4 ms·
I am wondering if in such development settings people have tests that grep the code for unwanted statements. Eg: since you found that big bug now, grep code for
by gtsop 5y ago
I am wondering if in such development settings people have tests that grep the code for unwanted statements. Eg: since you found that big bug now, grep code for system(".*"\+ to warn or prevent shell calls.
- elanning 5y agoI wrote a VS code extension and pre-commit hook for this kind of thing: https://github.com/elanning/checkr https://github.com/elanning/checkr It's a nice inbetween solution for quick stuff not worth writing a full static analysis plugin for.
- dbaupp 5y agoTools like semgrep allow catching injection-like issues like that. For instance, just among existing published rules: - shell=True: https://semgrep.dev/r?q=python.lang.security.audit.subprocess-shell-true.subprocess-shell-true https://semgrep.dev/r?q=python.lang.security.audit.subproces... - system-like calls with a non-static argument: https://semgrep.dev/r?q=python.lang.security.audit.dangerous-system-call.dangerous-system-call https://semgrep.dev/r?q=python.lang.security.audit.dangerous... Custom rules can be written for additional patterns of concern (or specific/uncommon/private APIs) too.