rspec/rules/S4823/python/rule.adoc

27 lines
1.1 KiB
Plaintext
Raw Normal View History

2020-06-30 12:49:37 +02:00
Using command line arguments is security-sensitive. It has led in the past to the following vulnerabilities:
2020-06-30 12:49:37 +02:00
* http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2018-7281[CVE-2018-7281]
* http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2018-12326[CVE-2018-12326]
* http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2011-3198[CVE-2011-3198]
Command line arguments can be dangerous just like any other user input. They should never be used without being first validated and sanitized.
2021-02-02 15:02:10 +01:00
2020-06-30 12:49:37 +02:00
Remember also that any user can retrieve the list of processes running on a system, which makes the arguments provided to them visible. Thus passing sensitive information via command line arguments should be considered as insecure.
2021-02-02 15:02:10 +01:00
2021-01-27 13:42:22 +01:00
This rule raises an issue on every reference to ``++sys.argv++``, call to ``++optparse.OptionParser()++`` or a call to ``++argparse.ArgumentParser()++``. The goal is to guide security code reviews.
2020-06-30 12:49:37 +02:00
include::../ask-yourself.adoc[]
include::../recommended.adoc[]
include::../see.adoc[]
ifdef::rspecator-view[]
== Comments And Links
(visible only on this page)
include::../comments-and-links.adoc[]
endif::rspecator-view[]