Python detectors
Showing all detectors for the Python language.
Browse by tags
Browse all detectors by tags.
Browse by severity
Browse all detectors by severity.
Browse by category
Browse all detectors by category.
Browse all detectors
Privilege escalation happens when a malicious user gains elevated access to resources that should be unavailable to them.
Allocated resources are not released properly.
Inefficient string concatenation inside loops results in new object creation which adds quadratic runtime cost.
Using the spawn
or forkserver
start method without importing the main module might lead to unexpected behavior (for example, it might cause a RuntimeError
).
Unsanitized wildcards or special matching symbols in user-provided strings can enable attacks and lead to unwanted behavior.
Lack of validation of a security certificate can lead to host impersonation and sensitive data leaks.
User-controlled input that specifies a link to an external site could lead to phishing attacks and allow user credentials to be stolen.
An integer overflow might might cause security issues when it is used for resource management or execution control.
Calls to mutually exclusive methods were found in the code.
Using naive datetime objects might cause time zone related issues.
Swallowing exceptions, without re-throwing or logging them, is a bad practice.
Obsolete, broken, or weak hashing algorithms can lead to security vulnerabilities.
Stack traces can be hard to use for debugging.
Using AutoAddPolicy
or WarningPolicy
can allow a malicious server to impersonate a trusted server.
This code uses deprecated methods, which suggests that it has not been recently reviewed or maintained.
Using untrusted inputs in a log statement can enable attackers to break the log's format, forge log entries, and bypass log monitors.
Weak obfuscation while configuring a web request.
Improper multiprocessing API usage with wrong parameters might lead to deadlocks.
Constructing operating system or shell commands with unsanitized user input can lead to inadvertently running malicious code.
Unauthenticated LDAP requests can allow untrusted access to LDAP servers.
Classes with low class cohesion contain unrelated operations which make them difficult to understand and less likely to be used.
Improper filtering of Amazon Machine Images (AMIs) can result in loading an untrusted image, a potential security vulnerability.
Confusion between equality ==
, !=
and identity is
in conditional expressions can lead to unintended behavior.
Constructing path names with unsanitized user input can lead to path traversal attacks (for example, ../../..
) that allow an attacker access to file system resources.
Logging unencrypted AWS credentials can expose them to an attacker.
Weak file permissions can lead to privilege escalation.
The os.close()
does not work on some platforms.
Expanding unsanitized archive files taken as input can lead to zip bomb attacks.
Scripts generated from unsanitized inputs can lead to malicious behavior and inadvertently running code remotely.
Encryption that is dependent on conditional logic, such as an if...then
clause, might cause unencrypted sensitive data to be stored.
Synchronous publication of AWS Lambda metrics is inefficient.
Sequence modification while iterating over it might cause unexpected bugs.
Not checking which items have failed can lead to loss of data.
Throwing a base or generic exception might cause important error information to be lost. This can make your code difficult to maintain.
Insufficiently restrictive file uploads can lead to inadvertently running malicious code.
Custom polling can be inefficient and prone to error. Consider using AWS waiters instead.
Hardcoding an IP address can cause security problems.
Connections that use insecure protocols transmit data in cleartext, which can leak sensitive information.
The Process.terminate
API might cause data corruption of shared resources.
Failing to set the AuthenticateOnUnsubscribe
flag to True
when confirming an SNS subscription can lead to unauthenticated cancellations.
Credentials, such as passwords and access keys, should not be hardcoded in source code.
Binding the socket with an empty IP address can introduce security risks.
Objects that parse or handle XML can lead to XML External Entity (XXE) attacks when misconfigured.
Cross-Origin Resource Sharing policies that are too permissive may lead to security vulnerabilities.
Insecure configuration can lead to a cross-site request forgery (CRSF) vulnerability.
To always return the subscription ARN, set the ReturnSubscriptionArn
argument to True
.
Do not pass generic exception.
Iteration when only one item is needed from a list is inefficient.
Weak, broken, or misconfigured cryptography can lead to security vulnerabilities.
Using outdated multiprocessing API calls and parameters is not recommended.
Passing a parent process object in a child process can prevent its garbage collection.
Catching and re-throwing an exception without further actions is redundant and wasteful.
Improper input validation can enable attacks and lead to unwanted behavior.
Your code doesn't sufficiently authenticate identities provided by its users.
Relying on potentially untrusted user inputs when constructing web application outputs can lead to cross-site scripting vulnerabilities.
Response metadata was not checked to verify that it is not None
.
Missing pagination on a paginated call can lead to inaccurate results.
When you process and remove an item from the JoinableQueue
without calling JoinableQueue.task_done()
, a semaphore overflow exception might be thrown.
Default values in Python are created exactly once, when the function is defined. If that object is changed, subsequent calls to the function will refer to the changed object, leading to confusion.
Insecure cookies can lead to unencrypted transmission of sensitive data.
Violating PEP8 programming recommendations might make code difficult to read and can introduce ambiguity.
Insecure ways of creating temporary files and directories can lead to race conditions, privilege escalation, and other security vulnerabilities.
Incorrect binding of SNS publish operations with the subscribe
or create_topic
operations might lead to latency issues.
Client-side decryption followed by reencryption is inefficient and can lead to sensitive data leaks.
Not setting the connection timeout parameter can cause a blocking socket connection.
Recreating AWS clients in each Lambda function invocation is expensive.
Complex code can be difficult to read and hard to maintain.
The constructors for the hashlib
module are faster than new()
Failure to end a child process that doesn't terminate before its timeout expires can result in leaked resources.
APIs that are not recommended were found.
Global variables can be dangerous and cause bugs because they can be simultaneously accessed from multiple sections of a program.
The Debug feature should not be enabled or overridden.
Using the get
method from the dict
class without default values can cause runtime exceptions.
Methods that return multiple values can be difficult to read and prone to error.
LDAP queries that rely on potentially untrusted inputs can allow attackers to read or modify sensitive data, run code, and perform other unwanted actions.
Potentially unsanitized user input in XPath queries can allow an attacker to control the query in unwanted or insecure ways.
Credentials that are stored in clear text can be intercepted by a malicious actor.
Deserialization of untrusted objects can lead to security vulnerabilities such as inadvertently running remote code.
Incorrect use of API leads to ambiguity and inconsistency
list
replication using replication operator creates references to the existing objects, not copies, which could introduce bugs.
Overriding environment variables that are reserved by AWS Lambda might lead to unexpected behavior.
Use of untrusted inputs in a SQL database query can enable attackers to read, modify, or delete sensitive data in the database
Passing an unsanitized user argument to a function call makes your code insecure.
Not setting the S3 bucket owner condition might introduce a risk of accidentally using a wrong bucket.
Directly modifying the __dict__
object might cause undesirable behavior due to symbol table modification.
Inefficient regular expression patterns can lead to catastrophic backtracking.