Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Update main.py #1

Open
wants to merge 1 commit into
base: main
Choose a base branch
from
Open

Update main.py #1

Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
8 changes: 8 additions & 0 deletions python/main.py
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -9,24 +9,30 @@

with open(temp_file, 'r') as f:
print(f)


os.chmod("/tmp/foo.txt", stat.S_IXGRP)
tar_file = '/file.tax*'
os.system(tar_file)


KEY_SIZE = 1024

Copy link
Owner Author

@arielkru arielkru Aug 26, 2024 •
edited
Loading

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Suggested change
MOCK_FIX

IAC

HIGH  Finding Type Name

Description

MOCK_DESCRIPTION

Benchmarks

  • MOCK_BENCH_1
  • MOCK_BENCH_2

Copy link
Owner Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

SECRETS

LOW  Base64 High Entropy String (:warning: Valid)

Description

Entropy check

Copy link
Owner Author

@arielkru arielkru Aug 26, 2024 •
edited
Loading

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

LICENSE

PackageName:1.0.0 / ec2.tf

HIGH  Non Compliant License (MIT)

Description

Non Compliant License

Copy link
Owner Author

@arielkru arielkru Aug 26, 2024 •
edited
Loading

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

SAST

MEDIUM  External control of system or configuration setting
    Source File: ExternalControlOfSystemOrConfigurationSetting1-taint3.java, Sink File: ExternalControlOfSystemOrConfigurationSetting1-taint3.java
Data Flow

     ExternalControlOfSystemOrConfigurationSetting1-taint3.java
    13 | String tainted = req.getParameter("input");
     ExternalControlOfSystemOrConfigurationSetting1-taint3.java
    14 | c.setCatalog(tainted);


How To Fix

String userInput = request.getParameter("catalogName");
if(isValidCatalogName(userInput)) {
connection.setCatalog(userInput);
}


Description

This SAST policy detects instances where user input is used in the java.sql.Connection's setCatalog call. This can be a potential issue as it may allow attackers to change the database during a connection, leading to disruptions or unexpected behaviors.

Vulnerable code example:

java
String userInput = request.getParameter("catalogName");
connection.setCatalog(userInput);

In the above code, the setCatalog method uses user input catalogName directly without any validation or sanitization. This allows an attacker to manipulate the catalogName parameter and potentially change the database being accessed.

Copy link
Owner Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

SCA

MOCK_PACKAGE_NAME 1.1.2 / ec2.tf

Total vulnerabilities: 2

Critical: 1 High: 1 Medium: 0 Low: 0
Vulnerability IDSeverityCVSSFixed inStatus
CVE-2022-1650 CRITICAL CRITICAL 9.3 1.1.1 Open
CVE-2020-7788 HIGH HIGH 7.3 1.0.5 Open

Bridgecrew Comment by Bridgecrew Bot

private_rsa_key = rsa.generate_private_key(
public_exponent=65537,
key_size=KEY_SIZE

)

private_dsa_key = dsa.generate_private_key(
key_size=KEY_SIZE,
)



private_dsa_key_2 = DSA.generate(bits=KEY_SIZE)


assert(private_dsa_key_2 == private_dsa_key)

program = 'a = 5\nb=10\nprint("Sum =", a+b)'
Expand All @@ -42,6 +48,7 @@ def is_real_user(user="user123", password="Password1"):
SOCK_STREAM | SOCK_NONBLOCK)

# Bind the socket to the internet with a port number

sock.bind(("::", 32007))


Expand All @@ -50,6 +57,7 @@ def add_server_port(sg, server_name, port):
if server is not None:
return False
set_port(port)

return server

add_server_port('security-group', 'server', 80)
Expand Down