Advertisement
Not a member of Pastebin yet?
Sign Up,
it unlocks many cool features!
- # optional: after how many files to update progress
- #show_progress_every: 100
- # optional: plugins directory name
- #plugins_dir: 'plugins'
- # optional: plugins discovery name pattern
- plugin_name_pattern: '*.py'
- # optional: terminal escape sequences to display colors
- #output_colors:
- # DEFAULT: '\033[0m'
- # HEADER: '\033[95m'
- # INFO: '\033[94m'
- # WARN: '\033[93m'
- # ERROR: '\033[91m'
- # optional: log format string
- #log_format: "[%(module)s]\t%(levelname)s\t%(message)s"
- # globs of files which should be analyzed
- include:
- - '*.py'
- - '*.pyw'
- # a list of strings, which if found in the path will cause files to be excluded
- # for example /tests/ - to remove all all files in tests directory
- exclude_dirs:
- - '/tests/'
- - '/doc/'
- profiles:
- keystone_conservative:
- include:
- - blacklist_functions
- - blacklist_imports
- - request_with_no_cert_validation
- - exec_used
- - set_bad_file_permissions
- - subprocess_popen_with_shell_equals_true
- - linux_commands_wildcard_injection
- - ssl_with_bad_version
- keystone_verbose:
- include:
- - blacklist_functions
- - blacklist_imports
- - request_with_no_cert_validation
- - exec_used
- - set_bad_file_permissions
- - hardcoded_tmp_directory
- - subprocess_popen_with_shell_equals_true
- - any_other_function_with_shell_equals_true
- - linux_commands_wildcard_injection
- - ssl_with_bad_version
- - ssl_with_bad_defaults
- blacklist_functions:
- bad_name_sets:
- - pickle:
- qualnames: [pickle.loads, pickle.load, pickle.Unpickler,
- cPickle.loads, cPickle.load, cPickle.Unpickler]
- message: "Pickle library appears to be in use, possible security issue."
- - marshal:
- qualnames: [marshal.load, marshal.loads]
- message: "Deserialization with the marshal module is possibly dangerous."
- - md5:
- qualnames: [hashlib.md5]
- message: "Use of insecure MD5 hash function."
- - mktemp_q:
- qualnames: [tempfile.mktemp]
- message: "Use of insecure and deprecated function (mktemp)."
- - eval:
- qualnames: [eval]
- message: "Use of possibly insecure function - consider using safer ast.literal_eval."
- - mark_safe:
- names: [mark_safe]
- message: "Use of mark_safe() may expose cross-site scripting vulnerabilities and should be reviewed."
- - httpsconnection:
- qualnames: [httplib.HTTPSConnection]
- message: "Use of HTTPSConnection does not provide security, see https://wiki.openstack.org/wiki/OSSN/OSSN-0033"
- - yaml_load:
- qualnames: [yaml.load]
- message: "Use of unsafe yaml load. Allows instantiation of arbitrary objects. Consider yaml.safe_load()."
- - urllib_urlopen:
- qualnames: [urllib.urlopen, urllib.urlretrieve, urllib.URLopener, urllib.FancyURLopener, urllib2.urlopen, urllib2.Request]
- message: "Audit url open for permitted schemes. Allowing use of file:/ or custom schemes is often unexpected."
- shell_injection:
- # Start a process using the subprocess module, or one of its wrappers.
- subprocess: [subprocess.Popen, subprocess.call, subprocess.check_call,
- subprocess.check_output, utils.execute, utils.execute_with_timeout]
- # Start a process with a function vulnerable to shell injection.
- shell: [os.system, os.popen, os.popen2, os.popen3, os.popen4,
- popen2.popen2, popen2.popen3, popen2.popen4, popen2.Popen3,
- popen2.Popen4, commands.getoutput, commands.getstatusoutput]
- # Start a process with a function that is not vulnerable to shell injection.
- no_shell: [os.execl, os.execle, os.execlp, os.execlpe, os.execv,os.execve,
- os.execvp, os.execvpe, os.spawnl, os.spawnle, os.spawnlp,
- os.spawnlpe, os.spawnv, os.spawnve, os.spawnvp, os.spawnvpe,
- os.startfile]
- blacklist_imports:
- bad_import_sets:
- - telnet:
- imports: [telnetlib]
- level: ERROR
- message: "Telnet is considered insecure. Use SSH or some other encrypted protocol."
- password_config_option_not_marked_secret:
- function_names:
- - oslo.config.cfg.StrOpt
- - oslo_config.cfg.StrOpt
- ssl_with_bad_version:
- bad_protocol_versions:
- - 'PROTOCOL_SSLv2'
- - 'SSLv2_METHOD'
- - 'SSLv23_METHOD'
Advertisement
Add Comment
Please, Sign In to add comment
Advertisement