811876 - Python Static Code Security Analysis

Status: RESOLVED WORKSFORME

(mozilla.org :: Security Assurance, task)

Description

[Yvan Boily [:ygjb][:yvan]]

Duration: 200 hours ? (maybe more?)

Requirements: Python application development skills. Basic understanding of file parsing and Python AST processing. Basic understanding of Python vulnerability patterns.

Goals:
Like in any language, it is easy to make mistakes in the design of code or to simply introduce bugs. Often, these problems have big security consequences.
Think for example of a common case where SQL is constructed manually by appending strings instead of using parameterized statements. Or, for open source projects, accidentally embedding web service API keys or account credentials in code committed to a public source code repository.
Both these problems can be found by analyzing source code and looking for common vulnerability patterns and things that look suspicious.
This project is about building a tool that can run a wide range of tests on a Python project. The goal is to both write the infrastructure in which tests can run and to implement a number of interesting vulnerability scanners.
This project has similarities to tools like pychecker and pylint but instead of focusing on code style its primary goal will be to find security issues.

Comment 1

[adu]

Can i pick this bug?

Comment 2

[Stefan Arentz | :st3fan | ⏰ EST | he/him]

Hi Adaresh, We already have a student working on this bug. But I will remember that you are interested in this bug and maybe later we can assign you smaller subtasks of this bug. It very much depends on what the student is going to do as we want to be sure not to interfere with his thesis work.

Comment 3

[Stefan Arentz | :st3fan | ⏰ EST | he/him]

I am happy to announce that Jurriaan Bremer will be working on this project! I have attached his thesis proposal to this bug as an attachment.

Comment 4

[Stefan Arentz | :st3fan | ⏰ EST | he/him]

Attachment: Jurriaan's thesis proposal

Comment 5

[Liz Henry (:lizzard) (privacy/fingerprinting team)]

jbremer, you are still active on this bug, right? Just checking! Thanks!

Comment 6

[Jurriaan Bremer [:jbremer]]

Yup. Currently writing my thesis. If you're interested, however, you can check out the code here. https://github.com/st3fan/pythoncodeanalysis The basics are there already, but I'll be working on the interesting stuff after having written my thesis.

Comment 7

[Manish [:manishkk]]

Anyone working on this?

Comment 8

[Frederik Braun [:freddy] (OOO - Back April 8th)]

Juriaan worked somewhere within this, see comment 6.