faraday icon indicating copy to clipboard operation
faraday copied to clipboard

Fix inappropriate comparison in a logical expression

Open munahaf opened this issue 2 years ago • 0 comments

In file: get_exploits.py, method: get_exploits, a logical expression uses the identity operator. A new object is created inside the identity check operation and then used for matching identity. Since this is a distinct, new object, it will not have identity an match with anything else. As a result, the identity check will have a logical short circuit and the program may have unintended behavior. I suggested a modified logical operation; this should be reviewed for correctness.

Sponsorship and Support:

This work is done by the security researchers from OpenRefactory and is supported by the Open Source Security Foundation (OpenSSF)(https://openssf.org/): Project Alpha-Omega(https://alpha-omega.dev/). Alpha-Omega is a project partnering with open source software project maintainers to systematically find new, as-yet-undiscovered vulnerabilities in open source code - and get them fixed – to improve global software supply chain security.

The bug is found by running the Intelligent Code Repair (iCR) tool by OpenRefactory and then manually triaging the results.

munahaf avatar Aug 17 '23 10:08 munahaf