mirror of
https://github.com/norandom/OpenUltraSAST.git
synced 2026-10-16 03:49:26 +00:00
31 lines
790 B
Python
31 lines
790 B
Python
|
"""Safe equivalents. None of these lines should produce a finding."""
|
||
|
|
import hashlib
|
||
|
|
import subprocess
|
||
|
|
|
||
|
|
import yaml
|
||
|
|
from flask import request
|
||
|
|
|
||
|
|
|
||
|
|
def ping_safe(host):
|
||
|
|
# list-form subprocess without shell is not command injection
|
||
|
|
return subprocess.check_output(["ping", "-c", "1", host])
|
||
|
|
|
||
|
|
|
||
|
|
def user_safe(db):
|
||
|
|
name = request.args["name"]
|
||
|
|
# parameterised query: %s here is a bound placeholder, not %-formatting
|
||
|
|
return db.execute("select * from users where name = %s", (name,))
|
||
|
|
|
||
|
|
|
||
|
|
def config_safe(data):
|
||
|
|
return yaml.safe_load(data) # safe_load is not the unsafe yaml.load sink
|
||
|
|
|
||
|
|
|
||
|
|
def token_safe(pw):
|
||
|
|
return hashlib.sha256(pw.encode()).hexdigest() # strong hash
|
||
|
|
|
||
|
|
|
||
|
|
def comment_only():
|
||
|
|
# os.system("rm -rf /") would be dangerous but this is a comment
|
||
|
|
return "ok"
|