Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

fix(rules): improve S507 detection #7661

Merged
merged 4 commits into from Sep 28, 2023
Merged

fix(rules): improve S507 detection #7661

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
4 commits
Select commit Hold shift + click to select a range
9b9d833
fix(rules): detect policy instances in S507
mkniewallner Sep 25, 2023
98d74c0
fix(rules): account for `paramiko.*` imports
mkniewallner Sep 25, 2023
3fe2449
Merge branch 'main' into fix/detect-more-S507-misusages
charliermarsh Sep 28, 2023
27187e8
Use map_callable
charliermarsh Sep 28, 2023
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Jump to
Jump to file
Failed to load files.
Diff view
Diff view
4 changes: 4 additions & 0 deletions crates/ruff_linter/resources/test/fixtures/flake8_bandit/S507.py
View file
Open in desktop
@@ -1,7 +1,9 @@
import paramiko
from paramiko import client
from paramiko.client import AutoAddPolicy, WarningPolicy

ssh_client = client.SSHClient()
ssh_client_from_paramiko = paramiko.SSHClient()

# OK
ssh_client.set_missing_host_key_policy(policy=foo)
Expand All @@ -12,10 +14,12 @@
# Errors
ssh_client.set_missing_host_key_policy(client.AutoAddPolicy)
ssh_client.set_missing_host_key_policy(client.WarningPolicy)
ssh_client.set_missing_host_key_policy(client.AutoAddPolicy())
ssh_client.set_missing_host_key_policy(AutoAddPolicy)
ssh_client.set_missing_host_key_policy(policy=client.AutoAddPolicy)
ssh_client.set_missing_host_key_policy(policy=client.WarningPolicy)
ssh_client.set_missing_host_key_policy(policy=WarningPolicy)
ssh_client_from_paramiko.set_missing_host_key_policy(paramiko.AutoAddPolicy)

# Unrelated
set_missing_host_key_policy(client.AutoAddPolicy)
Expand Down
10 changes: 8 additions & 2 deletions crates/ruff_linter/src/rules/flake8_bandit/rules/ssh_no_host_key_verification.rs
View file
Open in desktop
@@ -1,5 +1,6 @@
use ruff_diagnostics::{Diagnostic, Violation};
use ruff_macros::{derive_message_formats, violation};
use ruff_python_ast::helpers::map_callable;
use ruff_python_ast::{Expr, ExprAttribute, ExprCall};
use ruff_python_semantic::analyze::typing;
use ruff_text_size::Ranged;
Expand Down Expand Up @@ -56,21 +57,26 @@ pub(crate) fn ssh_no_host_key_verification(checker: &mut Checker, call: &ExprCal
return;
};

// Detect either, e.g., `paramiko.client.AutoAddPolicy` or `paramiko.client.AutoAddPolicy()`.
if !checker
.semantic()
.resolve_call_path(policy_argument)
.resolve_call_path(map_callable(policy_argument))
.is_some_and(|call_path| {
matches!(
call_path.as_slice(),
["paramiko", "client", "AutoAddPolicy" | "WarningPolicy"]
| ["paramiko", "AutoAddPolicy" | "WarningPolicy"]
)
})
{
return;
}

if typing::resolve_assignment(value, checker.semantic()).is_some_and(|call_path| {
matches!(call_path.as_slice(), ["paramiko", "client", "SSHClient"])
matches!(
call_path.as_slice(),
["paramiko", "client", "SSHClient"] | ["paramiko", "SSHClient"]
)
}) {
checker.diagnostics.push(Diagnostic::new(
SSHNoHostKeyVerification,
Expand Down
88 changes: 54 additions & 34 deletions ...rules/flake8_bandit/snapshots/ruff_linter__rules__flake8_bandit__tests__S507_S507.py.snap
View file
Open in desktop
@@ -1,62 +1,82 @@
---
source: crates/ruff_linter/src/rules/flake8_bandit/mod.rs
---
S507.py:13:40: S507 Paramiko call with policy set to automatically trust the unknown host key
S507.py:15:40: S507 Paramiko call with policy set to automatically trust the unknown host key
|
12 | # Errors
13 | ssh_client.set_missing_host_key_policy(client.AutoAddPolicy)
14 | # Errors
15 | ssh_client.set_missing_host_key_policy(client.AutoAddPolicy)
| ^^^^^^^^^^^^^^^^^^^^ S507
14 | ssh_client.set_missing_host_key_policy(client.WarningPolicy)
15 | ssh_client.set_missing_host_key_policy(AutoAddPolicy)
16 | ssh_client.set_missing_host_key_policy(client.WarningPolicy)
17 | ssh_client.set_missing_host_key_policy(client.AutoAddPolicy())
|

S507.py:14:40: S507 Paramiko call with policy set to automatically trust the unknown host key
S507.py:16:40: S507 Paramiko call with policy set to automatically trust the unknown host key
|
12 | # Errors
13 | ssh_client.set_missing_host_key_policy(client.AutoAddPolicy)
14 | ssh_client.set_missing_host_key_policy(client.WarningPolicy)
14 | # Errors
15 | ssh_client.set_missing_host_key_policy(client.AutoAddPolicy)
16 | ssh_client.set_missing_host_key_policy(client.WarningPolicy)
| ^^^^^^^^^^^^^^^^^^^^ S507
15 | ssh_client.set_missing_host_key_policy(AutoAddPolicy)
16 | ssh_client.set_missing_host_key_policy(policy=client.AutoAddPolicy)
17 | ssh_client.set_missing_host_key_policy(client.AutoAddPolicy())
18 | ssh_client.set_missing_host_key_policy(AutoAddPolicy)
|

S507.py:15:40: S507 Paramiko call with policy set to automatically trust the unknown host key
S507.py:17:40: S507 Paramiko call with policy set to automatically trust the unknown host key
|
15 | ssh_client.set_missing_host_key_policy(client.AutoAddPolicy)
16 | ssh_client.set_missing_host_key_policy(client.WarningPolicy)
17 | ssh_client.set_missing_host_key_policy(client.AutoAddPolicy())
| ^^^^^^^^^^^^^^^^^^^^^^ S507
18 | ssh_client.set_missing_host_key_policy(AutoAddPolicy)
19 | ssh_client.set_missing_host_key_policy(policy=client.AutoAddPolicy)
|

S507.py:18:40: S507 Paramiko call with policy set to automatically trust the unknown host key
|
13 | ssh_client.set_missing_host_key_policy(client.AutoAddPolicy)
14 | ssh_client.set_missing_host_key_policy(client.WarningPolicy)
15 | ssh_client.set_missing_host_key_policy(AutoAddPolicy)
16 | ssh_client.set_missing_host_key_policy(client.WarningPolicy)
17 | ssh_client.set_missing_host_key_policy(client.AutoAddPolicy())
18 | ssh_client.set_missing_host_key_policy(AutoAddPolicy)
| ^^^^^^^^^^^^^ S507
16 | ssh_client.set_missing_host_key_policy(policy=client.AutoAddPolicy)
17 | ssh_client.set_missing_host_key_policy(policy=client.WarningPolicy)
19 | ssh_client.set_missing_host_key_policy(policy=client.AutoAddPolicy)
20 | ssh_client.set_missing_host_key_policy(policy=client.WarningPolicy)
|

S507.py:16:47: S507 Paramiko call with policy set to automatically trust the unknown host key
S507.py:19:47: S507 Paramiko call with policy set to automatically trust the unknown host key
|
14 | ssh_client.set_missing_host_key_policy(client.WarningPolicy)
15 | ssh_client.set_missing_host_key_policy(AutoAddPolicy)
16 | ssh_client.set_missing_host_key_policy(policy=client.AutoAddPolicy)
17 | ssh_client.set_missing_host_key_policy(client.AutoAddPolicy())
18 | ssh_client.set_missing_host_key_policy(AutoAddPolicy)
19 | ssh_client.set_missing_host_key_policy(policy=client.AutoAddPolicy)
| ^^^^^^^^^^^^^^^^^^^^ S507
17 | ssh_client.set_missing_host_key_policy(policy=client.WarningPolicy)
18 | ssh_client.set_missing_host_key_policy(policy=WarningPolicy)
20 | ssh_client.set_missing_host_key_policy(policy=client.WarningPolicy)
21 | ssh_client.set_missing_host_key_policy(policy=WarningPolicy)
|

S507.py:17:47: S507 Paramiko call with policy set to automatically trust the unknown host key
S507.py:20:47: S507 Paramiko call with policy set to automatically trust the unknown host key
|
15 | ssh_client.set_missing_host_key_policy(AutoAddPolicy)
16 | ssh_client.set_missing_host_key_policy(policy=client.AutoAddPolicy)
17 | ssh_client.set_missing_host_key_policy(policy=client.WarningPolicy)
18 | ssh_client.set_missing_host_key_policy(AutoAddPolicy)
19 | ssh_client.set_missing_host_key_policy(policy=client.AutoAddPolicy)
20 | ssh_client.set_missing_host_key_policy(policy=client.WarningPolicy)
| ^^^^^^^^^^^^^^^^^^^^ S507
18 | ssh_client.set_missing_host_key_policy(policy=WarningPolicy)
21 | ssh_client.set_missing_host_key_policy(policy=WarningPolicy)
22 | ssh_client_from_paramiko.set_missing_host_key_policy(paramiko.AutoAddPolicy)
|

S507.py:18:47: S507 Paramiko call with policy set to automatically trust the unknown host key
S507.py:21:47: S507 Paramiko call with policy set to automatically trust the unknown host key
|
16 | ssh_client.set_missing_host_key_policy(policy=client.AutoAddPolicy)
17 | ssh_client.set_missing_host_key_policy(policy=client.WarningPolicy)
18 | ssh_client.set_missing_host_key_policy(policy=WarningPolicy)
19 | ssh_client.set_missing_host_key_policy(policy=client.AutoAddPolicy)
20 | ssh_client.set_missing_host_key_policy(policy=client.WarningPolicy)
21 | ssh_client.set_missing_host_key_policy(policy=WarningPolicy)
| ^^^^^^^^^^^^^ S507
19 |
20 | # Unrelated
22 | ssh_client_from_paramiko.set_missing_host_key_policy(paramiko.AutoAddPolicy)
|

S507.py:22:54: S507 Paramiko call with policy set to automatically trust the unknown host key
|
20 | ssh_client.set_missing_host_key_policy(policy=client.WarningPolicy)
21 | ssh_client.set_missing_host_key_policy(policy=WarningPolicy)
22 | ssh_client_from_paramiko.set_missing_host_key_policy(paramiko.AutoAddPolicy)
| ^^^^^^^^^^^^^^^^^^^^^^ S507
23 |
24 | # Unrelated
|