Sign upLogin

failmap/admin

View on GitHub
Star
websecmap/scanners/scanner/security_headers.py

Summary

Maintainability
C
7 hrs
Test Coverage

File security_headers.py has 319 lines of code (exceeds 250 allowed). Consider refactoring.
Open

"""
Check if the https site uses HSTS to tell the browser the site should only be reached over HTTPS.
(useful until browsers do https by default, instead of by choice)
"""
import logging
Severity: Minor
Found in websecmap/scanners/scanner/security_headers.py - About 3 hrs to fix

    Cyclomatic complexity is too high in function analyze_headers. (9)
    Open

    @app.task(queue="storage")
def analyze_headers(headers: Dict[str, str], endpoint_id):
    # todo: remove code paths, and make a more clear case per header type. That's easier to understand edge cases.
    # todo: Content-Security-Policy, Referrer-Policy
    Severity: Minor
    Found in websecmap/scanners/scanner/security_headers.py by radon

    Cyclomatic Complexity

    Cyclomatic Complexity corresponds to the number of decisions a block of code contains plus 1. This number (also called McCabe number) is equal to the number of linearly independent paths through the code. This number can be used as a guide when testing conditional logic in blocks.

    Radon analyzes the AST tree of a Python program to compute Cyclomatic Complexity. Statements have the following effects on Cyclomatic Complexity:

    Construct Effect on CC Reasoning
    if +1 An if statement is a single decision.
    elif +1 The elif statement adds another decision.
    else +0 The else statement does not cause a new decision. The decision is at the if.
    for +1 There is a decision at the start of the loop.
    while +1 There is a decision at the while statement.
    except +1 Each except branch adds a new conditional path of execution.
    finally +0 The finally block is unconditionally executed.
    with +1 The with statement roughly corresponds to a try/except block (see PEP 343 for details).
    assert +1 The assert statement internally roughly equals a conditional statement.
    Comprehension +1 A list/set/dict comprehension of generator expression is equivalent to a for loop.
    Boolean Operator +1 Every boolean operator (and, or) adds a decision point.

    Source: http://radon.readthedocs.org/en/latest/intro.html

    Cyclomatic complexity is too high in function discover_service_type. (6)
    Open

    def discover_service_type(headers: Dict = None):
    """
    Try to discover some meaning of the webserver headers, because some HTTP servers are used for entirely different
    purposes than hosting web pages. For example SOAP is used for XML messages and has their own security paradigm.
    Severity: Minor
    Found in websecmap/scanners/scanner/security_headers.py by radon

    Cyclomatic Complexity

    Cyclomatic Complexity corresponds to the number of decisions a block of code contains plus 1. This number (also called McCabe number) is equal to the number of linearly independent paths through the code. This number can be used as a guide when testing conditional logic in blocks.

    Radon analyzes the AST tree of a Python program to compute Cyclomatic Complexity. Statements have the following effects on Cyclomatic Complexity:

    Construct Effect on CC Reasoning
    if +1 An if statement is a single decision.
    elif +1 The elif statement adds another decision.
    else +0 The else statement does not cause a new decision. The decision is at the if.
    for +1 There is a decision at the start of the loop.
    while +1 There is a decision at the while statement.
    except +1 Each except branch adds a new conditional path of execution.
    finally +0 The finally block is unconditionally executed.
    with +1 The with statement roughly corresponds to a try/except block (see PEP 343 for details).
    assert +1 The assert statement internally roughly equals a conditional statement.
    Comprehension +1 A list/set/dict comprehension of generator expression is equivalent to a for loop.
    Boolean Operator +1 Every boolean operator (and, or) adds a decision point.

    Source: http://radon.readthedocs.org/en/latest/intro.html

    Function analyze_headers has a Cognitive Complexity of 10 (exceeds 5 allowed). Consider refactoring.
    Open

    def analyze_headers(headers: Dict[str, str], endpoint_id):
    # todo: remove code paths, and make a more clear case per header type. That's easier to understand edge cases.
    # todo: Content-Security-Policy, Referrer-Policy

    # if scan task failed, ignore the result (exception) and report failed status
    Severity: Minor
    Found in websecmap/scanners/scanner/security_headers.py - About 1 hr to fix

    Cognitive Complexity

    Cognitive Complexity is a measure of how difficult a unit of code is to intuitively understand. Unlike Cyclomatic Complexity, which determines how difficult your code will be to test, Cognitive Complexity tells you how difficult your code will be to read and comprehend.

    A method's cognitive complexity is based on a few simple rules:

    • Code is not considered more complex when it uses shorthand that the language provides for collapsing multiple statements into one
    • Code is considered more complex for each "break in the linear flow of the code"
    • Code is considered more complex when "flow breaking structures are nested"

    Further reading

    Function analyze_website_headers has a Cognitive Complexity of 8 (exceeds 5 allowed). Consider refactoring.
    Open

    def analyze_website_headers(endpoint_id: int, url: int, protocol: str, headers: Dict[str, str]):
    """
    #125: CSP can replace X-XSS-Protection and X-Frame-Options. Thus if a (more modern) CSP header is present, assume
    that decisions have been made about what's in it and ignore the previously mentioned headers.
    Severity: Minor
    Found in websecmap/scanners/scanner/security_headers.py - About 45 mins to fix

    Cognitive Complexity

    Cognitive Complexity is a measure of how difficult a unit of code is to intuitively understand. Unlike Cyclomatic Complexity, which determines how difficult your code will be to test, Cognitive Complexity tells you how difficult your code will be to read and comprehend.

    A method's cognitive complexity is based on a few simple rules:

    • Code is not considered more complex when it uses shorthand that the language provides for collapsing multiple statements into one
    • Code is considered more complex for each "break in the linear flow of the code"
    • Code is considered more complex when "flow breaking structures are nested"

    Further reading

    Avoid too many return statements within this function.
    Open

        return "UNKNOWN"
    Severity: Major
    Found in websecmap/scanners/scanner/security_headers.py - About 30 mins to fix

      Avoid too many return statements within this function.
      Open

              return analyze_soap_headers(endpoint_id)
      Severity: Major
      Found in websecmap/scanners/scanner/security_headers.py - About 30 mins to fix

        Avoid too many return statements within this function.
        Open

                return clean_up_existing_headers(endpoint_id, service_type=service_type, reason="unknown_content_type")
        Severity: Major
        Found in websecmap/scanners/scanner/security_headers.py - About 30 mins to fix

          Avoid too many return statements within this function.
          Open

                  return clean_up_existing_headers(endpoint_id, service_type=service_type, reason="authentication_required")
          Severity: Major
          Found in websecmap/scanners/scanner/security_headers.py - About 30 mins to fix

            There are no issues that match your filters.

            Category
            Status