general_bad_file_permission only works for mode as int
Nobody has claimed this yet.
- Dominant language
- Python
- Stars
- 8.3k
- Forks
- 836
- Avg merge
- 5d 3h
- Merged PRs (30d)
- 1
Description
Describe the bug
The testing of the general_bad_file_permission plugin makes it appear it can test the
mode argument as an int or as constant from the stat module.
However, the plugin checks whether the mode argument is an int only. If the argument is
stat.S_IXOTH for example, the argument would be a str.
This is a prime example of how the current model of testing based on counts of of severity
and confidence instead of whether or not each line is an issue or not.
Reproduction steps
1. Review general_bad_file_permission.py
2. Notice the check for isinstance(mode, int)
3. If you add debug to print mode when passed as "stat.S_IXOTH", you'll notice it's not an int.
Expected behavior
Either the plugin needs to handle stat constants or claim it can't. Right now, there is a false impression that it can.
Bandit version
1.7.4 (Default)
Python version
3.10 (Default)
Additional context
No response
Contributor guide
First steps
- Read the whole issue, then the project's contributing guide.
- Comment on the issue to say you are picking it up — it saves two people doing the same work.
- Fork the repository and make your change on a branch.
- Open a pull request that references the issue number.
Research direction
Start by reviewing general_bad_file_permission.py and reproduce the issue with stat.S_IXOTH, as described in the reproduction steps. Check how the plugin handles the mode argument, then ensure its behavior accurately reflects whether stat constants are supported or not.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- python
- Domain
- security
- Issue type
- Bug
- Difficulty
- 2/5
- Estimated time
- 1-3 hours
- Activity status
- Stale
- Clarity
- Mostly clear
- Newbie friendliness
- 35/100