Blacklists (Imports)
Overview
The "Blacklists (Imports)" feature in BugZ is designed to identify and flag potentially risky module imports in Python code. By categorizing these imports based on their security implications, BugZ helps developers mitigate security risks associated with third-party modules. This page presents a comprehensive table of blacklisted imports categorized by severity level.
Function Calls Considered Harmful
The following tables provide an overview of various security vulnerabilities identified by their unique IDs, names, the specific imports that are considered risky, and their severity levels. This information is crucial for developers looking to mitigate potential security risks in their applications.
High Severity Imports
| ID | Name | Imports | Severity |
|---|---|---|---|
| 2001 | import_telnetlib | telnetlib | High |
| 2002 | import_ftplib | ftplib | High |
| 2011 | import_xmlrpclib | xmlrpc | High |
| 2012 | import_httpoxy | wsgiref.handlers.CGIHandler, twisted.web.twcgi.CGIScript | High |
| 2013 | import_pycrypto | Crypto.Cipher, Crypto.Hash, Crypto.IO, Crypto.Protocol, Crypto.PublicKey, Crypto.Random, Crypto.Signature, Crypto.Util | High |
| 2014 | import_pycryptodome | Cryptodome.Cipher, Cryptodome.Hash, Cryptodome.IO, Cryptodome.Protocol, Cryptodome.PublicKey, Cryptodome.Random, Cryptodome.Signature, Cryptodome.Util | High |
| 2015 | import_pyghmi | pyghmi | High |
Low Severity Imports
| ID | Name | Imports | Severity |
|---|---|---|---|
| 2003 | import_pickle | pickle, cPickle, dill, shelve | Low |
| 2004 | import_subprocess | subprocess | Low |
| 2005 | import_xml_etree | xml.etree.cElementTree, xml.etree.ElementTree | Low |
| 2006 | import_xml_sax | xml.sax | Low |
| 2007 | import_xml_expat | xml.dom.expatbuilder | Low |
| 2008 | import_xml_minidom | xml.dom.minidom | Low |
| 2009 | import_xml_pulldom | xml.dom.pulldom | Low |
| 2010 | import_lxml | lxml | Low |
This table is a part of BugZ's effort to provide comprehensive security insights into commonly used but potentially risky imports in Python, enabling developers to enhance their code security effectively.
Best Practices
- Regular Code Reviews: Incorporate regular code reviews focusing on security to catch uses of blacklisted imports.
- Static Analysis: Use static analysis tools like BugZ routinely to automatically detect and report the use of high-risk imports.
- Developer Education: Educate developers about the risks associated with these imports and train them on safer alternatives.
By adhering to these guidelines and using BugZ, you can significantly enhance the security posture of your applications, mitigating the risk of exploiting dangerous imports.