Mailman 3 October 2020 - code-quality

Unsafe input analyzer
by Mikko Elomaa Oct. 13, 2020

Oct. 13, 2020

Hello, While working on embedded Linux devices I ran into multiple cases of unsafe use of input data on the back-end. These back-ends used Python Flask framework and were made without the help of commercial (and expensive) static analysis tools. I looked around for a tool to spot these vulnerabilities, but could not find anything available for free. So, I wrote a quick script at first and then made it more generic. The tool checks functions with the route decorator, it detects the request related input data and checks if the data is passed to a function without being checked by a known filter or validator. I call the tool Python API parser and input analyzer (Papaia). I have the sources available at https://gitlab.com/melomaa/papaia Do you think this tool could be helpful for others and do you see that it would fit under the PyCQA? Best Regards, Mikko Elomaa

3 2

Regarding bandit execution output
by Mahesh.M3＠cognizant.com Oct. 8, 2020

Oct. 8, 2020

Hi, Currently I'm implementing bandit in my project to check the code vulnerability. We can see only the failed tests id in the report. Is there any way to check or view the overall tests ids executed? One of my client want to these information somewhere in Jenkins. Kindly help me out on this query asap. Thanks & Regards, Mahesh +91 9941160925 This e-mail and any files transmitted with it are for the sole use of the intended recipient(s) and may contain confidential and privileged information. If you are not the intended recipient(s), please reply to the sender and destroy all copies of the original message. Any unauthorized review, use, disclosure, dissemination, forwarding, printing or copying of this email, and/or any action taken in reliance on the contents of this e-mail is strictly prohibited and may be unlawful. Where permitted by applicable law, this e-mail and other e-mail communications sent to and from Cognizant e-mail addresses may be monitored. This e-mail and any files transmitted with it are for the sole use of the intended recipient(s) and may contain confidential and privileged information. If you are not the intended recipient(s), please reply to the sender and destroy all copies of the original message. Any unauthorized review, use, disclosure, dissemination, forwarding, printing or copying of this email, and/or any action taken in reliance on the contents of this e-mail is strictly prohibited and may be unlawful. Where permitted by applicable law, this e-mail and other e-mail communications sent to and from Cognizant e-mail addresses may be monitored.

1 0

Pragma scoping in Pylint
by William Tracy Oct. 5, 2020

Oct. 5, 2020

Hello, I've been digging around the Pylint codebase trying to understand how the scope of enable/disable pragmas is handled. Several checkers directly reference utils/pragma_parser.py, but the code doesn't seem to go any deeper than checking whether the current line contains a pragma. I can't see that pragma_parser.py is referenced anywhere else in the codebase. Where is the code for managing scope? Is it hiding under a different name? Is it somehow handled in astroid rather than in Pylint itself? Thanks for any answers, and thanks for providing such a useful tool! William Tracy

2 1

Request to add Pycln project.
by Hadi Alqattan Oct. 4, 2020

Oct. 4, 2020

What is *Pycln*? *Pycln is a formatter for finding and removing unused imports automatically and accurately.* Why do you build it while Autoflake & Unimport exists? Because *Pycln* has designed to be: - Safer by statically analyzing modules side effects before considering them as unused, which neither Autoflake nor Unimport provides this functionality! - More accurate by supporting a wide variety of special cases (we can improve this part more and more). *Pycln Github repo:* https://github.com/hadialqattan/pycln *For more information see:* https://hadialqattan.github.io/pycln

1 0