Flake8 plugin adding some checks to make Python code adhere to more secure coding standard
Project description
Flake8 Secure Coding Standard Plugin
flake8 plugin that enforces some secure coding standards.
Installation
pip install flake8-secure-coding-standard
Flake8 codes
| Code | Description |
|---|---|
| SCS100 | Use of os.path.abspath() and os.path.relpath() should be avoided in favor of os.path.realpath() |
| SCS101 | Use of eval() and exec() represent a security risk and should be avoided |
| SCS102 | Use of os.system() should be avoided |
| SCS103 | Use of shell=True in subprocess functions or use of functions that internally set this should be avoided |
| SCS104 | Use of tempfile.mktemp() should be avoided, prefer tempfile.mkstemp() |
| SCS105 | Use of yaml.load() should be avoided, prefer yaml.safe_load() or yaml.load(xxx, Loader=SafeLoader) |
| SCS106 | Use of jsonpickle.decode() should be avoided |
| SCS107 | Use of debugging code should not be present in production code (e.g. import pdb) |
| SCS108 | assert statements should not be present in production code |
| SCS109 | Use of builtin open for writing is discouraged in favor of os.open to allow for setting file permissions |
| SCS110 | Avoid using os.popen() as it internally uses subprocess.Popen with shell=True |
| SCS111 | Use of shlex.quote() should be avoided on non-POSIX platforms |
| SCS112 | Avoid using os.open() with unsafe file permissions |
| SCS113 | Avoid using pickle.load() and pickle.loads() |
| SCS114 | Avoid using marshal.load() and marshal.loads() |
| SCS115 | Avoid using shelve.open() |
| SCS116 | Avoid using os.mkdir and os.makedirs with unsafe file permissions |
| SCS117 | Avoid using os.mkfifo with unsafe file permissions |
| SCS118 | Avoid using os.mknod with unsafe file permissions |
| SCS119 | Avoid using os.chmod with unsafe file permissions (W ^ X for group and others) |
Plugin configuration options
This plugin supports some configuration options that may either be specified directly on the command line with a flag
using the option name as --name or by specifying them in one of flake8's configuration files (ie. pyproject.toml,
setup.cfg, .flake8, etc.).
Available options:
| Option name | Option type | Default value | Related error code |
|---|---|---|---|
| os-open-mode | mode-like | 0 (off) | SCS112 |
| os-mkdir-mode | mode-like | 0 (off) | SCS116 |
| os-mkfifo-mode | mode-like | 0 (off) | SCS117 |
| os-mknod-mode | mode-like | 0 (off) | SCS118 |
Mode-like options
Mode-like options are configuration options for errors/warnings that relate to some function that accepts a mode
parameter (or similar) that control some file or directory permissions. For those kind of options, the plugin
understands a variety of values that must be specified as string. They will then be parsed into a list of allowed mode
values:
- Any positive, non-zero (octal or decimal) integer value specifies the maximum value for the mode value
- A comma-separated list of (octal or decimal) integers indicates the list of allowed mode values
- 'y', 'yes', 'true' (case-insensitive) will turn on the warnings using the default value of
0o755 - 'n', 'no', 'false' (case-insensitive) will turn off the warnings
Example of values (for pyproject.toml):
[tool.flake8]
os-open-mode = '0' # check disabled
os-open-mode = 'no' # check disabled
os-open-mode = '493' # all modes from 0 to 493 (=0o755)
os-open-mode = '0o755' # all modes from 0 to 0o755
os-open-mode = '0o755,' # only 0o755 (notice the comma)
os-open-mode = '0o644,0o755' # only 0o644 and 0o755
You can also specify those options directly on the command line:
python3 -m flake8 --os-open-mode='0o755'
Pre-commit hook
See pre-commit for instructions
Sample .pre-commit-config.yaml:
- repo: https://github.com/PyCQA/flake8
rev: 4.0.0
hooks:
- id: flake8
additional_dependencies: [flake8-secure-coding-standard]
Release history Release notifications | RSS feed
Download files
Download the file for your platform. If you're not sure which to choose, learn more about installing packages.
Source Distribution
Built Distribution
Hashes for flake8-secure-coding-standard-1.4.1.tar.gz
| Algorithm | Hash digest | |
|---|---|---|
| SHA256 | 75590fba3af46028a908bad7c11e789b6c1bf78805be54f92229d3c490009bf2 |
|
| MD5 | d243f6313b41bf97c04b9781932a297a |
|
| BLAKE2b-256 | cea6ac397ae47be9f25b6fe99ba0639d261936215ce42f897813194b4a6d09d1 |
Hashes for flake8_secure_coding_standard-1.4.1-py2.py3-none-any.whl
| Algorithm | Hash digest | |
|---|---|---|
| SHA256 | 65b06d6935e19c22ec457b2f9c805f083969bd33cefdbcdceee8d41abb761695 |
|
| MD5 | b9bc5b9ea3da1ef48ab981b91f407aff |
|
| BLAKE2b-256 | 8a6bb52c3ad5dcc50b81741136d00b1441782690fdecde92819d53b3f75dc643 |
