PyCQA / PyCQA/bandit

general_bad_file_permission only works for mode as int

Open
#936 2 comments 0 reactions 0 assignees View on GitHub

Nobody has claimed this yet.

bug
Dominant language
Python
Stars
8.3k
Forks
836
Avg merge
5d 3h
Merged PRs (30d)
1

Description

Describe the bug

The testing of the general_bad_file_permission plugin makes it appear it can test the
mode argument as an int or as constant from the stat module.

However, the plugin checks whether the mode argument is an int only. If the argument is
stat.S_IXOTH for example, the argument would be a str.

This is a prime example of how the current model of testing based on counts of of severity
and confidence instead of whether or not each line is an issue or not.

Reproduction steps
1. Review general_bad_file_permission.py
2. Notice the check for isinstance(mode, int)
3. If you add debug to print mode when passed as "stat.S_IXOTH", you'll notice it's not an int.
Expected behavior

Either the plugin needs to handle stat constants or claim it can't. Right now, there is a false impression that it can.

Bandit version

1.7.4 (Default)

Python version

3.10 (Default)

Additional context

No response

Contributor guide

Open the contributing guide

First steps

  1. Read the whole issue, then the project's contributing guide.
  2. Comment on the issue to say you are picking it up — it saves two people doing the same work.
  3. Fork the repository and make your change on a branch.
  4. Open a pull request that references the issue number.

Research direction

Start by reviewing general_bad_file_permission.py and reproduce the issue with stat.S_IXOTH, as described in the reproduction steps. Check how the plugin handles the mode argument, then ensure its behavior accurately reflects whether stat constants are supported or not.

Written by the indexing model from the issue text.

Assessment

Tech stack
python
Domain
security
Issue type
Bug
Difficulty
2/5
Estimated time
1-3 hours
Activity status
Stale
Clarity
Mostly clear
Newbie friendliness
35/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.