Feature Request: Whitelist lines ending in # nosec

So both detect-secrets and Bandit have the concept of whitelisting a line by putting a comment at the end, similar to how you've probably seen people do # noqa: F401 or whatever, with pylint.

Let us steal once again, from Bandit, since they are most similar to us, here are the relevant lines, but we shall change lineno + 1 for to enumerate(lines, start=1) because it is more pythonic.

They also have the --ignore-nosec do not skip lines with # nosec comments command line optionso we shall pass in the set of lines to the 2 calls tofind_vulnerabilities` in __main__,

While I initially thought we would just give the option to add # nosec to the sinks, e.g.

@app.route('/menu', methods=['POST'])
def menu():
    param = request.form['suggestion']
    command = 'echo ' + param + ' >> ' + 'menu.txt'

    subprocess.call(command, shell=True)  # nosec

    with open('menu.txt','r') as f:
        menu = f.read()

    return render_template('command_injection.html', menu=menu)

We can, without writing any more lines of code, give the option to add # nosec to the sources, e.g.

@app.route('/menu', methods=['POST'])
def menu():
    param = request.form['suggestion']  # nosec
    command = 'echo ' + param + ' >> ' + 'menu.txt'

    subprocess.call(command, shell=True)

    with open('menu.txt','r') as f:
        menu = f.read()

    return render_template('command_injection.html', menu=menu)

This may be the preference of a security team, as the code may change in the future, and it's more dangerous to have the sink be whitelisted, because there may be multiple vuln chains.

@omergunal

Would you like to take this one, @omergunal?

sure

I forgot to say this before, but after passing the set of lines to find_vulnerabilities we can ignore both sources and sinks in the same function, find_triggers, something like if node.lineno not in nosec_lines:

Also for some reason I cannot 'Assign' you the issue in GitHub, maybe you can assign yourself.

I couldnt do

nosec_lines for python-security#108's issue

Woohoo 👍

Navigation Menu

Repository navigation

Feature Request: Whitelist lines ending in # nosec #108

Metadata

Assignees

Labels

Type

Projects

Milestone

Relationships

Development

Feature Request: Whitelist lines ending in # nosec #108

Description

Activity

KevinHock commented on Apr 14, 2018

KevinHock commented on Apr 14, 2018

omergunal commented on Apr 14, 2018

KevinHock commented on Apr 14, 2018

KevinHock commented on Apr 14, 2018

omergunal commented on Apr 14, 2018

KevinHock commented on Apr 28, 2018

Metadata

Metadata

Assignees

Labels

Type

Projects

Milestone

Relationships

Development

Issue actions