Check for calls of functions susceptible to AST stack overflow
Nobody has claimed this yet.
- Dominant language
- Python
- Stars
- 8.3k
- Forks
- 835
- Avg merge
- 5d 3h
- Merged PRs (30d)
- 1
Description
Is your feature request related to a problem? Please describe.
It is possible to crash the Python interpreter by passing sufficiently large/complex string to ast.literal_eval, ast.parse, compile, dbm.dumb.open, eval or exec due to stack depth limitations in Python’s AST compiler.
My biggest issue is with ast.literal_eval which is recommended as a safe(r) alternative to eval by both the official documentation and bandit itself, so I suspect it is commonly[citation needed] used for parsing untrusted data where some evaluation is needed, instead of using eval, which might cause a false sense of security.
Describe the solution you'd like
Add the following functions to the calls blacklist:
ast.literal_evalast.parsecompiledbm.dumb.open
Describe alternatives you've considered
Not sure about adding eval and exec as they are already covered by B307 and B102, respectively, and I'm not sure if duplicating them would make sense.
Additional context
References:
- https://bugs.python.org/issue32758
- https://github.com/python/cpython/pull/5960
- https://github.com/python/cpython/pull/6043
PR: #423
Contributor guide
First steps
- Read the whole issue, then the project's contributing guide.
- Comment on the issue to say you are picking it up — it saves two people doing the same work.
- Fork the repository and make your change on a branch.
- Open a pull request that references the issue number.
Research direction
Start by reviewing Bandit’s calls blacklist and PR #423, then compare the requested functions with the existing B307 and B102 coverage. Done means the blacklist checks ast.literal_eval, ast.parse, compile, and dbm.dumb.open without unnecessarily duplicating eval or exec coverage.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- python
- Domain
- security, tooling
- Issue type
- Feature
- Difficulty
- 3/5
- Estimated time
- 1-2 days
- Activity status
- Stale
- Clarity
- Mostly clear
- Newbie friendliness
- 25/100