55 lines
1.4 KiB
YAML
55 lines
1.4 KiB
YAML
rules:
|
|
- id: no-eval
|
|
pattern: eval(...)
|
|
message: >
|
|
Use of eval() is a security risk. Do not use eval() in production code.
|
|
Consider using ast.literal_eval() for safe evaluation of literals.
|
|
languages: [python]
|
|
severity: ERROR
|
|
paths:
|
|
include:
|
|
- src/
|
|
|
|
- id: no-exec
|
|
pattern: exec(...)
|
|
message: >
|
|
Use of exec() is a security risk. Do not use exec() in production code.
|
|
Find an alternative approach that does not require dynamic code execution.
|
|
languages: [python]
|
|
severity: ERROR
|
|
paths:
|
|
include:
|
|
- src/
|
|
|
|
- id: no-compile-exec
|
|
pattern: compile(..., ..., "exec")
|
|
message: >
|
|
Using compile() with exec mode is a security risk.
|
|
Avoid dynamic code compilation in production code.
|
|
languages: [python]
|
|
severity: ERROR
|
|
paths:
|
|
include:
|
|
- src/
|
|
|
|
- id: no-os-system
|
|
pattern: os.system(...)
|
|
message: >
|
|
Use of os.system() is insecure. Use subprocess.run() with shell=False instead.
|
|
languages: [python]
|
|
severity: WARNING
|
|
paths:
|
|
include:
|
|
- src/
|
|
|
|
- id: no-pickle-loads
|
|
pattern: pickle.loads(...)
|
|
message: >
|
|
Use of pickle.loads() on untrusted data is a security risk.
|
|
Consider using json or a safe serialization format.
|
|
languages: [python]
|
|
severity: WARNING
|
|
paths:
|
|
include:
|
|
- src/
|