3 ms·
Some of the checks here seem very brittle. For example this one[1]. In the context of security scanning (versus, say, listing), I think it's reasonable to expe
by woodruffw 7mo ago
Some of the checks here seem very brittle. For example this one[1].
In the context of security scanning (versus, say, listing), I think it's reasonable to expect the tool to be resilient to attempts at obfuscation (or just badly written code that doesn't adhere to normal Python idioms around import paths).
[1]: https://github.com/PwnKit-Labs/foxguard/blob/a215faf52dcff5655d5fa13240085dd80fc39861/src/rules/python.rs#L306-L316 https://github.com/PwnKit-Labs/foxguard/blob/a215faf52dcff56...
- deleted 7mo ago[deleted]
- peaktwilight 7mo agoupdate: `NoPickle`/`NoYamlLoad` string-match the callee text, so `import pickle as p; p.loads(...)` and `from pickle import loads as d` slip past. Filed as #7 with a fix plan (intraprocedural alias table). Thanks!