diff --git a/README.rst b/README.rst index c4206bfb..f10fe78b 100644 --- a/README.rst +++ b/README.rst @@ -163,6 +163,7 @@ Usage:: B319 xml_bad_pulldom B320 xml_bad_etree B321 ftplib + B322 input B401 import_telnetlib B402 import_ftplib B403 import_pickle diff --git a/bandit/blacklists/calls.py b/bandit/blacklists/calls.py index ae88ad99..952372a6 100644 --- a/bandit/blacklists/calls.py +++ b/bandit/blacklists/calls.py @@ -260,6 +260,20 @@ SSH/SFTP/SCP or some other encrypted protocol. | B321 | ftplib | - ftplib.\* | High | +------+---------------------+------------------------------------+-----------+ +B322: input +------------ + +The input method in Python 2 will read from standard input, evaluate and +run the resulting string as python source code. This is similar, though in +many ways worse, then using eval. On Python 2, use raw_input instead, input +is safe in Python 3. + ++------+---------------------+------------------------------------+-----------+ +| ID | Name | Calls | Severity | ++======+=====================+====================================+===========+ +| B322 | ftplib | - input | High | ++------+---------------------+------------------------------------+-----------+ + """ from bandit.blacklists import utils @@ -473,4 +487,13 @@ def gen_blacklist(): 'HIGH' )) + sets.append(utils.build_conf_dict( + 'input', 'B322', ['input'], + 'The input method in Python 2 will read from standard input, ' + 'evaluate and run the resulting string as python source code. This ' + 'is similar, though in many ways worse, then using eval. On Python ' + '2, use raw_input instead, input is safe in Python 3.', + 'HIGH' + )) + return {'Call': sets} diff --git a/examples/input.py b/examples/input.py new file mode 100644 index 00000000..51a1f1e6 --- /dev/null +++ b/examples/input.py @@ -0,0 +1 @@ +input() diff --git a/tests/functional/test_functional.py b/tests/functional/test_functional.py index 53161d84..0fc7f0de 100644 --- a/tests/functional/test_functional.py +++ b/tests/functional/test_functional.py @@ -532,3 +532,10 @@ class FunctionalTests(testtools.TestCase): self.run_example('flask_debug.py') self.assertEqual(1, len(self.b_mgr.baseline)) self.assertEqual({}, self.b_mgr.get_issue_list()) + + def test_blacklist_input(self): + expect = { + 'SEVERITY': {'HIGH': 1}, + 'CONFIDENCE': {'HIGH': 1} + } + self.check_example('input.py', expect)