CodeGuru
Detector Library
Python detectors (123/123)
Improper privilege managementResource leakTensorflow redundant softmaxAWS insecure transmission CDKSpawning a process without main modulePublic method parameter validationImproper error handlingInteger overflowTime zone aware datetimesCatch and swallow exceptionPytorch control sources of randomnessDeadlocks caused by improper multiprocessing API usageUnauthenticated LDAP requestsLow maintainability with low class cohesionUntrusted AMI imagesNotebook invalid execution orderConfusion between equality and identity in conditional expressionPytorch sigmoid before bcelossPath traversalLoose file permissionsPytorch data loader with multiple workersPytorch avoid softmax with nlllossPytorch miss call to zero gradError prone sequence modificationBad exception handlingUse of Default Credentials CDKExposure of Sensitive Information CDKFile injectionIncorrect use of Process.terminate APIXML External EntityNotebook variable redefinitionPytorch use nondeterministic algoritmSet SNS Return Subscription ARNDo not pass generic exception ruleUsage of an API that is not recommended - High SeverityInsecure cryptographyTensorflow enable ops determinismOutdated subprocess module APIS3 partial encrypt CDKImproper input validationImproper authenticationCross-site scriptingMissing paginationSemaphore overflow preventionMutable objects as default arguments of functionsInsecure cookieViolation of PEP8 programming recommendationsInsecure temporary file or directoryUsage of an API that is not recommended - Low SeveritySocket connection timeoutAWS client not reused in a Lambda functionPytorch assign in place modComplex code hard to maintainLeaky subprocess timeoutUsage of an API that is not recommendedPytorch disable gradient calculationEnabling and overriding debug featureRisky use of dict get methodXPath injectionMissing authorizationDeserialization of untrusted objectUse of an inefficient or incorrect APIMultidimensional list initialization using replication is error proneSQL injectionAvoid using nondeterministic Tensorflow APIPytorch miss call to evalInefficient string concatenation inside loopImproper sanitization of wildcards or matching symbolsImproper certificate validationURL redirection to untrusted siteMutually exclusive callInsecure hashingNotebook best practice violationStack trace exposureUsing AutoAddPolicy or WarningPolicyUse of a deprecated methodLog injectionWeak obfuscation of web requestAWS api logging disabled cdkOS command injectionAWS credentials loggedSocket close platform compatibilityZip bomb attackUnsanitized input is run as codeSensitive data stored unencrypted due to partial encryptionSynchronous publication of AWS Lambda metricsBatch request with unchecked failuresUnrestricted upload of dangerous file typePytorch redundant softmaxInefficient polling of AWS resourceHardcoded interface bindingHardcoded IP addressInsecure connection using unencrypted protocolUnauthenticated Amazon SNS unsubscribe requests might succeedHardcoded credentialsInsecure Socket BindInsecure CORS policyCross-site request forgeryServer-side request forgeryModule injectionUnnecessary iterationTensorflow control sources of randomnessGarbage collection prevention in multiprocessingCatch and rethrow exceptionWeak algorithm used for Password HashingMissing Authentication for Critical Function CDKUsage of an API that is not recommended - Medium SeverityMissing none check on response metadataSensitive information leakIncorrect binding of SNS publish operationsClient-side KMS reencryptionPyTorch create tensors directly on deviceInefficient new method from hashlibDangerous global variablesMultiple values in return statement is prone to errorLDAP injectionClear text credentialsOverride of reserved variable names in a Lambda functionDocker arbitrary container runMissing S3 bucket owner conditionDirect dict object modificationCatastrophic backtracking regexAWS missing encryption CDK
High
Showing all detectors for the Python language with high severity.
Improper privilege management
Privilege escalation happens when a malicious user gains elevated access to resources that should be unavailable to them.
AWS insecure transmission CDK
The product transmits sensitive or security-critical data in cleartext in a communication channel that can be sniffed by unauthorized actors.
Unauthenticated LDAP requests
Unauthenticated LDAP requests can allow untrusted access to LDAP servers.
Path traversal
Constructing path names with unsanitized user input can lead to path traversal attacks (for example,
../../..) that allow an attacker access to file system resources.Loose file permissions
Weak file permissions can lead to privilege escalation.
Use of Default Credentials CDK
The product relies on default credentials(including passwords and cryptographic keys) for potentially vital functions.
Exposure of Sensitive Information CDK
The product unintentionally grants unauthorized actors access to a resource by placing it in the wrong control sphere.
File injection
Writing unsanitized user data to a file is unsafe.
XML External Entity
Objects that parse or handle XML can lead to XML External Entity (XXE) attacks when misconfigured.
Do not pass generic exception rule
Do not pass generic exception.
Usage of an API that is not recommended - High Severity
APIs that are not recommended were found - High Severity.
Outdated subprocess module API
Using outdated multiprocessing API calls and parameters is not recommended.
S3 partial encrypt CDK
An unencrypted bucket could lead to sensitive data exposure.
Improper authentication
Your code doesn't sufficiently authenticate identities provided by its users.
Cross-site scripting
Relying on potentially untrusted user inputs when constructing web application outputs can lead to cross-site scripting vulnerabilities.
Insecure cookie
Insecure cookies can lead to unencrypted transmission of sensitive data.
Usage of an API that is not recommended
APIs that are not recommended were found.
XPath injection
Potentially unsanitized user input in XPath queries can allow an attacker to control the query in unwanted or insecure ways.
Missing authorization
Missing authorization checks can lead to unauthorized access to a resource or performance of an action.
Deserialization of untrusted object
Deserialization of untrusted objects can lead to security vulnerabilities such as inadvertently running remote code.
SQL injection
Use of untrusted inputs in a SQL database query can enable attackers to read, modify, or delete sensitive data in the database
Improper sanitization of wildcards or matching symbols
Unsanitized wildcards or special matching symbols in user-provided strings can enable attacks and lead to unwanted behavior.
Improper certificate validation
Lack of validation of a security certificate can lead to host impersonation and sensitive data leaks.
URL redirection to untrusted site
User-controlled input that specifies a link to an external site could lead to phishing attacks and allow user credentials to be stolen.
Mutually exclusive call
Calls to mutually exclusive methods were found in the code.
Using AutoAddPolicy or WarningPolicy
Using
AutoAddPolicy or WarningPolicy can allow a malicious server to impersonate a trusted server.Log injection
Using untrusted inputs in a log statement can enable attackers to break the log's format, forge log entries, and bypass log monitors.
Weak obfuscation of web request
Weak obfuscation while configuring a web request.
AWS api logging disabled cdk
Api Logging Disabled may lead to unable to access log and does not record the event.
OS command injection
Constructing operating system or shell commands with unsanitized user input can lead to inadvertently running malicious code.
AWS credentials logged
Logging unencrypted AWS credentials can expose them to an attacker.
Socket close platform compatibility
The
os.close() does not work on some platforms.Zip bomb attack
Expanding unsanitized archive files taken as input can lead to zip bomb attacks.
Synchronous publication of AWS Lambda metrics
Synchronous publication of AWS Lambda metrics is inefficient.
Unrestricted upload of dangerous file type
Insufficiently restrictive file uploads can lead to inadvertently running malicious code.
Insecure connection using unencrypted protocol
Connections that use insecure protocols transmit data in cleartext, which can leak sensitive information.
Unauthenticated Amazon SNS unsubscribe requests might succeed
Failing to set the
AuthenticateOnUnsubscribe flag to True when confirming an SNS subscription can lead to unauthenticated cancellations.Cross-site request forgery
Insecure configuration can lead to a cross-site request forgery (CRSF) vulnerability.
Server-side request forgery
Insufficient sanitization of potentially untrusted URLs on the server side can allow server requests to unwanted destinations.
Module injection
Untrusted user imports in the
importlib.import_module() function allow attacks.Weak algorithm used for Password Hashing
Weak algorithm used for Password Hashing. Consider using stronger algorithms, such as Argon2, PBKDF2, or scrypt.
Missing Authentication for Critical Function CDK
Missing authentication checks can lead to unauthorized access to a resource or performance of an action.
Sensitive information leak
Exposure of sensitive information can lead to an unauthorized actor having access to the information.
Client-side KMS reencryption
Client-side decryption followed by reencryption is inefficient and can lead to sensitive data leaks.
Inefficient new method from hashlib
The constructors for the
hashlib module are faster than new()LDAP injection
LDAP queries that rely on potentially untrusted inputs can allow attackers to read or modify sensitive data, run code, and perform other unwanted actions.
Clear text credentials
Credentials that are stored in clear text can be intercepted by a malicious actor.
Override of reserved variable names in a Lambda function
Overriding environment variables that are reserved by AWS Lambda might lead to unexpected behavior.
AWS missing encryption CDK
The AWS resource is missing appropriate encryption.