bandit icon indicating copy to clipboard operation
bandit copied to clipboard

Fix 'get_code' method if issue is generated from dict

Open e0ne opened this issue 6 years ago • 5 comments

If issue is generated from dict 'get_code' method doesn't return code source. This patch fixes this by returning self.code property.

e0ne avatar Jan 23 '20 16:01 e0ne

Is there a related issue to this to help us get some insight into what this fixes or how to test the change?

lukehinds avatar Feb 07 '20 18:02 lukehinds

@lukehinds It was an issue with serialization-deserialization of bandit issues. We do some automation on top of bandit and to_dict/from_dict are regular operations. I can provide an example of how to reproduce the issue if needed.

e0ne avatar Feb 07 '20 18:02 e0ne

yes please @e0ne

lukehinds avatar Feb 07 '20 18:02 lukehinds

here is a code to reproduce the bug:

from bandit import core

d = {'filename': 'horizon/forms/fields.py',
 'test_name': 'django_mark_safe',
 'test_id': 'B703',
 'issue_severity': 'MEDIUM',
 'issue_confidence': 'HIGH',
 'issue_text': 'Potential XSS on mark_safe function.',
 'line_number': 236,
 'line_range': [236],
 'code': "235         output.append('</select>')\n236         return mark_safe('\\n'.join(output))\n237 \n"}

i = core.issue_from_dict(d)
print(i.code)
print(i.as_dict())

Output:

235         output.append('</select>')
236         return mark_safe('\n'.join(output))
237

{'filename': 'horizon/forms/fields.py', 'test_name': 'django_mark_safe', 'test_id': 'B703', 'issue_severity': 'MEDIUM', 'issue_confidence': 'HIGH', 'issue_text': 'Potential XSS on mark_safe function.', 'line_number': 236, 'line_range': [236], 'code': ''}

As I understood, it's reproducible only when linecache can't load the file.

e0ne avatar Feb 07 '20 18:02 e0ne

@lukehinds as you can see, as_dict method dumps the issue without code

e0ne avatar Feb 07 '20 18:02 e0ne