Sign upLogin

python-security/pyt

View on GitHub
Star
pyt/vulnerabilities/vulnerabilities.py

Summary

Maintainability
D
2 days
Test Coverage

File vulnerabilities.py has 458 lines of code (exceeds 250 allowed). Consider refactoring.
Open

"""Module for finding vulnerabilities based on a definitions file."""

import ast
import json
from collections import defaultdict
Severity: Minor
Found in pyt/vulnerabilities/vulnerabilities.py - About 7 hrs to fix

    Function get_vulnerability has a Cognitive Complexity of 23 (exceeds 5 allowed). Consider refactoring.
    Open

    def get_vulnerability(
    source,
    sink,
    triggers,
    lattice,
    Severity: Minor
    Found in pyt/vulnerabilities/vulnerabilities.py - About 3 hrs to fix

    Cognitive Complexity

    Cognitive Complexity is a measure of how difficult a unit of code is to intuitively understand. Unlike Cyclomatic Complexity, which determines how difficult your code will be to test, Cognitive Complexity tells you how difficult your code will be to read and comprehend.

    A method's cognitive complexity is based on a few simple rules:

    • Code is not considered more complex when it uses shorthand that the language provides for collapsing multiple statements into one
    • Code is considered more complex for each "break in the linear flow of the code"
    • Code is considered more complex when "flow breaking structures are nested"

    Further reading

    Cyclomatic complexity is too high in function get_vulnerability. (12)
    Open

    def get_vulnerability(
    source,
    sink,
    triggers,
    lattice,
    Severity: Minor
    Found in pyt/vulnerabilities/vulnerabilities.py by radon

    Cyclomatic Complexity

    Cyclomatic Complexity corresponds to the number of decisions a block of code contains plus 1. This number (also called McCabe number) is equal to the number of linearly independent paths through the code. This number can be used as a guide when testing conditional logic in blocks.

    Radon analyzes the AST tree of a Python program to compute Cyclomatic Complexity. Statements have the following effects on Cyclomatic Complexity:

    Construct Effect on CC Reasoning
    if +1 An if statement is a single decision.
    elif +1 The elif statement adds another decision.
    else +0 The else statement does not cause a new decision. The decision is at the if.
    for +1 There is a decision at the start of the loop.
    while +1 There is a decision at the while statement.
    except +1 Each except branch adds a new conditional path of execution.
    finally +0 The finally block is unconditionally executed.
    with +1 The with statement roughly corresponds to a try/except block (see PEP 343 for details).
    assert +1 The assert statement internally roughly equals a conditional statement.
    Comprehension +1 A list/set/dict comprehension of generator expression is equivalent to a for loop.
    Boolean Operator +1 Every boolean operator (and, or) adds a decision point.

    Source: http://radon.readthedocs.org/en/latest/intro.html

    Function how_vulnerable has a Cognitive Complexity of 20 (exceeds 5 allowed). Consider refactoring.
    Open

    def how_vulnerable(
    chain,
    blackbox_mapping,
    sanitiser_nodes,
    potential_sanitiser,
    Severity: Minor
    Found in pyt/vulnerabilities/vulnerabilities.py - About 2 hrs to fix

    Cognitive Complexity

    Cognitive Complexity is a measure of how difficult a unit of code is to intuitively understand. Unlike Cyclomatic Complexity, which determines how difficult your code will be to test, Cognitive Complexity tells you how difficult your code will be to read and comprehend.

    A method's cognitive complexity is based on a few simple rules:

    • Code is not considered more complex when it uses shorthand that the language provides for collapsing multiple statements into one
    • Code is considered more complex for each "break in the linear flow of the code"
    • Code is considered more complex when "flow breaking structures are nested"

    Further reading

    Cyclomatic complexity is too high in function how_vulnerable. (10)
    Open

    def how_vulnerable(
    chain,
    blackbox_mapping,
    sanitiser_nodes,
    potential_sanitiser,
    Severity: Minor
    Found in pyt/vulnerabilities/vulnerabilities.py by radon

    Cyclomatic Complexity

    Cyclomatic Complexity corresponds to the number of decisions a block of code contains plus 1. This number (also called McCabe number) is equal to the number of linearly independent paths through the code. This number can be used as a guide when testing conditional logic in blocks.

    Radon analyzes the AST tree of a Python program to compute Cyclomatic Complexity. Statements have the following effects on Cyclomatic Complexity:

    Construct Effect on CC Reasoning
    if +1 An if statement is a single decision.
    elif +1 The elif statement adds another decision.
    else +0 The else statement does not cause a new decision. The decision is at the if.
    for +1 There is a decision at the start of the loop.
    while +1 There is a decision at the while statement.
    except +1 Each except branch adds a new conditional path of execution.
    finally +0 The finally block is unconditionally executed.
    with +1 The with statement roughly corresponds to a try/except block (see PEP 343 for details).
    assert +1 The assert statement internally roughly equals a conditional statement.
    Comprehension +1 A list/set/dict comprehension of generator expression is equivalent to a for loop.
    Boolean Operator +1 Every boolean operator (and, or) adds a decision point.

    Source: http://radon.readthedocs.org/en/latest/intro.html

    Cyclomatic complexity is too high in function get_sink_args_which_propagate. (8)
    Open

    def get_sink_args_which_propagate(sink, ast_node):
    sink_args_with_positions = CallVisitor.get_call_visit_results(sink.trigger.call, ast_node)
    sink_args = []
    kwargs_present = set()
    Severity: Minor
    Found in pyt/vulnerabilities/vulnerabilities.py by radon

    Cyclomatic Complexity

    Cyclomatic Complexity corresponds to the number of decisions a block of code contains plus 1. This number (also called McCabe number) is equal to the number of linearly independent paths through the code. This number can be used as a guide when testing conditional logic in blocks.

    Radon analyzes the AST tree of a Python program to compute Cyclomatic Complexity. Statements have the following effects on Cyclomatic Complexity:

    Construct Effect on CC Reasoning
    if +1 An if statement is a single decision.
    elif +1 The elif statement adds another decision.
    else +0 The else statement does not cause a new decision. The decision is at the if.
    for +1 There is a decision at the start of the loop.
    while +1 There is a decision at the while statement.
    except +1 Each except branch adds a new conditional path of execution.
    finally +0 The finally block is unconditionally executed.
    with +1 The with statement roughly corresponds to a try/except block (see PEP 343 for details).
    assert +1 The assert statement internally roughly equals a conditional statement.
    Comprehension +1 A list/set/dict comprehension of generator expression is equivalent to a for loop.
    Boolean Operator +1 Every boolean operator (and, or) adds a decision point.

    Source: http://radon.readthedocs.org/en/latest/intro.html

    Cyclomatic complexity is too high in function build_sanitiser_node_dict. (6)
    Open

    def build_sanitiser_node_dict(
    cfg,
    sinks_in_file
):
    """Build a dict of string -> TriggerNode pairs, where the string
    Severity: Minor
    Found in pyt/vulnerabilities/vulnerabilities.py by radon

    Cyclomatic Complexity

    Cyclomatic Complexity corresponds to the number of decisions a block of code contains plus 1. This number (also called McCabe number) is equal to the number of linearly independent paths through the code. This number can be used as a guide when testing conditional logic in blocks.

    Radon analyzes the AST tree of a Python program to compute Cyclomatic Complexity. Statements have the following effects on Cyclomatic Complexity:

    Construct Effect on CC Reasoning
    if +1 An if statement is a single decision.
    elif +1 The elif statement adds another decision.
    else +0 The else statement does not cause a new decision. The decision is at the if.
    for +1 There is a decision at the start of the loop.
    while +1 There is a decision at the while statement.
    except +1 Each except branch adds a new conditional path of execution.
    finally +0 The finally block is unconditionally executed.
    with +1 The with statement roughly corresponds to a try/except block (see PEP 343 for details).
    assert +1 The assert statement internally roughly equals a conditional statement.
    Comprehension +1 A list/set/dict comprehension of generator expression is equivalent to a for loop.
    Boolean Operator +1 Every boolean operator (and, or) adds a decision point.

    Source: http://radon.readthedocs.org/en/latest/intro.html

    Function get_sink_args_which_propagate has a Cognitive Complexity of 10 (exceeds 5 allowed). Consider refactoring.
    Open

    def get_sink_args_which_propagate(sink, ast_node):
    sink_args_with_positions = CallVisitor.get_call_visit_results(sink.trigger.call, ast_node)
    sink_args = []
    kwargs_present = set()
    Severity: Minor
    Found in pyt/vulnerabilities/vulnerabilities.py - About 1 hr to fix

    Cognitive Complexity

    Cognitive Complexity is a measure of how difficult a unit of code is to intuitively understand. Unlike Cyclomatic Complexity, which determines how difficult your code will be to test, Cognitive Complexity tells you how difficult your code will be to read and comprehend.

    A method's cognitive complexity is based on a few simple rules:

    • Code is not considered more complex when it uses shorthand that the language provides for collapsing multiple statements into one
    • Code is considered more complex for each "break in the linear flow of the code"
    • Code is considered more complex when "flow breaking structures are nested"

    Further reading

    Function find_vulnerabilities_in_cfg has 7 arguments (exceeds 4 allowed). Consider refactoring.
    Open

    def find_vulnerabilities_in_cfg(
    Severity: Major
    Found in pyt/vulnerabilities/vulnerabilities.py - About 50 mins to fix

      Function how_vulnerable has 7 arguments (exceeds 4 allowed). Consider refactoring.
      Open

      def how_vulnerable(
      Severity: Major
      Found in pyt/vulnerabilities/vulnerabilities.py - About 50 mins to fix

        Function get_vulnerability has 7 arguments (exceeds 4 allowed). Consider refactoring.
        Open

        def get_vulnerability(
        Severity: Major
        Found in pyt/vulnerabilities/vulnerabilities.py - About 50 mins to fix

          Avoid deeply nested control flow statements.
          Open

                              if isinstance(cfg_node, AssignmentNode):
                        sanitiser_nodes.add(cfg_node)
                    elif isinstance(cfg_node, IfNode):
                        potential_sanitiser = cfg_node
          Severity: Major
          Found in pyt/vulnerabilities/vulnerabilities.py - About 45 mins to fix

            Function build_sanitiser_node_dict has a Cognitive Complexity of 8 (exceeds 5 allowed). Consider refactoring.
            Open

            def build_sanitiser_node_dict(
    cfg,
    sinks_in_file
):
    """Build a dict of string -> TriggerNode pairs, where the string
            Severity: Minor
            Found in pyt/vulnerabilities/vulnerabilities.py - About 45 mins to fix

            Cognitive Complexity

            Cognitive Complexity is a measure of how difficult a unit of code is to intuitively understand. Unlike Cyclomatic Complexity, which determines how difficult your code will be to test, Cognitive Complexity tells you how difficult your code will be to read and comprehend.

            A method's cognitive complexity is based on a few simple rules:

            • Code is not considered more complex when it uses shorthand that the language provides for collapsing multiple statements into one
            • Code is considered more complex for each "break in the linear flow of the code"
            • Code is considered more complex when "flow breaking structures are nested"

            Further reading

            Function identify_triggers has 5 arguments (exceeds 4 allowed). Consider refactoring.
            Open

            def identify_triggers(
            Severity: Minor
            Found in pyt/vulnerabilities/vulnerabilities.py - About 35 mins to fix

              Function find_vulnerabilities has 5 arguments (exceeds 4 allowed). Consider refactoring.
              Open

              def find_vulnerabilities(
              Severity: Minor
              Found in pyt/vulnerabilities/vulnerabilities.py - About 35 mins to fix

                Function update_assignments has a Cognitive Complexity of 7 (exceeds 5 allowed). Consider refactoring.
                Open

                def update_assignments(
    assignment_list,
    assignment_nodes,
    source,
    lattice
                Severity: Minor
                Found in pyt/vulnerabilities/vulnerabilities.py - About 35 mins to fix

                Cognitive Complexity

                Cognitive Complexity is a measure of how difficult a unit of code is to intuitively understand. Unlike Cyclomatic Complexity, which determines how difficult your code will be to test, Cognitive Complexity tells you how difficult your code will be to read and comprehend.

                A method's cognitive complexity is based on a few simple rules:

                • Code is not considered more complex when it uses shorthand that the language provides for collapsing multiple statements into one
                • Code is considered more complex for each "break in the linear flow of the code"
                • Code is considered more complex when "flow breaking structures are nested"

                Further reading

                Avoid too many return statements within this function.
                Open

                    return VulnerabilityType.TRUE, interactive
                Severity: Major
                Found in pyt/vulnerabilities/vulnerabilities.py - About 30 mins to fix

                  Avoid too many return statements within this function.
                  Open

                                  return VulnerabilityType.UNKNOWN, interactive
                  Severity: Major
                  Found in pyt/vulnerabilities/vulnerabilities.py - About 30 mins to fix

                    Avoid too many return statements within this function.
                    Open

                            return VulnerabilityType.SANITISED, interactive
                    Severity: Major
                    Found in pyt/vulnerabilities/vulnerabilities.py - About 30 mins to fix

                      Function find_vulnerabilities_in_cfg has a Cognitive Complexity of 6 (exceeds 5 allowed). Consider refactoring.
                      Open

                      def find_vulnerabilities_in_cfg(
    cfg,
    definitions,
    lattice,
    blackbox_mapping,
                      Severity: Minor
                      Found in pyt/vulnerabilities/vulnerabilities.py - About 25 mins to fix

                      Cognitive Complexity

                      Cognitive Complexity is a measure of how difficult a unit of code is to intuitively understand. Unlike Cyclomatic Complexity, which determines how difficult your code will be to test, Cognitive Complexity tells you how difficult your code will be to read and comprehend.

                      A method's cognitive complexity is based on a few simple rules:

                      • Code is not considered more complex when it uses shorthand that the language provides for collapsing multiple statements into one
                      • Code is considered more complex for each "break in the linear flow of the code"
                      • Code is considered more complex when "flow breaking structures are nested"

                      Further reading

                      There are no issues that match your filters.

                      Category
                      Status