Secure your code as it's written. Use Snyk Code to scan source code in minutes - no build needed - and fix issues immediately.
def test_django_xss_insecure(self):
"""Test for Django XSS via django.utils.safestring"""
expect = {
'SEVERITY': {'UNDEFINED': 0, 'LOW': 0, 'MEDIUM': 28, 'HIGH': 0},
'CONFIDENCE': {'UNDEFINED': 0, 'LOW': 0, 'MEDIUM': 0, 'HIGH': 28}
}
self.b_mgr.b_ts = b_test_set.BanditTestSet(
config=self.b_mgr.b_conf,
profile={'exclude': ['B308']}
)
self.check_example('mark_safe_insecure.py', expect)
def setUp(self):
super(FunctionalTests, self).setUp()
# NOTE(tkelsey): bandit is very sensitive to paths, so stitch
# them up here for the testing environment.
#
path = os.path.join(os.getcwd(), 'bandit', 'plugins')
b_conf = b_config.BanditConfig()
self.b_mgr = b_manager.BanditManager(b_conf, 'file')
self.b_mgr.b_conf._settings['plugins_dir'] = path
self.b_mgr.b_ts = b_test_set.BanditTestSet(config=b_conf)
def test_django_xss_secure(self):
"""Test false positives for Django XSS"""
expect = {
'SEVERITY': {'UNDEFINED': 0, 'LOW': 0, 'MEDIUM': 0, 'HIGH': 0},
'CONFIDENCE': {'UNDEFINED': 0, 'LOW': 0, 'MEDIUM': 0, 'HIGH': 0}
}
self.b_mgr.b_ts = b_test_set.BanditTestSet(
config=self.b_mgr.b_conf,
profile={'exclude': ['B308']}
)
self.check_example('mark_safe_secure.py', expect)
def test_profile_exclude_none(self):
profile = {'exclude': []} # same as no exclude
ts = test_set.BanditTestSet(self.config, profile)
self.assertEqual(1, len(ts.get_tests('Str')))
def test_profile_filter_blacklist_all(self):
profile = {'exclude': ['B401', 'B302']}
ts = test_set.BanditTestSet(self.config, profile)
# if there is no blacklist data for a node type then we wont add a
# blacklist test to it, as this would be pointless.
self.assertEqual(0, len(ts.get_tests('Import')))
self.assertEqual(0, len(ts.get_tests('ImportFrom')))
self.assertEqual(0, len(ts.get_tests('Call')))
def test_profile_exclude_builtin_blacklist(self):
profile = {'exclude': ['B001']}
ts = test_set.BanditTestSet(self.config, profile)
self.assertEqual(0, len(ts.get_tests('Import')))
self.assertEqual(0, len(ts.get_tests('ImportFrom')))
self.assertEqual(0, len(ts.get_tests('Call')))
def test_profile_exclude_builtin_blacklist_specific(self):
profile = {'exclude': ['B302', 'B401']}
ts = test_set.BanditTestSet(self.config, profile)
self.assertEqual(0, len(ts.get_tests('Import')))
self.assertEqual(0, len(ts.get_tests('ImportFrom')))
self.assertEqual(0, len(ts.get_tests('Call')))
def setUp(self):
super(FunctionalTests, self).setUp()
# NOTE(tkelsey): bandit is very sensitive to paths, so stitch
# them up here for the testing environment.
#
path = os.path.join(os.getcwd(), 'bandit', 'plugins')
b_conf = b_config.BanditConfig()
self.b_mgr = b_manager.BanditManager(b_conf, 'file')
self.b_mgr.b_conf._settings['plugins_dir'] = path
self.b_mgr.b_ts = b_test_set.BanditTestSet(config=b_conf)
config.read(ini_file)
profile = {k: v.replace("S", "B") for k, v in config.items("bandit")}
if profile.get("skips"):
profile["exclude"] = profile.get("skips").split(",")
if profile.get("tests"):
profile["include"] = profile.get("tests").split(",")
except (configparser.Error, KeyError, TypeError) as e:
if str(e) != "No section: 'bandit'":
import sys
err = "Unable to parse config file: %s\n" % e
sys.stderr.write(err)
profile = {}
bnv = BanditNodeVisitor(
self.filename,
BanditMetaAst(),
BanditTestSet(BanditConfig(), profile=profile),
False,
[],
Metrics(),
)
bnv.generic_visit(self.tree)
return [
{
# flake8-bugbear uses bandit default prefix 'B'
# so this plugin replaces the 'B' with an 'S' for Security
# See https://github.com/PyCQA/flake8-bugbear/issues/37
"test_id": item.test_id.replace("B", "S"),
"issue_text": item.text,
"line_number": item.lineno,
}
for item in bnv.tester.results
]