PyCQA / PyCQA/bandit

Check for calls of functions susceptible to AST stack overflow

Open
#431 0 comments 0 reactions 0 assignees View on GitHub

Nobody has claimed this yet.

enhancement
Dominant language
Python
Stars
8.3k
Forks
835
Avg merge
5d 3h
Merged PRs (30d)
1

Description

Is your feature request related to a problem? Please describe.
It is possible to crash the Python interpreter by passing sufficiently large/complex string to ast.literal_eval, ast.parse, compile, dbm.dumb.open, eval or exec due to stack depth limitations in Python’s AST compiler.

My biggest issue is with ast.literal_eval which is recommended as a safe(r) alternative to eval by both the official documentation and bandit itself, so I suspect it is commonly[citation needed] used for parsing untrusted data where some evaluation is needed, instead of using eval, which might cause a false sense of security.

Describe the solution you'd like
Add the following functions to the calls blacklist:

  • ast.literal_eval
  • ast.parse
  • compile
  • dbm.dumb.open

Describe alternatives you've considered

Not sure about adding eval and exec as they are already covered by B307 and B102, respectively, and I'm not sure if duplicating them would make sense.

Additional context
References:

PR: #423

Contributor guide

Open the contributing guide

First steps

  1. Read the whole issue, then the project's contributing guide.
  2. Comment on the issue to say you are picking it up — it saves two people doing the same work.
  3. Fork the repository and make your change on a branch.
  4. Open a pull request that references the issue number.

Research direction

Start by reviewing Bandit’s calls blacklist and PR #423, then compare the requested functions with the existing B307 and B102 coverage. Done means the blacklist checks ast.literal_eval, ast.parse, compile, and dbm.dumb.open without unnecessarily duplicating eval or exec coverage.

Written by the indexing model from the issue text.

Assessment

Tech stack
python
Domain
security, tooling
Issue type
Feature
Difficulty
3/5
Estimated time
1-2 days
Activity status
Stale
Clarity
Mostly clear
Newbie friendliness
25/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.