infobyte / infobyte/faraday_plugins

Burp plugin not working on Python >= 3.12 due to import from deprecated distutils

Open
#35 0 comments 0 reactions 0 assignees View on GitHub

Nobody has claimed this yet.

Dominant language
Python
Stars
61
Forks
22
PR merge metrics
No merged PRs in 30d

Description

The Burp plugin cannot be used because it attempts to import distutils.util, but distutils is deprecated since Python 3.12:

$ faraday-cli tool report report.xml -w CENSORED --create-workspace --plugin-id burp
Cant load plugin module: burp [No module named 'distutils']
Invalid Plugin: burp

The code block in question in plugin.py only attempts to parse a bool from str in decode_binary_node:

def decode_binary_node(self, node):
        """
        Finds a subnode matching `path` and returns its inner text if
        it has no base64 attribute or its base64 decoded inner text if
        it has it.
        """
        if node is not None:
            encoded = distutils.util.strtobool(node.get('base64', 'false'))
            if encoded:
                res = base64.b64decode(node.text).decode('utf-8', errors="backslashreplace")
            else:
                res = node.text
            return "".join([ch for ch in res if ord(ch) <= 128])
        return ""

Instead of using distutils.util.strtobool, I suggest a "stupid" bool parser that would not have any dependencies:

    def strtobool(self, some_str: str) -> bool:
        if some_str.lower() in ["true", "yes", "wahr", "1"]:
            return True
        elif some_str.lower() in ["false", "no", "falsch", "0"]:
            return False
        else:
            raise ValueError(f"Cannot parse str to bool: {some_str}")

This can then be called by decode_binary_node:

    def decode_binary_node(self, node):
        """
        Finds a subnode matching `path` and returns its inner text if
        it has no base64 attribute or its base64 decoded inner text if
        it has it.
        """
        if node is not None:
            encoded = self.strtobool(node.get('base64', 'false'))
            if encoded:
                res = base64.b64decode(node.text).decode('utf-8', errors="backslashreplace")
            else:
                res = node.text
            return "".join([ch for ch in res if ord(ch) <= 128])
        return ""

Contributor guide

No contributing guide indexed for this repository

First steps

  1. Read the whole issue, then the project's contributing guide.
  2. Comment on the issue to say you are picking it up — it saves two people doing the same work.
  3. Fork the repository and make your change on a branch.
  4. Open a pull request that references the issue number.

Research direction

Start in plugin.py at decode_binary_node and inspect how the Burp plugin is loaded. Verify the replacement boolean parsing handles the base64 attribute without importing distutils, then confirm the Burp plugin loads and processes a report on Python 3.12 or newer.

Written by the indexing model from the issue text.

Assessment

Tech stack
python
Domain
security, tooling
Issue type
Bug
Difficulty
2/5
Estimated time
1-3 hours
Activity status
Stale
Clarity
Clearly specified
Newbie friendliness
48/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.