<s> import ast <EOL> import re <EOL> import bandit <EOL> from bandit . core import test_properties as test <EOL> def _has_special_characters ( command ) : <EOL> return bool ( re . search ( r'<STR_LIT>' , command ) ) <EOL> def _evaluate_shell_call ( context ) : <EOL> no_formatting = isinstance ( context . node . args [ <NUM_LIT:0> ] , ast . Str ) <EOL> if no_formatting : <EOL> command = context . call_args [ <NUM_LIT:0> ] <EOL> no_special_chars = not _has_special_characters ( command ) <EOL> else : <EOL> no_special_chars = False <EOL> if no_formatting and no_special_chars : <EOL> return bandit . LOW <EOL> elif no_formatting : <EOL> return bandit . MEDIUM <EOL> else : <EOL> return bandit . HIGH <EOL> def gen_config ( name ) : <EOL> if name == '<STR_LIT>' : <EOL> return { <EOL> '<STR_LIT>' : <EOL> [ '<STR_LIT>' , <EOL> '<STR_LIT>' , <EOL> '<STR_LIT>' , <EOL> '<STR_LIT>' , <EOL> '<STR_LIT>' , <EOL> '<STR_LIT>' ] , <EOL> '<STR_LIT>' : <EOL> [ '<STR_LIT>' , <EOL> '<STR_LIT>' , <EOL> '<STR_LIT>' , <EOL> '<STR_LIT>' , <EOL> '<STR_LIT>' , <EOL> '<STR_LIT>' , <EOL> '<STR_LIT>' , <EOL> '<STR_LIT>' , <EOL> '<STR_LIT>' , <EOL> '<STR_LIT>' , <EOL> '<STR_LIT>' , <EOL> '<STR_LIT>' ] , <EOL> '<STR_LIT>' : <EOL> [ '<STR_LIT>' , <EOL> '<STR_LIT>' , <EOL> '<STR_LIT>' , <EOL> '<STR_LIT>' , <EOL> '<STR_LIT>' , <EOL> '<STR_LIT>' , <EOL> '<STR_LIT>' , <EOL> '<STR_LIT>' , <EOL> '<STR_LIT>' , <EOL> '<STR_LIT>' , <EOL> '<STR_LIT>' , <EOL> '<STR_LIT>' , <EOL> '<STR_LIT>' , <EOL> '<STR_LIT>' , <EOL> '<STR_LIT>' , <EOL> '<STR_LIT>' , <EOL> '<STR_LIT>' ] <EOL> } <EOL> @ test . takes_config ( '<STR_LIT>' ) <EOL> @ test . checks ( '<STR_LIT>' ) <EOL> @ test . test_id ( '<STR_LIT>' ) <EOL> def subprocess_popen_with_shell_equals_true ( context , config ) : <EOL> """<STR_LIT>""" <EOL> if config and context . call_function_name_qual in config [ '<STR_LIT>' ] : <EOL> if context . check_call_arg_value ( '<STR_LIT>' , '<STR_LIT:True>' ) : <EOL> if len ( context . call_args ) > <NUM_LIT:0> : <EOL> sev = _evaluate_shell_call ( context ) <EOL> if sev == bandit . LOW : <EOL> return bandit . Issue ( <EOL> severity = bandit . LOW , <EOL> confidence = bandit . HIGH , <EOL> text = '<STR_LIT>' <EOL> '<STR_LIT>' <EOL> '<STR_LIT>' , <EOL> lineno = context . get_lineno_for_call_arg ( '<STR_LIT>' ) , <EOL> ) <EOL> elif sev == bandit . MEDIUM : <EOL> return bandit . Issue ( <EOL> severity = bandit . MEDIUM , <EOL> confidence = bandit . HIGH , <EOL> text = '<STR_LIT>' <EOL> '<STR_LIT>' <EOL> '<STR_LIT>' , <EOL> lineno = context . get_lineno_for_call_arg ( '<STR_LIT>' ) , <EOL> ) <EOL> else : <EOL> return bandit . Issue ( <EOL> severity = bandit . HIGH , <EOL> confidence = bandit . HIGH , <EOL> text = '<STR_LIT>' <EOL> '<STR_LIT>' , <EOL> lineno = context . get_lineno_for_call_arg ( '<STR_LIT>' ) , <EOL> ) <EOL> @ test . takes_config ( '<STR_LIT>' ) <EOL> @ test . checks ( '<STR_LIT>' ) <EOL> @ test . test_id ( '<STR_LIT>' ) <EOL> def subprocess_without_shell_equals_true ( context , config ) : <EOL> """<STR_LIT>""" <EOL> if config and context . call_function_name_qual in config [ '<STR_LIT>' ] : <EOL> if not context . check_call_arg_value ( '<STR_LIT>' , '<STR_LIT:True>' ) : <EOL> return bandit . Issue ( <EOL> severity = bandit . LOW , <EOL> confidence = bandit . HIGH , <EOL> text = '<STR_LIT>' <EOL> '<STR_LIT>' , <EOL> lineno = context . get_lineno_for_call_arg ( '<STR_LIT>' ) , <EOL> ) <EOL> @ test . takes_config ( '<STR_LIT>' ) <EOL> @ test . checks ( '<STR_LIT>' ) <EOL> @ test . test_id ( '<STR_LIT>' ) <EOL> def any_other_function_with_shell_equals_true ( context , config ) : <EOL> """<STR_LIT>""" <EOL> if config and context . call_function_name_qual not in config [ '<STR_LIT>' ] : <EOL> if context . check_call_arg_value ( '<STR_LIT>' , '<STR_LIT:True>' ) : <EOL> return bandit . Issue ( <EOL> severity = bandit . MEDIUM , <EOL> confidence = bandit . LOW , <EOL> text = '<STR_LIT>' <EOL> '<STR_LIT>' , <EOL> lineno = context . get_lineno_for_call_arg ( '<STR_LIT>' ) , <EOL> ) <EOL> @ test . takes_config ( '<STR_LIT>' ) <EOL> @ test . checks ( '<STR_LIT>' ) <EOL> @ test . test_id ( '<STR_LIT>' ) <EOL> def start_process_with_a_shell ( context , config ) : <EOL> """<STR_LIT>""" <EOL> if config and context . call_function_name_qual in config [ '<STR_LIT>' ] : <EOL> if len ( context . call_args ) > <NUM_LIT:0> : <EOL> sev = _evaluate_shell_call ( context ) <EOL> if sev == bandit . LOW : <EOL> return bandit . Issue ( <EOL> severity = bandit . LOW , <EOL> confidence = bandit . HIGH , <EOL> text = '<STR_LIT>' <EOL> '<STR_LIT>' <EOL> '<STR_LIT>' <EOL> ) <EOL> elif sev == bandit . MEDIUM : <EOL> return bandit . Issue ( <EOL> severity = bandit . MEDIUM , <EOL> confidence = bandit . HIGH , <EOL> text = '<STR_LIT>' <EOL> '<STR_LIT>' <EOL> '<STR_LIT>' <EOL> ) <EOL> else : <EOL> return bandit . Issue ( <EOL> severity = bandit . HIGH , <EOL> confidence = bandit . HIGH , <EOL> text = '<STR_LIT>' <EOL> '<STR_LIT>' <EOL> ) <EOL> @ test . takes_config ( '<STR_LIT>' ) <EOL> @ test . checks ( '<STR_LIT>' ) <EOL> @ test . test_id ( '<STR_LIT>' ) <EOL> def start_process_with_no_shell ( context , config ) : <EOL> """<STR_LIT>""" <EOL> if config and context . call_function_name_qual in config [ '<STR_LIT>' ] : <EOL> return bandit . Issue ( <EOL> severity = bandit . LOW , <EOL> confidence = bandit . MEDIUM , <EOL> text = '<STR_LIT>' <EOL> ) <EOL> @ test . takes_config ( '<STR_LIT>' ) <EOL> @ test . checks ( '<STR_LIT>' ) <EOL> @ test . test_id ( '<STR_LIT>' ) <EOL> def start_process_with_partial_path ( context , config ) : <EOL> """<STR_LIT>""" <EOL> if config and len ( context . call_args ) : <EOL> if ( context . call_function_name_qual in config [ '<STR_LIT>' ] or <EOL> context . call_function_name_qual in config [ '<STR_LIT>' ] or <EOL> context . call_function_name_qual in config [ '<STR_LIT>' ] ) : <EOL> delims = [ '<STR_LIT:/>' , '<STR_LIT:\\>' , '<STR_LIT:.>' ] <EOL> node = context . node . args [ <NUM_LIT:0> ] <EOL> if isinstance ( node , ast . List ) : <EOL> node = node . elts [ <NUM_LIT:0> ] <EOL> if ( isinstance ( node , ast . Str ) and node . s [ <NUM_LIT:0> ] not in delims ) : <EOL> return bandit . Issue ( <EOL> severity = bandit . LOW , <EOL> confidence = bandit . HIGH , <EOL> text = '<STR_LIT>' <EOL> ) </s>
