forked from PyCQA/bandit
-
Notifications
You must be signed in to change notification settings - Fork 0
/
cwemap.py
89 lines (79 loc) · 2.79 KB
/
cwemap.py
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
# -*- coding:utf-8 -*-
#
# SPDX-License-Identifier: Apache-2.0
from bandit.core.issue import Cwe as Cwe
CWEMAP = {
"B000": Cwe.UNDEF,
"LEGACY": Cwe.UNDEF,
# Plugins
"B101": Cwe.IMPROPER_CHECK_OF_EXCEPT_COND,
"B102": Cwe.OS_COMMAND_INJECTION,
"B103": Cwe.INCORRECT_PERMISSION_ASSIGNMENT,
"B104": Cwe.MULTIPLE_BINDS,
"B105": Cwe.HARD_CODED_PASSWORD,
"B108": Cwe.INSECURE_TEMP_FILE,
"B110": Cwe.IMPROPER_CHECK_OF_EXCEPT_COND,
"B112": Cwe.IMPROPER_CHECK_OF_EXCEPT_COND,
"B201": Cwe.CODE_INJECTION,
"B324": Cwe.BROKEN_CRYPTO,
"B501": Cwe.IMPROPER_CERT_VALIDATION,
"B502": Cwe.BROKEN_CRYPTO,
"B503": Cwe.BROKEN_CRYPTO,
"B504": Cwe.BROKEN_CRYPTO,
"B505": Cwe.INADEQUATE_ENCRYPTION_STRENGTH,
"B506": Cwe.IMPROPER_INPUT_VALIDATION,
"B507": Cwe.IMPROPER_CERT_VALIDATION,
"B601": Cwe.OS_COMMAND_INJECTION,
"B602": Cwe.OS_COMMAND_INJECTION,
"B603": Cwe.OS_COMMAND_INJECTION,
"B604": Cwe.OS_COMMAND_INJECTION,
"B605": Cwe.OS_COMMAND_INJECTION,
"B606": Cwe.OS_COMMAND_INJECTION,
"B607": Cwe.OS_COMMAND_INJECTION,
"B608": Cwe.SQL_INJECTION,
"B609": Cwe.IMPROPER_WILDCARD_NEUTRALIZATION,
"B611": Cwe.SQL_INJECTION,
"B701": Cwe.CODE_INJECTION,
"B702": Cwe.BASIC_XSS,
"B703": Cwe.BASIC_XSS,
# Calls
"B301": Cwe.DESERIALIZATION_OF_UNTRUSTED_DATA,
"B302": Cwe.DESERIALIZATION_OF_UNTRUSTED_DATA,
"B303": Cwe.BROKEN_CRYPTO,
"B304": Cwe.BROKEN_CRYPTO,
"B305": Cwe.BROKEN_CRYPTO,
"B306": Cwe.INSECURE_TEMP_FILE,
"B307": Cwe.OS_COMMAND_INJECTION,
"B308": Cwe.XSS,
"B309": Cwe.CLEARTEXT_TRANSMISSION,
"B310": Cwe.PATH_TRAVERSAL,
"B311": Cwe.INSUFFICIENT_RANDOM_VALUES,
"B312": Cwe.CLEARTEXT_TRANSMISSION,
"B313": Cwe.IMPROPER_INPUT_VALIDATION,
"B314": Cwe.IMPROPER_INPUT_VALIDATION,
"B315": Cwe.IMPROPER_INPUT_VALIDATION,
"B316": Cwe.IMPROPER_INPUT_VALIDATION,
"B317": Cwe.IMPROPER_INPUT_VALIDATION,
"B318": Cwe.IMPROPER_INPUT_VALIDATION,
"B319": Cwe.IMPROPER_INPUT_VALIDATION,
"B320": Cwe.IMPROPER_INPUT_VALIDATION,
"B321": Cwe.CLEARTEXT_TRANSMISSION,
"B322": Cwe.OS_COMMAND_INJECTION,
"B323": Cwe.IMPROPER_CERT_VALIDATION,
"B325": Cwe.INSECURE_TEMP_FILE,
# Imports
"B401": Cwe.CLEARTEXT_TRANSMISSION,
"B402": Cwe.CLEARTEXT_TRANSMISSION,
"B403": Cwe.DESERIALIZATION_OF_UNTRUSTED_DATA,
"B404": Cwe.OS_COMMAND_INJECTION,
"B405": Cwe.IMPROPER_INPUT_VALIDATION,
"B406": Cwe.IMPROPER_INPUT_VALIDATION,
"B407": Cwe.IMPROPER_INPUT_VALIDATION,
"B408": Cwe.IMPROPER_INPUT_VALIDATION,
"B409": Cwe.IMPROPER_INPUT_VALIDATION,
"B410": Cwe.IMPROPER_INPUT_VALIDATION,
"B411": Cwe.IMPROPER_INPUT_VALIDATION,
"B412": Cwe.IMPROPER_ACCESS_CONTROL,
"B413": Cwe.BROKEN_CRYPTO,
"B414": Cwe.BROKEN_CRYPTO,
}