README.md

Docs

Dlint uses a simple, folder-based hierarchy written in Markdown for documentation.

Linters

• DUO101 YieldReturnStatementLinter "inlineCallbacks" function cannot have non-empty "return" statement
• DUO102 BadRandomGeneratorUseLinter insecure use of "random" module, prefer "random.SystemRandom"
• DUO103 BadPickleUseLinter insecure use of "pickle" or "cPickle"
• DUO104 BadEvalUseLinter use of "eval" is insecure
• DUO105 BadExecUseLinter use of "exec" is insecure
• DUO106 BadOSUseLinter insecure use of "os" module
• DUO107 BadXMLUseLinter insecure use of XML modules, prefer "defusedxml"
• DUO108 BadInputUseLinter use of "input" is insecure
• DUO109 BadYAMLUseLinter insecure use of "yaml" parsing function, prefer "safe_*" equivalent
• DUO110 BadCompileUseLinter use of "compile" is insecure
• DUO111 BadSysUseLinter insecure use of "sys" module
• DUO112 BadZipfileUseLinter use of "extract|extractall" is insecure
• DUO113 InlineCallbacksYieldStatementLinter "inlineCallbacks" function missing "yield" statement
• DUO114 ReturnValueInInlineCallbacksLinter "returnValue" in function missing "inlineCallbacks" decorator
• DUO115 BadTarfileUseLinter use of "extract|extractall" is insecure
• DUO116 BadSubprocessUseLinter use of "shell=True" is insecure in "subprocess" module
• DUO117 BadDlUseLinter avoid "dl" module use
• DUO118 BadGlUseLinter avoid "gl" module use
• DUO119 BadShelveUseLinter avoid "shelve" module use
• DUO120 BadMarshalUseLinter avoid "marshal" module use
• DUO121 BadTempfileUseLinter use of "tempfile.mktemp" allows for race conditions
• DUO122 BadSSLModuleAttributeUseLinter insecure "ssl" module attribute use
• DUO123 BadRequestsUseLinter use of "verify=False" is insecure in "requests" module
• DUO124 BadXmlrpcUseLinter instance with "allow_dotted_names" enabled is insecure
• DUO125 BadCommandsUseLinter avoid "commands" module use
• DUO126 BadPopen2UseLinter avoid "popen2" module use
• DUO127 BadDuoClientUseLinter use of "ca_certs=HTTP|DISABLE" is insecure in "duo_client" module
• DUO128 BadOneLoginKwargUseLinter insecure "OneLogin" SAML function call
• DUO129 BadOneLoginModuleAttributeUseLinter insecure "OneLogin" SAML attribute use
• DUO130 BadHashlibUseLinter insecure use of "hashlib" module
• DUO131 BadUrllib3ModuleAttributeUseLinter "urllib3" warnings disabled, insecure connections possible
• DUO132 BadUrllib3KwargUseLinter "urllib3" certificate verification disabled, insecure connections possible
• DUO133 BadPycryptoUseLinter use of "Crypto" module is insecure
• DUO134 BadCryptographyModuleAttributeUseLinter insecure "cryptography" attribute use
• DUO135 BadDefusedxmlUseLinter enable all "forbid_*" defenses when using "defusedxml" parsing
• DUO136 BadXmlsecModuleAttributeUseLinter insecure "xmlsec" attribute use
• DUO137 BadItsDangerousKwargUseLinter insecure "itsdangerous" use allowing empty signing
• DUO138 BadReCatastrophicUseLinter catastrophic "re" usage - denial-of-service possible

FAQs

Why not Bandit?

Bandit is another static analysis tool aimed at searching for security issues in Python code. Bandit is a great tool and can easily be used simultaneously with Dlint. However, there are a few advantages Dlint has over Bandit:

• Dlint can identify function calls that are insecure specifically because of their keyword argument usage. For example, subprocess module function calls that use the shell=True keyword argument: subprocess security considerations.
• Dlint can identify insecure method calls on specific objects. For example, the TarFile.extractall object method can often lead to security vulnerabilities. Dlint tracks variable names of instantiated objects and searches for insecure methods used by these specific objects.
• Dlint can identify insecurities arising from the use of wildcard imports. For example, from os import *, which results in insecure use of the os module, such as a system call.
• Dlint is built upon the ubiquitous Flake8 project so it's easy to use, provides a fully-featured interface, and is backed by the Python Code Quality Authority. This means things like no more re-inventing the wheel for selecting and ignoring violations, including and excluding specific files, running multiple jobs in parallel, showing results inline in your editor, and much more.

Bandit also provides some advantages over Dlint:

• Bandit can identify SQL injections in your code: B608.
• Bandit can identify security issues resulting from hardcoded information: B104, B105, B106, B107, and B108.

Running multiple security tools over your codebase will provide a more comprehensive analysis and ensure you're coding with confidence.

Where can I learn more about static analysis?

• Lessons from Building Static Analysis Tools at Google (2018)
• Scaling Static Analyses at Facebook (2019)
• Static Analysis at Scale: An Instagram Story (2019)
• A Few Billion Lines of Code Later: Using Static Analysis to Find Bugs in the Real World (2010)
• How to Build Static Checking Systems Using Orders of Magnitude Less Code (2016)
• What Developers Want and Need from Program Analysis: An Empirical Study (2016)

How can I integrate Dlint into XYZ?

TravisCI

Include Dlint in your .travis.yml configuration file:

language: python
install:
    - python -m pip install dlint
script:
    - python -m flake8 --select=DUO /path/to/code

CircleCI

Include Dlint in your .circleci/config.yml configuration file:

version: 2
jobs:
    build:
        docker:
            - image: circleci/python
        steps:
            - checkout
            - run: python -m pip install dlint
            - run: python -m flake8 --select=DUO /path/to/code

Gitlab

Include Dlint in your .gitlab-ci.yml configuration file:

stages:
    - test
test:
    image: python
    before_script:
        - python -m pip install dlint
    script:
        - python -m flake8 --select=DUO /path/to/code

Phabricator

Include Dlint in your Arcanist linting process via the .arclint configuration file:

{
    "linters": {
        "sample": {
            "type": "flake8"
        }
    }
}

Dlint rules will automatically be run via flake8 once it's installed, so the standard flake8 configuration will work. You can also utilize more granular control over the linting process:

{
    "linters": {
        "sample": {
            "type": "flake8"
        },
        "bin": ["python2.7", "python2"],
        "flags": ["-m", "flake8", "--select", "DUO"]
    }
}

How can I output results in JSON?

Use the flake8-json plugin:

$ python -m pip install flake8-json

$ python -m flake8 --format=json --select=DUO ...