Blacklists (Calls)
Overview
The "Blacklists (Calls)" feature in BugZ is designed to identify and flag potentially dangerous function calls within your source code. These calls are known to introduce security risks or are considered unsafe practices. This page details the types of function calls that BugZ scans for, why they are considered risky, and how you can address these issues.
Function Calls Considered Harmful
The following tables provide an overview of various security vulnerabilities identified by their unique IDs, names, the specific calls that are considered risky, and their severity levels. This information is crucial for developers looking to mitigate potential security risks in their applications.
High Severity Vulnerabilities
| ID | Name | Calls | Severity |
|---|---|---|---|
| 1004 | ciphers | Crypto.Cipher.ARC2.new, Crypto.Cipher.ARC4.new, Crypto.Cipher.Blowfish.new, Crypto.Cipher.DES.new, Crypto.Cipher.XOR.new, Cryptodome.Cipher.ARC2.new, Cryptodome.Cipher.ARC4.new, Cryptodome.Cipher.Blowfish.new, Cryptodome.Cipher.DES.new, Cryptodome.Cipher.XOR.new, cryptography.hazmat.primitives.ciphers.algorithms.ARC4, cryptography.hazmat.primitives.ciphers.algorithms.Blowfish, cryptography.hazmat.primitives.ciphers.algorithms.IDEA | High |
| 1012 | telnetlib | telnetlib.* | High |
| 1021 | ftplib | ftplib.* | High |
| 1022 | input | input | High |
Medium Severity Vulnerabilities
| ID | Name | Calls | Severity |
|---|---|---|---|
| 1001 | pickle | pickle.loads, pickle.load, pickle.Unpickler, dill.loads, dill.load, dill.Unpickler, shelve.open, shelve.DbfilenameShelf, jsonpickle.decode, jsonpickle.unpickler.decode, jsonpickle.unpickler.Unpickler, pandas.read_pickle | Medium |
| 1002 | marshal | marshal.load, marshal.loads | Medium |
| 1003 | md5 | hashlib.md5, hashlib.sha1, Crypto.Hash.MD2.new, Crypto.Hash.MD4.new, Crypto.Hash.MD5.new, Crypto.Hash.SHA.new, Cryptodome.Hash.MD2.new, Cryptodome.Hash.MD4.new, Cryptodome.Hash.MD5.new, Cryptodome.Hash.SHA.new, cryptography.hazmat.primitives.hashes.MD5, cryptography.hazmat.primitives.hashes.SHA1 | Medium |
| 1005 | cipher_modes | cryptography.hazmat.primitives.ciphers.modes.ECB | Medium |
| 1006 | mktemp_q | tempfile.mktemp | Medium |
| 1007 | eval | eval | Medium |
| 1008 | mark_safe | django.utils.safestring.mark_safe | Medium |
| 1009 | httpsconnection | httplib.HTTPSConnection, http.client.HTTPSConnection, six.moves.http_client.HTTPSConnection | Medium |
| 1010 | urllib_urlopen | urllib.urlopen, urllib.request.urlopen, urllib.urlretrieve, urllib.request.urlretrieve, urllib.URLopener, urllib.request.URLopener, urllib.FancyURLopener, urllib.request.FancyURLopener, urllib2.urlopen, urllib2.Request, six.moves.urllib.request.urlopen, six.moves.urllib.request.urlretrieve, six.moves.urllib.request.URLopener, six.moves.urllib.request.FancyURLopener | Medium |
| 1013 | xml_bad_cElementTree | xml.etree.cElementTree.parse, xml.etree.cElementTree.iterparse, xml.etree.cElementTree.fromstring, xml.etree.cElementTree.XMLParser | Medium |
| 1014 | xml_bad_ElementTree | xml.etree.ElementTree.parse, xml.etree.ElementTree.iterparse, xml.etree.ElementTree.fromstring, xml.etree.ElementTree.XMLParser | Medium |
| 1015 | xml_bad_expatreader | xml.sax.expatreader.create_parser | Medium |
| 1016 | xml_bad_expatbuilder | xml.dom.expatbuilder.parse, xml.dom.expatbuilder.parseString | Medium |
| 1017 | xml_bad_sax | xml.sax.parse, xml.sax.parseString, xml.sax.make_parser | Medium |
| 1018 | xml_bad_minidom | xml.dom.minidom.parse, xml.dom.minidom.parseString | Medium |
| 1019 | xml_bad_pulldom | xml.dom.pulldom.parse, xml.dom.pulldom.parseString | Medium |
| 1020 | xml_bad_etree | lxml.etree.parse, lxml.etree.fromstring, lxml.etree.RestrictedElement, lxml.etree.GlobalParserTLS, lxml.etree.getDefaultParser, lxml.etree.check_docinfo | Medium |
| 1023 | unverified_context | ssl._create_unverified_context | Medium |
| 1025 | tempnam | os.tempnam(), os.tmpnam() | Medium |
Low Severity Vulnerabilities
| ID | Name | Calls | Severity |
|---|---|---|---|
| 1011 | random | random.Random, random.random, random.randrange, random.randint, random.choice, random.choices, random.uniform, random.triangular, random.randbytes | Low |
This table is a part of BugZ's effort to provide comprehensive security insights into commonly used but potentially risky function calls in Python, enabling developers to enhance their code security effectively.
Best Practices
- Regular Code Reviews: Incorporate regular code reviews focusing on security to catch uses of blacklisted function calls.
- Static Analysis: Use static analysis tools like BugZ routinely to automatically detect and report the use of high-risk function calls.
- Developer Education: Educate developers about the risks associated with these function calls and train them on safer alternatives.
By adhering to these guidelines and using BugZ, you can significantly enhance the security posture of your applications, mitigating the risk of exploiting dangerous function calls.