }
+ },
+ {
+ "defaultConfiguration": {
+ "level": "note"
+ },
+ "fullDescription": {
+ "text": "Starting a process with a shell; seems safe, but may be changed in the future, consider\nrewriting without shell\n"
+ },
+ "id": "bandit.B607",
+ "name": "bandit.B607",
+ "properties": {
+ "precision": "very-high",
+ "tags": [
+ "CWE-78",
+ "OWASP-A1:2017-Injection",
+ "security"
+ ]
+ },
+ "shortDescription": {
+ "text": "Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')"
+ }
+ },
+ {
+ "defaultConfiguration": {
+ "level": "warning"
+ },
+ "fullDescription": {
+ "text": "The method identified is susceptible to injection. The input should be validated and properly\nescaped.\n"
+ },
+ "id": "find_sec_bugs.CUSTOM_INJECTION-1",
+ "name": "find_sec_bugs.CUSTOM_INJECTION-1",
+ "properties": {
+ "precision": "very-high",
+ "tags": [
+ "CWE-89",
+ "security"
+ ]
+ },
+ "shortDescription": {
+ "text": "Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')"
+ }
+ },
+ {
+ "defaultConfiguration": {
+ "level": "warning"
+ },
+ "fullDescription": {
+ "text": "SQL Injection is a critical vulnerability that can lead to data or system compromise. By\ndynamically generating SQL query strings, user input may be able to influence the logic of\nthe SQL statement. This could lead to an adversary accessing information they should\nnot have access to, or in some circumstances, being able to execute OS functionality or code.\n\nReplace all dynamically generated SQL queries with parameterized queries. In situations where\ndynamic queries must be created, never use direct user input, but instead use a map or\ndictionary of valid values and resolve them using a user-supplied key.\n\nFor example, some database drivers do not allow parameterized queries for `>` or `<` comparison\noperators. In these cases, do not use a user supplied `>` or `<` value, but rather have the\nuser\nsupply a `gt` or `lt` value. The alphabetical values are then used to look up the `>` and `<`\nvalues to be used in the construction of the dynamic query. The same goes for other queries\nwhere\ncolumn or table names are required but cannot be parameterized.\n\nExample using `PreparedStatement` queries:\n```\n// Some userInput\nString userInput = \"someUserInput\";\n// Your connection string\nString url = \"...\";\n// Get a connection from the DB via the DriverManager\nConnection conn = DriverManager.getConnection(url);\n// Create a prepared statement\nPreparedStatement st = conn.prepareStatement(\"SELECT name FROM table where name=?\");\n// Set each parameters value by the index (starting from 1)\nst.setString(1, userInput);\n// Execute query and get the result set\nResultSet rs = st.executeQuery();\n// Iterate over results\nwhile (rs.next()) {\n // Get result for this row at the provided column number (starting from 1)\n String result = rs.getString(1);\n // ...\n}\n// Close the ResultSet\nrs.close();\n// Close the PreparedStatement\nst.close();\n```\n\nFor more information on SQL Injection see OWASP:\nhttps://cheatsheetseries.owasp.org/cheatsheets/SQL_Injection_Prevention_Cheat_Sheet.html\n"
+ },
+ "id": "find_sec_bugs.CUSTOM_INJECTION-1",
+ "name": "find_sec_bugs.CUSTOM_INJECTION-1",
+ "properties": {
+ "precision": "very-high",
+ "tags": [
+ "CWE-89",
+ "security"
+ ]
+ },
+ "shortDescription": {
+ "text": "Improper neutralization of special elements used in an SQL command ('SQL Injection')"
+ }
+ },
+ {
+ "defaultConfiguration": {
+ "level": "warning"
+ },
+ "fullDescription": {
+ "text": "The application was found using `cPickle` which is vulnerable to deserialization attacks.\nDeserialization attacks exploit the process of reading serialized data and turning it back\ninto an object. By constructing malicious objects and serializing them, an adversary may\nattempt to:\n\n- Inject code that is executed upon object construction, which occurs during the\ndeserialization process.\n- Exploit mass assignment by including fields that are not normally a part of the serialized\ndata but are read in during deserialization.\n\nConsider safer alternatives such as serializing data in the JSON format. Ensure any format\nchosen allows\nthe application to specify exactly which object types are allowed to be deserialized.\n\nTo protect against mass assignment, only allow deserialization of the specific fields that are\nrequired. If this is not easily done, consider creating an intermediary type that\ncan be serialized with only the necessary fields exposed.\n\nExample JSON deserializer using an intermediary type that is validated against a schema to\nensure\nit is safe from mass assignment:\n```\nimport jsonschema\n\n# Create a schema to validate our user-supplied input against\n# an intermediary object\nintermediary_schema = {\n \"type\" : \"object\",\n \"properties\" : {\n \"name\": {\"type\" : \"string\"}\n },\n \"required\": [\"name\"],\n # Protect against random properties being added to the object\n \"additionalProperties\": False,\n}\n# If a user attempted to add \"'is_admin': True\" it would cause a validation error\nintermediary_object = {'name': 'test user'}\n\ntry:\n # Validate the user supplied intermediary object against our schema\n jsonschema.validate(instance=intermediary_object, schema=intermediary_schema)\n user_object = {'user':\n {\n # Assign the deserialized data from intermediary object\n 'name': intermediary_object['name'],\n # Add in protected data in object definition (or set it from a class constructor)\n 'is_admin': False,\n }\n }\n # Work with the user_object\nexcept jsonschema.exceptions.ValidationError as ex:\n # Gracefully handle validation errors\n # ...\n```\n\nFor more details on deserialization attacks in general, see OWASP's guide:\n- https://cheatsheetseries.owasp.org/cheatsheets/Deserialization_Cheat_Sheet.html\n"
+ },
+ "id": "bandit.B301-2",
+ "name": "bandit.B301-2",
+ "properties": {
+ "precision": "very-high",
+ "tags": [
+ "CWE-502",
+ "OWASP-A8:2017-Insecure Deserialization",
+ "security"
+ ]
+ },
+ "shortDescription": {
+ "text": "Deserialization of untrusted data"
+ }
+ },
+ {
+ "defaultConfiguration": {
+ "level": "warning"
+ },
+ "fullDescription": {
+ "text": "A HostnameVerifier that accept any host are often use because of certificate\nreuse on many hosts. As a consequence, this is vulnerable to Man-in-the-middle\nattacks since the client will trust any certificate.\n"
+ },
+ "id": "find_sec_bugs.WEAK_HOSTNAME_VERIFIER-1.WEAK_TRUST_MANAGER-1",
+ "name": "find_sec_bugs.WEAK_HOSTNAME_VERIFIER-1.WEAK_TRUST_MANAGER-1",
+ "properties": {
+ "precision": "very-high",
+ "tags": [
+ "CWE-295",
+ "security"
+ ]
+ },
+ "shortDescription": {
+ "text": "Improper Certificate Validation"
+ }
+ },
+ {
+ "defaultConfiguration": {
+ "level": "warning"
+ },
+ "fullDescription": {
+ "text": "Either the `HostnameVerifier` has been set to always return `true` or the `X509TrustManager`\nhas\nbeen configured to return null, or both. This effectively disables the validation of server or\nclient certificates.\n\nThis allows for an adversary who is in between the application and the target host to intercept\npotentially sensitive information or transmit malicious data.\n\nIt is recommended to not override the default `HostnameVerifiers`.\n\nConsider using the default `TrustManager` instead of implementing a custom one. If you must\noverride\nthe default verification process, implement proper TrustManager verification for\n`checkServerTrusted` and\n`checkClientTrusted` by throwing `CertificateException` if the certificate is invalid.\n\nExample using the built in `TrustManagerFactory` to manage validating certificate chains:\n```\n// Use the default TrustManagerFactory\nTrustManagerFactory trustManagerFactory =\nTrustManagerFactory.getInstance(TrustManagerFactory.getDefaultAlgorithm());\n// Use default system KeyStore, alternatively pass in your own keystore.\ntrustManagerFactory.init((KeyStore) null);\n// Create SSLContext for TLS connections\nSSLContext tlsContext = SSLContext.getInstance(\"TLS\");\n// Initialize the tlsContext with our trust manager and a SecureRandom number generator.\ntlsContext.init(null, trustManagerFactory.getTrustManagers(), new SecureRandom());\n```\n\nFor more information on TLS security see OWASP:\nhttps://cheatsheetseries.owasp.org/cheatsheets/Transport_Layer_Protection_Cheat_Sheet.html\n"
+ },
+ "id": "find_sec_bugs.WEAK_HOSTNAME_VERIFIER-1.WEAK_TRUST_MANAGER-1",
+ "name": "find_sec_bugs.WEAK_HOSTNAME_VERIFIER-1.WEAK_TRUST_MANAGER-1",
+ "properties": {
+ "precision": "very-high",
+ "tags": [
+ "CWE-295",
+ "security"
+ ]
+ },
+ "shortDescription": {
+ "text": "Improper certificate validation"
+ }
+ },
+ {
+ "defaultConfiguration": {
+ "level": "note"
+ },
+ "fullDescription": {
+ "text": "Perform bounds checking, use functions that limit length, or ensure that the size is larger\nthan the maximum possible length.\n"
+ },
+ "id": "flawfinder.char-1.TCHAR-1.wchar_t-1",
+ "name": "flawfinder.char-1.TCHAR-1.wchar_t-1",
+ "properties": {
+ "precision": "very-high",
+ "tags": [
+ "CWE-120",
+ "OWASP-A1:2017-Injection",
+ "security"
+ ]
+ },
+ "shortDescription": {
+ "text": "Statically-sized arrays can be improperly restricted, leading to potential overflows or other issues (CWE-119!/CWE-120)"
+ }
+ },
+ {
+ "defaultConfiguration": {
+ "level": "note"
+ },
+ "fullDescription": {
+ "text": "The `memalign` function may not check that the alignment argument is correct. Calling\nfree (on non Linux-based systems) may fail and in certain circumstances this failure\nmay be exploitable. This function has been deprecated in favor of `posix_memalign`.\n\nFor more information please see: https://linux.die.net/man/3/memalign\n"
+ },
+ "id": "flawfinder.memalign-1",
+ "name": "flawfinder.memalign-1",
+ "properties": {
+ "precision": "very-high",
+ "tags": [
+ "CWE-676",
+ "OWASP-A1:2017-Injection",
+ "security"
+ ]
+ },
+ "shortDescription": {
+ "text": "Use of deprecated function (memalign)"
+ }
+ },
+ {
+ "defaultConfiguration": {
+ "level": "warning"
+ },
+ "fullDescription": {
+ "text": "DefaultHttpClient with default constructor is not compatible with TLS 1.2\n"
+ },
+ "id": "find_sec_bugs.DEFAULT_HTTP_CLIENT-1",
+ "name": "find_sec_bugs.DEFAULT_HTTP_CLIENT-1",
+ "properties": {
+ "precision": "very-high",
+ "tags": [
+ "CWE-326",
+ "security"
+ ]
+ },
+ "shortDescription": {
+ "text": "Inadequate encryption strength"
+ }
+ },
+ {
+ "defaultConfiguration": {
+ "level": "error"
+ },
+ "fullDescription": {
+ "text": "The filename provided by the FileUpload API can be tampered with by the client to reference\nunauthorized files. The provided filename should be properly validated to ensure it's properly\nstructured, contains no unauthorized path characters (e.g., / \\), and refers to an authorized\nfile.\n"
+ },
+ "id": "find_sec_bugs.FILE_UPLOAD_FILENAME-1",
+ "name": "find_sec_bugs.FILE_UPLOAD_FILENAME-1",
+ "properties": {
+ "precision": "very-high",
+ "tags": [
+ "CWE-22",
+ "security"
+ ]
+ },
+ "shortDescription": {
+ "text": "Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')"
+ }
+ },
+ {
+ "defaultConfiguration": {
+ "level": "warning"
+ },
+ "fullDescription": {
+ "text": "Avoid using XMLDecoder to parse content from an untrusted source.\n"
+ },
+ "id": "find_sec_bugs.XML_DECODER-1",
+ "name": "find_sec_bugs.XML_DECODER-1",
+ "properties": {
+ "precision": "very-high",
+ "tags": [
+ "CWE-502",
+ "security"
+ ]
+ },
+ "shortDescription": {
+ "text": "Deserialization of Untrusted Data"
+ }
+ },
+ {
+ "defaultConfiguration": {
+ "level": "warning"
+ },
+ "fullDescription": {
+ "text": "DefaultHttpClient with default constructor is not compatible with TLS 1.2\n"
+ },
+ "id": "find_sec_bugs.DEFAULT_HTTP_CLIENT-1",
+ "name": "find_sec_bugs.DEFAULT_HTTP_CLIENT-1",
+ "properties": {
+ "precision": "very-high",
+ "tags": [
+ "CWE-326",
+ "security"
+ ]
+ },
+ "shortDescription": {
+ "text": "Inadequate encryption strength"
+ }
+ },
+ {
+ "defaultConfiguration": {
+ "level": "error"
+ },
+ "fullDescription": {
+ "text": "The filename provided by the FileUpload API can be tampered with by the client to reference\nunauthorized files. The provided filename should be properly validated to ensure it's properly\nstructured, contains no unauthorized path characters (e.g., / \\), and refers to an authorized\nfile.\n"
+ },
+ "id": "find_sec_bugs.FILE_UPLOAD_FILENAME-1",
+ "name": "find_sec_bugs.FILE_UPLOAD_FILENAME-1",
+ "properties": {
+ "precision": "very-high",
+ "tags": [
+ "CWE-22",
+ "security"
+ ]
+ },
+ "shortDescription": {
+ "text": "Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')"
+ }
+ },
+ {
+ "defaultConfiguration": {
+ "level": "warning"
+ },
+ "fullDescription": {
+ "text": "Deserialization attacks exploit the process of reading serialized data and turning it back\ninto an object. By constructing malicious objects and serializing them, an adversary may\nattempt to:\n\n- Inject code that is executed upon object construction, which occurs during the\ndeserialization process.\n- Exploit mass assignment by including fields that are not normally a part of the serialized\ndata but are read in during deserialization.\n\nConsider safer alternatives such as serializing data in the JSON format. Ensure any format\nchosen allows\nthe application to specify exactly which object types are allowed to be deserialized.\nAdditionally, when\ndeserializing, never deserialize to base object types like `Object` and only cast to the exact\nobject\ntype that is expected.\n\nTo protect against mass assignment, only allow deserialization of the specific fields that are\nrequired. If this is not easily done, consider creating an intermediary type that\ncan be serialized with only the necessary fields exposed.\n\nDo note that `XMLEncoder` and `XMLDecoder` are not recommended. If the application must\nuse this serialization method, use a custom ClassLoader to prevent loading of arbitrary\nclasses:\n```\nXMLDecoder decoder = new XMLDecoder(inputStream, null, null, new ClassLoader() {\n @Override\n protected Class loadClass(String name, boolean resolve) throws ClassNotFoundException {\n if (!name.equals(NameOfBeanHere.class.getName()) &&\n!name.equals(XMLDecoder.class.getName())) {\n throw new RuntimeException(\"Unauthorized deserialization attempt: \" + name);\n }\n\n throw new ClassNotFoundException(name);\n }\n});\n```\n\nFor more information on XML security see OWASP's guide:\nhttps://cheatsheetseries.owasp.org/cheatsheets/XML_External_Entity_Prevention_Cheat_Sheet.html#java\n\nFor more details on deserialization attacks in general, see OWASP's guide:\nhttps://cheatsheetseries.owasp.org/cheatsheets/Deserialization_Cheat_Sheet.html\n\nIt should be noted that [tools exist](https://github.com/frohoff/ysoserial) to\nautomatically create\nexploit code for these vulnerabilities.\n"
+ },
+ "id": "find_sec_bugs.XML_DECODER-1",
+ "name": "find_sec_bugs.XML_DECODER-1",
+ "properties": {
+ "precision": "very-high",
+ "tags": [
+ "CWE-502",
+ "security"
+ ]
+ },
+ "shortDescription": {
+ "text": "Deserialization of untrusted data"
+ }
+ },
+ {
+ "defaultConfiguration": {
+ "level": "error"
+ },
+ "fullDescription": {
+ "text": "Server identity verification is disabled when making SSL connections.\n"
+ },
+ "id": "find_sec_bugs.INSECURE_SMTP_SSL-1",
+ "name": "find_sec_bugs.INSECURE_SMTP_SSL-1",
+ "properties": {
+ "precision": "very-high",
+ "tags": [
+ "CWE-297",
+ "security"
+ ]
+ },
+ "shortDescription": {
+ "text": "Improper Validation of Certificate with Host Mismatch"
+ }
+ },
+ {
+ "defaultConfiguration": {
+ "level": "warning"
+ },
+ "fullDescription": {
+ "text": "A small key size makes the ciphertext vulnerable to brute force attacks. At least 128 bits of\nentropy should be used when generating the key if use of Blowfish is required.\n"
+ },
+ "id": "find_sec_bugs.BLOWFISH_KEY_SIZE-1",
+ "name": "find_sec_bugs.BLOWFISH_KEY_SIZE-1",
+ "properties": {
+ "precision": "very-high",
+ "tags": [
+ "CWE-326",
+ "security"
+ ]
+ },
+ "shortDescription": {
+ "text": "Inadequate Encryption Strength"
+ }
+ },
+ {
+ "defaultConfiguration": {
+ "level": "warning"
+ },
+ "fullDescription": {
+ "text": "The Blowfish encryption algorithm was meant as a drop-in replacement for DES and was created in\n1993. Smaller key sizes may make the ciphertext vulnerable to [birthday\nattacks](https://en.wikipedia.org/wiki/Birthday_attack). While no known attacks against\nBlowfish\nexist, it should never be used to encrypt files over 4GB in size. If possible consider\nusing AES as the instance of `KeyGenerator` instead of Blowfish.\n\nTo remediate the small key size, pass a value such as 256 to the `KeyGenerator.init(keySize)`\nmethod.\n\nExample setting a larger key size and changing to `KeyGenerator` to AES:\n```\npublic static void aesKeyGenerator() throws java.security.NoSuchAlgorithmException {\n // Use the AES algorithm for key generation\n KeyGenerator keyGenerator = KeyGenerator.getInstance(\"AES\");\n\n // Set the key size here\n keyGenerator.init(256);\n\n // get the raw bytes of the key\n byte[] key = keyGenerator.generateKey().getEncoded();\n\n // pass the key bytes to create a SecretKeySpec\n SecretKeySpec secretKeySpec = new SecretKeySpec(key, \"AES\");\n}\n```\n\nExample setting a larger key size for Blowfish:\n```\npublic static void blowFishKeyGenerator() throws java.security.NoSuchAlgorithmException {\n // Use the Blowfish algorithm for key generation\n KeyGenerator keyGenerator = KeyGenerator.getInstance(\"Blowfish\");\n\n // Set the key size here\n keyGenerator.init(256);\n\n // get the raw bytes of the key\n byte[] key = keyGenerator.generateKey().getEncoded();\n\n // pass the key bytes to create a SecretKeySpec\n SecretKeySpec secretKeySpec = new SecretKeySpec(key, \"Blowfish\");\n}\n```\n\nFor more information on Java Cryptography see:\nhttps://docs.oracle.com/en/java/javase/15/security/java-cryptography-architecture-jca-reference-guide.html\n"
+ },
+ "id": "find_sec_bugs.BLOWFISH_KEY_SIZE-1",
+ "name": "find_sec_bugs.BLOWFISH_KEY_SIZE-1",
+ "properties": {
+ "precision": "very-high",
+ "tags": [
+ "CWE-326",
+ "security"
+ ]
+ },
+ "shortDescription": {
+ "text": "Inadequate encryption strength"
+ }
+ },
+ {
+ "defaultConfiguration": {
+ "level": "error"
+ },
+ "fullDescription": {
+ "text": "The Apache commons mail client by default does not enable TLS server identity.\nThis allows for an adversary who is in between the application and the target host to intercept\npotentially sensitive information or transmit malicious data.\n\nEnable checking server identity by calling `Email.setSSLCheckServerIdentity(true)`\n\nExample email client that enables TLS and server identity:\n```\n// Create an email client\nEmail email = new SimpleEmail();\n// Configure the email hostname\nemail.setHostName(\"smtp.mail.example.com\");\n// Set the port\nemail.setSmtpPort(465);\n// Securely retrieve username and password values\nString username = getUserNameFromKMSorSecretStore();\nString password = getPasswordFromKMSorSecretStore();\n// Configure the Authenticator\nDefaultAuthenticator auth = new DefaultAuthenticator(username, password);\n// Set the authenticator\nemail.setAuthenticator(auth);\n// Ensure we use SSL on connect\nemail.setSSLOnConnect(true);\n// Ensure we validate server identity\nemail.setSSLCheckServerIdentity(true);\n// configure the rest of the email\nemail.setFrom(\"x@example.com\");\nemail.setSubject(\"TestMail\");\nemail.setMsg(\"This is a test mail ... :-)\");\nemail.addTo(\"y@example.com\");\nemail.send();\n```\n"
+ },
+ "id": "find_sec_bugs.INSECURE_SMTP_SSL-1",
+ "name": "find_sec_bugs.INSECURE_SMTP_SSL-1",
+ "properties": {
+ "precision": "very-high",
+ "tags": [
+ "CWE-297",
+ "security"
+ ]
+ },
+ "shortDescription": {
+ "text": "Improper validation of certificate with host mismatch"
+ }
+ },
+ {
+ "defaultConfiguration": {
+ "level": "error"
+ },
+ "fullDescription": {
+ "text": "The application was detected importing `pycrypto`. This package has been deprecated as it\ncontains\nsecurity vulnerabilities.\n\nTo remediate this issue, consider using the [cryptography](https://cryptography.io/)\npackage instead.\n"
+ },
+ "id": "bandit.B413",
+ "name": "bandit.B413",
+ "properties": {
+ "precision": "very-high",
+ "tags": [
+ "CWE-1104",
+ "OWASP-A9:2017-Using Components with Known Vulnerabilities",
+ "security"
+ ]
+ },
+ "shortDescription": {
+ "text": "Use of unmaintained third party components"
+ }
+ },
+ {
+ "defaultConfiguration": {
+ "level": "note"
+ },
+ "fullDescription": {
+ "text": "This method is part of a SOAP Web Service (JSR224). The security of this web service should be\nanalyzed. For example:\n- Authentication, if enforced, should be tested.\n- Access control, if enforced, should be tested.\n- The inputs should be tracked for potential vulnerabilities.\n- The communication should ideally be over SSL.\n"
+ },
+ "id": "find_sec_bugs.JAXWS_ENDPOINT-1",
+ "name": "find_sec_bugs.JAXWS_ENDPOINT-1",
+ "properties": {
+ "precision": "very-high",
+ "tags": [
+ "CWE-20",
+ "OWASP-A7:2017-Cross-Site Scripting (XSS)",
+ "security"
+ ]
+ },
+ "shortDescription": {
+ "text": "Improper Input Validation"
+ }
+ },
+ {
+ "defaultConfiguration": {
+ "level": "note"
+ },
+ "fullDescription": {
+ "text": "This method is part of a SOAP Web Service (JSR224). The security of this web service should be\nanalyzed; Authentication, if enforced, should be tested. Access control, if enforced, should be\ntested. The inputs should be tracked for potential vulnerabilities. The communication should\nideally be over SSL.\n"
+ },
+ "id": "find_sec_bugs.JAXWS_ENDPOINT-1",
+ "name": "find_sec_bugs.JAXWS_ENDPOINT-1",
+ "properties": {
+ "precision": "very-high",
+ "tags": [
+ "CWE-20",
+ "OWASP-A7:2017-Cross-Site Scripting (XSS)",
+ "security"
+ ]
+ },
+ "shortDescription": {
+ "text": "Improper Input Validation"
+ }
+ },
+ {
+ "defaultConfiguration": {
+ "level": "warning"
+ },
+ "fullDescription": {
+ "text": "The `LoadLibraryEx` function is used to load DLLs dynamically. Depending on the filepath\nparameter,\nthe OS version, and the modes set for the process prior to calling LoadLibrary, DLL hijacking\nmay\nbe possible. Attackers can exploit this by placing DLL files with the same name in directories\nthat\nare searched before the legitimate DLL is.\n\nTo assist in preventing against this class of vulnerability consider:\n- Specifying a fully qualified path when using LoadLibraryEx.\n- Use the `LOAD_LIBRARY_SEARCH` flags with LoadLibraryEx or with SetDefaultDllDirectories.\n- If you use SetDefaultDllDirectories, be sure to use the AddDllDirectory or SetDllDirectory\n functions to modify the list of directories.\n- Only use `SearchPath` if the `SetSearchPathMode` function is called with\n `BASE_SEARCH_PATH_ENABLE_SAFE_SEARCHMODE`. (Note: this only moves the current directory to\n the end of the SearchPath search list.)\n\nFor more information see the security remarks section of the MSDN documentation:\nhttps://learn.microsoft.com/en-us/windows/win32/api/libloaderapi/nf-libloaderapi-loadlibrarya#security-remarks\n\nFor general information securely loading dynamic link libraries, see the MSDN documentation:\nhttps://learn.microsoft.com/en-us/windows/win32/dlls/dynamic-link-library-security\n"
+ },
+ "id": "flawfinder.LoadLibraryEx-1",
+ "name": "flawfinder.LoadLibraryEx-1",
+ "properties": {
+ "precision": "very-high",
+ "tags": [
+ "CWE-20",
+ "OWASP-A1:2017-Injection",
+ "security"
+ ]
+ },
+ "shortDescription": {
+ "text": "Potential for DLL hijacking (LoadLibraryEx)"
+ }
+ },
+ {
+ "defaultConfiguration": {
+ "level": "error"
+ },
+ "fullDescription": {
+ "text": "When data from an untrusted source is put into a logger and not neutralized correctly, an\nattacker could forge log entries or include malicious content. Inserted false entries could be\nused to skew statistics, distract the administrator or even to implicate another party in the\ncommission of a malicious act. If the log file is processed automatically, the attacker can\nrender the file unusable by corrupting the format of the file or injecting unexpected\ncharacters. An attacker may also inject code or other commands into the log file and take\nadvantage of a vulnerability in the log processing utility (e.g. command injection or XSS).\n"
+ },
+ "id": "find_sec_bugs.CRLF_INJECTION_LOGS-1",
+ "name": "find_sec_bugs.CRLF_INJECTION_LOGS-1",
+ "properties": {
+ "precision": "very-high",
+ "tags": [
+ "CWE-93",
+ "security"
+ ]
+ },
+ "shortDescription": {
+ "text": "Improper Neutralization of CRLF Sequences ('CRLF Injection')"
+ }
+ },
+ {
+ "defaultConfiguration": {
+ "level": "error"
+ },
+ "fullDescription": {
+ "text": "The application was found to take data from user input and output it into a logger method.\nWhen data from\nan untrusted source is sent to a logger without validation, an attacker could forge log\nentries\nor include malicious content. If the log file is processed automatically, the attacker can\nrender the file unusable by corrupting the format of the file or injecting unexpected\ncharacters. An attacker may also inject code or other commands into the log file and take\nadvantage of a vulnerability in the log processing utility (e.g. command injection or XSS).\n\nTo mitigate this issue, encode values that come from user input with a package such as\n[Apache Commons Text](https://commons.apache.org/proper/commons-text/) to escape the input:\n```\npublic String escapeValue(String value) {\n return StringEscapeUtils.escapeJava(value);\n}\n```\n\nFor more information on log injection see OWASP:\nhttps://owasp.org/www-community/attacks/Log_Injection\n"
+ },
+ "id": "find_sec_bugs.CRLF_INJECTION_LOGS-1",
+ "name": "find_sec_bugs.CRLF_INJECTION_LOGS-1",
+ "properties": {
+ "precision": "very-high",
+ "tags": [
+ "CWE-93",
+ "security"
+ ]
+ },
+ "shortDescription": {
+ "text": "Improper neutralization of CRLF sequences ('CRLF Injection')"
+ }
+ },
+ {
+ "defaultConfiguration": {
+ "level": "warning"
+ },
+ "fullDescription": {
+ "text": "The application was found using an FTP library. As FTP does not provide encryption, it is\nstrongly recommended that any file transfers be done over a more secure transport such as\nSSH.\n\nThe [paramiko](https://www.paramiko.org/) library can be used with an SCP module to allow\nsecure file transfers.\n\nExample using `paramiko` SSH client and the `scp` module:\n```\nimport paramiko\nimport scp\n\n# Create an SSH client\nwith paramiko.SSHClient() as ssh:\n # Load the system host keys so we can confirm the\n # host we are connecting to is legitimate\n ssh.load_system_host_keys('/home/appuser/.ssh/known_hosts')\n\n # Connect to the remote host using our SSH private key\n ssh.connect(hostname='example.org',\n port=22,\n username='appuser',\n key_filename='/home/appuser/.ssh/private_key')\n\n # Create an SCP client with the ssh transport and copy files\n with scp.SCPClient(ssh.get_transport()) as secure_copy:\n secure_copy.get('remote/test.file', 'local/test.file')\n secure_copy.put('local/some.file', 'remote/some.file')\n```\n\nFor more information on the paramiko module see:\n- https://www.paramiko.org/\n\nFor more information on the scp module see:\n- https://github.com/jbardin/scp.py\n"
+ },
+ "id": "bandit.B321",
+ "name": "bandit.B321",
+ "properties": {
+ "precision": "very-high",
+ "tags": [
+ "CWE-319",
+ "OWASP-A3:2017-Sensitive Data Exposure",
+ "security"
+ ]
+ },
+ "shortDescription": {
+ "text": "Cleartext transmission of sensitive information"
+ }
+ },
+ {
+ "defaultConfiguration": {
+ "level": "error"
+ },
+ "fullDescription": {
+ "text": "Golang's `int` type size depends on the architecture of where the application is running. For\n32-bit systems, `int` is\n32-bit, for 64-bit systems, `int` will be 64-bit. By calling `strconv.Atoi` with a large\nnumber, the integer may overflow\nif the `int` return value is type converted into a smaller type (`int32` or `int16`). This\ncould cause unexpected application\nbehavior depending on how the resultant value is used.\n\nPrior to running any type conversion, check that the value returned from `strconv.Atoi` will\nfit in the resulting integer.\n\nExample of checking the return value before type conversion:\n```\nbigValue, _ := strconv.Atoi(\"32768\")\nif bigValue > math.MaxInt16 {\n log.Fatal(\"value too large to fit in int16\")\n}\nvalue := int16(bigValue)\nfmt.Println(value)\n```\n\nFor more information on integer min/max constants see: https://pkg.go.dev/math#pkg-constants\n"
+ },
+ "id": "gosec.G109-1",
+ "name": "gosec.G109-1",
+ "properties": {
+ "precision": "very-high",
+ "tags": [
+ "CWE-190",
+ "security"
+ ]
+ },
+ "shortDescription": {
+ "text": "Integer overflow or wraparound"
+ }
+ },
+ {
+ "defaultConfiguration": {
+ "level": "warning"
+ },
+ "fullDescription": {
+ "text": "Just like SQL, all inputs passed to an LDAP query need to be passed in safely. Unfortunately,\nLDAP doesn't have prepared statement interfaces like SQL. Therefore, the primary defense\nagainst LDAP injection is strong input validation of any untrusted data before including it in\nan LDAP query.\n"
+ },
+ "id": "find_sec_bugs.LDAP_INJECTION-1",
+ "name": "find_sec_bugs.LDAP_INJECTION-1",
+ "properties": {
+ "precision": "very-high",
+ "tags": [
+ "CWE-90",
+ "security"
+ ]
+ },
+ "shortDescription": {
+ "text": "Improper Neutralization of Special Elements used in an LDAP Query ('LDAP Injection')"
+ }
+ },
+ {
+ "defaultConfiguration": {
+ "level": "warning"
+ },
+ "fullDescription": {
+ "text": "LDAP injection attacks exploit LDAP queries to influence how data is returned by\nthe LDAP server.\n\nLater versions of Java's `InitialDirContext.search` introduced a four argument method, one of\nwhich is the `filterArg` parameter. The `filterArg` will be automatically encoded when\nquerying\nthe LDAP server. If this method signature is not available, the application must encode the\nLDAP strings manually.\n\nMore details on the four argument `search` method can be found here:\nhttps://docs.oracle.com/en/java/javase/20/docs/api/java.naming/javax/naming/directory/InitialDirContext.html#search(javax.naming.Name,java.lang.String,java.lang.Object[],javax.naming.directory.SearchControls)\n\nTo encode the string manually, it is recommended that all input passed to LDAP querying\nsystems\nencode the following values:\n\n- Any occurrence of the null character must be escaped as \u201c\\00\u201d.\n- Any occurrence of the open parenthesis character must be escaped as \u201c\\28\u201d.\n- Any occurrence of the close parenthesis character must be escaped as \u201c\\29\u201d.\n- Any occurrence of the asterisk character must be escaped as \u201c\\2a\u201d.\n- Any occurrence of the backslash character must be escaped as \u201c\\5c\u201d.\n\nExample function that safely encodes user-supplied input to be used in an LDAP query.\n```\npublic static String encodeLDAPString(String input) {\n // Note the \\ character is replaced first\n CharSequence[] chars = new CharSequence[] { \"\\\\\", \"\\0\", \"(\", \")\", \"*\" };\n CharSequence[] encoded = new CharSequence[] { \"\\\\5c\", \"\\\\00\", \"\\\\28\", \"\\\\29\", \"\\\\2a\" };\n // Iterate over each character sequence, replacing the raw value with an encoded version of\nit\n for (int i = 0; i < chars.length; i++)\n {\n // re-assign to input\n input = input.replace(chars[i], encoded[i]);\n }\n // return our modified input string\n return input;\n}\n```\n\nExample code that using the `filterArgs` parameter which automatically encodes for us:\n```\n// Create a properties to hold the ldap connection details\nProperties props = new Properties();\n// Use the com.sun.jndi.ldap.LdapCtxFactory factory provider\nprops.put(Context.INITIAL_CONTEXT_FACTORY, \"com.sun.jndi.ldap.LdapCtxFactory\");\n// The LDAP server URL\nprops.put(Context.PROVIDER_URL, \"ldap://ldap.example.org:3889\");\n// User details for the connection\nprops.put(Context.SECURITY_PRINCIPAL, \"cn=admin,dc=example,dc=org\");\n// LDAP account password\nString ldapAccountPassword = getAccountPasswordFromSecureStoreOrKMS();\n// Pass in the LDAP password\nprops.put(Context.SECURITY_CREDENTIALS, ldapAccountPassword);\n\n// Create the LDAPContext\nInitialDirContext ldapContext = new InitialDirContext(props);\n// Example using SUBTREE_SCOPE SearchControls\nSearchControls searchControls = new SearchControls();\nsearchControls.setSearchScope(SearchControls.SUBTREE_SCOPE);\n\n// Get user input for query\nString userQuery = someUserInput;\n// Use searchArguments to hold the user-supplied input\nObject[] searchArguments = new Object[]{userQuery};\n// Hardcode the BaseDN, use the {0} format specifier to use the searchArguments array value,\nand pass in the search controls.\n// searchArguments automatically encode\nNamingEnumeration answer = ldapContext.search(\"dc=example,dc=org\", \"(cn={0})\",\nsearchArguments, searchControls);\n// Process the response answer\nwhile (answer.hasMoreElements()) {\n ...\n}\n```\n\nFor more information on LDAP Injection see OWASP:\nhttps://cheatsheetseries.owasp.org/cheatsheets/LDAP_Injection_Prevention_Cheat_Sheet.html\n"
+ },
+ "id": "find_sec_bugs.LDAP_INJECTION-1",
+ "name": "find_sec_bugs.LDAP_INJECTION-1",
+ "properties": {
+ "precision": "very-high",
+ "tags": [
+ "CWE-90",
+ "security"
+ ]
+ },
+ "shortDescription": {
+ "text": "Improper neutralization of special elements used in an LDAP query ('LDAP Injection')"
+ }
+ },
+ {
+ "defaultConfiguration": {
+ "level": "error"
+ },
+ "fullDescription": {
+ "text": "Go has a built in profiling service that is enabled by starting an HTTP server with\n`net/http/pprof` imported. The `/debug/pprof` endpoint does not require any\nauthentication and can be accessed by anonymous users. This profiling endpoint\ncan leak sensitive information and should not be enabled in production.\n\nTo remediate this, remove the `net/http/pprof` import from the file.\n"
+ },
+ "id": "gosec.G108-1",
+ "name": "gosec.G108-1",
+ "properties": {
+ "precision": "very-high",
+ "tags": [
+ "CWE-489",
+ "security"
+ ]
+ },
+ "shortDescription": {
+ "text": "Active debug code (pprof enabled)"
+ }
+ },
+ {
+ "defaultConfiguration": {
+ "level": "warning"
+ },
+ "fullDescription": {
+ "text": "The `GetTempFileName` function works by generating a randomly named file, creating the file\n(if it does not exist) and then closing it. An application wishing to use this temporary file\nwill need to reopen this file to begin working with it. This leads to a potential\nTime Of Check Time Of Use (TOCTOU) vulnerability, as an attacker could replace or modify\nthe contents of the file prior to it being used by the application.\n\nConsider generating a random filename and opening the file directly in a single `CreateFile`\nor `OpenFile` call.\n"
+ },
+ "id": "flawfinder.GetTempFileName-1",
+ "name": "flawfinder.GetTempFileName-1",
+ "properties": {
+ "precision": "very-high",
+ "tags": [
+ "CWE-377",
+ "OWASP-A5:2017-Broken Access Control",
+ "security"
+ ]
+ },
+ "shortDescription": {
+ "text": "Potential time of check time of use vulnerability (GetTempFileName)"
+ }
+ },
+ {
+ "defaultConfiguration": {
+ "level": "warning"
+ },
+ "fullDescription": {
+ "text": "The application was found creating files in shared system temporary directories\n(`/tmp` or `/var/tmp`) without using the `os.CreateTemp` function. Depending\non how the application uses this temporary file, an attacker may be able to create\nsymlinks that point to other files prior to the application creating or writing\nto the target file, leading to unintended files being created or overwritten.\n\nExample using `os.CreateTemp` in an application restricted directory:\n```\n// assumes /opt/appdir/ is chown'd to the running application user\nif err := os.MkdirAll(\"/opt/appdir/restricted\", 0700); err != nil {\n log.Fatal(err)\n}\n\n// create a temporary file in the restricted directory in the form of temp-952569059.txt\nf, err := os.CreateTemp(\"/opt/appdir/restricted\", \"temp-*.txt\")\nif err != nil {\n log.Fatal(err)\n}\n\ndefer f.Close()\n// clean up on exit\ndefer os.Remove(f.Name())\n// work with file\n```\n"
+ },
+ "id": "gosec.G303-1",
+ "name": "gosec.G303-1",
+ "properties": {
+ "precision": "very-high",
+ "tags": [
+ "CWE-378",
+ "security"
+ ]
+ },
+ "shortDescription": {
+ "text": "Creation of temporary file with insecure permissions"
+ }
+ },
+ {
+ "defaultConfiguration": {
+ "level": "warning"
+ },
+ "fullDescription": {
+ "text": "This code creates a database connect using a hardcoded, constant password. Anyone with access\nto either the source code or the compiled code can easily learn the password.\n"
+ },
+ "id": "find_sec_bugs.DMI_CONSTANT_DB_PASSWORD-1.HARD_CODE_PASSWORD-3",
+ "name": "find_sec_bugs.DMI_CONSTANT_DB_PASSWORD-1.HARD_CODE_PASSWORD-3",
+ "properties": {
+ "precision": "very-high",
+ "tags": [
+ "CWE-259",
+ "security"
+ ]
+ },
+ "shortDescription": {
+ "text": "Use of Hard-coded Password"
+ }
+ },
+ {
+ "defaultConfiguration": {
+ "level": "warning"
+ },
+ "fullDescription": {
+ "text": "A potential hard-coded password was identified in a database connection string.\nPasswords should not be stored directly in code\nbut loaded from secure locations such as a Key Management System (KMS).\n\nThe purpose of using a Key Management System is so access can be audited and keys easily\nrotated\nin the event of a breach. By hardcoding passwords, it will be extremely difficult to determine\nwhen or if, a key is compromised.\n\nThe recommendation on which KMS to use depends on the environment the application is running\nin:\n\n- For Google Cloud Platform consider [Cloud Key Management](https://cloud.google.com/kms/docs)\n- For Amazon Web Services consider [AWS Key Management](https://aws.amazon.com/kms/)\n- For on premise or other alternatives to cloud providers, consider [Hashicorp's\nVault](https://www.vaultproject.io/)\n- For other cloud providers, please see their documentation\n"
+ },
+ "id": "find_sec_bugs.DMI_CONSTANT_DB_PASSWORD-1.HARD_CODE_PASSWORD-3",
+ "name": "find_sec_bugs.DMI_CONSTANT_DB_PASSWORD-1.HARD_CODE_PASSWORD-3",
+ "properties": {
+ "precision": "very-high",
+ "tags": [
+ "CWE-259",
+ "security"
+ ]
+ },
+ "shortDescription": {
+ "text": "Use of hard-coded password"
+ }
+ },
+ {
+ "defaultConfiguration": {
+ "level": "warning"
+ },
+ "fullDescription": {
+ "text": "Go's `math/rand` is not meant for use in generating random numbers for any cryptographic or\nsecurity sensitive context. This includes generating random numbers that could be used in\nuser specific identifiers or where the random number that is generated is considered to\nbe secret.\n\nReplace all imports of `math/rand` with `crypto/rand`.\n"
+ },
+ "id": "gosec.G404-1",
+ "name": "gosec.G404-1",
+ "properties": {
+ "precision": "very-high",
+ "tags": [
+ "CWE-338",
+ "OWASP-A3:2017-Sensitive Data Exposure",
+ "security"
+ ]
+ },
+ "shortDescription": {
+ "text": "Use of cryptographically weak Pseudo-Random Number Generator (PRNG)"
+ }
+ },
+ {
+ "defaultConfiguration": {
+ "level": "warning"
+ },
+ "fullDescription": {
+ "text": "The application was found using `shelve` which is vulnerable to deserialization attacks as\nit calls `pickle` internally.\nDeserialization attacks exploit the process of reading serialized data and turning it back\ninto an object. By constructing malicious objects and serializing them, an adversary may\nattempt to:\n\n- Inject code that is executed upon object construction, which occurs during the\ndeserialization process.\n- Exploit mass assignment by including fields that are not normally a part of the serialized\ndata but are read in during deserialization.\n\nConsider safer alternatives such as serializing data in the JSON format. Ensure any format\nchosen allows\nthe application to specify exactly which object types are allowed to be deserialized.\n\nTo protect against mass assignment, only allow deserialization of the specific fields that are\nrequired. If this is not easily done, consider creating an intermediary type that\ncan be serialized with only the necessary fields exposed.\n\nExample JSON deserializer using an intermediary type that is validated against a schema to\nensure\nit is safe from mass assignment:\n```\nimport jsonschema\n\n# Create a schema to validate our user-supplied input against\n# an intermediary object\nintermediary_schema = {\n \"type\" : \"object\",\n \"properties\" : {\n \"name\": {\"type\" : \"string\"}\n },\n \"required\": [\"name\"],\n # Protect against random properties being added to the object\n \"additionalProperties\": False,\n}\n# If a user attempted to add \"'is_admin': True\" it would cause a validation error\nintermediary_object = {'name': 'test user'}\n\ntry:\n # Validate the user supplied intermediary object against our schema\n jsonschema.validate(instance=intermediary_object, schema=intermediary_schema)\n user_object = {'user':\n {\n # Assign the deserialized data from intermediary object\n 'name': intermediary_object['name'],\n # Add in protected data in object definition (or set it from a class constructor)\n 'is_admin': False,\n }\n }\n # Work with the user_object\nexcept jsonschema.exceptions.ValidationError as ex:\n # Gracefully handle validation errors\n # ...\n```\n\nFor more details on deserialization attacks in general, see OWASP's guide:\n- https://cheatsheetseries.owasp.org/cheatsheets/Deserialization_Cheat_Sheet.html\n"
+ },
+ "id": "bandit.B301-4",
+ "name": "bandit.B301-4",
+ "properties": {
+ "precision": "very-high",
+ "tags": [
+ "CWE-502",
+ "OWASP-A8:2017-Insecure Deserialization",
+ "security"
+ ]
+ },
+ "shortDescription": {
+ "text": "Deserialization of untrusted data"
+ }
+ },
+ {
+ "defaultConfiguration": {
+ "level": "error"
+ },
+ "fullDescription": {
+ "text": "XML External Entity (XXE) attacks can occur when an XML parser supports XML\nentities while processing XML received from an untrusted source.\n"
+ },
+ "id": "find_sec_bugs.XXE_SAXPARSER-1",
+ "name": "find_sec_bugs.XXE_SAXPARSER-1",
+ "properties": {
+ "precision": "very-high",
+ "tags": [
+ "CWE-611",
+ "security"
+ ]
+ },
+ "shortDescription": {
+ "text": "Improper Restriction of XML External Entity Reference ('XXE')"
+ }
+ },
+ {
+ "defaultConfiguration": {
+ "level": "warning"
+ },
+ "fullDescription": {
+ "text": "The use of a predictable random value can lead to vulnerabilities when used in certain security\ncritical contexts. A quick fix could be to replace the use of scala.util.Random with something\nstronger, such as java.security.SecureRandom\n"
+ },
+ "id": "find_sec_bugs.PREDICTABLE_RANDOM-1.PREDICTABLE_RANDOM_SCALA-1",
+ "name": "find_sec_bugs.PREDICTABLE_RANDOM-1.PREDICTABLE_RANDOM_SCALA-1",
+ "properties": {
+ "precision": "very-high",
+ "tags": [
+ "CWE-330",
+ "security"
+ ]
+ },
+ "shortDescription": {
+ "text": "Use of Insufficiently Random Values"
+ }
+ },
+ {
+ "defaultConfiguration": {
+ "level": "error"
+ },
+ "fullDescription": {
+ "text": "External XML entities are a feature of XML parsers that allow documents to contain references\nto\nother documents or data. This feature can be abused to read files, communicate with external\nhosts,\nexfiltrate data, or cause a Denial of Service (DoS).\n\nIt is recommended that the `SAXParser` is configured to disable DTD doctypes as this protects\nagainst the majority of XXE attacks.\n\nExample creating a SAXParser with disallowing the doctypes feature enabled:\n```\n// Create a SAXParserFactory\nSAXParserFactory saxParserFactory = SAXParserFactory.newInstance();\n// Enable the feature which disallows -`.\n\nTo remediate this issue, the `UsmUserData` should be configured with `usr-sha-aes` for\nSHA authentication and AES encryption.\n\nExample querying a device using SNMPv3 with SHA-AES:\n```\nfrom pysnmp.hlapi import *\n# Create the snpm iterator\niterator = getCmd(\n SnmpEngine(),\n # Configure using SHA AES\n UsmUserData('usr-sha-aes', 'authkey1', 'privkey1',\n authProtocol=USM_AUTH_HMAC96_SHA,\n privProtocol=USM_PRIV_CFB128_AES),\n UdpTransportTarget(('demo.snmplabs.com', 161)),\n ContextData(),\n ObjectType(ObjectIdentity('SNMPv2-MIB', 'sysDescr', 0))\n)\n```\n\nFor more information on using SNMPv3 with `Pysnmp` see:\n-\nhttps://pysnmp.readthedocs.io/en/latest/examples/hlapi/v3arch/asyncore/sync/manager/cmdgen/snmp-versions.html#snmpv3-auth-sha-privacy-aes128\n"
+ },
+ "id": "bandit.B509",
+ "name": "bandit.B509",
+ "properties": {
+ "precision": "very-high",
+ "tags": [
+ "CWE-319",
+ "security"
+ ]
+ },
+ "shortDescription": {
+ "text": "Cleartext Transmission of Sensitive Information"
+ }
+ },
+ {
+ "defaultConfiguration": {
+ "level": "note"
+ },
+ "fullDescription": {
+ "text": "Using various methods to parse untrusted XML data is known to be vulnerable to\nXML attacks. Replace vulnerable imports with the equivalent defusedxml package,\nor make sure defusedxml.defuse_stdlib() is called.\n"
+ },
+ "id": "bandit.B406",
+ "name": "bandit.B406",
+ "properties": {
+ "precision": "very-high",
+ "tags": [
+ "CWE-502",
+ "OWASP-A8:2017-Insecure Deserialization",
+ "security"
+ ]
+ },
+ "shortDescription": {
+ "text": "Deserialization of Untrusted Data"
+ }
+ },
+ {
+ "defaultConfiguration": {
+ "level": "warning"
+ },
+ "fullDescription": {
+ "text": "When an HTTP request contains unexpected CR and LF characters, the server may respond with an\noutput stream that is interpreted as two different HTTP responses (instead of one). An attacker\ncan control the second response and mount attacks such as cross-site scripting and cache\npoisoning attacks.\n"
+ },
+ "id": "find_sec_bugs.HTTP_RESPONSE_SPLITTING-1",
+ "name": "find_sec_bugs.HTTP_RESPONSE_SPLITTING-1",
+ "properties": {
+ "precision": "very-high",
+ "tags": [
+ "CWE-113",
+ "security"
+ ]
+ },
+ "shortDescription": {
+ "text": "Improper Neutralization of CRLF Sequences in HTTP Headers ('HTTP Response Splitting')"
+ }
+ },
+ {
+ "defaultConfiguration": {
+ "level": "note"
+ },
+ "fullDescription": {
+ "text": "This method is part of a REST Web Service (JSR311). The security of this web service should be\nanalyzed. For example:\n- Authentication, if enforced, should be tested.\n- Access control, if enforced, should be tested.\n- The inputs should be tracked for potential vulnerabilities.\n- The communication should ideally be over SSL.\n- If the service supports writes (e.g., via POST), its vulnerability to CSRF should be\ninvestigated.\n"
+ },
+ "id": "find_sec_bugs.JAXRS_ENDPOINT-1",
+ "name": "find_sec_bugs.JAXRS_ENDPOINT-1",
+ "properties": {
+ "precision": "very-high",
+ "tags": [
+ "CWE-20",
+ "security"
+ ]
+ },
+ "shortDescription": {
+ "text": "Improper Input Validation"
+ }
+ },
+ {
+ "defaultConfiguration": {
+ "level": "warning"
+ },
+ "fullDescription": {
+ "text": "HTTP Response Splitting is a vulnerability where Carriage Return (CR `\\r`) and Line Feed (LF\n`\\n`)\ncharacters are introduced into an HTTP header from user-supplied input. By injecting the\n`\\r\\n`\ncharacter sequence, an adversary could potentially modify how the response is interpreted by\nthe\nclient or any downstream caching services. This could allow an adversary to poison the cache\ndata or execute Cross-Site Scripting (XSS) attacks.\n\nSome Java application servers such as [Apache Tomcat](https://tomcat.apache.org/) will\ndisallow `\\r\\n`\ncharacters from being set in cookies. If your application server does not automatically\nprovide this\nfunctionality, user-supplied input that is used in cookie keys or values must be validated.\n\nExample of validating cookies to only allow valid characters:\n```\n// throws an IllegalArgumentException if the provided value contains invalid characters\npublic void validateRfc6265CookieValue(String value) throws IllegalArgumentException {\n char[] chars = value.toCharArray();\n\n // iterate over every character\n for (int i = 0; i < chars.length; i++) {\n char c = chars[i];\n\n // check for any characters below 0x21 as well as: '\"' ',' ';' '\\' and 0x7f.\n if (c < 0x21 || c == '\"' || c == ',' || c == ';' || c == '\\\\' || c == 0x7f) {\n throw new IllegalArgumentException(\"Invalid character in cookie detected:\n{0}\".format(Integer.toString(c)));\n }\n }\n}\n```\n\nAlternatively, you could use a string escape package such as\n[Apache Commons Text](https://commons.apache.org/proper/commons-text/) to escape the input:\n```\npublic String escapeValue(String value) {\n return StringEscapeUtils.escapeJava(value);\n}\n```\n\nFor more information on response splitting attacks see OWASP:\nhttps://owasp.org/www-community/attacks/HTTP_Response_Splitting\n"
+ },
+ "id": "find_sec_bugs.HTTP_RESPONSE_SPLITTING-1",
+ "name": "find_sec_bugs.HTTP_RESPONSE_SPLITTING-1",
+ "properties": {
+ "precision": "very-high",
+ "tags": [
+ "CWE-113",
+ "security"
+ ]
+ },
+ "shortDescription": {
+ "text": "Improper neutralization of CRLF sequences in HTTP headers ('HTTP Response Splitting')"
+ }
+ },
+ {
+ "defaultConfiguration": {
+ "level": "warning"
+ },
+ "fullDescription": {
+ "text": "This method is part of a REST Web Service (JSR311). The security of this web service should be\nanalyzed; Authentication, if enforced, should be tested. Access control, if enforced, should be\ntested. The inputs should be tracked for potential vulnerabilities. The communication should\nideally be over SSL.\n"
+ },
+ "id": "find_sec_bugs.JAXRS_ENDPOINT-1",
+ "name": "find_sec_bugs.JAXRS_ENDPOINT-1",
+ "properties": {
+ "precision": "very-high",
+ "tags": [
+ "CWE-20",
+ "security"
+ ]
+ },
+ "shortDescription": {
+ "text": "Improper Input Validation"
+ }
+ },
+ {
+ "defaultConfiguration": {
+ "level": "warning"
+ },
+ "fullDescription": {
+ "text": "The application may be vulnerable to a path traversal if it extracts untrusted archive files.\nThis vulnerability is colloquially known as 'Zip Slip'. Archive files may contain folders\nwhich,\nwhen extracted, may write outside of the intended directory. This is exploited by including\npath traversal characters such as `../../other/directory` to overwrite or place files in system\nor application directories.\n\nExtra care must be taken when extracting archive files as there are numerous concerns:\n\n- Limit the size of the zip archive as it may contain \"Zip Bombs\", files that extract to\nextremely\nlarge sizes.\n- If possible, generate unique filenames instead of using the archives file names, as it may be\npossible for users to overwrite files if the filenames are the same.\n- Validate file paths are written with a prefixed, known trusted directory.\n- Only process regular files and not symbolic links, as some applications may attempt to\nread/follow\nthe symbolic link, leading to arbitrary file read / write vulnerabilities.\n\n\nExample of securely processing an archive file:\n```\nr, err := zip.OpenReader(\"trusted.zip\")\nif err != nil {\n log.Fatal(err)\n}\n\n// Ensure archive contains only the expected number of files\nconst expectedFileCount = 10\nif len(r.File) > expectedFileCount {\n log.Fatalf(\"too many files in archive: %d\\n\", len(r.File))\n}\n\n// One approach is to sum up all files before attempting to process\n// them.\nconst totalAllowedSize = 1024 * 1024 * 10 // 10MB\nvar totalSize uint64\nfor _, f := range r.File {\n totalSize += f.UncompressedSize64\n}\n\nif totalSize > totalAllowedSize {\n log.Fatalf(\"archive exceeds total allowed size: %d\\n\", totalSize)\n}\n\n// configure a max size per file allowed\nconst maxFileSize = 1024 * 1024 // 1 MB\n\n// set restricted basePath\nconst basePath = \"/var/restricted/\"\n\n// iterate over the files in the archive\nfor _, f := range r.File {\n\n // Ensure uncompressed size does not exceed our allowed file size\n if f.UncompressedSize64 > maxFileSize {\n log.Printf(\"skipping file as it exceeds maxFileSize: %s\\n\", f.Name)\n continue\n }\n\n // Ensure file is a regular file and not a symbolic link or has other mode type\n // bits set\n if !f.Mode().IsRegular() {\n log.Printf(\"skipping non regular file: %s\\n\", f.Name)\n continue\n }\n\n // if possible consider not using the name at all, but generating a random id instead.\n // If the filename must be used, extract the base name and not folder path information\n name := filepath.Base(f.Name)\n\n // Join the file name to the basePath.\n resolvedPath, err := filepath.Join(basePath, name)\n if err != nil {\n log.Fatal(err)\n }\n\n // Application must still verify the path is prefixed by the basePath\n if !strings.HasPrefix(resolvedPath, basePath) {\n log.Fatal(\"path does not start with basePath\")\n }\n\n // process / work with file\n}\n```\n\nIf the application must process directory names as well, use the following code:\n```\n// Join the cleaned name to the basePath, note if 'name' starts with `../../` it\n// will still allow for traversal, so you _must_ verify the path prefix below\nresolvedPath := filepath.Join(basePath, filepath.Clean(name))\n\n// Application must still verify the path is prefixed by the basePath\nif !strings.HasPrefix(resolvedPath, basePath) {\n log.Fatal(\"path does not start with basePath\")\n}\n\n// process / work with file\n```\n"
+ },
+ "id": "gosec.G305-1",
+ "name": "gosec.G305-1",
+ "properties": {
+ "precision": "very-high",
+ "tags": [
+ "CWE-22",
+ "security"
+ ]
+ },
+ "shortDescription": {
+ "text": "Improper limitation of a pathname to a restricted directory ('Path Traversal')"
+ }
+ },
+ {
+ "defaultConfiguration": {
+ "level": "warning"
+ },
+ "fullDescription": {
+ "text": "The application was found using mako templates without `default_filters` being passed to the\n`Template` or `TemplateLookup` constructors. If using in the context of HTML, this could lead\nto Cross-Site Scripting (XSS) attacks when rendering with\nuser-supplied input.\n\nUnfortunately, Jinja2 does not support context-aware escaping, meaning it is insufficient to\nprotect against\nXSS for the various web contexts. It is important to encode the data depending on the specific\ncontext\nit\nis used in. There are at least six context types:\n\n- Inside HTML tags `
context 1
`\n- Inside attributes: ``\n- Inside event attributes ``\n- Inside script blocks: ``\n- Unsafe element HTML assignment: `element.innerHTML = \"context 5\"`\n- Inside URLs: `link`\n\nScript blocks alone have multiple ways they need to be encoded. Extra care must be taken if\nuser input\nis ever output inside of script tags.\n\nUser input that is displayed within the application must be encoded, sanitized or validated\nto ensure it cannot be treated as HTML or executed as Javascript code. Care must also be\ntaken\nto not mix server-side templating with client-side templating, as the server-side templating\nwill\nnot encode things like {{ 7*7 }} which may execute client-side templating features.\n\nIt is _NOT_ advised to encode user input prior to inserting into a data store. The data will\nneed to be\nencoded depending on context of where it is output. It is much safer to force the displaying\nsystem to\nhandle the encoding and not attempt to guess how it should be encoded.\n\nTo handle different contexts, one approach would be to write custom mako filters. Below is\nan example\nthat escapes or encodes links and potentially malicious script, note this does not include\nother contexts\nsuch as CSS or attributes:\n```\n# filters.py module:\n\ndef escape_link(value):\n bad_link = \"#JinjatmplZ\"\n # Block any values that start with // as that could be used to inject\n # links to third party pages see:\nhttps://en.wikipedia.org/wiki/Wikipedia:Protocol-relative_URL\n if value.startswith('//'):\n return bad_link\n\n # Only allow relative links\n # if you want to allow links that start with http or ws replace with below:\n # if not value.startswith('/'): and not value.startswith('http') and not\nvalue.startswith('ws')\n if not value.startswith('/'):\n return bad_link\n\n return value\n\n# Create a replacement table\njs_replacement = str.maketrans({\n '\\0': \"\\\\u0000\",\n '\\t': \"\\\\t\",\n '\\n': \"\\\\n\",\n '\\v': \"\\\\u000b\",\n '\\f': \"\\\\f`\",\n '\\r': \"\\\\r\",\n '\"': \"\\\\u0022\",\n '`': \"\\\\u0060\",\n '&': \"\\\\u0026\",\n '\\'': \"\\\\u0027\",\n '+': \"\\\\u002b\",\n '/': \"\\\\/\",\n '<': \"\\\\u003c\",\n '>': \"\\\\u003e\",\n '\\\\': \"\\\\\\\\\",\n '(': \"\\\\u0028\",\n ')': \"\\\\u0029\",\n})\n\ndef escape_js(value):\n # Escape the input for use in \n\n