diff --git a/.github/workflows/deploy.yml b/.github/workflows/deploy.yml index 48887a3..8c66687 100644 --- a/.github/workflows/deploy.yml +++ b/.github/workflows/deploy.yml @@ -39,4 +39,4 @@ jobs: git config --global user.email "actions@github.com" git config --global user.name "gh-actions" yarn install --frozen-lockfile - yarn deploy \ No newline at end of file + yarn deploy diff --git a/.github/workflows/status.yml b/.github/workflows/status.yml index 1b03c83..b080dad 100644 --- a/.github/workflows/status.yml +++ b/.github/workflows/status.yml @@ -4,22 +4,22 @@ on: workflow_dispatch: inputs: install: - description: 'App Installation' + description: "App Installation" type: boolean required: true default: true repo: - description: 'Repository Review' + description: "Repository Review" type: boolean required: true default: true pr: - description: 'Pull Request Review' + description: "Pull Request Review" type: boolean required: true default: true command: - description: 'Comment Commands' + description: "Comment Commands" type: boolean required: true default: true @@ -45,4 +45,4 @@ jobs: uses: ad-m/github-push-action@master with: github_token: ${{ secrets.GITHUB_TOKEN }} - branch: ${{ github.ref }} \ No newline at end of file + branch: ${{ github.ref }} diff --git a/LICENSE.md b/LICENSE.md index cbe5ad1..1197617 100644 --- a/LICENSE.md +++ b/LICENSE.md @@ -67,90 +67,88 @@ Licensor grants You such rights in consideration of benefits the Licensor receives from making the Licensed Material available under these terms and conditions. - Section 1 -- Definitions. - a. Adapted Material means material subject to Copyright and Similar - Rights that is derived from or based upon the Licensed Material - and in which the Licensed Material is translated, altered, - arranged, transformed, or otherwise modified in a manner requiring - permission under the Copyright and Similar Rights held by the - Licensor. For purposes of this Public License, where the Licensed - Material is a musical work, performance, or sound recording, - Adapted Material is always produced where the Licensed Material is - synched in timed relation with a moving image. - - b. Adapter's License means the license You apply to Your Copyright - and Similar Rights in Your contributions to Adapted Material in - accordance with the terms and conditions of this Public License. - - c. BY-NC-SA Compatible License means a license listed at - creativecommons.org/compatiblelicenses, approved by Creative - Commons as essentially the equivalent of this Public License. - - d. Copyright and Similar Rights means copyright and/or similar rights - closely related to copyright including, without limitation, - performance, broadcast, sound recording, and Sui Generis Database - Rights, without regard to how the rights are labeled or - categorized. For purposes of this Public License, the rights - specified in Section 2(b)(1)-(2) are not Copyright and Similar - Rights. - - e. Effective Technological Measures means those measures that, in the - absence of proper authority, may not be circumvented under laws - fulfilling obligations under Article 11 of the WIPO Copyright - Treaty adopted on December 20, 1996, and/or similar international - agreements. - - f. Exceptions and Limitations means fair use, fair dealing, and/or - any other exception or limitation to Copyright and Similar Rights - that applies to Your use of the Licensed Material. - - g. License Elements means the license attributes listed in the name - of a Creative Commons Public License. The License Elements of this - Public License are Attribution, NonCommercial, and ShareAlike. - - h. Licensed Material means the artistic or literary work, database, - or other material to which the Licensor applied this Public - License. - - i. Licensed Rights means the rights granted to You subject to the - terms and conditions of this Public License, which are limited to - all Copyright and Similar Rights that apply to Your use of the - Licensed Material and that the Licensor has authority to license. - - j. Licensor means the individual(s) or entity(ies) granting rights - under this Public License. - - k. NonCommercial means not primarily intended for or directed towards - commercial advantage or monetary compensation. For purposes of - this Public License, the exchange of the Licensed Material for - other material subject to Copyright and Similar Rights by digital - file-sharing or similar means is NonCommercial provided there is - no payment of monetary compensation in connection with the - exchange. - - l. Share means to provide material to the public by any means or - process that requires permission under the Licensed Rights, such - as reproduction, public display, public performance, distribution, - dissemination, communication, or importation, and to make material - available to the public including in ways that members of the - public may access the material from a place and at a time - individually chosen by them. - - m. Sui Generis Database Rights means rights other than copyright - resulting from Directive 96/9/EC of the European Parliament and of - the Council of 11 March 1996 on the legal protection of databases, - as amended and/or succeeded, as well as other essentially - equivalent rights anywhere in the world. - - n. You means the individual or entity exercising the Licensed Rights - under this Public License. Your has a corresponding meaning. - +a. Adapted Material means material subject to Copyright and Similar +Rights that is derived from or based upon the Licensed Material +and in which the Licensed Material is translated, altered, +arranged, transformed, or otherwise modified in a manner requiring +permission under the Copyright and Similar Rights held by the +Licensor. For purposes of this Public License, where the Licensed +Material is a musical work, performance, or sound recording, +Adapted Material is always produced where the Licensed Material is +synched in timed relation with a moving image. + +b. Adapter's License means the license You apply to Your Copyright +and Similar Rights in Your contributions to Adapted Material in +accordance with the terms and conditions of this Public License. + +c. BY-NC-SA Compatible License means a license listed at +creativecommons.org/compatiblelicenses, approved by Creative +Commons as essentially the equivalent of this Public License. + +d. Copyright and Similar Rights means copyright and/or similar rights +closely related to copyright including, without limitation, +performance, broadcast, sound recording, and Sui Generis Database +Rights, without regard to how the rights are labeled or +categorized. For purposes of this Public License, the rights +specified in Section 2(b)(1)-(2) are not Copyright and Similar +Rights. + +e. Effective Technological Measures means those measures that, in the +absence of proper authority, may not be circumvented under laws +fulfilling obligations under Article 11 of the WIPO Copyright +Treaty adopted on December 20, 1996, and/or similar international +agreements. + +f. Exceptions and Limitations means fair use, fair dealing, and/or +any other exception or limitation to Copyright and Similar Rights +that applies to Your use of the Licensed Material. + +g. License Elements means the license attributes listed in the name +of a Creative Commons Public License. The License Elements of this +Public License are Attribution, NonCommercial, and ShareAlike. + +h. Licensed Material means the artistic or literary work, database, +or other material to which the Licensor applied this Public +License. + +i. Licensed Rights means the rights granted to You subject to the +terms and conditions of this Public License, which are limited to +all Copyright and Similar Rights that apply to Your use of the +Licensed Material and that the Licensor has authority to license. + +j. Licensor means the individual(s) or entity(ies) granting rights +under this Public License. + +k. NonCommercial means not primarily intended for or directed towards +commercial advantage or monetary compensation. For purposes of +this Public License, the exchange of the Licensed Material for +other material subject to Copyright and Similar Rights by digital +file-sharing or similar means is NonCommercial provided there is +no payment of monetary compensation in connection with the +exchange. + +l. Share means to provide material to the public by any means or +process that requires permission under the Licensed Rights, such +as reproduction, public display, public performance, distribution, +dissemination, communication, or importation, and to make material +available to the public including in ways that members of the +public may access the material from a place and at a time +individually chosen by them. + +m. Sui Generis Database Rights means rights other than copyright +resulting from Directive 96/9/EC of the European Parliament and of +the Council of 11 March 1996 on the legal protection of databases, +as amended and/or succeeded, as well as other essentially +equivalent rights anywhere in the world. + +n. You means the individual or entity exercising the Licensed Rights +under this Public License. Your has a corresponding meaning. Section 2 -- Scope. - a. License grant. +a. License grant. 1. Subject to the terms and conditions of this Public License, the Licensor hereby grants You a worldwide, royalty-free, @@ -211,7 +209,7 @@ Section 2 -- Scope. the Licensor or others designated to receive attribution as provided in Section 3(a)(1)(A)(i). - b. Other rights. +b. Other rights. 1. Moral rights, such as the right of integrity, are not licensed under this Public License, nor are publicity, @@ -233,13 +231,12 @@ Section 2 -- Scope. the Licensed Material is used other than for NonCommercial purposes. - Section 3 -- License Conditions. Your exercise of the Licensed Rights is expressly made subject to the following conditions. - a. Attribution. +a. Attribution. 1. If You Share the Licensed Material (including in modified form), You must: @@ -280,7 +277,7 @@ following conditions. information required by Section 3(a)(1)(A) to the extent reasonably practicable. - b. ShareAlike. +b. ShareAlike. In addition to the conditions in Section 3(a), if You Share Adapted Material You produce, the following conditions also apply. @@ -299,69 +296,66 @@ following conditions. Measures to, Adapted Material that restrict exercise of the rights granted under the Adapter's License You apply. - Section 4 -- Sui Generis Database Rights. Where the Licensed Rights include Sui Generis Database Rights that apply to Your use of the Licensed Material: - a. for the avoidance of doubt, Section 2(a)(1) grants You the right - to extract, reuse, reproduce, and Share all or a substantial - portion of the contents of the database for NonCommercial purposes - only; +a. for the avoidance of doubt, Section 2(a)(1) grants You the right +to extract, reuse, reproduce, and Share all or a substantial +portion of the contents of the database for NonCommercial purposes +only; - b. if You include all or a substantial portion of the database - contents in a database in which You have Sui Generis Database - Rights, then the database in which You have Sui Generis Database - Rights (but not its individual contents) is Adapted Material, - including for purposes of Section 3(b); and +b. if You include all or a substantial portion of the database +contents in a database in which You have Sui Generis Database +Rights, then the database in which You have Sui Generis Database +Rights (but not its individual contents) is Adapted Material, +including for purposes of Section 3(b); and - c. You must comply with the conditions in Section 3(a) if You Share - all or a substantial portion of the contents of the database. +c. You must comply with the conditions in Section 3(a) if You Share +all or a substantial portion of the contents of the database. For the avoidance of doubt, this Section 4 supplements and does not replace Your obligations under this Public License where the Licensed Rights include other Copyright and Similar Rights. - Section 5 -- Disclaimer of Warranties and Limitation of Liability. - a. UNLESS OTHERWISE SEPARATELY UNDERTAKEN BY THE LICENSOR, TO THE - EXTENT POSSIBLE, THE LICENSOR OFFERS THE LICENSED MATERIAL AS-IS - AND AS-AVAILABLE, AND MAKES NO REPRESENTATIONS OR WARRANTIES OF - ANY KIND CONCERNING THE LICENSED MATERIAL, WHETHER EXPRESS, - IMPLIED, STATUTORY, OR OTHER. THIS INCLUDES, WITHOUT LIMITATION, - WARRANTIES OF TITLE, MERCHANTABILITY, FITNESS FOR A PARTICULAR - PURPOSE, NON-INFRINGEMENT, ABSENCE OF LATENT OR OTHER DEFECTS, - ACCURACY, OR THE PRESENCE OR ABSENCE OF ERRORS, WHETHER OR NOT - KNOWN OR DISCOVERABLE. WHERE DISCLAIMERS OF WARRANTIES ARE NOT - ALLOWED IN FULL OR IN PART, THIS DISCLAIMER MAY NOT APPLY TO YOU. - - b. TO THE EXTENT POSSIBLE, IN NO EVENT WILL THE LICENSOR BE LIABLE - TO YOU ON ANY LEGAL THEORY (INCLUDING, WITHOUT LIMITATION, - NEGLIGENCE) OR OTHERWISE FOR ANY DIRECT, SPECIAL, INDIRECT, - INCIDENTAL, CONSEQUENTIAL, PUNITIVE, EXEMPLARY, OR OTHER LOSSES, - COSTS, EXPENSES, OR DAMAGES ARISING OUT OF THIS PUBLIC LICENSE OR - USE OF THE LICENSED MATERIAL, EVEN IF THE LICENSOR HAS BEEN - ADVISED OF THE POSSIBILITY OF SUCH LOSSES, COSTS, EXPENSES, OR - DAMAGES. WHERE A LIMITATION OF LIABILITY IS NOT ALLOWED IN FULL OR - IN PART, THIS LIMITATION MAY NOT APPLY TO YOU. - - c. The disclaimer of warranties and limitation of liability provided - above shall be interpreted in a manner that, to the extent - possible, most closely approximates an absolute disclaimer and - waiver of all liability. - +a. UNLESS OTHERWISE SEPARATELY UNDERTAKEN BY THE LICENSOR, TO THE +EXTENT POSSIBLE, THE LICENSOR OFFERS THE LICENSED MATERIAL AS-IS +AND AS-AVAILABLE, AND MAKES NO REPRESENTATIONS OR WARRANTIES OF +ANY KIND CONCERNING THE LICENSED MATERIAL, WHETHER EXPRESS, +IMPLIED, STATUTORY, OR OTHER. THIS INCLUDES, WITHOUT LIMITATION, +WARRANTIES OF TITLE, MERCHANTABILITY, FITNESS FOR A PARTICULAR +PURPOSE, NON-INFRINGEMENT, ABSENCE OF LATENT OR OTHER DEFECTS, +ACCURACY, OR THE PRESENCE OR ABSENCE OF ERRORS, WHETHER OR NOT +KNOWN OR DISCOVERABLE. WHERE DISCLAIMERS OF WARRANTIES ARE NOT +ALLOWED IN FULL OR IN PART, THIS DISCLAIMER MAY NOT APPLY TO YOU. + +b. TO THE EXTENT POSSIBLE, IN NO EVENT WILL THE LICENSOR BE LIABLE +TO YOU ON ANY LEGAL THEORY (INCLUDING, WITHOUT LIMITATION, +NEGLIGENCE) OR OTHERWISE FOR ANY DIRECT, SPECIAL, INDIRECT, +INCIDENTAL, CONSEQUENTIAL, PUNITIVE, EXEMPLARY, OR OTHER LOSSES, +COSTS, EXPENSES, OR DAMAGES ARISING OUT OF THIS PUBLIC LICENSE OR +USE OF THE LICENSED MATERIAL, EVEN IF THE LICENSOR HAS BEEN +ADVISED OF THE POSSIBILITY OF SUCH LOSSES, COSTS, EXPENSES, OR +DAMAGES. WHERE A LIMITATION OF LIABILITY IS NOT ALLOWED IN FULL OR +IN PART, THIS LIMITATION MAY NOT APPLY TO YOU. + +c. The disclaimer of warranties and limitation of liability provided +above shall be interpreted in a manner that, to the extent +possible, most closely approximates an absolute disclaimer and +waiver of all liability. Section 6 -- Term and Termination. - a. This Public License applies for the term of the Copyright and - Similar Rights licensed here. However, if You fail to comply with - this Public License, then Your rights under this Public License - terminate automatically. +a. This Public License applies for the term of the Copyright and +Similar Rights licensed here. However, if You fail to comply with +this Public License, then Your rights under this Public License +terminate automatically. - b. Where Your right to use the Licensed Material has terminated under - Section 6(a), it reinstates: +b. Where Your right to use the Licensed Material has terminated under +Section 6(a), it reinstates: 1. automatically as of the date the violation is cured, provided it is cured within 30 days of Your discovery of the @@ -373,47 +367,45 @@ Section 6 -- Term and Termination. right the Licensor may have to seek remedies for Your violations of this Public License. - c. For the avoidance of doubt, the Licensor may also offer the - Licensed Material under separate terms or conditions or stop - distributing the Licensed Material at any time; however, doing so - will not terminate this Public License. - - d. Sections 1, 5, 6, 7, and 8 survive termination of this Public - License. +c. For the avoidance of doubt, the Licensor may also offer the +Licensed Material under separate terms or conditions or stop +distributing the Licensed Material at any time; however, doing so +will not terminate this Public License. +d. Sections 1, 5, 6, 7, and 8 survive termination of this Public +License. Section 7 -- Other Terms and Conditions. - a. The Licensor shall not be bound by any additional or different - terms or conditions communicated by You unless expressly agreed. - - b. Any arrangements, understandings, or agreements regarding the - Licensed Material not stated herein are separate from and - independent of the terms and conditions of this Public License. +a. The Licensor shall not be bound by any additional or different +terms or conditions communicated by You unless expressly agreed. +b. Any arrangements, understandings, or agreements regarding the +Licensed Material not stated herein are separate from and +independent of the terms and conditions of this Public License. Section 8 -- Interpretation. - a. For the avoidance of doubt, this Public License does not, and - shall not be interpreted to, reduce, limit, restrict, or impose - conditions on any use of the Licensed Material that could lawfully - be made without permission under this Public License. - - b. To the extent possible, if any provision of this Public License is - deemed unenforceable, it shall be automatically reformed to the - minimum extent necessary to make it enforceable. If the provision - cannot be reformed, it shall be severed from this Public License - without affecting the enforceability of the remaining terms and - conditions. - - c. No term or condition of this Public License will be waived and no - failure to comply consented to unless expressly agreed to by the - Licensor. - - d. Nothing in this Public License constitutes or may be interpreted - as a limitation upon, or waiver of, any privileges and immunities - that apply to the Licensor or You, including from the legal - processes of any jurisdiction or authority. +a. For the avoidance of doubt, this Public License does not, and +shall not be interpreted to, reduce, limit, restrict, or impose +conditions on any use of the Licensed Material that could lawfully +be made without permission under this Public License. + +b. To the extent possible, if any provision of this Public License is +deemed unenforceable, it shall be automatically reformed to the +minimum extent necessary to make it enforceable. If the provision +cannot be reformed, it shall be severed from this Public License +without affecting the enforceability of the remaining terms and +conditions. + +c. No term or condition of this Public License will be waived and no +failure to comply consented to unless expressly agreed to by the +Licensor. + +d. Nothing in this Public License constitutes or may be interpreted +as a limitation upon, or waiver of, any privileges and immunities +that apply to the Licensor or You, including from the legal +processes of any jurisdiction or authority. ======================================================================= diff --git a/README.md b/README.md index c4af541..a9de8f3 100644 --- a/README.md +++ b/README.md @@ -44,5 +44,3 @@ $ GIT_USER= yarn deploy ``` If you are using GitHub pages for hosting, this command is a convenient way to build the website and push to the `gh-pages` branch. - - diff --git a/babel.config.js b/babel.config.js index e00595d..bfd75db 100644 --- a/babel.config.js +++ b/babel.config.js @@ -1,3 +1,3 @@ module.exports = { - presets: [require.resolve('@docusaurus/core/lib/babel/preset')], + presets: [require.resolve("@docusaurus/core/lib/babel/preset")], }; diff --git a/docs/codemods/java/codeql_java_database-resource-leak.md b/docs/codemods/java/codeql_java_database-resource-leak.md index dda278b..cb67179 100644 --- a/docs/codemods/java/codeql_java_database-resource-leak.md +++ b/docs/codemods/java/codeql_java_database-resource-leak.md @@ -3,11 +3,11 @@ title: "Prevent database resource leaks (CodeQL)" sidebar_position: 1 --- -## codeql:java/database-resource-leak +## codeql:java/database-resource-leak -| Importance | Review Guidance | Requires Scanning Tool | -|-------------|----------------------|------------------------| -| MEDIUM | Merge Without Review | Yes (CodeQL) | +| Importance | Review Guidance | Requires Scanning Tool | +| ---------- | -------------------- | ---------------------- | +| MEDIUM | Merge Without Review | Yes (CodeQL) | This change adds [try-with-resources](https://docs.oracle.com/javase/tutorial/essential/exceptions/tryResourceClose.html) to JDBC code to prevent database resources from being leaked, which could lead to denial-of-service conditions like connection pool or file handle exhaustion. @@ -29,10 +29,8 @@ Our changes look something like this: This codemod causes database resources to be cleaned up immediately after use instead of at garbage collection time, and we don't believe this change entails any risk. - - - ## References - * [https://codeql.github.com/codeql-query-help/java/java-database-resource-leak/](https://codeql.github.com/codeql-query-help/java/java-database-resource-leak/) - * [https://cwe.mitre.org/data/definitions/404.html](https://cwe.mitre.org/data/definitions/404.html) - * [https://cwe.mitre.org/data/definitions/772.html](https://cwe.mitre.org/data/definitions/772.html) + +- [https://codeql.github.com/codeql-query-help/java/java-database-resource-leak/](https://codeql.github.com/codeql-query-help/java/java-database-resource-leak/) +- [https://cwe.mitre.org/data/definitions/404.html](https://cwe.mitre.org/data/definitions/404.html) +- [https://cwe.mitre.org/data/definitions/772.html](https://cwe.mitre.org/data/definitions/772.html) diff --git a/docs/codemods/java/codeql_java_input-resource-leak.md b/docs/codemods/java/codeql_java_input-resource-leak.md index e725de0..81b1fb3 100644 --- a/docs/codemods/java/codeql_java_input-resource-leak.md +++ b/docs/codemods/java/codeql_java_input-resource-leak.md @@ -3,11 +3,11 @@ title: "Prevent resource leaks (CodeQL)" sidebar_position: 1 --- -## codeql:java/input-resource-leak +## codeql:java/input-resource-leak -| Importance | Review Guidance | Requires Scanning Tool | -|-------------|----------------------|------------------------| -| MEDIUM | Merge Without Review | Yes (CodeQL) | +| Importance | Review Guidance | Requires Scanning Tool | +| ---------- | -------------------- | ---------------------- | +| MEDIUM | Merge Without Review | Yes (CodeQL) | This change adds [try-with-resources](https://docs.oracle.com/javase/tutorial/essential/exceptions/tryResourceClose.html) to code to prevent resources from being leaked, which could lead to denial-of-service conditions like connection pool or file handle exhaustion. @@ -27,8 +27,8 @@ Our changes look something like this: This codemod causes resources to be cleaned up immediately after use instead of at garbage collection time, and we don't believe this change entails any risk. - ## References - * [https://codeql.github.com/codeql-query-help/java/java-input-resource-leak/](https://codeql.github.com/codeql-query-help/java/java-input-resource-leak/) - * [https://cwe.mitre.org/data/definitions/404.html](https://cwe.mitre.org/data/definitions/404.html) - * [https://cwe.mitre.org/data/definitions/772.html](https://cwe.mitre.org/data/definitions/772.html) + +- [https://codeql.github.com/codeql-query-help/java/java-input-resource-leak/](https://codeql.github.com/codeql-query-help/java/java-input-resource-leak/) +- [https://cwe.mitre.org/data/definitions/404.html](https://cwe.mitre.org/data/definitions/404.html) +- [https://cwe.mitre.org/data/definitions/772.html](https://cwe.mitre.org/data/definitions/772.html) diff --git a/docs/codemods/java/codeql_java_insecure-cookie.md b/docs/codemods/java/codeql_java_insecure-cookie.md index 0b0b30b..fa0ba07 100644 --- a/docs/codemods/java/codeql_java_insecure-cookie.md +++ b/docs/codemods/java/codeql_java_insecure-cookie.md @@ -3,11 +3,11 @@ title: "Added secure flag to HTTP cookies (CodeQL)" sidebar_position: 1 --- -## codeql:java/insecure-cookie +## codeql:java/insecure-cookie -| Importance | Review Guidance | Requires Scanning Tool | -|-------------|----------------------|------------------------| -| LOW | Merge Without Review | Yes (CodeQL) | +| Importance | Review Guidance | Requires Scanning Tool | +| ---------- | -------------------- | ---------------------- | +| LOW | Merge Without Review | Yes (CodeQL) | This change marks new cookies sent in the HTTP with the ["secure" flag](https://owasp.org/www-community/controls/SecureCookieAttribute). This flag, despite its ambitious name, only provides one type of protection: confidentiality. Cookies with this flag are guaranteed by the browser never to be sent over a cleartext channel ("http://") and only sent over secure channels ("https://"). @@ -27,9 +27,9 @@ Note: this code change **may cause issues** with the application if any of the p This code change may cause issues with the application if any of the places this code runs (in CI, pre-production or in production) are running over plaintext HTTP. - ## References - * [https://codeql.github.com/codeql-query-help/java/java-insecure-cookie/](https://codeql.github.com/codeql-query-help/java/java-insecure-cookie/) - * [https://owasp.org/www-community/controls/SecureCookieAttribute](https://owasp.org/www-community/controls/SecureCookieAttribute) - * [https://developer.mozilla.org/en-US/docs/Web/HTTP/Cookies](https://developer.mozilla.org/en-US/docs/Web/HTTP/Cookies) - * [https://cwe.mitre.org/data/definitions/614.html](https://cwe.mitre.org/data/definitions/614.html) + +- [https://codeql.github.com/codeql-query-help/java/java-insecure-cookie/](https://codeql.github.com/codeql-query-help/java/java-insecure-cookie/) +- [https://owasp.org/www-community/controls/SecureCookieAttribute](https://owasp.org/www-community/controls/SecureCookieAttribute) +- [https://developer.mozilla.org/en-US/docs/Web/HTTP/Cookies](https://developer.mozilla.org/en-US/docs/Web/HTTP/Cookies) +- [https://cwe.mitre.org/data/definitions/614.html](https://cwe.mitre.org/data/definitions/614.html) diff --git a/docs/codemods/java/codeql_java_jexl-expression-injection.md b/docs/codemods/java/codeql_java_jexl-expression-injection.md index a1b7f16..011ce3b 100644 --- a/docs/codemods/java/codeql_java_jexl-expression-injection.md +++ b/docs/codemods/java/codeql_java_jexl-expression-injection.md @@ -3,11 +3,11 @@ title: "Expression language injection (JEXL) (CodeQL)" sidebar_position: 1 --- -## codeql:java/jexl-expression-injection +## codeql:java/jexl-expression-injection -| Importance | Review Guidance | Requires Scanning Tool | -|-------------|----------------------|------------------------| -| MEDIUM | Merge Without Review | Yes (CodeQL) | +| Importance | Review Guidance | Requires Scanning Tool | +| ---------- | -------------------- | ---------------------- | +| MEDIUM | Merge Without Review | Yes (CodeQL) | This change adds [a sandbox](https://commons.apache.org/proper/commons-jexl/apidocs/org/apache/commons/jexl3/introspection/JexlSandbox.html) to JEXL expression evaluation. This sandbox prevents access to many types that don't appear in typical usage, but are very common in exploits. @@ -29,9 +29,9 @@ Our changes look something like this: expression.evaluate(context); ``` - ## References - * [https://codeql.github.com/codeql-query-help/java/java-jexl-expression-injection/](https://codeql.github.com/codeql-query-help/java/java-jexl-expression-injection/) - * [https://commons.apache.org/proper/commons-jexl/apidocs/org/apache/commons/jexl3/introspection/JexlSandbox.html](https://commons.apache.org/proper/commons-jexl/apidocs/org/apache/commons/jexl3/introspection/JexlSandbox.html) - * [https://cwe.mitre.org/data/definitions/693.html](https://cwe.mitre.org/data/definitions/693.html) - * [https://cwe.mitre.org/data/definitions/94.html](https://cwe.mitre.org/data/definitions/94.html) + +- [https://codeql.github.com/codeql-query-help/java/java-jexl-expression-injection/](https://codeql.github.com/codeql-query-help/java/java-jexl-expression-injection/) +- [https://commons.apache.org/proper/commons-jexl/apidocs/org/apache/commons/jexl3/introspection/JexlSandbox.html](https://commons.apache.org/proper/commons-jexl/apidocs/org/apache/commons/jexl3/introspection/JexlSandbox.html) +- [https://cwe.mitre.org/data/definitions/693.html](https://cwe.mitre.org/data/definitions/693.html) +- [https://cwe.mitre.org/data/definitions/94.html](https://cwe.mitre.org/data/definitions/94.html) diff --git a/docs/codemods/java/codeql_java_maven_non-https-url.md b/docs/codemods/java/codeql_java_maven_non-https-url.md index 6a8155d..cb64b00 100644 --- a/docs/codemods/java/codeql_java_maven_non-https-url.md +++ b/docs/codemods/java/codeql_java_maven_non-https-url.md @@ -3,11 +3,11 @@ title: "Failure to use HTTPS or SFTP URL in Maven artifact upload/download (Code sidebar_position: 1 --- -## codeql:java/maven/non-https-url +## codeql:java/maven/non-https-url -| Importance | Review Guidance | Requires Scanning Tool | -|-------------|----------------------|------------------------| -| MEDIUM | Merge Without Review | Yes (CodeQL) | +| Importance | Review Guidance | Requires Scanning Tool | +| ---------- | -------------------- | ---------------------- | +| MEDIUM | Merge Without Review | Yes (CodeQL) | This change replaces any HTTP URLs found in `` definitions with HTTPS URLs. Without this change, Maven will make requests to either publish or retrieve artifacts over a plaintext channel. @@ -30,8 +30,8 @@ Our changes look something like this: ``` - ## References - * [https://codeql.github.com/codeql-query-help/java/java-maven-non-https-url](https://codeql.github.com/codeql-query-help/java/java-maven-non-https-url) - * [https://cwe.mitre.org/data/definitions/494.html](https://cwe.mitre.org/data/definitions/494.html) - * [https://en.wikipedia.org/wiki/Man-in-the-middle_attack](https://en.wikipedia.org/wiki/Man-in-the-middle_attack) + +- [https://codeql.github.com/codeql-query-help/java/java-maven-non-https-url](https://codeql.github.com/codeql-query-help/java/java-maven-non-https-url) +- [https://cwe.mitre.org/data/definitions/494.html](https://cwe.mitre.org/data/definitions/494.html) +- [https://en.wikipedia.org/wiki/Man-in-the-middle_attack](https://en.wikipedia.org/wiki/Man-in-the-middle_attack) diff --git a/docs/codemods/java/codeql_java_missing-jwt-signature-check.md b/docs/codemods/java/codeql_java_missing-jwt-signature-check.md index 1244600..3ffd72e 100644 --- a/docs/codemods/java/codeql_java_missing-jwt-signature-check.md +++ b/docs/codemods/java/codeql_java_missing-jwt-signature-check.md @@ -3,11 +3,11 @@ title: "Switch JWT calls to versions that enforce signature validity (CodeQL)" sidebar_position: 1 --- -## codeql:java/missing-jwt-signature-check +## codeql:java/missing-jwt-signature-check -| Importance | Review Guidance | Requires Scanning Tool | -|-------------|----------------------|------------------------| -| MEDIUM | Merge Without Review | Yes (CodeQL) | +| Importance | Review Guidance | Requires Scanning Tool | +| ---------- | -------------------- | ---------------------- | +| MEDIUM | Merge Without Review | Yes (CodeQL) | This change switches to Json Web Token (JWT) parsing APIs that perform signature validation. @@ -22,7 +22,7 @@ Changing out these methods is easy and our changes look something like this: + Jwt jwt = jwtParser.parseClaimsJwt(token); ``` - ## References - * [https://codeql.github.com/codeql-query-help/java/java-missing-jwt-signature-check/](https://codeql.github.com/codeql-query-help/java/java-missing-jwt-signature-check/) - * [https://cwe.mitre.org/data/definitions/347.html](https://cwe.mitre.org/data/definitions/347.html) + +- [https://codeql.github.com/codeql-query-help/java/java-missing-jwt-signature-check/](https://codeql.github.com/codeql-query-help/java/java-missing-jwt-signature-check/) +- [https://cwe.mitre.org/data/definitions/347.html](https://cwe.mitre.org/data/definitions/347.html) diff --git a/docs/codemods/java/codeql_java_output-resource-leak.md b/docs/codemods/java/codeql_java_output-resource-leak.md index 4f742c5..21a713d 100644 --- a/docs/codemods/java/codeql_java_output-resource-leak.md +++ b/docs/codemods/java/codeql_java_output-resource-leak.md @@ -3,11 +3,11 @@ title: "Prevent resource leaks (CodeQL)" sidebar_position: 1 --- -## codeql:java/output-resource-leak +## codeql:java/output-resource-leak -| Importance | Review Guidance | Requires Scanning Tool | -|-------------|----------------------|------------------------| -| MEDIUM | Merge Without Review | Yes (CodeQL) | +| Importance | Review Guidance | Requires Scanning Tool | +| ---------- | -------------------- | ---------------------- | +| MEDIUM | Merge Without Review | Yes (CodeQL) | This change adds [try-with-resources](https://docs.oracle.com/javase/tutorial/essential/exceptions/tryResourceClose.html) to code to prevent resources from being leaked, which could lead to denial-of-service conditions like connection pool or file handle exhaustion. @@ -16,13 +16,13 @@ Our changes look something like this: ```diff - BufferedWriter bw = new BufferedWriter(new FileWriter("C:\\test.txt")); - bw.write("Hello world!"); -+ try(FileWriter input = new FileWriter("C:\\test.txt")); BufferedWriter bw = new BufferedWriter(input)){ ++ try(FileWriter input = new FileWriter("C:\\test.txt")); BufferedWriter bw = new BufferedWriter(input)){ + bw.write("Hello world!"); + } ``` - ## References - * [https://codeql.github.com/codeql-query-help/java/java-output-resource-leak/](https://codeql.github.com/codeql-query-help/java/java-output-resource-leak/) - * [https://cwe.mitre.org/data/definitions/404.html](https://cwe.mitre.org/data/definitions/404.html) - * [https://cwe.mitre.org/data/definitions/772.html](https://cwe.mitre.org/data/definitions/772.html) + +- [https://codeql.github.com/codeql-query-help/java/java-output-resource-leak/](https://codeql.github.com/codeql-query-help/java/java-output-resource-leak/) +- [https://cwe.mitre.org/data/definitions/404.html](https://cwe.mitre.org/data/definitions/404.html) +- [https://cwe.mitre.org/data/definitions/772.html](https://cwe.mitre.org/data/definitions/772.html) diff --git a/docs/codemods/java/codeql_java_stack-trace-exposure.md b/docs/codemods/java/codeql_java_stack-trace-exposure.md index c9f3a7c..ea2a9cc 100644 --- a/docs/codemods/java/codeql_java_stack-trace-exposure.md +++ b/docs/codemods/java/codeql_java_stack-trace-exposure.md @@ -3,11 +3,11 @@ title: "Prevent information leak of stack trace details to HTTP responses (CodeQ sidebar_position: 1 --- -## codeql:java/stack-trace-exposure +## codeql:java/stack-trace-exposure -| Importance | Review Guidance | Requires Scanning Tool | -|-------------|----------------------|------------------------| -| MEDIUM | Merge Without Review | Yes (CodeQL) | +| Importance | Review Guidance | Requires Scanning Tool | +| ---------- | -------------------- | ---------------------- | +| MEDIUM | Merge Without Review | Yes (CodeQL) | This change prevents stack trace information from reaching the HTTP response, which could leak code internals to an attacker and aid in further profiling and attacks. @@ -24,8 +24,8 @@ Switching to a safe signature that doesn't leak anything is easy and the changes } ``` - ## References - * [https://codeql.github.com/codeql-query-help/java/java-stack-trace-exposure/](https://codeql.github.com/codeql-query-help/java/java-stack-trace-exposure/) - * [https://cwe.mitre.org/data/definitions/209.html](https://cwe.mitre.org/data/definitions/209.html) - * [https://cwe.mitre.org/data/definitions/497.html](https://cwe.mitre.org/data/definitions/497.html) + +- [https://codeql.github.com/codeql-query-help/java/java-stack-trace-exposure/](https://codeql.github.com/codeql-query-help/java/java-stack-trace-exposure/) +- [https://cwe.mitre.org/data/definitions/209.html](https://cwe.mitre.org/data/definitions/209.html) +- [https://cwe.mitre.org/data/definitions/497.html](https://cwe.mitre.org/data/definitions/497.html) diff --git a/docs/codemods/java/pixee_java_add-clarifying-braces.md b/docs/codemods/java/pixee_java_add-clarifying-braces.md index e1a0245..700b0c9 100644 --- a/docs/codemods/java/pixee_java_add-clarifying-braces.md +++ b/docs/codemods/java/pixee_java_add-clarifying-braces.md @@ -3,15 +3,16 @@ title: "Add clarifying braces to misleading code" sidebar_position: 1 --- -## pixee:java/add-clarifying-braces +## pixee:java/add-clarifying-braces -| Importance | Review Guidance | Requires Scanning Tool | -|-------------|----------------------|------------------------| -| HIGH | Merge Without Review | No | +| Importance | Review Guidance | Requires Scanning Tool | +| ---------- | -------------------- | ---------------------- | +| HIGH | Merge Without Review | No | This change adds clarifying braces to misleading code blocks that look like they may be executing unintended code. Consider the following code: + ```java if (isAdmin) doFirstThing(); @@ -21,15 +22,16 @@ if (isAdmin) Although the code formatting makes it look like `doSecondThing()` only executes if `isAdmin` is true, it actually executes regardless of the value of the condition. This pattern of not having curly braces in combination with misaligned indentation leads to security bugs, including the famous [Apple iOS goto fail bug](https://www.synopsys.com/blogs/software-security/understanding-apple-goto-fail-vulnerability-2/) from their SSL library which allowed attackers to intercept and modify encrypted traffic. This codemod will add braces to control flow statements to make the code more clear, but only in situations in which there is confusing formatting. Our changes look something like this: + ```diff - if (isAdmin) + if (isAdmin) { doFirstThing(); -+ } ++ } doSecondThing(); ``` -Note that these changes illuminate situations in which there may be bugs and help make the control flow more clear. +Note that these changes illuminate situations in which there may be bugs and help make the control flow more clear. ## F.A.Q. @@ -37,7 +39,7 @@ Note that these changes illuminate situations in which there may be bugs and hel The intention of the changes introduced by this codemod is to illuminate situations where they may be bugs and format the code to make it more clear. Therefore, we invite review of this codemod's output not to double check the changed logic, but to see if any bugs have been found. - ## References - * [https://cwe.mitre.org/data/definitions/483.html](https://cwe.mitre.org/data/definitions/483.html) - * [https://www.synopsys.com/blogs/software-security/understanding-apple-goto-fail-vulnerability-2/](https://www.synopsys.com/blogs/software-security/understanding-apple-goto-fail-vulnerability-2/) + +- [https://cwe.mitre.org/data/definitions/483.html](https://cwe.mitre.org/data/definitions/483.html) +- [https://www.synopsys.com/blogs/software-security/understanding-apple-goto-fail-vulnerability-2/](https://www.synopsys.com/blogs/software-security/understanding-apple-goto-fail-vulnerability-2/) diff --git a/docs/codemods/java/pixee_java_disable-dircontext-deserialization.md b/docs/codemods/java/pixee_java_disable-dircontext-deserialization.md index 6408258..4a2f267 100644 --- a/docs/codemods/java/pixee_java_disable-dircontext-deserialization.md +++ b/docs/codemods/java/pixee_java_disable-dircontext-deserialization.md @@ -3,11 +3,11 @@ title: "Hardened LDAP call against deserialization attacks" sidebar_position: 1 --- -## pixee:java/disable-dircontext-deserialization +## pixee:java/disable-dircontext-deserialization -| Importance | Review Guidance | Requires Scanning Tool | -|-------------|----------------------|------------------------| -| HIGH | Merge After Cursory Review | No | +| Importance | Review Guidance | Requires Scanning Tool | +| ---------- | -------------------------- | ---------------------- | +| HIGH | Merge After Cursory Review | No | This change patches the LDAP interaction code to harden against a remote code execution vulnerability. @@ -29,7 +29,7 @@ Our changes look like this: The protection works by denying deserialization during processing of an LDAP query which we're confident is intentional in a vanishingly small percentage of usage. - ## References - * [https://www.blackhat.com/docs/us-16/materials/us-16-Munoz-A-Journey-From-JNDI-LDAP-Manipulation-To-RCE.pdf](https://www.blackhat.com/docs/us-16/materials/us-16-Munoz-A-Journey-From-JNDI-LDAP-Manipulation-To-RCE.pdf) - * [https://cheatsheetseries.owasp.org/cheatsheets/Deserialization_Cheat_Sheet.html](https://cheatsheetseries.owasp.org/cheatsheets/Deserialization_Cheat_Sheet.html) + +- [https://www.blackhat.com/docs/us-16/materials/us-16-Munoz-A-Journey-From-JNDI-LDAP-Manipulation-To-RCE.pdf](https://www.blackhat.com/docs/us-16/materials/us-16-Munoz-A-Journey-From-JNDI-LDAP-Manipulation-To-RCE.pdf) +- [https://cheatsheetseries.owasp.org/cheatsheets/Deserialization_Cheat_Sheet.html](https://cheatsheetseries.owasp.org/cheatsheets/Deserialization_Cheat_Sheet.html) diff --git a/docs/codemods/java/pixee_java_encode-jsp-scriptlet.md b/docs/codemods/java/pixee_java_encode-jsp-scriptlet.md index 2aa5dc3..22f2231 100644 --- a/docs/codemods/java/pixee_java_encode-jsp-scriptlet.md +++ b/docs/codemods/java/pixee_java_encode-jsp-scriptlet.md @@ -3,11 +3,11 @@ title: "Introduced protections against XSS attacks in JSP scriptlets" sidebar_position: 1 --- -## pixee:java/encode-jsp-scriptlet +## pixee:java/encode-jsp-scriptlet -| Importance | Review Guidance | Requires Scanning Tool | -|-------------|----------------------|------------------------| -| HIGH | Merge Without Review | No | +| Importance | Review Guidance | Requires Scanning Tool | +| ---------- | -------------------- | ---------------------- | +| HIGH | Merge Without Review | No | This change encodes certain JSP scriptlets to fix what appear to be trivially exploitable [Reflected Cross-Site Scripting (XSS)](https://portswigger.net/web-security/cross-site-scripting) vulnerabilities in your JSP files. XSS is a vulnerability that is tricky to understand initially, but really easy to exploit. @@ -28,8 +28,8 @@ Our changes introduce an HTML-encoding mechanism that look something like this: This change neutralizes the control characters that attackers would use to execute code. Depending on the context in which the scriptlet is rendered (e.g., inside HTML tags, HTML attributes, in JavaScript, quoted contexts, etc.), you may need to use another encoder. Check out the [OWASP XSS Prevention CheatSheet](https://cheatsheetseries.owasp.org/cheatsheets/Cross_Site_Scripting_Prevention_Cheat_Sheet.html) to learn more about these cases and other controls you may need. - ## References - * [https://portswigger.net/web-security/cross-site-scripting](https://portswigger.net/web-security/cross-site-scripting) - * [https://cheatsheetseries.owasp.org/cheatsheets/Cross_Site_Scripting_Prevention_Cheat_Sheet.html](https://cheatsheetseries.owasp.org/cheatsheets/Cross_Site_Scripting_Prevention_Cheat_Sheet.html) - * [https://cheatsheetseries.owasp.org/cheatsheets/XSS_Filter_Evasion_Cheat_Sheet.html](https://cheatsheetseries.owasp.org/cheatsheets/XSS_Filter_Evasion_Cheat_Sheet.html) + +- [https://portswigger.net/web-security/cross-site-scripting](https://portswigger.net/web-security/cross-site-scripting) +- [https://cheatsheetseries.owasp.org/cheatsheets/Cross_Site_Scripting_Prevention_Cheat_Sheet.html](https://cheatsheetseries.owasp.org/cheatsheets/Cross_Site_Scripting_Prevention_Cheat_Sheet.html) +- [https://cheatsheetseries.owasp.org/cheatsheets/XSS_Filter_Evasion_Cheat_Sheet.html](https://cheatsheetseries.owasp.org/cheatsheets/XSS_Filter_Evasion_Cheat_Sheet.html) diff --git a/docs/codemods/java/pixee_java_fix-verb-tampering.md b/docs/codemods/java/pixee_java_fix-verb-tampering.md index de8e3c7..2ef451f 100644 --- a/docs/codemods/java/pixee_java_fix-verb-tampering.md +++ b/docs/codemods/java/pixee_java_fix-verb-tampering.md @@ -3,15 +3,16 @@ title: "Introduced protections against verb tampering attacks (authN/authZ bypas sidebar_position: 1 --- -## pixee:java/fix-verb-tampering +## pixee:java/fix-verb-tampering -| Importance | Review Guidance | Requires Scanning Tool | -|-------------|----------------------|------------------------| -| HIGH | Merge Without Review | No | +| Importance | Review Guidance | Requires Scanning Tool | +| ---------- | -------------------- | ---------------------- | +| HIGH | Merge Without Review | No | The `web.xml` specification offers a way to protect certain parts of your URL space. Unfortunately, it doesn't work the way people think it does, developers who are trying to enhance their security often end up accidentally exposing those parts they were trying to protect. Consider the following `web.xml`, which is trying to restrict the `/admin/*` space to only those with the `admin` role: + ```xml @@ -46,8 +47,8 @@ Our change is simple: any place we see `` listed in a `` entries tells the server that this protection must be enforced for all methods, which is almost always the intent of the developer. - ## References - * [https://dl.packetstormsecurity.net/papers/web/Bypassing_VBAAC_with_HTTP_Verb_Tampering.pdf](https://dl.packetstormsecurity.net/papers/web/Bypassing_VBAAC_with_HTTP_Verb_Tampering.pdf) - * [https://vulncat.fortify.com/en/detail?id=desc.config.java.http_verb_tampering](https://vulncat.fortify.com/en/detail?id=desc.config.java.http_verb_tampering) - * [https://capec.mitre.org/data/definitions/274.html](https://capec.mitre.org/data/definitions/274.html) + +- [https://dl.packetstormsecurity.net/papers/web/Bypassing_VBAAC_with_HTTP_Verb_Tampering.pdf](https://dl.packetstormsecurity.net/papers/web/Bypassing_VBAAC_with_HTTP_Verb_Tampering.pdf) +- [https://vulncat.fortify.com/en/detail?id=desc.config.java.http_verb_tampering](https://vulncat.fortify.com/en/detail?id=desc.config.java.http_verb_tampering) +- [https://capec.mitre.org/data/definitions/274.html](https://capec.mitre.org/data/definitions/274.html) diff --git a/docs/codemods/java/pixee_java_harden-java-deserialization.md b/docs/codemods/java/pixee_java_harden-java-deserialization.md index 6338510..358f4fb 100644 --- a/docs/codemods/java/pixee_java_harden-java-deserialization.md +++ b/docs/codemods/java/pixee_java_harden-java-deserialization.md @@ -3,11 +3,11 @@ title: "Introduced protections against deserialization attacks" sidebar_position: 1 --- -## pixee:java/harden-java-deserialization +## pixee:java/harden-java-deserialization -| Importance | Review Guidance | Requires Scanning Tool | -|-------------|----------------------|------------------------| -| HIGH | Merge Without Review | No | +| Importance | Review Guidance | Requires Scanning Tool | +| ---------- | -------------------- | ---------------------- | +| HIGH | Merge Without Review | No | This change hardens Java deserialization operations against attack. Even a simple operation like an object deserialization is an opportunity to yield control of your system to an attacker. In fact, without specific, non-default protections, any object deserialization call can lead to arbitrary code execution. The JavaDoc [now even says](https://docs.oracle.com/en/java/javase/17/docs/api/java.base/java/io/ObjectInputFilter.html): @@ -33,7 +33,7 @@ static class MethodInvokeTypeProvider implements TypeProvider { Reflecting on this code reveals a terrifying conclusion. If an attacker presents this object to be deserialized by your app, the runtime will take a class and a method name from the attacker and then call them. Note that an attacker can provide any serliazed type -- it doesn't have to be the one you're expecting, and it will still deserialize. -Attackers can repurpose the logic of selected types within the Java classpath (called "gadgets") and chain them together to achieve arbitrary remote code execution. There are a limited number of publicly known gadgets that can be used for attack, and our change simply inserts an [ObjectInputFilter](https://docs.oracle.com/en/java/javase/17/docs/api/java.base/java/io/ObjectInputStream.html#setObjectInputFilter(java.io.ObjectInputFilter)) into the `ObjectInputStream` to prevent them from being used. +Attackers can repurpose the logic of selected types within the Java classpath (called "gadgets") and chain them together to achieve arbitrary remote code execution. There are a limited number of publicly known gadgets that can be used for attack, and our change simply inserts an [ObjectInputFilter]() into the `ObjectInputStream` to prevent them from being used. ```diff + import io.github.pixee.security.ObjectInputFilters; @@ -50,7 +50,7 @@ This is a tough vulnerability class to understand, but it is deadly serious. It We always prefer to use existing controls built into Java, or a control from a well-known and trusted community dependency. However, older versions of Java don't support fine-grained deserialization filter controls, and there are no community-trusted controls. - ## References - * [https://cheatsheetseries.owasp.org/cheatsheets/Deserialization_Cheat_Sheet.html](https://cheatsheetseries.owasp.org/cheatsheets/Deserialization_Cheat_Sheet.html) - * [https://portswigger.net/web-security/deserialization/exploiting](https://portswigger.net/web-security/deserialization/exploiting) + +- [https://cheatsheetseries.owasp.org/cheatsheets/Deserialization_Cheat_Sheet.html](https://cheatsheetseries.owasp.org/cheatsheets/Deserialization_Cheat_Sheet.html) +- [https://portswigger.net/web-security/deserialization/exploiting](https://portswigger.net/web-security/deserialization/exploiting) diff --git a/docs/codemods/java/pixee_java_harden-process-creation.md b/docs/codemods/java/pixee_java_harden-process-creation.md index 8b2fce9..1832d9f 100644 --- a/docs/codemods/java/pixee_java_harden-process-creation.md +++ b/docs/codemods/java/pixee_java_harden-process-creation.md @@ -3,11 +3,11 @@ title: "Introduced protections against system command injection" sidebar_position: 1 --- -## pixee:java/harden-process-creation +## pixee:java/harden-process-creation -| Importance | Review Guidance | Requires Scanning Tool | -|-------------|----------------------|------------------------| -| HIGH | Merge Without Review | No | +| Importance | Review Guidance | Requires Scanning Tool | +| ---------- | -------------------- | ---------------------- | +| HIGH | Merge Without Review | No | This change hardens all instances of [Runtime#exec()](https://docs.oracle.com/en/java/javase/17/docs/api/java.base/java/lang/Runtime.html) to offer protection against attack. @@ -23,8 +23,9 @@ Our change introduces a sandbox which protects the application: ``` The default restrictions applied are the following: -* **Prevent command chaining**. Many exploits work by injecting command separators and causing the shell to interpret a second, malicious command. The `SystemCommand#runCommand()` attempts to parse the given command, and throw a `SecurityException` if multiple commands are present. -* **Prevent arguments targeting sensitive files.** There is little reason for custom code to target sensitive system files like `/etc/passwd`, so the sandbox prevents arguments that point to these files that may be targets for exfiltration. + +- **Prevent command chaining**. Many exploits work by injecting command separators and causing the shell to interpret a second, malicious command. The `SystemCommand#runCommand()` attempts to parse the given command, and throw a `SecurityException` if multiple commands are present. +- **Prevent arguments targeting sensitive files.** There is little reason for custom code to target sensitive system files like `/etc/passwd`, so the sandbox prevents arguments that point to these files that may be targets for exfiltration. There are [more options for sandboxing](https://github.com/pixee/java-security-toolkit/blob/main/src/main/java/io/github/pixee/security/SystemCommand.java#L15) if you are interested in locking down system commands even more. @@ -34,7 +35,7 @@ There are [more options for sandboxing](https://github.com/pixee/java-security-t We believe this change is safe and effective. The behavior of hardened `Runtime#exec()` calls will only throw `SecurityException` if they see behavior involved in malicious code execution, which is extremely unlikely to happen in normal operation. - ## References - * [https://cheatsheetseries.owasp.org/cheatsheets/OS_Command_Injection_Defense_Cheat_Sheet.html](https://cheatsheetseries.owasp.org/cheatsheets/OS_Command_Injection_Defense_Cheat_Sheet.html) - * [https://wiki.sei.cmu.edu/confluence/display/java/IDS07-J.+Sanitize+untrusted+data+passed+to+the+Runtime.exec%28%29+method](https://wiki.sei.cmu.edu/confluence/display/java/IDS07-J.+Sanitize+untrusted+data+passed+to+the+Runtime.exec%28%29+method) + +- [https://cheatsheetseries.owasp.org/cheatsheets/OS_Command_Injection_Defense_Cheat_Sheet.html](https://cheatsheetseries.owasp.org/cheatsheets/OS_Command_Injection_Defense_Cheat_Sheet.html) +- [https://wiki.sei.cmu.edu/confluence/display/java/IDS07-J.+Sanitize+untrusted+data+passed+to+the+Runtime.exec%28%29+method](https://wiki.sei.cmu.edu/confluence/display/java/IDS07-J.+Sanitize+untrusted+data+passed+to+the+Runtime.exec%28%29+method) diff --git a/docs/codemods/java/pixee_java_harden-xmldecoder-stream.md b/docs/codemods/java/pixee_java_harden-xmldecoder-stream.md index 8a00d9d..00df3a5 100644 --- a/docs/codemods/java/pixee_java_harden-xmldecoder-stream.md +++ b/docs/codemods/java/pixee_java_harden-xmldecoder-stream.md @@ -3,11 +3,11 @@ title: "Hardened XMLDecoder usage to prevent common attacks" sidebar_position: 1 --- -## pixee:java/harden-xmldecoder-stream +## pixee:java/harden-xmldecoder-stream -| Importance | Review Guidance | Requires Scanning Tool | -|-------------|----------------------|------------------------| -| HIGH | Merge Without Review | No | +| Importance | Review Guidance | Requires Scanning Tool | +| ---------- | -------------------- | ---------------------- | +| HIGH | Merge Without Review | No | This change hardens usage of Java's [`java.beans.XMLDecoder`](https://docs.oracle.com/en/java/javase/17/docs/api/java.desktop/java/beans/XMLDecoder.html) APIs to prevent remote code execution attacks. @@ -60,7 +60,7 @@ Our change wraps all `InputStream` objects passed to `XMLDecoder` constructors w We believe this change is safe and effective. The behavior of hardened `XMLDecoder` instances will only throw `SecurityException` if they see types being deserialized are involved in code execution, which is extremely unlikely to in normal operation. - ## References - * [https://github.com/mgeeky/Penetration-Testing-Tools/blob/master/web/java-XMLDecoder-RCE.md](https://github.com/mgeeky/Penetration-Testing-Tools/blob/master/web/java-XMLDecoder-RCE.md) - * [http://diniscruz.blogspot.com/2013/08/using-xmldecoder-to-execute-server-side.html](http://diniscruz.blogspot.com/2013/08/using-xmldecoder-to-execute-server-side.html) + +- [https://github.com/mgeeky/Penetration-Testing-Tools/blob/master/web/java-XMLDecoder-RCE.md](https://github.com/mgeeky/Penetration-Testing-Tools/blob/master/web/java-XMLDecoder-RCE.md) +- [http://diniscruz.blogspot.com/2013/08/using-xmldecoder-to-execute-server-side.html](http://diniscruz.blogspot.com/2013/08/using-xmldecoder-to-execute-server-side.html) diff --git a/docs/codemods/java/pixee_java_harden-xmlinputfactory.md b/docs/codemods/java/pixee_java_harden-xmlinputfactory.md index ee30827..4e941ef 100644 --- a/docs/codemods/java/pixee_java_harden-xmlinputfactory.md +++ b/docs/codemods/java/pixee_java_harden-xmlinputfactory.md @@ -3,11 +3,11 @@ title: "Introduced protections against XXE attacks" sidebar_position: 1 --- -## pixee:java/harden-xmlinputfactory +## pixee:java/harden-xmlinputfactory -| Importance | Review Guidance | Requires Scanning Tool | -|-------------|----------------------|------------------------| -| HIGH | Merge Without Review | No | +| Importance | Review Guidance | Requires Scanning Tool | +| ---------- | -------------------- | ---------------------- | +| HIGH | Merge Without Review | No | This change updates all instances of [XMLInputFactory](https://docs.oracle.com/javase/8/docs/api/javax/xml/stream/XMLInputFactory.html) to prevent them from resolving external entities, which can protect you from arbitrary code execution, sensitive data exfiltration, and probably a bunch more evil things attackers are still discovering. @@ -31,6 +31,7 @@ Yes, it's pretty insane that this is the default behavior. Our change hardens th ``` You could take our protections one step further by changing our supplied code to prevent the user from supplying a `DOCTYPE`, which is more aggressive and more secure, but also more likely to affect existing code behavior: + ```diff + import io.github.pixee.security.XMLInputFactorySecurity; + import io.github.pixee.security.XMLRestrictions; @@ -44,8 +45,8 @@ You could take our protections one step further by changing our supplied code to We believe this change is safe and effective. The behavior of hardened `XMLInputFactory` instances will only be different if the XML they process uses external entities, which is exceptionally rare (and, as demonstrated, quite unsafe anyway.) - ## References - * [https://cheatsheetseries.owasp.org/cheatsheets/XML_External_Entity_Prevention_Cheat_Sheet.html](https://cheatsheetseries.owasp.org/cheatsheets/XML_External_Entity_Prevention_Cheat_Sheet.html) - * [https://owasp.org/www-community/vulnerabilities/XML_External_Entity_(XXE)_Processing](https://owasp.org/www-community/vulnerabilities/XML_External_Entity_(XXE)_Processing) - * [https://github.com/swisskyrepo/PayloadsAllTheThings/blob/master/XXE%20Injection/README.md](https://github.com/swisskyrepo/PayloadsAllTheThings/blob/master/XXE%20Injection/README.md) + +- [https://cheatsheetseries.owasp.org/cheatsheets/XML_External_Entity_Prevention_Cheat_Sheet.html](https://cheatsheetseries.owasp.org/cheatsheets/XML_External_Entity_Prevention_Cheat_Sheet.html) +- [https://owasp.org/www-community/vulnerabilities/XML*External_Entity*(XXE)\_Processing]() +- [https://github.com/swisskyrepo/PayloadsAllTheThings/blob/master/XXE%20Injection/README.md](https://github.com/swisskyrepo/PayloadsAllTheThings/blob/master/XXE%20Injection/README.md) diff --git a/docs/codemods/java/pixee_java_harden-xstream.md b/docs/codemods/java/pixee_java_harden-xstream.md index c843380..ff62dfc 100644 --- a/docs/codemods/java/pixee_java_harden-xstream.md +++ b/docs/codemods/java/pixee_java_harden-xstream.md @@ -3,11 +3,11 @@ title: "Hardened XStream with a converter to prevent exploitation" sidebar_position: 1 --- -## pixee:java/harden-xstream +## pixee:java/harden-xstream -| Importance | Review Guidance | Requires Scanning Tool | -|-------------|----------------------|------------------------| -| HIGH | Merge Without Review | No | +| Importance | Review Guidance | Requires Scanning Tool | +| ---------- | -------------------- | ---------------------- | +| HIGH | Merge Without Review | No | This change hardens usage of the `XStream` library to prevent remote code execution attacks. @@ -30,9 +30,9 @@ Looking at the [history of exploits](https://x-stream.github.io/security.html#CV We believe this change is safe and effective. The behavior of hardened XStream instances will only be different if the types being deserialized are involved in code execution, which is extremely unlikely to in normal operation. - ## References - * [https://x-stream.github.io/security.html](https://x-stream.github.io/security.html) - * [http://diniscruz.blogspot.com/2013/12/xstream-remote-code-execution-exploit.html](http://diniscruz.blogspot.com/2013/12/xstream-remote-code-execution-exploit.html) - * [https://www.contrastsecurity.com/security-influencers/serialization-must-die-act-2-xstream](https://www.contrastsecurity.com/security-influencers/serialization-must-die-act-2-xstream) - * [https://x-stream.github.io/CVE-2013-7285.html](https://x-stream.github.io/CVE-2013-7285.html) + +- [https://x-stream.github.io/security.html](https://x-stream.github.io/security.html) +- [http://diniscruz.blogspot.com/2013/12/xstream-remote-code-execution-exploit.html](http://diniscruz.blogspot.com/2013/12/xstream-remote-code-execution-exploit.html) +- [https://www.contrastsecurity.com/security-influencers/serialization-must-die-act-2-xstream](https://www.contrastsecurity.com/security-influencers/serialization-must-die-act-2-xstream) +- [https://x-stream.github.io/CVE-2013-7285.html](https://x-stream.github.io/CVE-2013-7285.html) diff --git a/docs/codemods/java/pixee_java_harden-zip-entry-paths.md b/docs/codemods/java/pixee_java_harden-zip-entry-paths.md index 32e485c..f88d459 100644 --- a/docs/codemods/java/pixee_java_harden-zip-entry-paths.md +++ b/docs/codemods/java/pixee_java_harden-zip-entry-paths.md @@ -1,13 +1,13 @@ --- -title: "Introduced protections against \"zip slip\" attacks" +title: 'Introduced protections against "zip slip" attacks' sidebar_position: 1 --- -## pixee:java/harden-zip-entry-paths +## pixee:java/harden-zip-entry-paths -| Importance | Review Guidance | Requires Scanning Tool | -|-------------|----------------------|------------------------| -| HIGH | Merge Without Review | No | +| Importance | Review Guidance | Requires Scanning Tool | +| ---------- | -------------------- | ---------------------- | +| HIGH | Merge Without Review | No | This change updates all new instances of [ZipInputStream](https://docs.oracle.com/en/java/javase/17/docs/api/java.base/java/util/zip/ZipInputStream.html) to protect against malicious entries that attempt to escape their "file root" and overwrite other files on the running filesystem. @@ -20,18 +20,20 @@ IOUtils.copy(is, new FileOutputStream(file)); // write the contents to the provi ``` This looks fine when it encounters a normal zip entry within a zip file, looking something like this pseudo-data: + ```binary path: data/names.txt contents: Zeus\nHelen\nLeda... ``` However, there's nothing to prevent an attacker from sending an evil entry in the zip that looks more like this: + ```binary path: ../../../../../etc/passwd contents: root::0:0:root:/:/bin/sh ``` -Yes, in the above code, which looks like [every](https://stackoverflow.com/a/23870468) [piece](https://stackoverflow.com/a/51285801) of [zip-processing](https://kodejava.org/how-do-i-decompress-a-zip-file-using-zipinputstream/) code you can [find](https://www.tabnine.com/code/java/classes/java.util.zip.ZipInputStream) on the [Internet](https://www.baeldung.com/java-compress-and-uncompress), attackers could overwrite any files to which the application has access. This rule replaces the standard `ZipInputStream` with a hardened subclass which prevents access to entry paths that attempt to traverse directories above the current directory (which no normal zip file should ever do.) Our changes end up looking something like this: +Yes, in the above code, which looks like [every](https://stackoverflow.com/a/23870468) [piece](https://stackoverflow.com/a/51285801) of [zip-processing](https://kodejava.org/how-do-i-decompress-a-zip-file-using-zipinputstream/) code you can [find](https://www.tabnine.com/code/java/classes/java.util.zip.ZipInputStream) on the [Internet](https://www.baeldung.com/java-compress-and-uncompress), attackers could overwrite any files to which the application has access. This rule replaces the standard `ZipInputStream` with a hardened subclass which prevents access to entry paths that attempt to traverse directories above the current directory (which no normal zip file should ever do.) Our changes end up looking something like this: ```diff + import io.github.pixee.security.ZipSecurity; @@ -46,9 +48,9 @@ Yes, in the above code, which looks like [every](https://stackoverflow.com/a/238 We believe this change is safe and effective. The behavior of hardened `ZipInputStream` instances will only be different if malicious zip entries are encountered. - ## References - * [https://snyk.io/research/zip-slip-vulnerability](https://snyk.io/research/zip-slip-vulnerability) - * [https://github.com/snyk/zip-slip-vulnerability](https://github.com/snyk/zip-slip-vulnerability) - * [https://wiki.sei.cmu.edu/confluence/display/java/IDS04-J.+Safely+extract+files+from+ZipInputStream](https://wiki.sei.cmu.edu/confluence/display/java/IDS04-J.+Safely+extract+files+from+ZipInputStream) - * [https://vulncat.fortify.com/en/detail?id=desc.dataflow.java.path_manipulation_zip_entry_overwrite](https://vulncat.fortify.com/en/detail?id=desc.dataflow.java.path_manipulation_zip_entry_overwrite) + +- [https://snyk.io/research/zip-slip-vulnerability](https://snyk.io/research/zip-slip-vulnerability) +- [https://github.com/snyk/zip-slip-vulnerability](https://github.com/snyk/zip-slip-vulnerability) +- [https://wiki.sei.cmu.edu/confluence/display/java/IDS04-J.+Safely+extract+files+from+ZipInputStream](https://wiki.sei.cmu.edu/confluence/display/java/IDS04-J.+Safely+extract+files+from+ZipInputStream) +- [https://vulncat.fortify.com/en/detail?id=desc.dataflow.java.path_manipulation_zip_entry_overwrite](https://vulncat.fortify.com/en/detail?id=desc.dataflow.java.path_manipulation_zip_entry_overwrite) diff --git a/docs/codemods/java/pixee_java_hql-parameterizer.md b/docs/codemods/java/pixee_java_hql-parameterizer.md index 046d25e..cfd06f5 100644 --- a/docs/codemods/java/pixee_java_hql-parameterizer.md +++ b/docs/codemods/java/pixee_java_hql-parameterizer.md @@ -3,11 +3,11 @@ title: "Refactored to use parameterized HQL APIs" sidebar_position: 1 --- -## pixee:java/hql-parameterizer +## pixee:java/hql-parameterizer -| Importance | Review Guidance | Requires Scanning Tool | -|-------------|----------------------|------------------------| -| HIGH | Merge After Review | No | +| Importance | Review Guidance | Requires Scanning Tool | +| ---------- | ------------------ | ---------------------- | +| HIGH | Merge After Review | No | This change refactors Hibernate queries to be parameterized, rather than built by hand. @@ -26,7 +26,7 @@ Our changes look something like this: Although there should be no functional differences, the rewrite here is complex and should be verified by a human. - ## References - * [https://cheatsheetseries.owasp.org/cheatsheets/Query_Parameterization_Cheat_Sheet.html#using-java-with-hibernate](https://cheatsheetseries.owasp.org/cheatsheets/Query_Parameterization_Cheat_Sheet.html#using-java-with-hibernate) - * [https://cwe.mitre.org/data/definitions/564.html](https://cwe.mitre.org/data/definitions/564.html) + +- [https://cheatsheetseries.owasp.org/cheatsheets/Query_Parameterization_Cheat_Sheet.html#using-java-with-hibernate](https://cheatsheetseries.owasp.org/cheatsheets/Query_Parameterization_Cheat_Sheet.html#using-java-with-hibernate) +- [https://cwe.mitre.org/data/definitions/564.html](https://cwe.mitre.org/data/definitions/564.html) diff --git a/docs/codemods/java/pixee_java_limit-readline.md b/docs/codemods/java/pixee_java_limit-readline.md index 770dcba..180ee4e 100644 --- a/docs/codemods/java/pixee_java_limit-readline.md +++ b/docs/codemods/java/pixee_java_limit-readline.md @@ -3,11 +3,11 @@ title: "Protect `readLine()` against DoS" sidebar_position: 1 --- -## pixee:java/limit-readline +## pixee:java/limit-readline -| Importance | Review Guidance | Requires Scanning Tool | -|-------------|----------------------|------------------------| -| MEDIUM | Merge Without Review | No | +| Importance | Review Guidance | Requires Scanning Tool | +| ---------- | -------------------- | ---------------------- | +| MEDIUM | Merge Without Review | No | This change hardens all [`BufferedReader#readLine()`](https://docs.oracle.com/javase/8/docs/api/java/io/BufferedReader.html#readLine--) operations against memory exhaustion. @@ -29,7 +29,7 @@ Fixing it is straightforward using an API which limits the amount of expected ch We always prefer to use existing controls built into Java, or a control from a well-known and trusted community dependency. However, we cannot find any such control. If you know of one, please let us know. - ## References - * [https://vulncat.fortify.com/en/detail?id=desc.dataflow.abap.denial_of_service](https://vulncat.fortify.com/en/detail?id=desc.dataflow.abap.denial_of_service) - * [https://cwe.mitre.org/data/definitions/400.html](https://cwe.mitre.org/data/definitions/400.html) + +- [https://vulncat.fortify.com/en/detail?id=desc.dataflow.abap.denial_of_service](https://vulncat.fortify.com/en/detail?id=desc.dataflow.abap.denial_of_service) +- [https://cwe.mitre.org/data/definitions/400.html](https://cwe.mitre.org/data/definitions/400.html) diff --git a/docs/codemods/java/pixee_java_make-prng-seed-unpredictable.md b/docs/codemods/java/pixee_java_make-prng-seed-unpredictable.md index 1938bd4..f77273f 100644 --- a/docs/codemods/java/pixee_java_make-prng-seed-unpredictable.md +++ b/docs/codemods/java/pixee_java_make-prng-seed-unpredictable.md @@ -3,11 +3,11 @@ title: "Strengthened cipher seed with more unpredictable value" sidebar_position: 1 --- -## pixee:java/make-prng-seed-unpredictable +## pixee:java/make-prng-seed-unpredictable -| Importance | Review Guidance | Requires Scanning Tool | -|-------------|----------------------|------------------------| -| LOW | Merge Without Review | No | +| Importance | Review Guidance | Requires Scanning Tool | +| ---------- | -------------------- | ---------------------- | +| LOW | Merge Without Review | No | This change replaces all the constant seeds passed to `Random#setSeed(long)` with a pseudo-random value, which will make it considerably more secure. @@ -21,9 +21,9 @@ Our change replaces the constant with `System#currentTimeMillis()`. + random.setSeed(System.currentTimeMillis()); ``` - ## References - * [https://wiki.sei.cmu.edu/confluence/display/c/MSC32-C.+Properly+seed+pseudorandom+number+generators](https://wiki.sei.cmu.edu/confluence/display/c/MSC32-C.+Properly+seed+pseudorandom+number+generators) - * [https://wiki.sei.cmu.edu/confluence/display/cplusplus/MSC51-CPP.+Ensure+your+random+number+generator+is+properly+seeded](https://wiki.sei.cmu.edu/confluence/display/cplusplus/MSC51-CPP.+Ensure+your+random+number+generator+is+properly+seeded) - * [https://cwe.mitre.org/data/definitions/337.html](https://cwe.mitre.org/data/definitions/337.html) - * [https://en.wikipedia.org/wiki/Random_seed](https://en.wikipedia.org/wiki/Random_seed) + +- [https://wiki.sei.cmu.edu/confluence/display/c/MSC32-C.+Properly+seed+pseudorandom+number+generators](https://wiki.sei.cmu.edu/confluence/display/c/MSC32-C.+Properly+seed+pseudorandom+number+generators) +- [https://wiki.sei.cmu.edu/confluence/display/cplusplus/MSC51-CPP.+Ensure+your+random+number+generator+is+properly+seeded](https://wiki.sei.cmu.edu/confluence/display/cplusplus/MSC51-CPP.+Ensure+your+random+number+generator+is+properly+seeded) +- [https://cwe.mitre.org/data/definitions/337.html](https://cwe.mitre.org/data/definitions/337.html) +- [https://en.wikipedia.org/wiki/Random_seed](https://en.wikipedia.org/wiki/Random_seed) diff --git a/docs/codemods/java/pixee_java_prevent-filewriter-leak-with-nio.md b/docs/codemods/java/pixee_java_prevent-filewriter-leak-with-nio.md index 0278512..95ecd2f 100644 --- a/docs/codemods/java/pixee_java_prevent-filewriter-leak-with-nio.md +++ b/docs/codemods/java/pixee_java_prevent-filewriter-leak-with-nio.md @@ -3,11 +3,11 @@ title: "Prevent file descriptor leak and modernize BufferedWriter creation" sidebar_position: 1 --- -## pixee:java/prevent-filewriter-leak-with-nio +## pixee:java/prevent-filewriter-leak-with-nio -| Importance | Review Guidance | Requires Scanning Tool | -|-------------|----------------------|------------------------| -| MEDIUM | Merge Without Review | No | +| Importance | Review Guidance | Requires Scanning Tool | +| ---------- | -------------------- | ---------------------- | +| MEDIUM | Merge Without Review | No | This change prevents a file descriptor leak and modernizes the file writing API pattern. @@ -20,6 +20,6 @@ Our changes look something like this: + BufferedWriter writer = Files.newBufferedWriter(f.toPath()); ``` - ## References - * [https://cwe.mitre.org/data/definitions/775.html](https://cwe.mitre.org/data/definitions/775.html) + +- [https://cwe.mitre.org/data/definitions/775.html](https://cwe.mitre.org/data/definitions/775.html) diff --git a/docs/codemods/java/pixee_java_replace-apache-defaulthttpclient.md b/docs/codemods/java/pixee_java_replace-apache-defaulthttpclient.md index b7b5baa..3dfd7e0 100644 --- a/docs/codemods/java/pixee_java_replace-apache-defaulthttpclient.md +++ b/docs/codemods/java/pixee_java_replace-apache-defaulthttpclient.md @@ -3,15 +3,15 @@ title: "Replaced deprecated and insecure Apache HTTP client" sidebar_position: 1 --- -## pixee:java/replace-apache-defaulthttpclient +## pixee:java/replace-apache-defaulthttpclient -| Importance | Review Guidance | Requires Scanning Tool | -|-------------|----------------------|------------------------| -| MEDIUM | Merge After Cursory Review | No | +| Importance | Review Guidance | Requires Scanning Tool | +| ---------- | -------------------------- | ---------------------- | +| MEDIUM | Merge After Cursory Review | No | -This change replaces all instances of the [deprecated `DefaultHttpClient`](https://hc.apache.org/httpcomponents-client-4.5.x/current/httpclient/apidocs/org/apache/http/impl/client/DefaultHttpClient.html) from Apache's HTTP client library with a more secure, modern implementation from the same package. +This change replaces all instances of the [deprecated `DefaultHttpClient`](https://hc.apache.org/httpcomponents-client-4.5.x/current/httpclient/apidocs/org/apache/http/impl/client/DefaultHttpClient.html) from Apache's HTTP client library with a more secure, modern implementation from the same package. - This type [does not support using TLS 1.2](https://find-sec-bugs.github.io/bugs.htm#DEFAULT_HTTP_CLIENT) and could be exposing the code to many different network security risks because of it. +This type [does not support using TLS 1.2](https://find-sec-bugs.github.io/bugs.htm#DEFAULT_HTTP_CLIENT) and could be exposing the code to many different network security risks because of it. Our changes look something like this: @@ -20,8 +20,8 @@ Our changes look something like this: + HttpClient client = HttpClientBuilder.create().useSystemProperties().build(); ``` - ## References - * [https://find-sec-bugs.github.io/bugs.htm#DEFAULT_HTTP_CLIENT](https://find-sec-bugs.github.io/bugs.htm#DEFAULT_HTTP_CLIENT) - * [https://www.ibm.com/support/pages/im-using-apache-httpclient-make-outbound-call-my-web-application-running-websphere-application-server-traditional-and-im-getting-ssl-handshake-error-how-can-i-debug](https://www.ibm.com/support/pages/im-using-apache-httpclient-make-outbound-call-my-web-application-running-websphere-application-server-traditional-and-im-getting-ssl-handshake-error-how-can-i-debug) - * [https://cwe.mitre.org/data/definitions/326.html](https://cwe.mitre.org/data/definitions/326.html) + +- [https://find-sec-bugs.github.io/bugs.htm#DEFAULT_HTTP_CLIENT](https://find-sec-bugs.github.io/bugs.htm#DEFAULT_HTTP_CLIENT) +- [https://www.ibm.com/support/pages/im-using-apache-httpclient-make-outbound-call-my-web-application-running-websphere-application-server-traditional-and-im-getting-ssl-handshake-error-how-can-i-debug](https://www.ibm.com/support/pages/im-using-apache-httpclient-make-outbound-call-my-web-application-running-websphere-application-server-traditional-and-im-getting-ssl-handshake-error-how-can-i-debug) +- [https://cwe.mitre.org/data/definitions/326.html](https://cwe.mitre.org/data/definitions/326.html) diff --git a/docs/codemods/java/pixee_java_sandbox-url-creation.md b/docs/codemods/java/pixee_java_sandbox-url-creation.md index d84e8ab..6c20c27 100644 --- a/docs/codemods/java/pixee_java_sandbox-url-creation.md +++ b/docs/codemods/java/pixee_java_sandbox-url-creation.md @@ -3,11 +3,11 @@ title: "Sandboxed URL creation to prevent SSRF attacks" sidebar_position: 1 --- -## pixee:java/sandbox-url-creation +## pixee:java/sandbox-url-creation -| Importance | Review Guidance | Requires Scanning Tool | -|-------------|----------------------|------------------------| -| HIGH | Merge Without Review | No | +| Importance | Review Guidance | Requires Scanning Tool | +| ---------- | -------------------- | ---------------------- | +| HIGH | Merge Without Review | No | This change sandboxes the creation of [`java.net.URL`](https://docs.oracle.com/en/java/javase/17/docs/api/java.base/java/net/URL.html) objects so they will be more resistant to Server-Side Request Forgery (SSRF) attacks. @@ -44,10 +44,10 @@ This change alone reduces attack surface significantly, but can be enhanced to c Note: Beware temptation to write some validation on your own. Parsing URLs is difficult and differences between parsers in validation and execution will certainly lead to exploits as attackers [have repeatedly proven](https://www.blackhat.com/docs/us-17/thursday/us-17-Tsai-A-New-Era-Of-SSRF-Exploiting-URL-Parser-In-Trending-Programming-Languages.pdf). - ## References - * [https://www.hacksplaining.com/prevention/ssrf](https://www.hacksplaining.com/prevention/ssrf) - * [https://portswigger.net/web-security/ssrf](https://portswigger.net/web-security/ssrf) - * [https://cheatsheetseries.owasp.org/cheatsheets/Server_Side_Request_Forgery_Prevention_Cheat_Sheet.html](https://cheatsheetseries.owasp.org/cheatsheets/Server_Side_Request_Forgery_Prevention_Cheat_Sheet.html) - * [https://www.rapid7.com/blog/post/2021/11/23/owasp-top-10-deep-dive-defending-against-server-side-request-forgery/](https://www.rapid7.com/blog/post/2021/11/23/owasp-top-10-deep-dive-defending-against-server-side-request-forgery/) - * [https://blog.assetnote.io/2021/01/13/blind-ssrf-chains/](https://blog.assetnote.io/2021/01/13/blind-ssrf-chains/) + +- [https://www.hacksplaining.com/prevention/ssrf](https://www.hacksplaining.com/prevention/ssrf) +- [https://portswigger.net/web-security/ssrf](https://portswigger.net/web-security/ssrf) +- [https://cheatsheetseries.owasp.org/cheatsheets/Server_Side_Request_Forgery_Prevention_Cheat_Sheet.html](https://cheatsheetseries.owasp.org/cheatsheets/Server_Side_Request_Forgery_Prevention_Cheat_Sheet.html) +- [https://www.rapid7.com/blog/post/2021/11/23/owasp-top-10-deep-dive-defending-against-server-side-request-forgery/](https://www.rapid7.com/blog/post/2021/11/23/owasp-top-10-deep-dive-defending-against-server-side-request-forgery/) +- [https://blog.assetnote.io/2021/01/13/blind-ssrf-chains/](https://blog.assetnote.io/2021/01/13/blind-ssrf-chains/) diff --git a/docs/codemods/java/pixee_java_sanitize-apache-multipart-filename.md b/docs/codemods/java/pixee_java_sanitize-apache-multipart-filename.md index c7d92ff..72987fa 100644 --- a/docs/codemods/java/pixee_java_sanitize-apache-multipart-filename.md +++ b/docs/codemods/java/pixee_java_sanitize-apache-multipart-filename.md @@ -3,11 +3,11 @@ title: "Sanitized user-provided file names in HTTP multipart uploads" sidebar_position: 1 --- -## pixee:java/sanitize-apache-multipart-filename +## pixee:java/sanitize-apache-multipart-filename -| Importance | Review Guidance | Requires Scanning Tool | -|-------------|----------------------|------------------------| -| HIGH | Merge Without Review | No | +| Importance | Review Guidance | Requires Scanning Tool | +| ---------- | -------------------- | ---------------------- | +| HIGH | Merge Without Review | No | This change hardens usage of Apache Common's popular multipart request and [file uploading library](https://commons.apache.org/proper/commons-fileupload/) to prevent file overwrite attacks. @@ -26,7 +26,7 @@ Our change sanitizes the output of `FileItem#getName()`, stripping the value of } ``` - ## References - * [https://owasp.org/www-community/vulnerabilities/Unrestricted_File_Upload](https://owasp.org/www-community/vulnerabilities/Unrestricted_File_Upload) - * [https://portswigger.net/web-security/file-upload](https://portswigger.net/web-security/file-upload) + +- [https://owasp.org/www-community/vulnerabilities/Unrestricted_File_Upload](https://owasp.org/www-community/vulnerabilities/Unrestricted_File_Upload) +- [https://portswigger.net/web-security/file-upload](https://portswigger.net/web-security/file-upload) diff --git a/docs/codemods/java/pixee_java_sanitize-spring-multipart-filename.md b/docs/codemods/java/pixee_java_sanitize-spring-multipart-filename.md index 4aebf80..f52a22c 100644 --- a/docs/codemods/java/pixee_java_sanitize-spring-multipart-filename.md +++ b/docs/codemods/java/pixee_java_sanitize-spring-multipart-filename.md @@ -3,11 +3,11 @@ title: "Sanitized user-provided file names in HTTP multipart uploads" sidebar_position: 1 --- -## pixee:java/sanitize-spring-multipart-filename +## pixee:java/sanitize-spring-multipart-filename -| Importance | Review Guidance | Requires Scanning Tool | -|-------------|----------------------|------------------------| -| HIGH | Merge Without Review | No | +| Importance | Review Guidance | Requires Scanning Tool | +| ---------- | -------------------- | ---------------------- | +| HIGH | Merge Without Review | No | This change hardens usage of the [Spring Web](https://github.com/spring-projects/spring-framework) multipart request and file uploading feature to prevent file overwrite attacks. @@ -24,8 +24,8 @@ Our change sanitizes the output of `FileItem#getName()`, stripping the value of writeFile(new File("my_upload_dir", name)); ``` - ## References - * [https://owasp.org/www-community/vulnerabilities/Unrestricted_File_Upload](https://owasp.org/www-community/vulnerabilities/Unrestricted_File_Upload) - * [https://portswigger.net/web-security/file-upload](https://portswigger.net/web-security/file-upload) - * [https://github.com/spring-projects/spring-framework/blob/c989470f94926ee5c7474bead278b00e9aaac787/spring-web/src/main/java/org/springframework/web/multipart/MultipartFile.java#L68](https://github.com/spring-projects/spring-framework/blob/c989470f94926ee5c7474bead278b00e9aaac787/spring-web/src/main/java/org/springframework/web/multipart/MultipartFile.java#L68) + +- [https://owasp.org/www-community/vulnerabilities/Unrestricted_File_Upload](https://owasp.org/www-community/vulnerabilities/Unrestricted_File_Upload) +- [https://portswigger.net/web-security/file-upload](https://portswigger.net/web-security/file-upload) +- [https://github.com/spring-projects/spring-framework/blob/c989470f94926ee5c7474bead278b00e9aaac787/spring-web/src/main/java/org/springframework/web/multipart/MultipartFile.java#L68](https://github.com/spring-projects/spring-framework/blob/c989470f94926ee5c7474bead278b00e9aaac787/spring-web/src/main/java/org/springframework/web/multipart/MultipartFile.java#L68) diff --git a/docs/codemods/java/pixee_java_secure-random.md b/docs/codemods/java/pixee_java_secure-random.md index b9f2d8f..a966972 100644 --- a/docs/codemods/java/pixee_java_secure-random.md +++ b/docs/codemods/java/pixee_java_secure-random.md @@ -3,11 +3,11 @@ title: "Introduced protections against predictable RNG abuse" sidebar_position: 1 --- -## pixee:java/secure-random +## pixee:java/secure-random -| Importance | Review Guidance | Requires Scanning Tool | -|-------------|----------------------|------------------------| -| MEDIUM | Merge Without Review | No | +| Importance | Review Guidance | Requires Scanning Tool | +| ---------- | -------------------- | ---------------------- | +| MEDIUM | Merge Without Review | No | This change replaces all new instances of `java.util.Random` with the marginally slower, but much more secure `java.security.SecureRandom`. @@ -22,8 +22,8 @@ Switching to a more secure version is simple and our changes all look something + Random r = new java.security.SecureRandom(); ``` - ## References - * [https://owasp.org/www-community/vulnerabilities/Insecure_Randomness](https://owasp.org/www-community/vulnerabilities/Insecure_Randomness) - * [https://metebalci.com/blog/everything-about-javas-securerandom/](https://metebalci.com/blog/everything-about-javas-securerandom/) - * [https://cwe.mitre.org/data/definitions/330.html](https://cwe.mitre.org/data/definitions/330.html) + +- [https://owasp.org/www-community/vulnerabilities/Insecure_Randomness](https://owasp.org/www-community/vulnerabilities/Insecure_Randomness) +- [https://metebalci.com/blog/everything-about-javas-securerandom/](https://metebalci.com/blog/everything-about-javas-securerandom/) +- [https://cwe.mitre.org/data/definitions/330.html](https://cwe.mitre.org/data/definitions/330.html) diff --git a/docs/codemods/java/pixee_java_sql-parameterizer.md b/docs/codemods/java/pixee_java_sql-parameterizer.md index 0031324..fa32ffe 100644 --- a/docs/codemods/java/pixee_java_sql-parameterizer.md +++ b/docs/codemods/java/pixee_java_sql-parameterizer.md @@ -3,11 +3,11 @@ title: "Refactored to use parameterized SQL APIs" sidebar_position: 1 --- -## pixee:java/sql-parameterizer +## pixee:java/sql-parameterizer -| Importance | Review Guidance | Requires Scanning Tool | -|-------------|----------------------|------------------------| -| HIGH | Merge After Review | No | +| Importance | Review Guidance | Requires Scanning Tool | +| ---------- | ------------------ | ---------------------- | +| HIGH | Merge After Review | No | This change refactors SQL statements to be parameterized, rather than built by hand. @@ -29,7 +29,7 @@ Our changes look something like this: Although there should be no functional differences, the rewrite here is complex and should be verified by a human. - ## References - * [https://cheatsheetseries.owasp.org/cheatsheets/SQL_Injection_Prevention_Cheat_Sheet.html](https://cheatsheetseries.owasp.org/cheatsheets/SQL_Injection_Prevention_Cheat_Sheet.html) - * [https://cwe.mitre.org/data/definitions/89.html](https://cwe.mitre.org/data/definitions/89.html) + +- [https://cheatsheetseries.owasp.org/cheatsheets/SQL_Injection_Prevention_Cheat_Sheet.html](https://cheatsheetseries.owasp.org/cheatsheets/SQL_Injection_Prevention_Cheat_Sheet.html) +- [https://cwe.mitre.org/data/definitions/89.html](https://cwe.mitre.org/data/definitions/89.html) diff --git a/docs/codemods/java/pixee_java_strip-http-header-newlines.md b/docs/codemods/java/pixee_java_strip-http-header-newlines.md index 861327c..98f08c6 100644 --- a/docs/codemods/java/pixee_java_strip-http-header-newlines.md +++ b/docs/codemods/java/pixee_java_strip-http-header-newlines.md @@ -3,17 +3,18 @@ title: "Introduced protections against HTTP header injection / smuggling attacks sidebar_position: 1 --- -## pixee:java/strip-http-header-newlines +## pixee:java/strip-http-header-newlines -| Importance | Review Guidance | Requires Scanning Tool | -|-------------|----------------------|------------------------| -| MEDIUM | Merge Without Review | No | +| Importance | Review Guidance | Requires Scanning Tool | +| ---------- | -------------------- | ---------------------- | +| MEDIUM | Merge Without Review | No | This change ensures that HTTP response header values can't contain newline characters, leaving you vulnerable to HTTP response splitting and other attacks. If malicious users can get newline characters into an HTTP response header, they can inject and forge new header values that look like they came from the server, and trick web gateways, proxies, and browsers. This leads to vulnerabilities like Cross-site Scripting (XSS), HTTP response splitting, and more attacks from there. Our change simply makes sure that if the string passed to be a new response header value is non-null, all the newline characters (CR and LF) will be removed: + ```diff + import io.github.pixee.security.Newlines; ... @@ -24,8 +25,8 @@ Our change simply makes sure that if the string passed to be a new response head Note: Many modern application servers will sanitize these values, but it's almost never specified in documentation, and thus there is little guarantee against regression. Given that, we still recommend this practice. - ## References - * [https://www.netsparker.com/blog/web-security/crlf-http-header/](https://www.netsparker.com/blog/web-security/crlf-http-header/) - * [https://owasp.org/www-community/attacks/HTTP_Response_Splitting](https://owasp.org/www-community/attacks/HTTP_Response_Splitting) - * [https://regilero.github.io/security/english/2015/10/04/http_smuggling_in_2015_part_one/](https://regilero.github.io/security/english/2015/10/04/http_smuggling_in_2015_part_one/) + +- [https://www.netsparker.com/blog/web-security/crlf-http-header/](https://www.netsparker.com/blog/web-security/crlf-http-header/) +- [https://owasp.org/www-community/attacks/HTTP_Response_Splitting](https://owasp.org/www-community/attacks/HTTP_Response_Splitting) +- [https://regilero.github.io/security/english/2015/10/04/http_smuggling_in_2015_part_one/](https://regilero.github.io/security/english/2015/10/04/http_smuggling_in_2015_part_one/) diff --git a/docs/codemods/java/pixee_java_switch-literal-first.md b/docs/codemods/java/pixee_java_switch-literal-first.md index 2db9a74..8ac46bf 100644 --- a/docs/codemods/java/pixee_java_switch-literal-first.md +++ b/docs/codemods/java/pixee_java_switch-literal-first.md @@ -3,13 +3,13 @@ title: "Switch order of literals to prevent NullPointerException" sidebar_position: 1 --- -## pixee:java/switch-literal-first +## pixee:java/switch-literal-first -| Importance | Review Guidance | Requires Scanning Tool | -|-------------|----------------------|------------------------| -| LOW | Merge Without Review | No | +| Importance | Review Guidance | Requires Scanning Tool | +| ---------- | -------------------- | ---------------------- | +| LOW | Merge Without Review | No | -This change defensively switches the order of literals in comparison expressions to ensure that no null pointer exceptions are unexpectedly thrown. Runtime exceptions especially can cause exceptional and unexpected code paths to be taken, and this can result in unexpected behavior. +This change defensively switches the order of literals in comparison expressions to ensure that no null pointer exceptions are unexpectedly thrown. Runtime exceptions especially can cause exceptional and unexpected code paths to be taken, and this can result in unexpected behavior. Both simple vulnerabilities (like information disclosure) and complex vulnerabilities (like business logic flaws) can take advantage of these unexpected code paths. @@ -24,8 +24,8 @@ Our changes look something like this: } ``` - ## References - * [https://cwe.mitre.org/data/definitions/476.html](https://cwe.mitre.org/data/definitions/476.html) - * [https://en.wikibooks.org/wiki/Java_Programming/Preventing_NullPointerException](https://en.wikibooks.org/wiki/Java_Programming/Preventing_NullPointerException) - * [https://rules.sonarsource.com/java/RSPEC-1132/](https://rules.sonarsource.com/java/RSPEC-1132/) + +- [https://cwe.mitre.org/data/definitions/476.html](https://cwe.mitre.org/data/definitions/476.html) +- [https://en.wikibooks.org/wiki/Java_Programming/Preventing_NullPointerException](https://en.wikibooks.org/wiki/Java_Programming/Preventing_NullPointerException) +- [https://rules.sonarsource.com/java/RSPEC-1132/](https://rules.sonarsource.com/java/RSPEC-1132/) diff --git a/docs/codemods/java/pixee_java_switch-to-standard-charsets.md b/docs/codemods/java/pixee_java_switch-to-standard-charsets.md index e28f62b..2b163ba 100644 --- a/docs/codemods/java/pixee_java_switch-to-standard-charsets.md +++ b/docs/codemods/java/pixee_java_switch-to-standard-charsets.md @@ -3,11 +3,11 @@ title: "Switch to StandardCharsets fields instead of strings" sidebar_position: 1 --- -## pixee:java/switch-to-standard-charsets +## pixee:java/switch-to-standard-charsets -| Importance | Review Guidance | Requires Scanning Tool | -|-------------|----------------------|------------------------| -| LOW | Merge After Review | No | +| Importance | Review Guidance | Requires Scanning Tool | +| ---------- | ------------------ | ---------------------- | +| LOW | Merge After Review | No | This change removes character set lookups with hardcoded strings like `"UTF-8"` in favor of referencing the `StandardCharsets` constants, which were [introduced in Java 7](https://docs.oracle.com/javase/7/docs/api/java/nio/charset/StandardCharsets.html). @@ -23,7 +23,7 @@ Our changes look something like this: Note: Further changes to exception handling may be needed. - ## References - * [https://community.sonarsource.com/t/use-standardcharsets-instead-of-charset-names/638](https://community.sonarsource.com/t/use-standardcharsets-instead-of-charset-names/638) - * [https://github.com/pmd/pmd/issues/3190](https://github.com/pmd/pmd/issues/3190) + +- [https://community.sonarsource.com/t/use-standardcharsets-instead-of-charset-names/638](https://community.sonarsource.com/t/use-standardcharsets-instead-of-charset-names/638) +- [https://github.com/pmd/pmd/issues/3190](https://github.com/pmd/pmd/issues/3190) diff --git a/docs/codemods/java/pixee_java_upgrade-sslcontext-tls.md b/docs/codemods/java/pixee_java_upgrade-sslcontext-tls.md index f616c7a..9ab825e 100644 --- a/docs/codemods/java/pixee_java_upgrade-sslcontext-tls.md +++ b/docs/codemods/java/pixee_java_upgrade-sslcontext-tls.md @@ -3,11 +3,11 @@ title: "Upgraded SSLContext#getInstance() TLS versions to match current best pra sidebar_position: 1 --- -## pixee:java/upgrade-sslcontext-tls +## pixee:java/upgrade-sslcontext-tls -| Importance | Review Guidance | Requires Scanning Tool | -|-------------|----------------------|------------------------| -| HIGH | Merge Without Review | No | +| Importance | Review Guidance | Requires Scanning Tool | +| ---------- | -------------------- | ---------------------- | +| HIGH | Merge Without Review | No | This change ensures that `SSLContext#getInstance()` uses a safe version of Transport Layer Security (TLS), which is necessary for safe SSL connections. @@ -22,7 +22,7 @@ Our change involves modifying the arguments to `getInstance()` to return TLSv1.2 There is no functional difference between the unsafe and safe versions, and all modern servers offer TLSv1.2. - ## References - * [https://datatracker.ietf.org/doc/rfc8996/](https://datatracker.ietf.org/doc/rfc8996/) - * [https://www.digicert.com/blog/depreciating-tls-1-0-and-1-1](https://www.digicert.com/blog/depreciating-tls-1-0-and-1-1) + +- [https://datatracker.ietf.org/doc/rfc8996/](https://datatracker.ietf.org/doc/rfc8996/) +- [https://www.digicert.com/blog/depreciating-tls-1-0-and-1-1](https://www.digicert.com/blog/depreciating-tls-1-0-and-1-1) diff --git a/docs/codemods/java/pixee_java_upgrade-sslengine-tls.md b/docs/codemods/java/pixee_java_upgrade-sslengine-tls.md index e3edb29..c9be58b 100644 --- a/docs/codemods/java/pixee_java_upgrade-sslengine-tls.md +++ b/docs/codemods/java/pixee_java_upgrade-sslengine-tls.md @@ -3,11 +3,11 @@ title: "Upgraded SSLEngine#setEnabledProtocols() TLS versions to match current b sidebar_position: 1 --- -## pixee:java/upgrade-sslengine-tls +## pixee:java/upgrade-sslengine-tls -| Importance | Review Guidance | Requires Scanning Tool | -|-------------|----------------------|------------------------| -| HIGH | Merge Without Review | No | +| Importance | Review Guidance | Requires Scanning Tool | +| ---------- | -------------------- | ---------------------- | +| HIGH | Merge Without Review | No | This change ensures that `SSLEngine#setEnabledProtocols()` retrieves a safe version of Transport Layer Security (TLS), which is necessary for safe SSL connections. @@ -23,7 +23,7 @@ Our change involves modifying the arguments to `setEnabledProtocols()` to return There is no functional difference between the unsafe and safe versions, and all modern servers offer TLSv1.2. - ## References - * [https://datatracker.ietf.org/doc/rfc8996/](https://datatracker.ietf.org/doc/rfc8996/) - * [https://www.digicert.com/blog/depreciating-tls-1-0-and-1-1](https://www.digicert.com/blog/depreciating-tls-1-0-and-1-1) + +- [https://datatracker.ietf.org/doc/rfc8996/](https://datatracker.ietf.org/doc/rfc8996/) +- [https://www.digicert.com/blog/depreciating-tls-1-0-and-1-1](https://www.digicert.com/blog/depreciating-tls-1-0-and-1-1) diff --git a/docs/codemods/java/pixee_java_upgrade-sslparameters-tls.md b/docs/codemods/java/pixee_java_upgrade-sslparameters-tls.md index 91ac0cb..bcb4971 100644 --- a/docs/codemods/java/pixee_java_upgrade-sslparameters-tls.md +++ b/docs/codemods/java/pixee_java_upgrade-sslparameters-tls.md @@ -3,11 +3,11 @@ title: "Upgraded SSLParameters#setProtocols() TLS versions to match current best sidebar_position: 1 --- -## pixee:java/upgrade-sslparameters-tls +## pixee:java/upgrade-sslparameters-tls -| Importance | Review Guidance | Requires Scanning Tool | -|-------------|----------------------|------------------------| -| HIGH | Merge Without Review | No | +| Importance | Review Guidance | Requires Scanning Tool | +| ---------- | -------------------- | ---------------------- | +| HIGH | Merge Without Review | No | This change ensures that `SSLParameters#setProtocols()` uses a safe version of Transport Layer Security (TLS), which is necessary for safe SSL connections. @@ -23,7 +23,7 @@ Our change involves modifying the arguments to `setProtocols()` to return TLSv1. There is no functional difference between the unsafe and safe versions, and all modern servers offer TLSv1.2. - ## References - * [https://datatracker.ietf.org/doc/rfc8996/](https://datatracker.ietf.org/doc/rfc8996/) - * [https://www.digicert.com/blog/depreciating-tls-1-0-and-1-1](https://www.digicert.com/blog/depreciating-tls-1-0-and-1-1) + +- [https://datatracker.ietf.org/doc/rfc8996/](https://datatracker.ietf.org/doc/rfc8996/) +- [https://www.digicert.com/blog/depreciating-tls-1-0-and-1-1](https://www.digicert.com/blog/depreciating-tls-1-0-and-1-1) diff --git a/docs/codemods/java/pixee_java_upgrade-sslsocket-tls.md b/docs/codemods/java/pixee_java_upgrade-sslsocket-tls.md index ab898e4..e2fadf8 100644 --- a/docs/codemods/java/pixee_java_upgrade-sslsocket-tls.md +++ b/docs/codemods/java/pixee_java_upgrade-sslsocket-tls.md @@ -3,11 +3,11 @@ title: "Upgraded SSLSocket#setEnabledProtocols() TLS versions to match current b sidebar_position: 1 --- -## pixee:java/upgrade-sslsocket-tls +## pixee:java/upgrade-sslsocket-tls -| Importance | Review Guidance | Requires Scanning Tool | -|-------------|----------------------|------------------------| -| HIGH | Merge Without Review | No | +| Importance | Review Guidance | Requires Scanning Tool | +| ---------- | -------------------- | ---------------------- | +| HIGH | Merge Without Review | No | This change ensures that `SSLSocket#setEnabledProtocols()` uses a safe version of Transport Layer Security (TLS), which is necessary for safe SSL connections. @@ -23,7 +23,7 @@ Our change involves modifying the arguments to `setEnabledProtocols()` to return There is no functional difference between the unsafe and safe versions, and all modern servers offer TLSv1.2. - ## References - * [https://datatracker.ietf.org/doc/rfc8996/](https://datatracker.ietf.org/doc/rfc8996/) - * [https://www.digicert.com/blog/depreciating-tls-1-0-and-1-1](https://www.digicert.com/blog/depreciating-tls-1-0-and-1-1) + +- [https://datatracker.ietf.org/doc/rfc8996/](https://datatracker.ietf.org/doc/rfc8996/) +- [https://www.digicert.com/blog/depreciating-tls-1-0-and-1-1](https://www.digicert.com/blog/depreciating-tls-1-0-and-1-1) diff --git a/docs/codemods/java/pixee_java_upgrade-tempfile-to-nio.md b/docs/codemods/java/pixee_java_upgrade-tempfile-to-nio.md index 251f761..fd04d70 100644 --- a/docs/codemods/java/pixee_java_upgrade-tempfile-to-nio.md +++ b/docs/codemods/java/pixee_java_upgrade-tempfile-to-nio.md @@ -3,13 +3,13 @@ title: "Modernize and secure temp file creation" sidebar_position: 1 --- -## pixee:java/upgrade-tempfile-to-nio +## pixee:java/upgrade-tempfile-to-nio -| Importance | Review Guidance | Requires Scanning Tool | -|-------------|----------------------|------------------------| -| MEDIUM | Merge Without Review | No | +| Importance | Review Guidance | Requires Scanning Tool | +| ---------- | -------------------- | ---------------------- | +| MEDIUM | Merge Without Review | No | -This change replaces the usage of [`java.io.File#createTempFile`](https://docs.oracle.com/en/java/javase/20/docs/api/java.base/java/io/File.html#createTempFile(java.lang.String,java.lang.String)) with [`java.nio.file.Files#createTempFile`](https://docs.oracle.com/en/java/javase/20/docs/api/java.base/java/nio/file/Files.html#createTempFile(java.lang.String,java.lang.String,java.nio.file.attribute.FileAttribute...)) which has more secure attributes. +This change replaces the usage of [`java.io.File#createTempFile`]() with [`java.nio.file.Files#createTempFile`]() which has more secure attributes. The `java.io.File#createTempFile()` method creates a file that is world-readable and world-writeable, which is almost never necessary. Also, the file created is placed in a predictable directory (e.g., `/tmp`). Having predictable file names, locations, and will lead to many types of vulnerabilities. History has shown that this insecure pattern can lead to [information leakage](https://www.cvedetails.com/cve/CVE-2021-28168/), [privilege escalation](https://www.cvedetails.com/cve/CVE-2021-29428/) and even [code execution](https://www.openwall.com/lists/oss-security/2022/02/25/3). @@ -22,11 +22,11 @@ Our changes look something like this: + File txtFile = Files.createTempFile("acme", ".txt").toFile(); ``` - ## References - * [https://cwe.mitre.org/data/definitions/378.html](https://cwe.mitre.org/data/definitions/378.html) - * [https://docs.fluidattacks.com/criteria/vulnerabilities/160/](https://docs.fluidattacks.com/criteria/vulnerabilities/160/) - * [https://github.com/apache/druid/issues/11130](https://github.com/apache/druid/issues/11130) - * [https://owasp.org/www-community/vulnerabilities/Insecure_Temporary_File](https://owasp.org/www-community/vulnerabilities/Insecure_Temporary_File) - * [https://nvd.nist.gov/vuln/detail/CVE-2022-41954](https://nvd.nist.gov/vuln/detail/CVE-2022-41954) - * [https://www.cvedetails.com/vulnerability-list/cwe-378/vulnerabilities.html](https://www.cvedetails.com/vulnerability-list/cwe-378/vulnerabilities.html) + +- [https://cwe.mitre.org/data/definitions/378.html](https://cwe.mitre.org/data/definitions/378.html) +- [https://docs.fluidattacks.com/criteria/vulnerabilities/160/](https://docs.fluidattacks.com/criteria/vulnerabilities/160/) +- [https://github.com/apache/druid/issues/11130](https://github.com/apache/druid/issues/11130) +- [https://owasp.org/www-community/vulnerabilities/Insecure_Temporary_File](https://owasp.org/www-community/vulnerabilities/Insecure_Temporary_File) +- [https://nvd.nist.gov/vuln/detail/CVE-2022-41954](https://nvd.nist.gov/vuln/detail/CVE-2022-41954) +- [https://www.cvedetails.com/vulnerability-list/cwe-378/vulnerabilities.html](https://www.cvedetails.com/vulnerability-list/cwe-378/vulnerabilities.html) diff --git a/docs/codemods/java/pixee_java_use-empty-for-toarray.md b/docs/codemods/java/pixee_java_use-empty-for-toarray.md index 4c311d9..245ce0a 100644 --- a/docs/codemods/java/pixee_java_use-empty-for-toarray.md +++ b/docs/codemods/java/pixee_java_use-empty-for-toarray.md @@ -3,11 +3,11 @@ title: "Use empty for Collection#toArray([])" sidebar_position: 1 --- -## pixee:java/use-empty-for-toarray +## pixee:java/use-empty-for-toarray -| Importance | Review Guidance | Requires Scanning Tool | -|-------------|----------------------|------------------------| -| LOW | Merge Without Review | No | +| Importance | Review Guidance | Requires Scanning Tool | +| ---------- | -------------------- | ---------------------- | +| LOW | Merge Without Review | No | This change updates new array creation with [Collection#toArray(T[])](https://docs.oracle.com/javase/8/docs/api/java/util/Collection.html#toArray-T:A-) to use an empty array argument, which is better for performance. @@ -15,8 +15,8 @@ The point of the argument is provide an array to hold the objects and be returne > If the collection fits in the specified array, it is returned therein. -Although it's not intuitive, allocating a right-sized array ahead of time to pass to the API appears to be [generally worse for performance](https://shipilev.net/blog/2016/arrays-wisdom-ancients/#_conclusion) according to benchmarking and JVM developers due to a number of implementation details in both Java and the virtual machine. - +Although it's not intuitive, allocating a right-sized array ahead of time to pass to the API appears to be [generally worse for performance](https://shipilev.net/blog/2016/arrays-wisdom-ancients/#_conclusion) according to benchmarking and JVM developers due to a number of implementation details in both Java and the virtual machine. + For a real world example, consider [this issue in H2](https://github.com/h2database/h2database/issues/311) where significant gains were achieved by switching to an empty array instead of a right-sized one. Our changes look something like this: @@ -27,7 +27,7 @@ Our changes look something like this: processTokens(tokenArray); ``` - ## References - * [https://docs.pmd-code.org/latest/pmd_rules_java_performance.html#optimizabletoarraycall](https://docs.pmd-code.org/latest/pmd_rules_java_performance.html#optimizabletoarraycall) - * [https://shipilev.net/blog/2016/arrays-wisdom-ancients/#_conclusion](https://shipilev.net/blog/2016/arrays-wisdom-ancients/#_conclusion) + +- [https://docs.pmd-code.org/latest/pmd_rules_java_performance.html#optimizabletoarraycall](https://docs.pmd-code.org/latest/pmd_rules_java_performance.html#optimizabletoarraycall) +- [https://shipilev.net/blog/2016/arrays-wisdom-ancients/#\_conclusion](https://shipilev.net/blog/2016/arrays-wisdom-ancients/#_conclusion) diff --git a/docs/codemods/java/pixee_java_validate-jakarta-forward-path.md b/docs/codemods/java/pixee_java_validate-jakarta-forward-path.md index fddf379..fc56171 100644 --- a/docs/codemods/java/pixee_java_validate-jakarta-forward-path.md +++ b/docs/codemods/java/pixee_java_validate-jakarta-forward-path.md @@ -3,11 +3,11 @@ title: "Introduced protections against user-controlled internal request forwardi sidebar_position: 1 --- -## pixee:java/validate-jakarta-forward-path +## pixee:java/validate-jakarta-forward-path -| Importance | Review Guidance | Requires Scanning Tool | -|-------------|----------------------|------------------------| -| HIGH | Merge Without Review | No | +| Importance | Review Guidance | Requires Scanning Tool | +| ---------- | -------------------- | ---------------------- | +| HIGH | Merge Without Review | No | This change hardens all [`ServletRequest#getRequestDispatcher(String)`](https://docs.oracle.com/javaee/7/api/javax/servlet/ServletRequest.html#getRequestDispatcher-java.lang.String-) calls against attack. @@ -24,6 +24,6 @@ Our change introduces an API that offers some validation against forwards that t request.getRequestDispatcher(path).forward(request, response); ``` - ## References - * [https://cheatsheetseries.owasp.org/cheatsheets/Unvalidated_Redirects_and_Forwards_Cheat_Sheet.html#dangerous-forward-example](https://cheatsheetseries.owasp.org/cheatsheets/Unvalidated_Redirects_and_Forwards_Cheat_Sheet.html#dangerous-forward-example) + +- [https://cheatsheetseries.owasp.org/cheatsheets/Unvalidated_Redirects_and_Forwards_Cheat_Sheet.html#dangerous-forward-example](https://cheatsheetseries.owasp.org/cheatsheets/Unvalidated_Redirects_and_Forwards_Cheat_Sheet.html#dangerous-forward-example) diff --git a/docs/codemods/java/pixee_java_verbose-request-mapping.md b/docs/codemods/java/pixee_java_verbose-request-mapping.md index ca74392..779f603 100644 --- a/docs/codemods/java/pixee_java_verbose-request-mapping.md +++ b/docs/codemods/java/pixee_java_verbose-request-mapping.md @@ -3,19 +3,19 @@ title: "Replaced @RequestMapping annotation with shortcut annotation for request sidebar_position: 1 --- -## pixee:java/verbose-request-mapping +## pixee:java/verbose-request-mapping -| Importance | Review Guidance | Requires Scanning Tool | -|-------------|----------------------|------------------------| -| LOW | Merge Without Review | No | +| Importance | Review Guidance | Requires Scanning Tool | +| ---------- | -------------------- | ---------------------- | +| LOW | Merge Without Review | No | This change simplifies Spring Framework annotations by making use of shortened annotations when applicable. Code that is easy to read is easy to review, reason about, and detect bugs in. -Making use of shortcut annotations accomplishes this by removing *wordy for no reason* elements. - +Making use of shortcut annotations accomplishes this by removing _wordy for no reason_ elements. Version 4.3 of Spring Framework introduced method-level variants for `@RequestMapping`. + - `@GetMapping` - `@PutMapping` - `@PostMapping` @@ -28,8 +28,7 @@ Version 4.3 of Spring Framework introduced method-level variants for `@RequestMa + @GetMapping(value = "/example") ``` - - ## References - * [https://docs.spring.io/spring-framework/reference/web/webmvc/mvc-controller/ann-requestmapping.html](https://docs.spring.io/spring-framework/reference/web/webmvc/mvc-controller/ann-requestmapping.html) - * [https://dzone.com/articles/using-the-spring-requestmapping-annotation](https://dzone.com/articles/using-the-spring-requestmapping-annotation) + +- [https://docs.spring.io/spring-framework/reference/web/webmvc/mvc-controller/ann-requestmapping.html](https://docs.spring.io/spring-framework/reference/web/webmvc/mvc-controller/ann-requestmapping.html) +- [https://dzone.com/articles/using-the-spring-requestmapping-annotation](https://dzone.com/articles/using-the-spring-requestmapping-annotation) diff --git a/docs/codemods/java/semgrep_java_java.lang.security.audit.overly-permissive-file-permission.overly-permissive-file-permission.md b/docs/codemods/java/semgrep_java_java.lang.security.audit.overly-permissive-file-permission.overly-permissive-file-permission.md index ce80a02..52e2353 100644 --- a/docs/codemods/java/semgrep_java_java.lang.security.audit.overly-permissive-file-permission.overly-permissive-file-permission.md +++ b/docs/codemods/java/semgrep_java_java.lang.security.audit.overly-permissive-file-permission.overly-permissive-file-permission.md @@ -3,15 +3,15 @@ title: "Fixed overly permissive file permissions (issue discovered by Semgrep)" sidebar_position: 1 --- -## semgrep:java/java.lang.security.audit.overly-permissive-file-permission.overly-permissive-file-permission +## semgrep:java/java.lang.security.audit.overly-permissive-file-permission.overly-permissive-file-permission -| Importance | Review Guidance | Requires Scanning Tool | -|-------------|----------------------|------------------------| -| MEDIUM | Merge After Cursory Review | Yes (Semgrep) | +| Importance | Review Guidance | Requires Scanning Tool | +| ---------- | -------------------------- | ---------------------- | +| MEDIUM | Merge After Cursory Review | Yes (Semgrep) | -This change removes excessive privilege from a file that appears to be overly permissive. Files can be granted privileges to the file's owner, the file owner's group, or "others" -- meaning anyone else. It is hard to imagine the need for a file to be readable, writable or executable by anyone other than the file's owner or the file owner's group in modern software development. +This change removes excessive privilege from a file that appears to be overly permissive. Files can be granted privileges to the file's owner, the file owner's group, or "others" -- meaning anyone else. It is hard to imagine the need for a file to be readable, writable or executable by anyone other than the file's owner or the file owner's group in modern software development. -If a file is readable by "others", it could be read by a malicious system user to retrieve sensitive information or useful implementation details. If the file is writable by "others", the application could be tricked into performing actions on data provide by malicious users. Allowing execution of a file by "others" could allow malicious users to run arbitrary code on the server. +If a file is readable by "others", it could be read by a malicious system user to retrieve sensitive information or useful implementation details. If the file is writable by "others", the application could be tricked into performing actions on data provide by malicious users. Allowing execution of a file by "others" could allow malicious users to run arbitrary code on the server. Our changes look something like this: @@ -20,7 +20,7 @@ Our changes look something like this: - startupPermissions.add(PosixFilePermission.OTHERS_WRITE); + startupPermissions.add(PosixFilePermission.GROUP_WRITE); Files.setPosixFilePermissions(startupScript, startupPermissions); - + - Set shutdownPermissions = PosixFilePermissions.fromString("rwxrwxrwx"); + Set shutdownPermissions = PosixFilePermissions.fromString("rwxrwx---"); Files.setPosixFilePermissions(shutdownScript, shutdownPermissions); @@ -28,8 +28,8 @@ Our changes look something like this: Note: It's worth considering whether you could use a more restrictive permission than `GROUP_WRITE` here. For example, if the file is owned by the same user that's running the application, you could use `OWNER_WRITE` instead. - ## References - * [https://find-sec-bugs.github.io/bugs.htm#OVERLY_PERMISSIVE_FILE_PERMISSION](https://find-sec-bugs.github.io/bugs.htm#OVERLY_PERMISSIVE_FILE_PERMISSION) - * [https://registry.semgrep.dev/rule/java.lang.security.audit.overly-permissive-file-permission.overly-permissive-file-permission](https://registry.semgrep.dev/rule/java.lang.security.audit.overly-permissive-file-permission.overly-permissive-file-permission) - * [https://cwe.mitre.org/data/definitions/732.html](https://cwe.mitre.org/data/definitions/732.html) + +- [https://find-sec-bugs.github.io/bugs.htm#OVERLY_PERMISSIVE_FILE_PERMISSION](https://find-sec-bugs.github.io/bugs.htm#OVERLY_PERMISSIVE_FILE_PERMISSION) +- [https://registry.semgrep.dev/rule/java.lang.security.audit.overly-permissive-file-permission.overly-permissive-file-permission](https://registry.semgrep.dev/rule/java.lang.security.audit.overly-permissive-file-permission.overly-permissive-file-permission) +- [https://cwe.mitre.org/data/definitions/732.html](https://cwe.mitre.org/data/definitions/732.html) diff --git a/docs/codemods/java/sonar_java_add-missing-override-s1161.md b/docs/codemods/java/sonar_java_add-missing-override-s1161.md index 68d5d20..5f195fe 100644 --- a/docs/codemods/java/sonar_java_add-missing-override-s1161.md +++ b/docs/codemods/java/sonar_java_add-missing-override-s1161.md @@ -3,11 +3,11 @@ title: "Added missing @Override parameter (Sonar)" sidebar_position: 1 --- -## sonar:java/add-missing-override-s1161 +## sonar:java/add-missing-override-s1161 -| Importance | Review Guidance | Requires Scanning Tool | -|-------------|----------------------|------------------------| -| LOW | Merge Without Review | Yes (Sonar) | +| Importance | Review Guidance | Requires Scanning Tool | +| ---------- | -------------------- | ---------------------- | +| LOW | Merge Without Review | Yes (Sonar) | This change adds missing `@Override` to known subclasses. Documenting inheritance will help readers and static analysis tools understand the code better, spot bugs easier, and in general lead to more efficient and effective review. @@ -16,7 +16,7 @@ Our changes look something like this: ```diff interface AcmeParent { void doThing(); - } + } class AcmeChild implements AcmeParent { @@ -24,7 +24,7 @@ Our changes look something like this: void doThing() { thing(); } - + } ``` @@ -34,6 +34,6 @@ Our changes look something like this: There is no functional difference after the change, but the source code will be easier to understand. - ## References - * [https://rules.sonarsource.com/java/RSPEC-1161/](https://rules.sonarsource.com/java/RSPEC-1161/) + +- [https://rules.sonarsource.com/java/RSPEC-1161/](https://rules.sonarsource.com/java/RSPEC-1161/) diff --git a/docs/codemods/java/sonar_java_avoid-implicit-public-constructor-s1118.md b/docs/codemods/java/sonar_java_avoid-implicit-public-constructor-s1118.md index 85899dd..5b9d999 100644 --- a/docs/codemods/java/sonar_java_avoid-implicit-public-constructor-s1118.md +++ b/docs/codemods/java/sonar_java_avoid-implicit-public-constructor-s1118.md @@ -3,11 +3,11 @@ title: "Set private constructor to hide implicit public constructor (Sonar)" sidebar_position: 1 --- -## sonar:java/avoid-implicit-public-constructor-s1118 +## sonar:java/avoid-implicit-public-constructor-s1118 -| Importance | Review Guidance | Requires Scanning Tool | -|-------------|----------------------|------------------------| -| LOW | Merge After Review | Yes (Sonar) | +| Importance | Review Guidance | Requires Scanning Tool | +| ---------- | ------------------ | ---------------------- | +| LOW | Merge After Review | Yes (Sonar) | This change adds private constructors to utility classes. Utility classes are only meant to be accessed statically. Since they're not meant to be instantiated, we can use the Java's code visibility protections to hide the constructor and prevent unintended or malicious access. @@ -25,6 +25,6 @@ Our changes look something like this: This change depends completely on Sonar's accuracy about in identifying types that are meant to only offer static utilities. Our testing shows this generally works as expected, but correctness can't be guaranteed in all situations. - ## References - * [https://rules.sonarsource.com/java/RSPEC-1118/](https://rules.sonarsource.com/java/RSPEC-1118/) + +- [https://rules.sonarsource.com/java/RSPEC-1118/](https://rules.sonarsource.com/java/RSPEC-1118/) diff --git a/docs/codemods/java/sonar_java_declare-variable-on-separate-line-s1659.md b/docs/codemods/java/sonar_java_declare-variable-on-separate-line-s1659.md index a518b37..6a81f41 100644 --- a/docs/codemods/java/sonar_java_declare-variable-on-separate-line-s1659.md +++ b/docs/codemods/java/sonar_java_declare-variable-on-separate-line-s1659.md @@ -3,11 +3,11 @@ title: "Split variable declarations into their own statements (Sonar)" sidebar_position: 1 --- -## sonar:java/declare-variable-on-separate-line-s1659 +## sonar:java/declare-variable-on-separate-line-s1659 -| Importance | Review Guidance | Requires Scanning Tool | -|-------------|----------------------|------------------------| -| LOW | Merge Without Review | Yes (Sonar) | +| Importance | Review Guidance | Requires Scanning Tool | +| ---------- | -------------------- | ---------------------- | +| LOW | Merge Without Review | Yes (Sonar) | This change splits variable assignments onto their own lines. [Many](https://wiki.sei.cmu.edu/confluence/display/java/DCL52-J.+Do+not+declare+more+than+one+variable+per+declaration) [sources](https://rules.sonarsource.com/java/RSPEC-1659/) [believe](https://dart.dev/tools/linter-rules/avoid_multiple_declarations_per_line) it is easier to review code where the variables are separate statements on their own individual line. @@ -27,7 +27,7 @@ Our changes look something like this: There is no functional difference after the change, but the source code will be easier to understand. - ## References - * [https://rules.sonarsource.com/java/RSPEC-1659/](https://rules.sonarsource.com/java/RSPEC-1659/) - * [https://wiki.sei.cmu.edu/confluence/display/java/DCL52-J.+Do+not+declare+more+than+one+variable+per+declaration](https://wiki.sei.cmu.edu/confluence/display/java/DCL52-J.+Do+not+declare+more+than+one+variable+per+declaration) + +- [https://rules.sonarsource.com/java/RSPEC-1659/](https://rules.sonarsource.com/java/RSPEC-1659/) +- [https://wiki.sei.cmu.edu/confluence/display/java/DCL52-J.+Do+not+declare+more+than+one+variable+per+declaration](https://wiki.sei.cmu.edu/confluence/display/java/DCL52-J.+Do+not+declare+more+than+one+variable+per+declaration) diff --git a/docs/codemods/java/sonar_java_define-constant-for-duplicate-literal-s1192.md b/docs/codemods/java/sonar_java_define-constant-for-duplicate-literal-s1192.md index 05c6562..35de1ca 100644 --- a/docs/codemods/java/sonar_java_define-constant-for-duplicate-literal-s1192.md +++ b/docs/codemods/java/sonar_java_define-constant-for-duplicate-literal-s1192.md @@ -3,11 +3,11 @@ title: "Define a constant for a literal string that is duplicated n times (Sonar sidebar_position: 1 --- -## sonar:java/define-constant-for-duplicate-literal-s1192 +## sonar:java/define-constant-for-duplicate-literal-s1192 -| Importance | Review Guidance | Requires Scanning Tool | -|-------------|----------------------|------------------------| -| HIGH | Merge After Review | Yes (Sonar) | +| Importance | Review Guidance | Requires Scanning Tool | +| ---------- | ------------------ | ---------------------- | +| HIGH | Merge After Review | Yes (Sonar) | This change defines a constant for duplicated literal expression values, simplifying the refactoring process and mitigating the risk of overlooking any values during updates. @@ -18,13 +18,13 @@ Our changes look something like this: + private static final String EXCEPTION_AT = "Exception at"; - LOG.error("Exception at", ex) -+ builder.add(EXCEPTION_AT) ++ builder.add(EXCEPTION_AT) - LOG.error("Exception at", ex) -+ builder.add(EXCEPTION_AT) ++ builder.add(EXCEPTION_AT) - LOG.error("Exception at", ex) -+ builder.add(EXCEPTION_AT) ++ builder.add(EXCEPTION_AT) ``` ## F.A.Q. @@ -33,6 +33,6 @@ Our changes look something like this: This modification is intended to introduce no functional alterations. Nevertheless, we believe it would be beneficial for a developer to review the newly defined constant names to ensure they align with their expectations. - ## References - * [https://rules.sonarsource.com/java/RSPEC-1192/](https://rules.sonarsource.com/java/RSPEC-1192/) + +- [https://rules.sonarsource.com/java/RSPEC-1192/](https://rules.sonarsource.com/java/RSPEC-1192/) diff --git a/docs/codemods/java/sonar_java_harden-string-parse-to-primitives-s2130.md b/docs/codemods/java/sonar_java_harden-string-parse-to-primitives-s2130.md index ebaa4ac..34e5fed 100644 --- a/docs/codemods/java/sonar_java_harden-string-parse-to-primitives-s2130.md +++ b/docs/codemods/java/sonar_java_harden-string-parse-to-primitives-s2130.md @@ -3,11 +3,11 @@ title: "Implemented parsing usage when converting Strings to primitives (Sonar)" sidebar_position: 1 --- -## sonar:java/harden-string-parse-to-primitives-s2130 +## sonar:java/harden-string-parse-to-primitives-s2130 -| Importance | Review Guidance | Requires Scanning Tool | -|-------------|----------------------|------------------------| -| LOW | Merge Without Review | Yes (Sonar) | +| Importance | Review Guidance | Requires Scanning Tool | +| ---------- | -------------------- | ---------------------- | +| LOW | Merge Without Review | Yes (Sonar) | This change updates `String`-to-number conversions by leveraging the intended parse methods. @@ -34,6 +34,6 @@ Our changes look like this: There is no functional difference after the change, but the source code will be easier to understand. - ## References - * [https://rules.sonarsource.com/java/RSPEC-2130/](https://rules.sonarsource.com/java/RSPEC-2130/) + +- [https://rules.sonarsource.com/java/RSPEC-2130/](https://rules.sonarsource.com/java/RSPEC-2130/) diff --git a/docs/codemods/java/sonar_java_overrides-match-synchronization-s3551.md b/docs/codemods/java/sonar_java_overrides-match-synchronization-s3551.md index a189f71..f9ba62b 100644 --- a/docs/codemods/java/sonar_java_overrides-match-synchronization-s3551.md +++ b/docs/codemods/java/sonar_java_overrides-match-synchronization-s3551.md @@ -3,11 +3,11 @@ title: "Added missing synchronized keyword (Sonar)" sidebar_position: 1 --- -## sonar:java/overrides-match-synchronization-s3551 +## sonar:java/overrides-match-synchronization-s3551 -| Importance | Review Guidance | Requires Scanning Tool | -|-------------|----------------------|------------------------| -| MEDIUM | Merge After Cursory Review | Yes (Sonar) | +| Importance | Review Guidance | Requires Scanning Tool | +| ---------- | -------------------------- | ---------------------- | +| MEDIUM | Merge After Cursory Review | Yes (Sonar) | This change adds missing synchronized keyword to methods that override a synchronized method in the parent class. Our changes look something like this: @@ -15,7 +15,7 @@ Our changes look something like this: ```diff interface AcmeParent { synchronized void doThing(); - } + } class AcmeChild implements AcmeParent { @@ -24,7 +24,7 @@ Our changes look something like this: + synchronized void doThing() { thing(); } - + } ``` @@ -34,7 +34,7 @@ Our changes look something like this: There are a number of different ways to fix this, but essentially we need to make this code thread-safe. This is important when the parent interface implies something is synchronized, signaling an expectation of thread-safety, when an implementation is not. - ## References - * [https://rules.sonarsource.com/java/RSPEC-3551/](https://rules.sonarsource.com/java/RSPEC-3551/) - * [https://wiki.sei.cmu.edu/confluence/display/java/TSM00-J.+Do+not+override+thread-safe+methods+with+methods+that+are+not+thread-safe](https://wiki.sei.cmu.edu/confluence/display/java/TSM00-J.+Do+not+override+thread-safe+methods+with+methods+that+are+not+thread-safe) + +- [https://rules.sonarsource.com/java/RSPEC-3551/](https://rules.sonarsource.com/java/RSPEC-3551/) +- [https://wiki.sei.cmu.edu/confluence/display/java/TSM00-J.+Do+not+override+thread-safe+methods+with+methods+that+are+not+thread-safe](https://wiki.sei.cmu.edu/confluence/display/java/TSM00-J.+Do+not+override+thread-safe+methods+with+methods+that+are+not+thread-safe) diff --git a/docs/codemods/java/sonar_java_remove-commented-code-s125.md b/docs/codemods/java/sonar_java_remove-commented-code-s125.md index b3574c6..2ce5a3a 100644 --- a/docs/codemods/java/sonar_java_remove-commented-code-s125.md +++ b/docs/codemods/java/sonar_java_remove-commented-code-s125.md @@ -3,23 +3,23 @@ title: "Removed block of commented-out lines of code (Sonar)" sidebar_position: 1 --- -## sonar:java/remove-commented-code-s125 +## sonar:java/remove-commented-code-s125 -| Importance | Review Guidance | Requires Scanning Tool | -|-------------|----------------------|------------------------| -| HIGH | Merge Without Review | Yes (Sonar) | +| Importance | Review Guidance | Requires Scanning Tool | +| ---------- | -------------------- | ---------------------- | +| HIGH | Merge Without Review | Yes (Sonar) | This change eliminates commented-out code that may impede readability and distract focus. Any deleted code can still be accessed through the source control history if needed. Our changes look something like this: ```diff - catch (IOException e) { + catch (IOException e) { - // LOG.error("Unexpected problem ", ex); return handleError(ex); } ``` - ## References - * [https://rules.sonarsource.com/java/RSPEC-125/](https://rules.sonarsource.com/java/RSPEC-125/) + +- [https://rules.sonarsource.com/java/RSPEC-125/](https://rules.sonarsource.com/java/RSPEC-125/) diff --git a/docs/codemods/java/sonar_java_remove-redundant-static-s2786.md b/docs/codemods/java/sonar_java_remove-redundant-static-s2786.md index f80f2e4..03cd48d 100644 --- a/docs/codemods/java/sonar_java_remove-redundant-static-s2786.md +++ b/docs/codemods/java/sonar_java_remove-redundant-static-s2786.md @@ -3,11 +3,11 @@ title: "Removed redundant static flag on enum (Sonar)" sidebar_position: 1 --- -## sonar:java/remove-redundant-static-s2786 +## sonar:java/remove-redundant-static-s2786 -| Importance | Review Guidance | Requires Scanning Tool | -|-------------|----------------------|------------------------| -| LOW | Merge Without Review | Yes (Sonar) | +| Importance | Review Guidance | Requires Scanning Tool | +| ---------- | -------------------- | ---------------------- | +| LOW | Merge Without Review | Yes (Sonar) | This change removes redundant (and possibly misleading) `static` keywords on `enum` types defined within classes. All `enum` types that are nested within another type are automatically `static`, and so listing the flag this clutters the code, and may cause confusion when reasoning about it. @@ -17,7 +17,7 @@ Our changes look something like this: @RestController final class CheckStatusController { -- static enum ResponseType { +- static enum ResponseType { + enum ResponseType { SUCCESS, FAILURE, @@ -31,6 +31,6 @@ Our changes look something like this: There are no functional changes after this change, but the code will be easier to understand. - ## References - * [https://sonarsource.github.io/rspec/#/rspec/S2786/java](https://sonarsource.github.io/rspec/#/rspec/S2786/java) + +- [https://sonarsource.github.io/rspec/#/rspec/S2786/java](https://sonarsource.github.io/rspec/#/rspec/S2786/java) diff --git a/docs/codemods/java/sonar_java_remove-redundant-variable-creation-s1488.md b/docs/codemods/java/sonar_java_remove-redundant-variable-creation-s1488.md index 03e77ad..1814e21 100644 --- a/docs/codemods/java/sonar_java_remove-redundant-variable-creation-s1488.md +++ b/docs/codemods/java/sonar_java_remove-redundant-variable-creation-s1488.md @@ -3,18 +3,18 @@ title: "Remove redundant variable creation expression when it is only returned/t sidebar_position: 1 --- -## sonar:java/remove-redundant-variable-creation-s1488 +## sonar:java/remove-redundant-variable-creation-s1488 -| Importance | Review Guidance | Requires Scanning Tool | -|-------------|----------------------|------------------------| -| LOW | Merge Without Review | Yes (Sonar) | +| Importance | Review Guidance | Requires Scanning Tool | +| ---------- | -------------------- | ---------------------- | +| LOW | Merge Without Review | Yes (Sonar) | This change removes intermediate variables who are only created to be thrown or returned in the next statement. This makes the code more readable, which makes reviewing the code for issues easier. Our changes look something like this: ```diff - public LocaleResolver localeResolver() { + public LocaleResolver localeResolver() { - SessionLocaleResolver localeResolver = new SessionLocaleResolver(); - return localeResolver; + return new SessionLocaleResolver(); @@ -22,13 +22,13 @@ Our changes look something like this: ``` ```diff - public void process() { + public void process() { - Exception ex = new Exception(); - throw ex; + throw new Exception(); } ``` - ## References - * [https://rules.sonarsource.com/java/RSPEC-1488/](https://rules.sonarsource.com/java/RSPEC-1488/) + +- [https://rules.sonarsource.com/java/RSPEC-1488/](https://rules.sonarsource.com/java/RSPEC-1488/) diff --git a/docs/codemods/java/sonar_java_remove-unused-local-variable-s1481.md b/docs/codemods/java/sonar_java_remove-unused-local-variable-s1481.md index a8f1b60..261ea42 100644 --- a/docs/codemods/java/sonar_java_remove-unused-local-variable-s1481.md +++ b/docs/codemods/java/sonar_java_remove-unused-local-variable-s1481.md @@ -3,11 +3,11 @@ title: "Removed unused local variable (Sonar)" sidebar_position: 1 --- -## sonar:java/remove-unused-local-variable-s1481 +## sonar:java/remove-unused-local-variable-s1481 -| Importance | Review Guidance | Requires Scanning Tool | -|-------------|----------------------|------------------------| -| LOW | Merge Without Review | Yes (Sonar) | +| Importance | Review Guidance | Requires Scanning Tool | +| ---------- | -------------------- | ---------------------- | +| LOW | Merge Without Review | Yes (Sonar) | This change removes unused variables. Unused variables make the code harder to read, which will lead to confusion and bugs. We only remove variables that have no state-changing effects. @@ -21,6 +21,6 @@ Our changes look something like this: } ``` - ## References - * [https://rules.sonarsource.com/java/RSPEC-1481/](https://rules.sonarsource.com/java/RSPEC-1481/) + +- [https://rules.sonarsource.com/java/RSPEC-1481/](https://rules.sonarsource.com/java/RSPEC-1481/) diff --git a/docs/codemods/java/sonar_java_remove-unused-private-method-s1144.md b/docs/codemods/java/sonar_java_remove-unused-private-method-s1144.md index dddbbe8..1bf84d6 100644 --- a/docs/codemods/java/sonar_java_remove-unused-private-method-s1144.md +++ b/docs/codemods/java/sonar_java_remove-unused-private-method-s1144.md @@ -3,11 +3,11 @@ title: "Removed unused private method (Sonar)" sidebar_position: 1 --- -## sonar:java/remove-unused-private-method-s1144 +## sonar:java/remove-unused-private-method-s1144 -| Importance | Review Guidance | Requires Scanning Tool | -|-------------|----------------------|------------------------| -| HIGH | Merge After Review | Yes (Sonar) | +| Importance | Review Guidance | Requires Scanning Tool | +| ---------- | ------------------ | ---------------------- | +| HIGH | Merge After Review | Yes (Sonar) | This change removes unused `private` methods. Dead code can cause confusion and increase the mental load of maintainers. It can increase your maintenance burden as you have to keep that unused code compiling when you make sweeping changes to the APIs used within the method. @@ -19,7 +19,7 @@ Our changes look something like this: - } ``` - ## References - * [https://rules.sonarsource.com/java/RSPEC-1144/](https://rules.sonarsource.com/java/RSPEC-1144/) - * [https://understandlegacycode.com/blog/delete-unused-code/](https://understandlegacycode.com/blog/delete-unused-code/) + +- [https://rules.sonarsource.com/java/RSPEC-1144/](https://rules.sonarsource.com/java/RSPEC-1144/) +- [https://understandlegacycode.com/blog/delete-unused-code/](https://understandlegacycode.com/blog/delete-unused-code/) diff --git a/docs/codemods/java/sonar_java_remove-useless-parentheses-s1110.md b/docs/codemods/java/sonar_java_remove-useless-parentheses-s1110.md index c2568ee..8ff2c80 100644 --- a/docs/codemods/java/sonar_java_remove-useless-parentheses-s1110.md +++ b/docs/codemods/java/sonar_java_remove-useless-parentheses-s1110.md @@ -3,11 +3,11 @@ title: "Remove useless parentheses (Sonar)" sidebar_position: 1 --- -## sonar:java/remove-useless-parentheses-s1110 +## sonar:java/remove-useless-parentheses-s1110 -| Importance | Review Guidance | Requires Scanning Tool | -|-------------|----------------------|------------------------| -| LOW | Merge Without Review | Yes (Sonar) | +| Importance | Review Guidance | Requires Scanning Tool | +| ---------- | -------------------- | ---------------------- | +| LOW | Merge Without Review | Yes (Sonar) | This change removes redundant parentheses. These extra parentheses make it harder to understand the code. @@ -20,6 +20,6 @@ Our changes look something like this: ``` - ## References - * [https://rules.sonarsource.com/java/RSPEC-1110/](https://rules.sonarsource.com/java/RSPEC-1110/) + +- [https://rules.sonarsource.com/java/RSPEC-1110/](https://rules.sonarsource.com/java/RSPEC-1110/) diff --git a/docs/codemods/java/sonar_java_replace-stream-collectors-to-list-s6204.md b/docs/codemods/java/sonar_java_replace-stream-collectors-to-list-s6204.md index df2d548..a561c8c 100644 --- a/docs/codemods/java/sonar_java_replace-stream-collectors-to-list-s6204.md +++ b/docs/codemods/java/sonar_java_replace-stream-collectors-to-list-s6204.md @@ -3,13 +3,13 @@ title: "Replaced `Stream.collect(Collectors.toList())` with `Stream.toList()` (S sidebar_position: 1 --- -## sonar:java/replace-stream-collectors-to-list-s6204 +## sonar:java/replace-stream-collectors-to-list-s6204 -| Importance | Review Guidance | Requires Scanning Tool | -|-------------|----------------------|------------------------| -| LOW | Merge Without Review | Yes (Sonar) | +| Importance | Review Guidance | Requires Scanning Tool | +| ---------- | -------------------- | ---------------------- | +| LOW | Merge Without Review | Yes (Sonar) | -This change modernizes a stream's `List` creation to be driven from the simple, and more readable [`Stream#toList()`](https://docs.oracle.com/javase/16/docs/api/java.base/java/util/stream/Collectors.html#toList()) method. +This change modernizes a stream's `List` creation to be driven from the simple, and more readable [`Stream#toList()`]() method. Our changes look something like this: @@ -18,6 +18,6 @@ Our changes look something like this: + List numbers = someStream.toList(); ``` - ## References - * [https://rules.sonarsource.com/java/RSPEC-6204/](https://rules.sonarsource.com/java/RSPEC-6204/) + +- [https://rules.sonarsource.com/java/RSPEC-6204/](https://rules.sonarsource.com/java/RSPEC-6204/) diff --git a/docs/codemods/java/sonar_java_simplify-rest-controller-annotations-s6833.md b/docs/codemods/java/sonar_java_simplify-rest-controller-annotations-s6833.md index 0386049..e41ba84 100644 --- a/docs/codemods/java/sonar_java_simplify-rest-controller-annotations-s6833.md +++ b/docs/codemods/java/sonar_java_simplify-rest-controller-annotations-s6833.md @@ -3,11 +3,11 @@ title: "Replace `@Controller` with `@RestController` and remove `@ResponseBody` sidebar_position: 1 --- -## sonar:java/simplify-rest-controller-annotations-s6833 +## sonar:java/simplify-rest-controller-annotations-s6833 -| Importance | Review Guidance | Requires Scanning Tool | -|-------------|----------------------|------------------------| -| LOW | Merge Without Review | Yes (Sonar) | +| Importance | Review Guidance | Requires Scanning Tool | +| ---------- | -------------------- | ---------------------- | +| LOW | Merge Without Review | Yes (Sonar) | This change makes it harder for developers to make a mistake when writing REST controllers in Spring. By marking the top level type with `@RestController`, it is now assumed that all the methods within it will return a Java object representing the response body. Thus, there is no need to specify, for each method, the `@ResponseBody` annotation. @@ -26,6 +26,6 @@ Our changes look something like this: ... ``` - ## References - * [https://rules.sonarsource.com/java/RSPEC-6833/](https://rules.sonarsource.com/java/RSPEC-6833/) + +- [https://rules.sonarsource.com/java/RSPEC-6833/](https://rules.sonarsource.com/java/RSPEC-6833/) diff --git a/docs/codemods/java/sonar_java_substitute-replaceAll-s5361.md b/docs/codemods/java/sonar_java_substitute-replaceAll-s5361.md index 5d0e62c..01bdfa8 100644 --- a/docs/codemods/java/sonar_java_substitute-replaceAll-s5361.md +++ b/docs/codemods/java/sonar_java_substitute-replaceAll-s5361.md @@ -3,11 +3,11 @@ title: "Fixed inefficient usage of `String#replaceAll()` (Sonar)" sidebar_position: 1 --- -## sonar:java/substitute-replaceAll-s5361 +## sonar:java/substitute-replaceAll-s5361 -| Importance | Review Guidance | Requires Scanning Tool | -|-------------|----------------------|------------------------| -| MEDIUM | Merge Without Review | Yes (Sonar) | +| Importance | Review Guidance | Requires Scanning Tool | +| ---------- | -------------------- | ---------------------- | +| MEDIUM | Merge Without Review | Yes (Sonar) | This change replaces `String#replaceAll()` with `String#replace()` to enhance performance and avoid confusion. @@ -22,6 +22,6 @@ Our changes look something like this: + String changed = init.replace("\n", "
"); ``` - ## References - * [https://rules.sonarsource.com/java/RSPEC-5361/](https://rules.sonarsource.com/java/RSPEC-5361/) + +- [https://rules.sonarsource.com/java/RSPEC-5361/](https://rules.sonarsource.com/java/RSPEC-5361/) diff --git a/docs/codemods/python/pixee_python_add-requests-timeouts.md b/docs/codemods/python/pixee_python_add-requests-timeouts.md index 3069d12..f1c92a7 100644 --- a/docs/codemods/python/pixee_python_add-requests-timeouts.md +++ b/docs/codemods/python/pixee_python_add-requests-timeouts.md @@ -6,19 +6,20 @@ sidebar_position: 1 ## pixee:python/add-requests-timeouts | Importance | Review Guidance | Requires Scanning Tool | -|------------|----------------------------|------------------------| +| ---------- | -------------------------- | ---------------------- | | Medium | Merge After Cursory Review | No | -Many developers will be surprised to learn that `requests` library calls do not include timeouts by default. This means that an attempted request could hang indefinitely if no connection is established or if no data is received from the server. +Many developers will be surprised to learn that `requests` library calls do not include timeouts by default. This means that an attempted request could hang indefinitely if no connection is established or if no data is received from the server. -The [requests documentation](https://requests.readthedocs.io/en/latest/user/advanced/#timeouts) suggests that most calls should explicitly include a `timeout` parameter. This codemod adds a default timeout value in order to set an upper bound on connection times and ensure that requests connect or fail in a timely manner. This value also ensures the connection will timeout if the server does not respond with data within a reasonable amount of time. +The [requests documentation](https://requests.readthedocs.io/en/latest/user/advanced/#timeouts) suggests that most calls should explicitly include a `timeout` parameter. This codemod adds a default timeout value in order to set an upper bound on connection times and ensure that requests connect or fail in a timely manner. This value also ensures the connection will timeout if the server does not respond with data within a reasonable amount of time. -While timeout values will be application dependent, we believe that this codemod adds a reasonable default that serves as an appropriate ceiling for most situations. +While timeout values will be application dependent, we believe that this codemod adds a reasonable default that serves as an appropriate ceiling for most situations. Our changes look like the following: + ```diff import requests - + - requests.get("http://example.com") + requests.get("http://example.com", timeout=60) ``` @@ -37,4 +38,4 @@ N/A ## References -* [https://docs.python-requests.org/en/master/user/quickstart/#timeouts](https://docs.python-requests.org/en/master/user/quickstart/#timeouts) +- [https://docs.python-requests.org/en/master/user/quickstart/#timeouts](https://docs.python-requests.org/en/master/user/quickstart/#timeouts) diff --git a/docs/codemods/python/pixee_python_bad-lock-with-statement.md b/docs/codemods/python/pixee_python_bad-lock-with-statement.md index 4ae9392..c2227b4 100644 --- a/docs/codemods/python/pixee_python_bad-lock-with-statement.md +++ b/docs/codemods/python/pixee_python_bad-lock-with-statement.md @@ -6,7 +6,7 @@ sidebar_position: 1 ## pixee:python/bad-lock-with-statement | Importance | Review Guidance | Requires Scanning Tool | -|------------|----------------------|------------------------| +| ---------- | -------------------- | ---------------------- | | Low | Merge Without Review | No | This codemod separates creating a threading lock instance from calling it as a context manager. Calling `with threading.Lock()` does not have the effect you would expect. The lock is not acquired. Instead, to correctly acquire a lock, create the instance separately, before calling it as a context manager. @@ -37,5 +37,5 @@ N/A ## References -* [https://pylint.pycqa.org/en/latest/user_guide/messages/warning/useless-with-lock.](https://pylint.pycqa.org/en/latest/user_guide/messages/warning/useless-with-lock.) -* [https://docs.python.org/3/library/threading.html#using-locks-conditions-and-semaphores-in-the-with-statement](https://docs.python.org/3/library/threading.html#using-locks-conditions-and-semaphores-in-the-with-statement) +- [https://pylint.pycqa.org/en/latest/user_guide/messages/warning/useless-with-lock.](https://pylint.pycqa.org/en/latest/user_guide/messages/warning/useless-with-lock.) +- [https://docs.python.org/3/library/threading.html#using-locks-conditions-and-semaphores-in-the-with-statement](https://docs.python.org/3/library/threading.html#using-locks-conditions-and-semaphores-in-the-with-statement) diff --git a/docs/codemods/python/pixee_python_combine-startswith-endswith.md b/docs/codemods/python/pixee_python_combine-startswith-endswith.md index d0cca40..4bab349 100644 --- a/docs/codemods/python/pixee_python_combine-startswith-endswith.md +++ b/docs/codemods/python/pixee_python_combine-startswith-endswith.md @@ -6,7 +6,7 @@ sidebar_position: 1 ## pixee:python/combine-startswith-endswith | Importance | Review Guidance | Requires Scanning Tool | -|------------|----------------------|------------------------| +| ---------- | -------------------- | ---------------------- | | Low | Merge Without Review | No | Many developers are not necessarily aware that the `startswith` and `endswith` methods of `str` objects can accept a tuple of strings to match. This means that there is a lot of code that uses boolean expressions such as `x.startswith('foo') or x.startswith('bar')` instead of the simpler expression `x.startswith(('foo', 'bar'))`. diff --git a/docs/codemods/python/pixee_python_django-debug-flag-on.md b/docs/codemods/python/pixee_python_django-debug-flag-on.md index 0e5625f..874d85f 100644 --- a/docs/codemods/python/pixee_python_django-debug-flag-on.md +++ b/docs/codemods/python/pixee_python_django-debug-flag-on.md @@ -6,7 +6,7 @@ sidebar_position: 1 ## pixee:python/django-debug-flag-on | Importance | Review Guidance | Requires Scanning Tool | -|------------|----------------------------|------------------------| +| ---------- | -------------------------- | ---------------------- | | Medium | Merge After Cursory Review | No | This codemod will flip django's `DEBUG` flag to `False` if it's `True` on the `settings.py` file within django's default directory structure. @@ -32,5 +32,5 @@ N/A ## References -* [https://owasp.org/www-project-top-ten/2017/A3_2017-Sensitive_Data_Exposure](https://owasp.org/www-project-top-ten/2017/A3_2017-Sensitive_Data_Exposure) -* [https://docs.djangoproject.com/en/4.2/ref/settings/#std-setting-DEBUG](https://docs.djangoproject.com/en/4.2/ref/settings/#std-setting-DEBUG) +- [https://owasp.org/www-project-top-ten/2017/A3_2017-Sensitive_Data_Exposure](https://owasp.org/www-project-top-ten/2017/A3_2017-Sensitive_Data_Exposure) +- [https://docs.djangoproject.com/en/4.2/ref/settings/#std-setting-DEBUG](https://docs.djangoproject.com/en/4.2/ref/settings/#std-setting-DEBUG) diff --git a/docs/codemods/python/pixee_python_django-json-response-type.md b/docs/codemods/python/pixee_python_django-json-response-type.md index 226ef94..6c6eca0 100644 --- a/docs/codemods/python/pixee_python_django-json-response-type.md +++ b/docs/codemods/python/pixee_python_django-json-response-type.md @@ -6,11 +6,11 @@ sidebar_position: 1 ## pixee:python/django-json-response-type | Importance | Review Guidance | Requires Scanning Tool | -|------------|----------------------|------------------------| +| ---------- | -------------------- | ---------------------- | | Medium | Merge Without Review | No | The default `content_type` for `HttpResponse` in Django is `'text/html'`. This is true even when the response contains JSON data. -If the JSON contains (unsanitized) user-supplied input, a malicious user may supply HTML code which leaves the application vulnerable to cross-site scripting (XSS). +If the JSON contains (unsanitized) user-supplied input, a malicious user may supply HTML code which leaves the application vulnerable to cross-site scripting (XSS). This fix explicitly sets the response type to `application/json` when the response body is JSON data to avoid this vulnerability. Our changes look something like this: ```diff @@ -37,5 +37,5 @@ N/A ## References -* [https://docs.djangoproject.com/en/4.0/ref/request-response/#django.http.HttpResponse.__init__](https://docs.djangoproject.com/en/4.0/ref/request-response/#django.http.HttpResponse.__init__) -* [https://cheatsheetseries.owasp.org/cheatsheets/Cross_Site_Scripting_Prevention_Cheat_Sheet.html#output-encoding-for-javascript-contexts](https://cheatsheetseries.owasp.org/cheatsheets/Cross_Site_Scripting_Prevention_Cheat_Sheet.html#output-encoding-for-javascript-contexts) +- [https://docs.djangoproject.com/en/4.0/ref/request-response/#django.http.HttpResponse.**init**](https://docs.djangoproject.com/en/4.0/ref/request-response/#django.http.HttpResponse.__init__) +- [https://cheatsheetseries.owasp.org/cheatsheets/Cross_Site_Scripting_Prevention_Cheat_Sheet.html#output-encoding-for-javascript-contexts](https://cheatsheetseries.owasp.org/cheatsheets/Cross_Site_Scripting_Prevention_Cheat_Sheet.html#output-encoding-for-javascript-contexts) diff --git a/docs/codemods/python/pixee_python_django-receiver-on-top.md b/docs/codemods/python/pixee_python_django-receiver-on-top.md index aaaff9a..008f0e8 100644 --- a/docs/codemods/python/pixee_python_django-receiver-on-top.md +++ b/docs/codemods/python/pixee_python_django-receiver-on-top.md @@ -6,10 +6,10 @@ sidebar_position: 1 ## pixee:python/django-receiver-on-top | Importance | Review Guidance | Requires Scanning Tool | -|------------|----------------------|------------------------| +| ---------- | -------------------- | ---------------------- | | Medium | Merge Without Review | No | -Django uses signals to notify and handle actions that happens elsewhere in the application. You can define a response to a given signal by decorating a function with the `@receiver(signal)` decorator. The order in which the decorators are declared for this function is important. If the `@receiver` decorator is not on top, any decorators before it will be ignored. +Django uses signals to notify and handle actions that happens elsewhere in the application. You can define a response to a given signal by decorating a function with the `@receiver(signal)` decorator. The order in which the decorators are declared for this function is important. If the `@receiver` decorator is not on top, any decorators before it will be ignored. Our changes look something like this: ```diff @@ -38,4 +38,4 @@ N/A ## References -* [https://docs.djangoproject.com/en/4.1/topics/signals/](https://docs.djangoproject.com/en/4.1/topics/signals/) +- [https://docs.djangoproject.com/en/4.1/topics/signals/](https://docs.djangoproject.com/en/4.1/topics/signals/) diff --git a/docs/codemods/python/pixee_python_django-session-cookie-secure-off.md b/docs/codemods/python/pixee_python_django-session-cookie-secure-off.md index 0b39d33..de41dbf 100644 --- a/docs/codemods/python/pixee_python_django-session-cookie-secure-off.md +++ b/docs/codemods/python/pixee_python_django-session-cookie-secure-off.md @@ -6,7 +6,7 @@ sidebar_position: 1 ## pixee:python/django-session-cookie-secure-off | Importance | Review Guidance | Requires Scanning Tool | -|------------|----------------------------|------------------------| +| ---------- | -------------------------- | ---------------------- | | Medium | Merge After Cursory Review | No | This codemod will set django's `SESSION_COOKIE_SECURE` flag to `True` if it's `False` or missing on the `settings.py` file within django's default directory structure. @@ -31,5 +31,5 @@ N/A ## References -* [https://owasp.org/www-community/controls/SecureCookieAttribute](https://owasp.org/www-community/controls/SecureCookieAttribute) -* [https://docs.djangoproject.com/en/4.2/ref/settings/#session-cookie-secure](https://docs.djangoproject.com/en/4.2/ref/settings/#session-cookie-secure) +- [https://owasp.org/www-community/controls/SecureCookieAttribute](https://owasp.org/www-community/controls/SecureCookieAttribute) +- [https://docs.djangoproject.com/en/4.2/ref/settings/#session-cookie-secure](https://docs.djangoproject.com/en/4.2/ref/settings/#session-cookie-secure) diff --git a/docs/codemods/python/pixee_python_enable-jinja2-autoescape.md b/docs/codemods/python/pixee_python_enable-jinja2-autoescape.md index 502033c..3a4f3d3 100644 --- a/docs/codemods/python/pixee_python_enable-jinja2-autoescape.md +++ b/docs/codemods/python/pixee_python_enable-jinja2-autoescape.md @@ -5,9 +5,9 @@ sidebar_position: 1 ## pixee:python/enable-jinja2-autoescape -| Importance | Review Guidance | Requires Scanning Tool | -|------------|---------------------|------------------------| -| High | Merge After Review | No | +| Importance | Review Guidance | Requires Scanning Tool | +| ---------- | ------------------ | ---------------------- | +| High | Merge After Review | No | This codemod enables autoescaping of HTML content in `jinja2`. Unfortunately, the jinja2 default behavior is to not autoescape when rendering templates, which makes your applications potentially vulnerable to Cross-Site Scripting (XSS) attacks. @@ -37,5 +37,5 @@ N/A ## References -* [https://owasp.org/www-community/attacks/xss/](https://owasp.org/www-community/attacks/xss/) -* [https://jinja.palletsprojects.com/en/3.1.x/api/#autoescaping](https://jinja.palletsprojects.com/en/3.1.x/api/#autoescaping) +- [https://owasp.org/www-community/attacks/xss/](https://owasp.org/www-community/attacks/xss/) +- [https://jinja.palletsprojects.com/en/3.1.x/api/#autoescaping](https://jinja.palletsprojects.com/en/3.1.x/api/#autoescaping) diff --git a/docs/codemods/python/pixee_python_exception-without-raise.md b/docs/codemods/python/pixee_python_exception-without-raise.md index 12361d2..bb3d1c4 100644 --- a/docs/codemods/python/pixee_python_exception-without-raise.md +++ b/docs/codemods/python/pixee_python_exception-without-raise.md @@ -6,12 +6,13 @@ sidebar_position: 1 ## pixee:python/exception-without-raise | Importance | Review Guidance | Requires Scanning Tool | -|------------|----------------------|------------------------| +| ---------- | -------------------- | ---------------------- | | Low | Merge Without Review | No | -This codemod fixes cases where an exception is referenced by itself in a statement without being raised. This most likely indicates a bug: you probably meant to actually raise the exception. +This codemod fixes cases where an exception is referenced by itself in a statement without being raised. This most likely indicates a bug: you probably meant to actually raise the exception. Our changes look something like this: + ```diff try: - ValueError @@ -34,4 +35,4 @@ N/A ## References -* [https://docs.python.org/3/tutorial/errors.html#raising-exceptions](https://docs.python.org/3/tutorial/errors.html#raising-exceptions) +- [https://docs.python.org/3/tutorial/errors.html#raising-exceptions](https://docs.python.org/3/tutorial/errors.html#raising-exceptions) diff --git a/docs/codemods/python/pixee_python_fix-assert-tuple.md b/docs/codemods/python/pixee_python_fix-assert-tuple.md index c9883ed..a7ae52a 100644 --- a/docs/codemods/python/pixee_python_fix-assert-tuple.md +++ b/docs/codemods/python/pixee_python_fix-assert-tuple.md @@ -6,7 +6,7 @@ sidebar_position: 1 ## pixee:python/fix-assert-tuple | Importance | Review Guidance | Requires Scanning Tool | -|------------|----------------------------|------------------------| +| ---------- | -------------------------- | ---------------------- | | Medium | Merge After Cursory Review | No | An assertion on a non-empty tuple will always evaluate to `True`. This means that `assert` statements involving non-empty tuple literals are likely unintentional and should be rewritten. This codemod rewrites the original `assert` statement by creating a new `assert` for each item in the original tuple. diff --git a/docs/codemods/python/pixee_python_fix-async-task-instantiation.md b/docs/codemods/python/pixee_python_fix-async-task-instantiation.md index 11f7c60..ca05870 100644 --- a/docs/codemods/python/pixee_python_fix-async-task-instantiation.md +++ b/docs/codemods/python/pixee_python_fix-async-task-instantiation.md @@ -6,12 +6,13 @@ sidebar_position: 1 ## pixee:python/fix-async-task-instantiation | Importance | Review Guidance | Requires Scanning Tool | -|------------|----------------------------|------------------------| +| ---------- | -------------------------- | ---------------------- | | Low | Merge After Cursory Review | No | The `asyncio` [documentation](https://docs.python.org/3/library/asyncio-task.html#asyncio.Task) explicitly discourages manual instantiation of a `Task` instance and instead recommends calling `create_task`. This keeps your code in line with recommended best practices and promotes maintainability. Our changes look like the following: + ```diff import asyncio @@ -33,4 +34,4 @@ N/A ## References -* [https://docs.python.org/3/library/asyncio-task.html#asyncio.Task](https://docs.python.org/3/library/asyncio-task.html#asyncio.Task) +- [https://docs.python.org/3/library/asyncio-task.html#asyncio.Task](https://docs.python.org/3/library/asyncio-task.html#asyncio.Task) diff --git a/docs/codemods/python/pixee_python_fix-deprecated-abstractproperty.md b/docs/codemods/python/pixee_python_fix-deprecated-abstractproperty.md index 013e230..7bcafc4 100644 --- a/docs/codemods/python/pixee_python_fix-deprecated-abstractproperty.md +++ b/docs/codemods/python/pixee_python_fix-deprecated-abstractproperty.md @@ -6,12 +6,13 @@ sidebar_position: 1 ## pixee:python/fix-deprecated-abstractproperty | Importance | Review Guidance | Requires Scanning Tool | -|------------|----------------------|------------------------| +| ---------- | -------------------- | ---------------------- | | Low | Merge Without Review | No | -The `@abstractproperty` decorator from `abc` has been [deprecated](https://docs.python.org/3/library/abc.html#abc.abstractproperty) since Python 3.3. This is because it's possible to use `@property` in combination with `@abstractmethod`. +The `@abstractproperty` decorator from `abc` has been [deprecated](https://docs.python.org/3/library/abc.html#abc.abstractproperty) since Python 3.3. This is because it's possible to use `@property` in combination with `@abstractmethod`. Our changes look like the following: + ```diff import abc @@ -37,4 +38,4 @@ N/A ## References -* [https://docs.python.org/3/library/abc.html#abc.abstractproperty](https://docs.python.org/3/library/abc.html#abc.abstractproperty) +- [https://docs.python.org/3/library/abc.html#abc.abstractproperty](https://docs.python.org/3/library/abc.html#abc.abstractproperty) diff --git a/docs/codemods/python/pixee_python_fix-deprecated-logging-warn.md b/docs/codemods/python/pixee_python_fix-deprecated-logging-warn.md index 89a2cc2..790a64f 100644 --- a/docs/codemods/python/pixee_python_fix-deprecated-logging-warn.md +++ b/docs/codemods/python/pixee_python_fix-deprecated-logging-warn.md @@ -6,12 +6,13 @@ sidebar_position: 1 ## pixee:python/fix-deprecated-logging-warn | Importance | Review Guidance | Requires Scanning Tool | -|------------|----------------------|------------------------| +| ---------- | -------------------- | ---------------------- | | Low | Merge Without Review | No | The `warn` method from `logging` has been [deprecated](https://docs.python.org/3/library/logging.html#logging.Logger.warning) in favor of `warning` since Python 3.3. Since the old method `warn` has been retained for a long time, there are a lot of developers that are unaware of this change and consequently a lot of code using the older method. Our changes look like the following: + ```diff import logging @@ -20,7 +21,7 @@ Our changes look like the following: ... log = logging.getLogger("my logger") - log.warn("hello") -+ log.warning("hello") ++ log.warning("hello") ``` If you have feedback on this codemod, [please let us know](mailto:feedback@pixee.ai)! @@ -37,4 +38,4 @@ N/A ## References -* [https://docs.python.org/3/library/logging.html#logging.Logger.warning](https://docs.python.org/3/library/logging.html#logging.Logger.warning) +- [https://docs.python.org/3/library/logging.html#logging.Logger.warning](https://docs.python.org/3/library/logging.html#logging.Logger.warning) diff --git a/docs/codemods/python/pixee_python_fix-empty-sequence-comparison.md b/docs/codemods/python/pixee_python_fix-empty-sequence-comparison.md index 2f35e7b..a82ae5c 100644 --- a/docs/codemods/python/pixee_python_fix-empty-sequence-comparison.md +++ b/docs/codemods/python/pixee_python_fix-empty-sequence-comparison.md @@ -5,19 +5,20 @@ sidebar_position: 1 ## pixee:python/fix-empty-sequence-comparison -| Importance | Review Guidance | Requires Scanning Tool | -|------------|---------------------|------------------------| -| Low | Merge After Review | No | +| Importance | Review Guidance | Requires Scanning Tool | +| ---------- | ------------------ | ---------------------- | +| Low | Merge After Review | No | Empty sequences in Python always evaluate to `False`. This means that comparison expressions that use empty sequences can sometimes be simplified. In these cases no explicit comparison is required: instead we can rely on the [truth value](https://docs.python.org/3/library/stdtypes.html#truth-value-testing) of the object under comparison. This is sometimes referred to as "implicit" comparison. Using implicit boolean comparison expressions is considered best practice and can lead to better code. Our changes look like the following: + ```diff x = [1] - if x != []: + if x: - pass + pass ``` If you have feedback on this codemod, [please let us know](mailto:feedback@pixee.ai)! @@ -34,4 +35,4 @@ N/A ## References -* [https://docs.python.org/3/library/stdtypes.html#truth-value-testing](https://docs.python.org/3/library/stdtypes.html#truth-value-testing) +- [https://docs.python.org/3/library/stdtypes.html#truth-value-testing](https://docs.python.org/3/library/stdtypes.html#truth-value-testing) diff --git a/docs/codemods/python/pixee_python_fix-file-resource-leak.md b/docs/codemods/python/pixee_python_fix-file-resource-leak.md index 2614f7a..d14a31f 100644 --- a/docs/codemods/python/pixee_python_fix-file-resource-leak.md +++ b/docs/codemods/python/pixee_python_fix-file-resource-leak.md @@ -6,7 +6,7 @@ sidebar_position: 1 ## pixee:python/fix-file-resource-leak | Importance | Review Guidance | Requires Scanning Tool | -|------------|----------------------|------------------------| +| ---------- | -------------------- | ---------------------- | | High | Merge Without Review | No | This codemod wraps assignments of `open` calls in a with statement. Without explicit closing, these resources will be "leaked" and won't be re-claimed until garbage collection. In situations where these resources are leaked rapidly (either through malicious repetitive action or unusually spiky usage), connection pool or file handle exhaustion will occur. These types of failures tend to be catastrophic, resulting in downtime and many times affect downstream applications. @@ -36,5 +36,5 @@ N/A ## References -* [https://cwe.mitre.org/data/definitions/772.html](https://cwe.mitre.org/data/definitions/772.html) -* [https://cwe.mitre.org/data/definitions/404.html](https://cwe.mitre.org/data/definitions/404.html) +- [https://cwe.mitre.org/data/definitions/772.html](https://cwe.mitre.org/data/definitions/772.html) +- [https://cwe.mitre.org/data/definitions/404.html](https://cwe.mitre.org/data/definitions/404.html) diff --git a/docs/codemods/python/pixee_python_fix-mutable-params.md b/docs/codemods/python/pixee_python_fix-mutable-params.md index ddf2154..1fa4c75 100644 --- a/docs/codemods/python/pixee_python_fix-mutable-params.md +++ b/docs/codemods/python/pixee_python_fix-mutable-params.md @@ -6,7 +6,7 @@ sidebar_position: 1 ## pixee:python/fix-mutable-params | Importance | Review Guidance | Requires Scanning Tool | -|------------|----------------------|------------------------| +| ---------- | -------------------- | ---------------------- | | Medium | Merge Without Review | No | Using mutable values for default arguments is not a safe practice. @@ -38,11 +38,12 @@ But that's not what happens! The value of `y` is preserved between calls! This might seem surprising, and it is. It's due to the way that scope works for function arguments in Python. -The result is that any default argument value will be preserved between function calls. This is problematic for *mutable* types, including things like `list`, `dict`, and `set`. +The result is that any default argument value will be preserved between function calls. This is problematic for _mutable_ types, including things like `list`, `dict`, and `set`. Relying on this behavior is unpredictable and generally considered to be unsafe. Most of us who write code like this were not anticipating the surprising behavior, so it's best to fix it. Our codemod makes an update that looks like this: + ```diff - def foo(x, y=[]): + def foo(x, y=None): diff --git a/docs/codemods/python/pixee_python_flask-enable-csrf-protection.md b/docs/codemods/python/pixee_python_flask-enable-csrf-protection.md index 763e3ed..0366aa8 100644 --- a/docs/codemods/python/pixee_python_flask-enable-csrf-protection.md +++ b/docs/codemods/python/pixee_python_flask-enable-csrf-protection.md @@ -5,9 +5,9 @@ sidebar_position: 1 ## pixee:python/flask-enable-csrf-protection -| Importance | Review Guidance | Requires Scanning Tool | -|------------|---------------------|------------------------| -| High | Merge After Review | No | +| Importance | Review Guidance | Requires Scanning Tool | +| ---------- | ------------------ | ---------------------- | +| High | Merge After Review | No | Cross-site request forgery (CSRF) is an attack where a user is tricked by a malicious agent to submit a unintended request (e.g login requests). A common way to mitigate this issue is to embed an additional token into requests to identify requests from unauthorized locations. @@ -39,5 +39,5 @@ N/A ## References -* [https://owasp.org/www-community/attacks/csrf](https://owasp.org/www-community/attacks/csrf) -* [https://flask-wtf.readthedocs.io/en/1.2.x/csrf/](https://flask-wtf.readthedocs.io/en/1.2.x/csrf/) +- [https://owasp.org/www-community/attacks/csrf](https://owasp.org/www-community/attacks/csrf) +- [https://flask-wtf.readthedocs.io/en/1.2.x/csrf/](https://flask-wtf.readthedocs.io/en/1.2.x/csrf/) diff --git a/docs/codemods/python/pixee_python_flask-json-response-type.md b/docs/codemods/python/pixee_python_flask-json-response-type.md index cf8119b..47bb7c8 100644 --- a/docs/codemods/python/pixee_python_flask-json-response-type.md +++ b/docs/codemods/python/pixee_python_flask-json-response-type.md @@ -6,11 +6,11 @@ sidebar_position: 1 ## pixee:python/flask-json-response-type | Importance | Review Guidance | Requires Scanning Tool | -|------------|----------------------|------------------------| +| ---------- | -------------------- | ---------------------- | | Medium | Merge Without Review | No | The default `mimetype` for `make_response` in Flask is `'text/html'`. This is true even when the response contains JSON data. -If the JSON contains (unsanitized) user-supplied input, a malicious user may supply HTML code which leaves the application vulnerable to cross-site scripting (XSS). +If the JSON contains (unsanitized) user-supplied input, a malicious user may supply HTML code which leaves the application vulnerable to cross-site scripting (XSS). This fix explicitly sets the response type to `application/json` when the response body is JSON data to avoid this vulnerability. Our changes look something like this: ```diff @@ -40,5 +40,5 @@ N/A ## References -* [https://flask.palletsprojects.com/en/2.3.x/patterns/javascript/#return-json-from-views](https://flask.palletsprojects.com/en/2.3.x/patterns/javascript/#return-json-from-views) -* [https://cheatsheetseries.owasp.org/cheatsheets/Cross_Site_Scripting_Prevention_Cheat_Sheet.html#output-encoding-for-javascript-contexts](https://cheatsheetseries.owasp.org/cheatsheets/Cross_Site_Scripting_Prevention_Cheat_Sheet.html#output-encoding-for-javascript-contexts) +- [https://flask.palletsprojects.com/en/2.3.x/patterns/javascript/#return-json-from-views](https://flask.palletsprojects.com/en/2.3.x/patterns/javascript/#return-json-from-views) +- [https://cheatsheetseries.owasp.org/cheatsheets/Cross_Site_Scripting_Prevention_Cheat_Sheet.html#output-encoding-for-javascript-contexts](https://cheatsheetseries.owasp.org/cheatsheets/Cross_Site_Scripting_Prevention_Cheat_Sheet.html#output-encoding-for-javascript-contexts) diff --git a/docs/codemods/python/pixee_python_harden-pyyaml.md b/docs/codemods/python/pixee_python_harden-pyyaml.md index c1d1baf..2468073 100644 --- a/docs/codemods/python/pixee_python_harden-pyyaml.md +++ b/docs/codemods/python/pixee_python_harden-pyyaml.md @@ -6,7 +6,7 @@ sidebar_position: 1 ## pixee:python/harden-pyyaml | Importance | Review Guidance | Requires Scanning Tool | -|------------|----------------------|------------------------| +| ---------- | -------------------- | ---------------------- | | Medium | Merge Without Review | No | This codemod hardens all [`yaml.load()`](https://pyyaml.org/wiki/PyYAMLDocumentation) calls against attacks that could result from deserializing untrusted data. @@ -20,6 +20,7 @@ The changes from this codemod look like this: - deserialized_data = yaml.load(data, yaml.Loader) + deserialized_data = yaml.load(data, Loader=yaml.SafeLoader) ``` + The codemod will also catch if you pass in the loader argument as a kwarg and if you use any loader other than `SafeLoader`, including `FullLoader` and `UnsafeLoader`. @@ -37,4 +38,4 @@ N/A ## References -* [https://owasp.org/www-community/vulnerabilities/Deserialization_of_untrusted_data](https://owasp.org/www-community/vulnerabilities/Deserialization_of_untrusted_data) +- [https://owasp.org/www-community/vulnerabilities/Deserialization_of_untrusted_data](https://owasp.org/www-community/vulnerabilities/Deserialization_of_untrusted_data) diff --git a/docs/codemods/python/pixee_python_harden-ruamel.md b/docs/codemods/python/pixee_python_harden-ruamel.md index d67ef96..0635530 100644 --- a/docs/codemods/python/pixee_python_harden-ruamel.md +++ b/docs/codemods/python/pixee_python_harden-ruamel.md @@ -6,7 +6,7 @@ sidebar_position: 1 ## pixee:python/harden-ruamel | Importance | Review Guidance | Requires Scanning Tool | -|------------|----------------------|------------------------| +| ---------- | -------------------- | ---------------------- | | Medium | Merge Without Review | No | This codemod hardens any unsafe [`ruamel.yaml.YAML()`](https://yaml.readthedocs.io/en/latest/) calls against attacks that could result from deserializing untrusted data. @@ -36,4 +36,4 @@ N/A ## References -* [https://owasp.org/www-community/vulnerabilities/Deserialization_of_untrusted_data](https://owasp.org/www-community/vulnerabilities/Deserialization_of_untrusted_data) +- [https://owasp.org/www-community/vulnerabilities/Deserialization_of_untrusted_data](https://owasp.org/www-community/vulnerabilities/Deserialization_of_untrusted_data) diff --git a/docs/codemods/python/pixee_python_https-connection.md b/docs/codemods/python/pixee_python_https-connection.md index 1245867..aa8bcbf 100644 --- a/docs/codemods/python/pixee_python_https-connection.md +++ b/docs/codemods/python/pixee_python_https-connection.md @@ -6,7 +6,7 @@ sidebar_position: 1 ## pixee:python/https-connection | Importance | Review Guidance | Requires Scanning Tool | -|------------|----------------------|------------------------| +| ---------- | -------------------- | ---------------------- | | High | Merge Without Review | No | This codemod replaces calls to `urllib3.connectionpool.HTTPConnectionPool` and `urllib3.HTTPConnectionPool` with their secure variant (`HTTPSConnectionPool`). @@ -33,5 +33,5 @@ N/A ## References -* [https://owasp.org/www-community/vulnerabilities/Insecure_Transport](https://owasp.org/www-community/vulnerabilities/Insecure_Transport) -* [https://urllib3.readthedocs.io/en/stable/reference/urllib3.connectionpool.html#urllib3.HTTPConnectionPool](https://urllib3.readthedocs.io/en/stable/reference/urllib3.connectionpool.html#urllib3.HTTPConnectionPool) +- [https://owasp.org/www-community/vulnerabilities/Insecure_Transport](https://owasp.org/www-community/vulnerabilities/Insecure_Transport) +- [https://urllib3.readthedocs.io/en/stable/reference/urllib3.connectionpool.html#urllib3.HTTPConnectionPool](https://urllib3.readthedocs.io/en/stable/reference/urllib3.connectionpool.html#urllib3.HTTPConnectionPool) diff --git a/docs/codemods/python/pixee_python_jwt-decode-verify.md b/docs/codemods/python/pixee_python_jwt-decode-verify.md index 4dea5b2..75b996e 100644 --- a/docs/codemods/python/pixee_python_jwt-decode-verify.md +++ b/docs/codemods/python/pixee_python_jwt-decode-verify.md @@ -6,7 +6,7 @@ sidebar_position: 1 ## pixee:python/jwt-decode-verify | Importance | Review Guidance | Requires Scanning Tool | -|------------|----------------------|------------------------| +| ---------- | -------------------- | ---------------------- | | High | Merge Without Review | No | This codemod ensures calls to [jwt.decode](https://pyjwt.readthedocs.io/en/stable/api.html#jwt.decode) do not disable signature validation and other verifications. It checks that both the `verify` parameter (soon to be deprecated) and any `verify` key in the `options` dict parameter are not assigned to `False`. @@ -39,5 +39,5 @@ N/A ## References -* [https://pyjwt.readthedocs.io/en/stable/api.html](https://pyjwt.readthedocs.io/en/stable/api.html) -* [https://owasp.org/www-project-web-security-testing-guide/latest/4-Web_Application_Security_Testing/06-Session_Management_Testing/10-Testing_JSON_Web_Tokens](https://owasp.org/www-project-web-security-testing-guide/latest/4-Web_Application_Security_Testing/06-Session_Management_Testing/10-Testing_JSON_Web_Tokens) +- [https://pyjwt.readthedocs.io/en/stable/api.html](https://pyjwt.readthedocs.io/en/stable/api.html) +- [https://owasp.org/www-project-web-security-testing-guide/latest/4-Web_Application_Security_Testing/06-Session_Management_Testing/10-Testing_JSON_Web_Tokens](https://owasp.org/www-project-web-security-testing-guide/latest/4-Web_Application_Security_Testing/06-Session_Management_Testing/10-Testing_JSON_Web_Tokens) diff --git a/docs/codemods/python/pixee_python_lazy-logging.md b/docs/codemods/python/pixee_python_lazy-logging.md index d2f1b13..ce42b3d 100644 --- a/docs/codemods/python/pixee_python_lazy-logging.md +++ b/docs/codemods/python/pixee_python_lazy-logging.md @@ -6,11 +6,11 @@ sidebar_position: 1 ## pixee:python/lazy-logging | Importance | Review Guidance | Requires Scanning Tool | -|------------|----------------------|------------------------| +| ---------- | -------------------- | ---------------------- | | Medium | Merge Without Review | No | This codemod converts "eager" logging into "lazy" logging, which is preferred for performance efficiency and resource optimization. -Lazy logging defers the actual construction and formatting of log messages until it's confirmed that the message will be logged based on the current log level, thereby avoiding unnecessary computation for messages that will not be logged. +Lazy logging defers the actual construction and formatting of log messages until it's confirmed that the message will be logged based on the current log level, thereby avoiding unnecessary computation for messages that will not be logged. Our changes look something like this: diff --git a/docs/codemods/python/pixee_python_limit-readline.md b/docs/codemods/python/pixee_python_limit-readline.md index 5f70d68..3725cda 100644 --- a/docs/codemods/python/pixee_python_limit-readline.md +++ b/docs/codemods/python/pixee_python_limit-readline.md @@ -6,7 +6,7 @@ sidebar_position: 1 ## pixee:python/limit-readline | Importance | Review Guidance | Requires Scanning Tool | -|------------|----------------------------|------------------------| +| ---------- | -------------------------- | ---------------------- | | Medium | Merge After Cursory Review | No | This codemod hardens all [`readline()`](https://docs.python.org/3/library/io.html#io.IOBase.readline) calls from file objects returned from an `open()` call, `StringIO` and `BytesIO` against denial of service attacks. A stream influenced by an attacker could keep providing bytes until the system runs out of memory, causing a crash. @@ -34,4 +34,4 @@ N/A ## References -* [https://cwe.mitre.org/data/definitions/400.html](https://cwe.mitre.org/data/definitions/400.html) +- [https://cwe.mitre.org/data/definitions/400.html](https://cwe.mitre.org/data/definitions/400.html) diff --git a/docs/codemods/python/pixee_python_literal-or-new-object-identity.md b/docs/codemods/python/pixee_python_literal-or-new-object-identity.md index 0b4a20d..4b5353f 100644 --- a/docs/codemods/python/pixee_python_literal-or-new-object-identity.md +++ b/docs/codemods/python/pixee_python_literal-or-new-object-identity.md @@ -6,7 +6,7 @@ sidebar_position: 1 ## pixee:python/literal-or-new-object-identity | Importance | Review Guidance | Requires Scanning Tool | -|------------|----------------------|------------------------| +| ---------- | -------------------- | ---------------------- | | Low | Merge Without Review | No | The `is` and `is not` operators only evaluate to `True` when the expressions on each side have the same `id`. In other words, `a is b` is equivalent to `id(a) == id(b)`. With few exceptions, objects and literals have unique identities and thus shouldn't generally be compared by using the `is` or `is not` operators. @@ -33,4 +33,4 @@ N/A ## References -* [https://docs.python.org/3/library/stdtypes.html#comparisons](https://docs.python.org/3/library/stdtypes.html#comparisons) +- [https://docs.python.org/3/library/stdtypes.html#comparisons](https://docs.python.org/3/library/stdtypes.html#comparisons) diff --git a/docs/codemods/python/pixee_python_numpy-nan-equality.md b/docs/codemods/python/pixee_python_numpy-nan-equality.md index 0982d2b..495112c 100644 --- a/docs/codemods/python/pixee_python_numpy-nan-equality.md +++ b/docs/codemods/python/pixee_python_numpy-nan-equality.md @@ -6,7 +6,7 @@ sidebar_position: 1 ## pixee:python/numpy-nan-equality | Importance | Review Guidance | Requires Scanning Tool | -|------------|----------------------|------------------------| +| ---------- | -------------------- | ---------------------- | | Medium | Merge Without Review | No | Comparisons against `numpy.nan` always result in `False`. Thus comparing an expression directly against `numpy.nan` is always unintended. The correct way to compare a value for `NaN` is to use the `numpy.isnan` function. @@ -36,4 +36,4 @@ N/A ## References -* [https://numpy.org/doc/stable/reference/constants.html#numpy.nan](https://numpy.org/doc/stable/reference/constants.html#numpy.nan) +- [https://numpy.org/doc/stable/reference/constants.html#numpy.nan](https://numpy.org/doc/stable/reference/constants.html#numpy.nan) diff --git a/docs/codemods/python/pixee_python_remove-assertion-in-pytest-raises.md b/docs/codemods/python/pixee_python_remove-assertion-in-pytest-raises.md index ceaac58..dd8fbc3 100644 --- a/docs/codemods/python/pixee_python_remove-assertion-in-pytest-raises.md +++ b/docs/codemods/python/pixee_python_remove-assertion-in-pytest-raises.md @@ -6,10 +6,10 @@ sidebar_position: 1 ## pixee:python/remove-assertion-in-pytest-raises | Importance | Review Guidance | Requires Scanning Tool | -|------------|----------------------|------------------------| +| ---------- | -------------------- | ---------------------- | | Low | Merge Without Review | No | -The context manager object `pytest.raises()` will assert if the code contained within its scope will raise an exception of type ``. The documentation points that the exception must be raised in the last line of its scope and any line afterwards won't be executed. +The context manager object `pytest.raises()` will assert if the code contained within its scope will raise an exception of type ``. The documentation points that the exception must be raised in the last line of its scope and any line afterwards won't be executed. Including asserts at the end of the scope is a common error. This codemod addresses that by moving them out of the scope. Our changes look something like this: @@ -39,4 +39,4 @@ N/A ## References -* [https://docs.pytest.org/en/7.4.x/reference/reference.html#pytest-raises](https://docs.pytest.org/en/7.4.x/reference/reference.html#pytest-raises) +- [https://docs.pytest.org/en/7.4.x/reference/reference.html#pytest-raises](https://docs.pytest.org/en/7.4.x/reference/reference.html#pytest-raises) diff --git a/docs/codemods/python/pixee_python_remove-debug-breakpoint.md b/docs/codemods/python/pixee_python_remove-debug-breakpoint.md index 0360c84..3b7511c 100644 --- a/docs/codemods/python/pixee_python_remove-debug-breakpoint.md +++ b/docs/codemods/python/pixee_python_remove-debug-breakpoint.md @@ -6,7 +6,7 @@ sidebar_position: 1 ## pixee:python/remove-debug-breakpoint | Importance | Review Guidance | Requires Scanning Tool | -|------------|----------------------|------------------------| +| ---------- | -------------------- | ---------------------- | | Medium | Merge Without Review | No | This codemod removes any calls to `breakpoint()` or `pdb.set_trace()` which are generally only used for interactive debugging and should not be deployed in production code. diff --git a/docs/codemods/python/pixee_python_remove-future-imports.md b/docs/codemods/python/pixee_python_remove-future-imports.md index 06a4156..0ddd48b 100644 --- a/docs/codemods/python/pixee_python_remove-future-imports.md +++ b/docs/codemods/python/pixee_python_remove-future-imports.md @@ -6,14 +6,15 @@ sidebar_position: 1 ## pixee:python/remove-future-imports | Importance | Review Guidance | Requires Scanning Tool | -|------------|----------------------|------------------------| +| ---------- | -------------------- | ---------------------- | | Low | Merge Without Review | No | -Many older codebases have `__future__` imports for forwards compatibility with features. As of this writing, all but one of those features is now stable in all currently supported versions of Python and so the imports are no longer needed. While such imports are harmless, they are also unnecessary and in most cases you probably just forgot to remove them. +Many older codebases have `__future__` imports for forwards compatibility with features. As of this writing, all but one of those features is now stable in all currently supported versions of Python and so the imports are no longer needed. While such imports are harmless, they are also unnecessary and in most cases you probably just forgot to remove them. -This codemod removes all such `__future__` imports, preserving only those that are still necessary for forwards compatibility. +This codemod removes all such `__future__` imports, preserving only those that are still necessary for forwards compatibility. Our changes look like the following: + ```diff import os -from __future__ import print_function @@ -35,4 +36,4 @@ N/A ## References -* [https://docs.python.org/3/library/__future__.html](https://docs.python.org/3/library/__future__.html) +- [https://docs.python.org/3/library/**future**.html](https://docs.python.org/3/library/__future__.html) diff --git a/docs/codemods/python/pixee_python_remove-module-global.md b/docs/codemods/python/pixee_python_remove-module-global.md index e06d45f..1c97752 100644 --- a/docs/codemods/python/pixee_python_remove-module-global.md +++ b/docs/codemods/python/pixee_python_remove-module-global.md @@ -6,7 +6,7 @@ sidebar_position: 1 ## pixee:python/remove-module-global | Importance | Review Guidance | Requires Scanning Tool | -|------------|----------------------|------------------------| +| ---------- | -------------------- | ---------------------- | | Low | Merge Without Review | No | Using the `global` keyword is necessary only when you intend to modify a module-level (aka global) variable within a non-global scope, such as within a class or function. It is unnecessary to call `global` at the module-level. diff --git a/docs/codemods/python/pixee_python_remove-unnecessary-f-str.md b/docs/codemods/python/pixee_python_remove-unnecessary-f-str.md index eb10ffe..fc33b5b 100644 --- a/docs/codemods/python/pixee_python_remove-unnecessary-f-str.md +++ b/docs/codemods/python/pixee_python_remove-unnecessary-f-str.md @@ -6,11 +6,11 @@ sidebar_position: 1 ## pixee:python/remove-unnecessary-f-str | Importance | Review Guidance | Requires Scanning Tool | -|------------|----------------------|------------------------| +| ---------- | -------------------- | ---------------------- | | Low | Merge Without Review | No | This codemod converts any f-strings without interpolated variables into regular strings. -In these cases the use of f-string is not necessary; a simple string literal is sufficient. +In these cases the use of f-string is not necessary; a simple string literal is sufficient. While in some (extreme) cases we might expect a very modest performance improvement, in general this is a fix that improves the overall cleanliness and @@ -36,5 +36,5 @@ N/A ## References -* [https://pylint.readthedocs.io/en/latest/user_guide/messages/warning/f-string-without-interpolation.html](https://pylint.readthedocs.io/en/latest/user_guide/messages/warning/f-string-without-interpolation.html) -* [https://github.com/Instagram/LibCST/blob/main/libcst/codemod/commands/unnecessary_format_string.py](https://github.com/Instagram/LibCST/blob/main/libcst/codemod/commands/unnecessary_format_string.py) +- [https://pylint.readthedocs.io/en/latest/user_guide/messages/warning/f-string-without-interpolation.html](https://pylint.readthedocs.io/en/latest/user_guide/messages/warning/f-string-without-interpolation.html) +- [https://github.com/Instagram/LibCST/blob/main/libcst/codemod/commands/unnecessary_format_string.py](https://github.com/Instagram/LibCST/blob/main/libcst/codemod/commands/unnecessary_format_string.py) diff --git a/docs/codemods/python/pixee_python_replace-flask-send-file.md b/docs/codemods/python/pixee_python_replace-flask-send-file.md index 037420c..5416e49 100644 --- a/docs/codemods/python/pixee_python_replace-flask-send-file.md +++ b/docs/codemods/python/pixee_python_replace-flask-send-file.md @@ -6,7 +6,7 @@ sidebar_position: 1 ## pixee:python/replace-flask-send-file | Importance | Review Guidance | Requires Scanning Tool | -|------------|----------------------|------------------------| +| ---------- | -------------------- | ---------------------- | | Medium | Merge Without Review | No | The `Flask` `send_file` function from Flask is susceptible to a path traversal attack if its input is not properly validated. @@ -43,5 +43,5 @@ N/A ## References -* [https://flask.palletsprojects.com/en/3.0.x/api/#flask.send_from_directory](https://flask.palletsprojects.com/en/3.0.x/api/#flask.send_from_directory) -* [https://owasp.org/www-community/attacks/Path_Traversal](https://owasp.org/www-community/attacks/Path_Traversal) +- [https://flask.palletsprojects.com/en/3.0.x/api/#flask.send_from_directory](https://flask.palletsprojects.com/en/3.0.x/api/#flask.send_from_directory) +- [https://owasp.org/www-community/attacks/Path_Traversal](https://owasp.org/www-community/attacks/Path_Traversal) diff --git a/docs/codemods/python/pixee_python_requests-verify.md b/docs/codemods/python/pixee_python_requests-verify.md index c70bba8..5fc6d70 100644 --- a/docs/codemods/python/pixee_python_requests-verify.md +++ b/docs/codemods/python/pixee_python_requests-verify.md @@ -6,27 +6,27 @@ sidebar_position: 1 ## pixee:python/requests-verify | Importance | Review Guidance | Requires Scanning Tool | -|------------|----------------------------|------------------------| +| ---------- | -------------------------- | ---------------------- | | High | Merge After Cursory Review | No | This codemod checks that calls to the `requests` module API or the `httpx` library use `verify=True` or a path to a CA bundle to ensure TLS certificate validation. The [requests documentation](https://requests.readthedocs.io/en/latest/api/) warns that the `verify` flag + > When set to False, requests will accept any TLS certificate presented by the server, and will ignore hostname mismatches and/or expired certificates, which will make your application vulnerable to man-in-the-middle (MitM) attacks. Setting verify to False may be useful during local development or testing. Similarly, setting `verify=False` when using the `httpx` library to make requests disables certificate verification. The changes from this codemod look like this: - ```diff import requests - + - requests.get("www.google.com", ...,verify=False) + requests.get("www.google.com", ...,verify=True) ... import httpx - + - httpx.get("www.google.com", ...,verify=False) + httpx.get("www.google.com", ...,verify=True) @@ -40,7 +40,7 @@ If you have feedback on this codemod, [please let us know](mailto:feedback@pixee ### Why is this codemod marked as Merge After Cursory Review? -There may be times when setting `verify=False` is useful for testing though we discourage it. +There may be times when setting `verify=False` is useful for testing though we discourage it. You may also decide to set `verify=/path/to/ca/bundle`. This codemod will not attempt to modify the `verify` value if you do set it to a path. ## Codemod Settings @@ -49,6 +49,6 @@ N/A ## References -* [https://requests.readthedocs.io/en/latest/api/](https://requests.readthedocs.io/en/latest/api/) -* [https://www.python-httpx.org/](https://www.python-httpx.org/) -* [https://owasp.org/www-community/attacks/Manipulator-in-the-middle_attack](https://owasp.org/www-community/attacks/Manipulator-in-the-middle_attack) +- [https://requests.readthedocs.io/en/latest/api/](https://requests.readthedocs.io/en/latest/api/) +- [https://www.python-httpx.org/](https://www.python-httpx.org/) +- [https://owasp.org/www-community/attacks/Manipulator-in-the-middle_attack](https://owasp.org/www-community/attacks/Manipulator-in-the-middle_attack) diff --git a/docs/codemods/python/pixee_python_safe-lxml-parser-defaults.md b/docs/codemods/python/pixee_python_safe-lxml-parser-defaults.md index e9b2d1c..9ef1f5b 100644 --- a/docs/codemods/python/pixee_python_safe-lxml-parser-defaults.md +++ b/docs/codemods/python/pixee_python_safe-lxml-parser-defaults.md @@ -6,7 +6,7 @@ sidebar_position: 1 ## pixee:python/safe-lxml-parser-defaults | Importance | Review Guidance | Requires Scanning Tool | -|------------|----------------------|------------------------| +| ---------- | -------------------- | ---------------------- | | High | Merge Without Review | No | This codemod configures safe parameter values when initializing `lxml.etree.XMLParser`, `lxml.etree.ETCompatXMLParser`, `lxml.etree.XMLTreeBuilder`, or `lxml.etree.XMLPullParser`. If parameters `resolve_entities`, `no_network`, and `dtd_validation` are not set to safe values, your code may be vulnerable to entity expansion attacks and external entity (XXE) attacks. @@ -42,6 +42,6 @@ N/A ## References -* [https://lxml.de/apidoc/lxml.etree.html#lxml.etree.XMLParser](https://lxml.de/apidoc/lxml.etree.html#lxml.etree.XMLParser) -* [https://owasp.org/www-community/vulnerabilities/XML_External_Entity_(XXE)_Processing](https://owasp.org/www-community/vulnerabilities/XML_External_Entity_(XXE)_Processing) -* [https://cheatsheetseries.owasp.org/cheatsheets/XML_External_Entity_Prevention_Cheat_Sheet.html](https://cheatsheetseries.owasp.org/cheatsheets/XML_External_Entity_Prevention_Cheat_Sheet.html) +- [https://lxml.de/apidoc/lxml.etree.html#lxml.etree.XMLParser](https://lxml.de/apidoc/lxml.etree.html#lxml.etree.XMLParser) +- [https://owasp.org/www-community/vulnerabilities/XML*External_Entity*(XXE)\_Processing]() +- [https://cheatsheetseries.owasp.org/cheatsheets/XML_External_Entity_Prevention_Cheat_Sheet.html](https://cheatsheetseries.owasp.org/cheatsheets/XML_External_Entity_Prevention_Cheat_Sheet.html) diff --git a/docs/codemods/python/pixee_python_safe-lxml-parsing.md b/docs/codemods/python/pixee_python_safe-lxml-parsing.md index 66c4acd..7b1e153 100644 --- a/docs/codemods/python/pixee_python_safe-lxml-parsing.md +++ b/docs/codemods/python/pixee_python_safe-lxml-parsing.md @@ -6,10 +6,10 @@ sidebar_position: 1 ## pixee:python/safe-lxml-parsing | Importance | Review Guidance | Requires Scanning Tool | -|------------|----------------------|------------------------| +| ---------- | -------------------- | ---------------------- | | High | Merge Without Review | No | -This codemod sets the `parser` parameter in calls to `lxml.etree.parse` and `lxml.etree.fromstring` if omitted or set to `None` (the default value). Unfortunately, the default `parser=None` means `lxml` will rely on an unsafe parser, making your code potentially vulnerable to entity expansion attacks and external entity (XXE) attacks. +This codemod sets the `parser` parameter in calls to `lxml.etree.parse` and `lxml.etree.fromstring` if omitted or set to `None` (the default value). Unfortunately, the default `parser=None` means `lxml` will rely on an unsafe parser, making your code potentially vulnerable to entity expansion attacks and external entity (XXE) attacks. The changes look as follows: @@ -35,6 +35,6 @@ N/A ## References -* [https://lxml.de/apidoc/lxml.etree.html#lxml.etree.XMLParser](https://lxml.de/apidoc/lxml.etree.html#lxml.etree.XMLParser) -* [https://owasp.org/www-community/vulnerabilities/XML_External_Entity_(XXE)_Processing](https://owasp.org/www-community/vulnerabilities/XML_External_Entity_(XXE)_Processing) -* [https://cheatsheetseries.owasp.org/cheatsheets/XML_External_Entity_Prevention_Cheat_Sheet.html](https://cheatsheetseries.owasp.org/cheatsheets/XML_External_Entity_Prevention_Cheat_Sheet.html) +- [https://lxml.de/apidoc/lxml.etree.html#lxml.etree.XMLParser](https://lxml.de/apidoc/lxml.etree.html#lxml.etree.XMLParser) +- [https://owasp.org/www-community/vulnerabilities/XML*External_Entity*(XXE)\_Processing]() +- [https://cheatsheetseries.owasp.org/cheatsheets/XML_External_Entity_Prevention_Cheat_Sheet.html](https://cheatsheetseries.owasp.org/cheatsheets/XML_External_Entity_Prevention_Cheat_Sheet.html) diff --git a/docs/codemods/python/pixee_python_sandbox-process-creation.md b/docs/codemods/python/pixee_python_sandbox-process-creation.md index 2d9ff08..4790d04 100644 --- a/docs/codemods/python/pixee_python_sandbox-process-creation.md +++ b/docs/codemods/python/pixee_python_sandbox-process-creation.md @@ -6,7 +6,7 @@ sidebar_position: 1 ## pixee:python/sandbox-process-creation | Importance | Review Guidance | Requires Scanning Tool | -|------------|----------------------------|------------------------| +| ---------- | -------------------------- | ---------------------- | | High | Merge After Cursory Review | No | This codemod sandboxes all instances of [subprocess.run](https://docs.python.org/3/library/subprocess.html#subprocess.run) and [subprocess.call](https://docs.python.org/3/library/subprocess.html#subprocess.call) to offer protection against attack. @@ -27,8 +27,9 @@ Our change introduces a sandbox which protects the application: ``` The default `safe_command` restrictions applied are the following: -* **Prevent command chaining**. Many exploits work by injecting command separators and causing the shell to interpret a second, malicious command. The `safe_command` functions attempt to parse the given command, and throw a `SecurityException` if multiple commands are present. -* **Prevent arguments targeting sensitive files.** There is little reason for custom code to target sensitive system files like `/etc/passwd`, so the sandbox prevents arguments that point to these files that may be targets for exfiltration. + +- **Prevent command chaining**. Many exploits work by injecting command separators and causing the shell to interpret a second, malicious command. The `safe_command` functions attempt to parse the given command, and throw a `SecurityException` if multiple commands are present. +- **Prevent arguments targeting sensitive files.** There is little reason for custom code to target sensitive system files like `/etc/passwd`, so the sandbox prevents arguments that point to these files that may be targets for exfiltration. There are [more options for sandboxing](https://github.com/pixee/python-security/blob/main/src/security/safe_command/api.py#L5) if you are interested in locking down system commands even more. @@ -46,5 +47,5 @@ N/A ## References -* [https://github.com/pixee/python-security/blob/main/src/security/safe_command/api.py](https://github.com/pixee/python-security/blob/main/src/security/safe_command/api.py) -* [https://cheatsheetseries.owasp.org/cheatsheets/OS_Command_Injection_Defense_Cheat_Sheet.html](https://cheatsheetseries.owasp.org/cheatsheets/OS_Command_Injection_Defense_Cheat_Sheet.html) +- [https://github.com/pixee/python-security/blob/main/src/security/safe_command/api.py](https://github.com/pixee/python-security/blob/main/src/security/safe_command/api.py) +- [https://cheatsheetseries.owasp.org/cheatsheets/OS_Command_Injection_Defense_Cheat_Sheet.html](https://cheatsheetseries.owasp.org/cheatsheets/OS_Command_Injection_Defense_Cheat_Sheet.html) diff --git a/docs/codemods/python/pixee_python_secure-flask-cookie.md b/docs/codemods/python/pixee_python_secure-flask-cookie.md index 2cbbe60..45bb8b6 100644 --- a/docs/codemods/python/pixee_python_secure-flask-cookie.md +++ b/docs/codemods/python/pixee_python_secure-flask-cookie.md @@ -6,7 +6,7 @@ sidebar_position: 1 ## pixee:python/secure-flask-cookie | Importance | Review Guidance | Requires Scanning Tool | -|------------|----------------------------|------------------------| +| ---------- | -------------------------- | ---------------------- | | Medium | Merge After Cursory Review | No | This codemod sets the most secure parameters when Flask applications call `set_cookie` on a response object. Without these parameters, your Flask @@ -39,5 +39,5 @@ N/A ## References -* [https://flask.palletsprojects.com/en/3.0.x/api/#flask.Response.set_cookie](https://flask.palletsprojects.com/en/3.0.x/api/#flask.Response.set_cookie) -* [https://owasp.org/www-community/controls/SecureCookieAttribute](https://owasp.org/www-community/controls/SecureCookieAttribute) +- [https://flask.palletsprojects.com/en/3.0.x/api/#flask.Response.set_cookie](https://flask.palletsprojects.com/en/3.0.x/api/#flask.Response.set_cookie) +- [https://owasp.org/www-community/controls/SecureCookieAttribute](https://owasp.org/www-community/controls/SecureCookieAttribute) diff --git a/docs/codemods/python/pixee_python_secure-flask-session-configuration.md b/docs/codemods/python/pixee_python_secure-flask-session-configuration.md index a8c5f79..3ece48b 100644 --- a/docs/codemods/python/pixee_python_secure-flask-session-configuration.md +++ b/docs/codemods/python/pixee_python_secure-flask-session-configuration.md @@ -5,11 +5,11 @@ sidebar_position: 1 ## pixee:python/secure-flask-session-configuration -| Importance | Review Guidance | Requires Scanning Tool | -|------------|---------------------|------------------------| -| Medium | Merge After Review | No | +| Importance | Review Guidance | Requires Scanning Tool | +| ---------- | ------------------ | ---------------------- | +| Medium | Merge After Review | No | -Flask applications can configure sessions behavior at the application level. +Flask applications can configure sessions behavior at the application level. This codemod looks for Flask application configuration that set `SESSION_COOKIE_HTTPONLY`, `SESSION_COOKIE_SECURE`, or `SESSION_COOKIE_SAMESITE` to an insecure value and changes it to a secure one. The changes from this codemod look like this: @@ -37,5 +37,5 @@ N/A ## References -* [https://owasp.org/www-community/controls/SecureCookieAttribute](https://owasp.org/www-community/controls/SecureCookieAttribute) -* [https://cheatsheetseries.owasp.org/cheatsheets/Session_Management_Cheat_Sheet.html](https://cheatsheetseries.owasp.org/cheatsheets/Session_Management_Cheat_Sheet.html) +- [https://owasp.org/www-community/controls/SecureCookieAttribute](https://owasp.org/www-community/controls/SecureCookieAttribute) +- [https://cheatsheetseries.owasp.org/cheatsheets/Session_Management_Cheat_Sheet.html](https://cheatsheetseries.owasp.org/cheatsheets/Session_Management_Cheat_Sheet.html) diff --git a/docs/codemods/python/pixee_python_secure-random.md b/docs/codemods/python/pixee_python_secure-random.md index 48cf2c1..6e2ebd2 100644 --- a/docs/codemods/python/pixee_python_secure-random.md +++ b/docs/codemods/python/pixee_python_secure-random.md @@ -6,7 +6,7 @@ sidebar_position: 1 ## pixee:python/secure-random | Importance | Review Guidance | Requires Scanning Tool | -|------------|----------------------------|------------------------| +| ---------- | -------------------------- | ---------------------- | | High | Merge After Cursory Review | No | This codemod replaces all instances of functions in the `random` module (e.g. `random.random()` with their, much more secure, equivalents from the `secrets` module (e.g. `secrets.SystemRandom().random()`). @@ -39,5 +39,5 @@ N/A ## References -* [https://owasp.org/www-community/vulnerabilities/Insecure_Randomness](https://owasp.org/www-community/vulnerabilities/Insecure_Randomness) -* [https://docs.python.org/3/library/random.html](https://docs.python.org/3/library/random.html) +- [https://owasp.org/www-community/vulnerabilities/Insecure_Randomness](https://owasp.org/www-community/vulnerabilities/Insecure_Randomness) +- [https://docs.python.org/3/library/random.html](https://docs.python.org/3/library/random.html) diff --git a/docs/codemods/python/pixee_python_secure-tempfile.md b/docs/codemods/python/pixee_python_secure-tempfile.md index 92933c4..b1a4332 100644 --- a/docs/codemods/python/pixee_python_secure-tempfile.md +++ b/docs/codemods/python/pixee_python_secure-tempfile.md @@ -6,7 +6,7 @@ sidebar_position: 1 ## pixee:python/secure-tempfile | Importance | Review Guidance | Requires Scanning Tool | -|------------|----------------------|------------------------| +| ---------- | -------------------- | ---------------------- | | High | Merge Without Review | No | This codemod replaces all `tempfile.mktemp` calls to the more secure `tempfile.mkstemp`. @@ -15,7 +15,6 @@ The Python [tempfile documentation](https://docs.python.org/3/library/tempfile.h that `tempfile.mktemp` should be deprecated to avoid an unsafe and unexpected race condition. The changes from this codemod look like this: - ```diff import tempfile - tempfile.mktemp(...) @@ -36,4 +35,4 @@ N/A ## References -* [https://docs.python.org/3/library/tempfile.html#tempfile.mktemp](https://docs.python.org/3/library/tempfile.html#tempfile.mktemp) +- [https://docs.python.org/3/library/tempfile.html#tempfile.mktemp](https://docs.python.org/3/library/tempfile.html#tempfile.mktemp) diff --git a/docs/codemods/python/pixee_python_sql-parameterization.md b/docs/codemods/python/pixee_python_sql-parameterization.md index 07084a8..ffef78a 100644 --- a/docs/codemods/python/pixee_python_sql-parameterization.md +++ b/docs/codemods/python/pixee_python_sql-parameterization.md @@ -6,7 +6,7 @@ sidebar_position: 1 ## pixee:python/sql-parameterization | Importance | Review Guidance | Requires Scanning Tool | -|------------|----------------------------|------------------------| +| ---------- | -------------------------- | ---------------------- | | High | Merge After Cursory Review | No | This codemod refactors SQL statements to be parameterized, rather than built by hand. @@ -39,5 +39,5 @@ N/A ## References -* [https://cwe.mitre.org/data/definitions/89.html](https://cwe.mitre.org/data/definitions/89.html) -* [https://owasp.org/www-community/attacks/SQL_Injection](https://owasp.org/www-community/attacks/SQL_Injection) +- [https://cwe.mitre.org/data/definitions/89.html](https://cwe.mitre.org/data/definitions/89.html) +- [https://owasp.org/www-community/attacks/SQL_Injection](https://owasp.org/www-community/attacks/SQL_Injection) diff --git a/docs/codemods/python/pixee_python_str-concat-in-sequence-literals.md b/docs/codemods/python/pixee_python_str-concat-in-sequence-literals.md index d9e3843..63b8e31 100644 --- a/docs/codemods/python/pixee_python_str-concat-in-sequence-literals.md +++ b/docs/codemods/python/pixee_python_str-concat-in-sequence-literals.md @@ -6,12 +6,13 @@ sidebar_position: 1 ## pixee:python/str-concat-in-sequence-literals | Importance | Review Guidance | Requires Scanning Tool | -|------------|----------------------------|------------------------| +| ---------- | -------------------------- | ---------------------- | | Medium | Merge After Cursory Review | No | -This codemod fixes cases of implicit string concatenation inside lists, sets, or tuples. This is most likely a mistake: you probably meant include a comma in between the concatenated strings. +This codemod fixes cases of implicit string concatenation inside lists, sets, or tuples. This is most likely a mistake: you probably meant include a comma in between the concatenated strings. Our changes look something like this: + ```diff bad = [ - "ab" diff --git a/docs/codemods/python/pixee_python_subprocess-shell-false.md b/docs/codemods/python/pixee_python_subprocess-shell-false.md index 44e14b5..63deb11 100644 --- a/docs/codemods/python/pixee_python_subprocess-shell-false.md +++ b/docs/codemods/python/pixee_python_subprocess-shell-false.md @@ -6,7 +6,7 @@ sidebar_position: 1 ## pixee:python/subprocess-shell-false | Importance | Review Guidance | Requires Scanning Tool | -|------------|----------------------------|------------------------| +| ---------- | -------------------------- | ---------------------- | | High | Merge After Cursory Review | No | This codemod sets the `shell` keyword argument to `False` in `subprocess` module function calls that have set it to `True`. @@ -35,6 +35,6 @@ N/A ## References -* [https://docs.python.org/3/library/subprocess.html#security-considerations](https://docs.python.org/3/library/subprocess.html#security-considerations) -* [https://en.wikipedia.org/wiki/Code_injection#Shell_injection](https://en.wikipedia.org/wiki/Code_injection#Shell_injection) -* [https://stackoverflow.com/a/3172488](https://stackoverflow.com/a/3172488) +- [https://docs.python.org/3/library/subprocess.html#security-considerations](https://docs.python.org/3/library/subprocess.html#security-considerations) +- [https://en.wikipedia.org/wiki/Code_injection#Shell_injection](https://en.wikipedia.org/wiki/Code_injection#Shell_injection) +- [https://stackoverflow.com/a/3172488](https://stackoverflow.com/a/3172488) diff --git a/docs/codemods/python/pixee_python_upgrade-sslcontext-minimum-version.md b/docs/codemods/python/pixee_python_upgrade-sslcontext-minimum-version.md index f9e0e96..d3fa8f5 100644 --- a/docs/codemods/python/pixee_python_upgrade-sslcontext-minimum-version.md +++ b/docs/codemods/python/pixee_python_upgrade-sslcontext-minimum-version.md @@ -6,7 +6,7 @@ sidebar_position: 1 ## pixee:python/upgrade-sslcontext-minimum-version | Importance | Review Guidance | Requires Scanning Tool | -|------------|----------------------|------------------------| +| ---------- | -------------------- | ---------------------- | | High | Merge Without Review | No | This codemod replaces all unsafe and/or deprecated SSL/TLS versions when used @@ -40,6 +40,6 @@ N/A ## References -* [https://docs.python.org/3/library/ssl.html#security-considerations](https://docs.python.org/3/library/ssl.html#security-considerations) -* [https://datatracker.ietf.org/doc/rfc8996/](https://datatracker.ietf.org/doc/rfc8996/) -* [https://www.digicert.com/blog/depreciating-tls-1-0-and-1-1](https://www.digicert.com/blog/depreciating-tls-1-0-and-1-1) +- [https://docs.python.org/3/library/ssl.html#security-considerations](https://docs.python.org/3/library/ssl.html#security-considerations) +- [https://datatracker.ietf.org/doc/rfc8996/](https://datatracker.ietf.org/doc/rfc8996/) +- [https://www.digicert.com/blog/depreciating-tls-1-0-and-1-1](https://www.digicert.com/blog/depreciating-tls-1-0-and-1-1) diff --git a/docs/codemods/python/pixee_python_upgrade-sslcontext-tls.md b/docs/codemods/python/pixee_python_upgrade-sslcontext-tls.md index 8ba8327..6d99776 100644 --- a/docs/codemods/python/pixee_python_upgrade-sslcontext-tls.md +++ b/docs/codemods/python/pixee_python_upgrade-sslcontext-tls.md @@ -6,7 +6,7 @@ sidebar_position: 1 ## pixee:python/upgrade-sslcontext-tls | Importance | Review Guidance | Requires Scanning Tool | -|------------|----------------------------|------------------------| +| ---------- | -------------------------- | ---------------------- | | High | Merge After Cursory Review | No | This codemod replaces the use of all unsafe and/or deprecated SSL/TLS versions @@ -19,7 +19,7 @@ use `PROTOCOL_TLS_CLIENT`. ```diff import ssl -- context = ssl.SSLContext() +- context = ssl.SSLContext() + context = ssl.SSLContext(protocol=PROTOCOL_TLS_CLIENT) - context = ssl.SSLContext(protocol=PROTOCOL_SSLv3) + context = ssl.SSLContext(protocol=PROTOCOL_TLS_CLIENT) @@ -47,6 +47,6 @@ N/A ## References -* [https://docs.python.org/3/library/ssl.html#security-considerations](https://docs.python.org/3/library/ssl.html#security-considerations) -* [https://datatracker.ietf.org/doc/rfc8996/](https://datatracker.ietf.org/doc/rfc8996/) -* [https://www.digicert.com/blog/depreciating-tls-1-0-and-1-1](https://www.digicert.com/blog/depreciating-tls-1-0-and-1-1) +- [https://docs.python.org/3/library/ssl.html#security-considerations](https://docs.python.org/3/library/ssl.html#security-considerations) +- [https://datatracker.ietf.org/doc/rfc8996/](https://datatracker.ietf.org/doc/rfc8996/) +- [https://www.digicert.com/blog/depreciating-tls-1-0-and-1-1](https://www.digicert.com/blog/depreciating-tls-1-0-and-1-1) diff --git a/docs/codemods/python/pixee_python_url-sandbox.md b/docs/codemods/python/pixee_python_url-sandbox.md index f80c221..50f787c 100644 --- a/docs/codemods/python/pixee_python_url-sandbox.md +++ b/docs/codemods/python/pixee_python_url-sandbox.md @@ -6,7 +6,7 @@ sidebar_position: 1 ## pixee:python/url-sandbox | Importance | Review Guidance | Requires Scanning Tool | -|------------|----------------------------|------------------------| +| ---------- | -------------------------- | ---------------------- | | High | Merge After Cursory Review | No | This codemod sandboxes calls to [`requests.get`](https://requests.readthedocs.io/en/latest/api/#requests.get) to be more resistant to Server-Side Request Forgery (SSRF) attacks. @@ -49,10 +49,9 @@ Our changes introduce sandboxing around URL creation that force developers to sp This change alone reduces attack surface significantly because the default behavior of `safe_requests.get` raises a `SecurityException` if a user attempts to access a known infrastructure location, unless specifically disabled. - If you have feedback on this codemod, [please let us know](mailto:feedback@pixee.ai)! -## F.A.Q. +## F.A.Q. ### Why does this codemod require a Pixee dependency? @@ -61,6 +60,7 @@ We always prefer to use built-in Python functions or one from a well-known and t ### Why is this codemod marked as Merge After Cursory Review? By default, the protection only weaves in 2 checks, which we believe will not cause any issues with the vast majority of code: + 1. The given URL must be HTTP/HTTPS. 2. The given URL must not point to a "well-known infrastructure target", which includes things like AWS Metadata Service endpoints, and internal routers (e.g., 192.168.1.1) which are common targets of attacks. @@ -80,6 +80,7 @@ If you have feedback on this codemod, [please let us know](mailto:feedback@pixee ### Why is this codemod marked as Merge After Cursory Review? By default, the protection only weaves in 2 checks, which we believe will not cause any issues with the vast majority of code: + 1. The given URL must be HTTP/HTTPS. 2. The given URL must not point to a "well-known infrastructure target", which includes things like AWS Metadata Service endpoints, and internal routers (e.g., 192.168.1.1) which are common targets of attacks. @@ -98,8 +99,8 @@ N/A ## References -* [https://github.com/pixee/python-security/blob/main/src/security/safe_requests/api.py](https://github.com/pixee/python-security/blob/main/src/security/safe_requests/api.py) -* [https://portswigger.net/web-security/ssrf](https://portswigger.net/web-security/ssrf) -* [https://cheatsheetseries.owasp.org/cheatsheets/Server_Side_Request_Forgery_Prevention_Cheat_Sheet.html](https://cheatsheetseries.owasp.org/cheatsheets/Server_Side_Request_Forgery_Prevention_Cheat_Sheet.html) -* [https://www.rapid7.com/blog/post/2021/11/23/owasp-top-10-deep-dive-defending-against-server-side-request-forgery/](https://www.rapid7.com/blog/post/2021/11/23/owasp-top-10-deep-dive-defending-against-server-side-request-forgery/) -* [https://blog.assetnote.io/2021/01/13/blind-ssrf-chains/](https://blog.assetnote.io/2021/01/13/blind-ssrf-chains/) +- [https://github.com/pixee/python-security/blob/main/src/security/safe_requests/api.py](https://github.com/pixee/python-security/blob/main/src/security/safe_requests/api.py) +- [https://portswigger.net/web-security/ssrf](https://portswigger.net/web-security/ssrf) +- [https://cheatsheetseries.owasp.org/cheatsheets/Server_Side_Request_Forgery_Prevention_Cheat_Sheet.html](https://cheatsheetseries.owasp.org/cheatsheets/Server_Side_Request_Forgery_Prevention_Cheat_Sheet.html) +- [https://www.rapid7.com/blog/post/2021/11/23/owasp-top-10-deep-dive-defending-against-server-side-request-forgery/](https://www.rapid7.com/blog/post/2021/11/23/owasp-top-10-deep-dive-defending-against-server-side-request-forgery/) +- [https://blog.assetnote.io/2021/01/13/blind-ssrf-chains/](https://blog.assetnote.io/2021/01/13/blind-ssrf-chains/) diff --git a/docs/codemods/python/pixee_python_use-defusedxml.md b/docs/codemods/python/pixee_python_use-defusedxml.md index 0af2b09..8eda00e 100644 --- a/docs/codemods/python/pixee_python_use-defusedxml.md +++ b/docs/codemods/python/pixee_python_use-defusedxml.md @@ -5,9 +5,9 @@ sidebar_position: 1 ## pixee:python/use-defusedxml -| Importance | Review Guidance | Requires Scanning Tool | -|------------|---------------------|------------------------| -| High | Merge After Review | No | +| Importance | Review Guidance | Requires Scanning Tool | +| ---------- | ------------------ | ---------------------- | +| High | Merge After Review | No | You might be surprised to learn that Python's built-in XML libraries are [considered insecure](https://docs.python.org/3/library/xml.html#xml-vulnerabilities) against various kinds of attacks. @@ -16,6 +16,7 @@ In fact, the [Python documentation itself](https://docs.python.org/3/library/xml This codemod updates all relevant uses of the standard library parsers with safe versions from `defusedxml`. It also adds the `defusedxml` dependency to your project where possible. The changes from this codemod look like this: + ```diff - from xml.etree.ElementTree import parse + import defusedxml.ElementTree @@ -38,7 +39,7 @@ N/A ## References -* [https://docs.python.org/3/library/xml.html#xml-vulnerabilities](https://docs.python.org/3/library/xml.html#xml-vulnerabilities) -* [https://docs.python.org/3/library/xml.html#the-defusedxml-package](https://docs.python.org/3/library/xml.html#the-defusedxml-package) -* [https://pypi.org/project/defusedxml/](https://pypi.org/project/defusedxml/) -* [https://cheatsheetseries.owasp.org/cheatsheets/XML_External_Entity_Prevention_Cheat_Sheet.html](https://cheatsheetseries.owasp.org/cheatsheets/XML_External_Entity_Prevention_Cheat_Sheet.html) +- [https://docs.python.org/3/library/xml.html#xml-vulnerabilities](https://docs.python.org/3/library/xml.html#xml-vulnerabilities) +- [https://docs.python.org/3/library/xml.html#the-defusedxml-package](https://docs.python.org/3/library/xml.html#the-defusedxml-package) +- [https://pypi.org/project/defusedxml/](https://pypi.org/project/defusedxml/) +- [https://cheatsheetseries.owasp.org/cheatsheets/XML_External_Entity_Prevention_Cheat_Sheet.html](https://cheatsheetseries.owasp.org/cheatsheets/XML_External_Entity_Prevention_Cheat_Sheet.html) diff --git a/docs/codemods/python/pixee_python_use-generator.md b/docs/codemods/python/pixee_python_use-generator.md index 28fb90a..219188e 100644 --- a/docs/codemods/python/pixee_python_use-generator.md +++ b/docs/codemods/python/pixee_python_use-generator.md @@ -6,7 +6,7 @@ sidebar_position: 1 ## pixee:python/use-generator | Importance | Review Guidance | Requires Scanning Tool | -|------------|----------------------|------------------------| +| ---------- | -------------------- | ---------------------- | | Low | Merge Without Review | No | Imagine that someone handed you a pile of 100 apples and then asked you to count how many of them were green without putting any of them down. You'd probably find this quite challenging and you'd struggle to hold the pile of apples at all. Now imagine someone handed you the apples one at a time and asked you to just count the green ones. This would be a much easier task. @@ -18,6 +18,7 @@ Using generator expressions instead of list comprehensions can lead to better pe This codemod replaces the use of a list comprehension expression with a generator expression within certain function calls. Generators allow for lazy evaluation of the iterator, which can have performance benefits. The changes from this codemod look like this: + ```diff - result = sum([x for x in range(1000)]) + result = sum(x for x in range(1000)) @@ -37,6 +38,6 @@ N/A ## References -* [https://pylint.readthedocs.io/en/latest/user_guide/messages/refactor/use-a-generator.html](https://pylint.readthedocs.io/en/latest/user_guide/messages/refactor/use-a-generator.html) -* [https://docs.python.org/3/glossary.html#term-generator-expression](https://docs.python.org/3/glossary.html#term-generator-expression) -* [https://docs.python.org/3/glossary.html#term-list-comprehension](https://docs.python.org/3/glossary.html#term-list-comprehension) +- [https://pylint.readthedocs.io/en/latest/user_guide/messages/refactor/use-a-generator.html](https://pylint.readthedocs.io/en/latest/user_guide/messages/refactor/use-a-generator.html) +- [https://docs.python.org/3/glossary.html#term-generator-expression](https://docs.python.org/3/glossary.html#term-generator-expression) +- [https://docs.python.org/3/glossary.html#term-list-comprehension](https://docs.python.org/3/glossary.html#term-list-comprehension) diff --git a/docs/codemods/python/pixee_python_use-set-literal.md b/docs/codemods/python/pixee_python_use-set-literal.md index 9abfc45..d9a3e26 100644 --- a/docs/codemods/python/pixee_python_use-set-literal.md +++ b/docs/codemods/python/pixee_python_use-set-literal.md @@ -6,12 +6,13 @@ sidebar_position: 1 ## pixee:python/use-set-literal | Importance | Review Guidance | Requires Scanning Tool | -|------------|----------------------|------------------------| +| ---------- | -------------------- | ---------------------- | | Low | Merge Without Review | No | This codemod converts Python set constructions using literal list arguments into more efficient and readable set literals. It simplifies expressions like `set([1, 2, 3])` to `{1, 2, 3}`, enhancing both performance and code clarity. Our changes look like this: + ```diff -x = set([1, 2, 3]) +x = {1, 2, 3} diff --git a/docs/codemods/python/pixee_python_use-walrus-if.md b/docs/codemods/python/pixee_python_use-walrus-if.md index 34b924e..d740779 100644 --- a/docs/codemods/python/pixee_python_use-walrus-if.md +++ b/docs/codemods/python/pixee_python_use-walrus-if.md @@ -6,7 +6,7 @@ sidebar_position: 1 ## pixee:python/use-walrus-if | Importance | Review Guidance | Requires Scanning Tool | -|------------|----------------------------|------------------------| +| ---------- | -------------------------- | ---------------------- | | Low | Merge After Cursory Review | No | This codemod updates places where two separate statements involving an assignment and conditional can be replaced with a single Assignment Expression (commonly known as the walrus operator). @@ -36,4 +36,4 @@ N/A ## References -* [https://docs.python.org/3/whatsnew/3.8.html#assignment-expressions](https://docs.python.org/3/whatsnew/3.8.html#assignment-expressions) +- [https://docs.python.org/3/whatsnew/3.8.html#assignment-expressions](https://docs.python.org/3/whatsnew/3.8.html#assignment-expressions) diff --git a/docs/codemods/python/sonar_python_django-json-response-type-S5131.md b/docs/codemods/python/sonar_python_django-json-response-type-S5131.md index ffe6326..b8d972b 100644 --- a/docs/codemods/python/sonar_python_django-json-response-type-S5131.md +++ b/docs/codemods/python/sonar_python_django-json-response-type-S5131.md @@ -6,13 +6,13 @@ sidebar_position: 1 ## sonar:python/django-json-response-type-S5131 | Importance | Review Guidance | Requires Scanning Tool | -|------------|----------------------|------------------------| +| ---------- | -------------------- | ---------------------- | | Medium | Merge Without Review | Yes (Sonar) | This codemod acts upon the following Sonar rules: 'pythonsecurity:S5131'. The default `content_type` for `HttpResponse` in Django is `'text/html'`. This is true even when the response contains JSON data. -If the JSON contains (unsanitized) user-supplied input, a malicious user may supply HTML code which leaves the application vulnerable to cross-site scripting (XSS). +If the JSON contains (unsanitized) user-supplied input, a malicious user may supply HTML code which leaves the application vulnerable to cross-site scripting (XSS). This fix explicitly sets the response type to `application/json` when the response body is JSON data to avoid this vulnerability. Our changes look something like this: ```diff @@ -39,6 +39,6 @@ N/A ## References -* [https://docs.djangoproject.com/en/4.0/ref/request-response/#django.http.HttpResponse.__init__](https://docs.djangoproject.com/en/4.0/ref/request-response/#django.http.HttpResponse.__init__) -* [https://cheatsheetseries.owasp.org/cheatsheets/Cross_Site_Scripting_Prevention_Cheat_Sheet.html#output-encoding-for-javascript-contexts](https://cheatsheetseries.owasp.org/cheatsheets/Cross_Site_Scripting_Prevention_Cheat_Sheet.html#output-encoding-for-javascript-contexts) -* [https://rules.sonarsource.com/python/type/Bug/RSPEC-5131/](https://rules.sonarsource.com/python/type/Bug/RSPEC-5131/) +- [https://docs.djangoproject.com/en/4.0/ref/request-response/#django.http.HttpResponse.**init**](https://docs.djangoproject.com/en/4.0/ref/request-response/#django.http.HttpResponse.__init__) +- [https://cheatsheetseries.owasp.org/cheatsheets/Cross_Site_Scripting_Prevention_Cheat_Sheet.html#output-encoding-for-javascript-contexts](https://cheatsheetseries.owasp.org/cheatsheets/Cross_Site_Scripting_Prevention_Cheat_Sheet.html#output-encoding-for-javascript-contexts) +- [https://rules.sonarsource.com/python/type/Bug/RSPEC-5131/](https://rules.sonarsource.com/python/type/Bug/RSPEC-5131/) diff --git a/docs/codemods/python/sonar_python_django-receiver-on-top-S6552.md b/docs/codemods/python/sonar_python_django-receiver-on-top-S6552.md index 9d5fb62..e75c90e 100644 --- a/docs/codemods/python/sonar_python_django-receiver-on-top-S6552.md +++ b/docs/codemods/python/sonar_python_django-receiver-on-top-S6552.md @@ -6,12 +6,12 @@ sidebar_position: 1 ## sonar:python/django-receiver-on-top-S6552 | Importance | Review Guidance | Requires Scanning Tool | -|------------|----------------------|------------------------| +| ---------- | -------------------- | ---------------------- | | Medium | Merge Without Review | Yes (Sonar) | This codemod acts upon the following Sonar rules: 'python:S6552'. -Django uses signals to notify and handle actions that happens elsewhere in the application. You can define a response to a given signal by decorating a function with the `@receiver(signal)` decorator. The order in which the decorators are declared for this function is important. If the `@receiver` decorator is not on top, any decorators before it will be ignored. +Django uses signals to notify and handle actions that happens elsewhere in the application. You can define a response to a given signal by decorating a function with the `@receiver(signal)` decorator. The order in which the decorators are declared for this function is important. If the `@receiver` decorator is not on top, any decorators before it will be ignored. Our changes look something like this: ```diff @@ -40,5 +40,5 @@ N/A ## References -* [https://docs.djangoproject.com/en/4.1/topics/signals/](https://docs.djangoproject.com/en/4.1/topics/signals/) -* [https://rules.sonarsource.com/python/type/Bug/RSPEC-6552/](https://rules.sonarsource.com/python/type/Bug/RSPEC-6552/) +- [https://docs.djangoproject.com/en/4.1/topics/signals/](https://docs.djangoproject.com/en/4.1/topics/signals/) +- [https://rules.sonarsource.com/python/type/Bug/RSPEC-6552/](https://rules.sonarsource.com/python/type/Bug/RSPEC-6552/) diff --git a/docs/codemods/python/sonar_python_exception-without-raise-S3984.md b/docs/codemods/python/sonar_python_exception-without-raise-S3984.md index 531c558..a2f7c8f 100644 --- a/docs/codemods/python/sonar_python_exception-without-raise-S3984.md +++ b/docs/codemods/python/sonar_python_exception-without-raise-S3984.md @@ -6,14 +6,15 @@ sidebar_position: 1 ## sonar:python/exception-without-raise-S3984 | Importance | Review Guidance | Requires Scanning Tool | -|------------|----------------------|------------------------| +| ---------- | -------------------- | ---------------------- | | Low | Merge Without Review | Yes (Sonar) | This codemod acts upon the following Sonar rules: 'python:S3984'. -This codemod fixes cases where an exception is referenced by itself in a statement without being raised. This most likely indicates a bug: you probably meant to actually raise the exception. +This codemod fixes cases where an exception is referenced by itself in a statement without being raised. This most likely indicates a bug: you probably meant to actually raise the exception. Our changes look something like this: + ```diff try: - ValueError @@ -36,5 +37,5 @@ N/A ## References -* [https://docs.python.org/3/tutorial/errors.html#raising-exceptions](https://docs.python.org/3/tutorial/errors.html#raising-exceptions) -* [https://rules.sonarsource.com/python/type/Bug/RSPEC-3984/](https://rules.sonarsource.com/python/type/Bug/RSPEC-3984/) +- [https://docs.python.org/3/tutorial/errors.html#raising-exceptions](https://docs.python.org/3/tutorial/errors.html#raising-exceptions) +- [https://rules.sonarsource.com/python/type/Bug/RSPEC-3984/](https://rules.sonarsource.com/python/type/Bug/RSPEC-3984/) diff --git a/docs/codemods/python/sonar_python_fix-assert-tuple-S5905.md b/docs/codemods/python/sonar_python_fix-assert-tuple-S5905.md index 35d6574..470c5b5 100644 --- a/docs/codemods/python/sonar_python_fix-assert-tuple-S5905.md +++ b/docs/codemods/python/sonar_python_fix-assert-tuple-S5905.md @@ -6,7 +6,7 @@ sidebar_position: 1 ## sonar:python/fix-assert-tuple-S5905 | Importance | Review Guidance | Requires Scanning Tool | -|------------|----------------------------|------------------------| +| ---------- | -------------------------- | ---------------------- | | Medium | Merge After Cursory Review | Yes (Sonar) | This codemod acts upon the following Sonar rules: 'python:S5905'. @@ -35,4 +35,4 @@ N/A ## References -* [https://rules.sonarsource.com/python/type/Bug/RSPEC-5905/](https://rules.sonarsource.com/python/type/Bug/RSPEC-5905/) +- [https://rules.sonarsource.com/python/type/Bug/RSPEC-5905/](https://rules.sonarsource.com/python/type/Bug/RSPEC-5905/) diff --git a/docs/codemods/python/sonar_python_flask-json-response-type-S5131.md b/docs/codemods/python/sonar_python_flask-json-response-type-S5131.md index 0f23d7c..eb8a13b 100644 --- a/docs/codemods/python/sonar_python_flask-json-response-type-S5131.md +++ b/docs/codemods/python/sonar_python_flask-json-response-type-S5131.md @@ -6,13 +6,13 @@ sidebar_position: 1 ## sonar:python/flask-json-response-type-S5131 | Importance | Review Guidance | Requires Scanning Tool | -|------------|----------------------|------------------------| +| ---------- | -------------------- | ---------------------- | | Medium | Merge Without Review | Yes (Sonar) | This codemod acts upon the following Sonar rules: 'pythonsecurity:S5131'. The default `mimetype` for `make_response` in Flask is `'text/html'`. This is true even when the response contains JSON data. -If the JSON contains (unsanitized) user-supplied input, a malicious user may supply HTML code which leaves the application vulnerable to cross-site scripting (XSS). +If the JSON contains (unsanitized) user-supplied input, a malicious user may supply HTML code which leaves the application vulnerable to cross-site scripting (XSS). This fix explicitly sets the response type to `application/json` when the response body is JSON data to avoid this vulnerability. Our changes look something like this: ```diff @@ -42,6 +42,6 @@ N/A ## References -* [https://flask.palletsprojects.com/en/2.3.x/patterns/javascript/#return-json-from-views](https://flask.palletsprojects.com/en/2.3.x/patterns/javascript/#return-json-from-views) -* [https://cheatsheetseries.owasp.org/cheatsheets/Cross_Site_Scripting_Prevention_Cheat_Sheet.html#output-encoding-for-javascript-contexts](https://cheatsheetseries.owasp.org/cheatsheets/Cross_Site_Scripting_Prevention_Cheat_Sheet.html#output-encoding-for-javascript-contexts) -* [https://rules.sonarsource.com/python/type/Bug/RSPEC-5131/](https://rules.sonarsource.com/python/type/Bug/RSPEC-5131/) +- [https://flask.palletsprojects.com/en/2.3.x/patterns/javascript/#return-json-from-views](https://flask.palletsprojects.com/en/2.3.x/patterns/javascript/#return-json-from-views) +- [https://cheatsheetseries.owasp.org/cheatsheets/Cross_Site_Scripting_Prevention_Cheat_Sheet.html#output-encoding-for-javascript-contexts](https://cheatsheetseries.owasp.org/cheatsheets/Cross_Site_Scripting_Prevention_Cheat_Sheet.html#output-encoding-for-javascript-contexts) +- [https://rules.sonarsource.com/python/type/Bug/RSPEC-5131/](https://rules.sonarsource.com/python/type/Bug/RSPEC-5131/) diff --git a/docs/codemods/python/sonar_python_literal-or-new-object-identity-S5796.md b/docs/codemods/python/sonar_python_literal-or-new-object-identity-S5796.md index 6e0c9fe..e4d85d0 100644 --- a/docs/codemods/python/sonar_python_literal-or-new-object-identity-S5796.md +++ b/docs/codemods/python/sonar_python_literal-or-new-object-identity-S5796.md @@ -6,7 +6,7 @@ sidebar_position: 1 ## sonar:python/literal-or-new-object-identity-S5796 | Importance | Review Guidance | Requires Scanning Tool | -|------------|----------------------|------------------------| +| ---------- | -------------------- | ---------------------- | | Low | Merge Without Review | Yes (Sonar) | This codemod acts upon the following Sonar rules: 'python:S5796'. @@ -35,5 +35,5 @@ N/A ## References -* [https://docs.python.org/3/library/stdtypes.html#comparisons](https://docs.python.org/3/library/stdtypes.html#comparisons) -* [https://rules.sonarsource.com/python/type/Bug/RSPEC-5796/](https://rules.sonarsource.com/python/type/Bug/RSPEC-5796/) +- [https://docs.python.org/3/library/stdtypes.html#comparisons](https://docs.python.org/3/library/stdtypes.html#comparisons) +- [https://rules.sonarsource.com/python/type/Bug/RSPEC-5796/](https://rules.sonarsource.com/python/type/Bug/RSPEC-5796/) diff --git a/docs/codemods/python/sonar_python_numpy-nan-equality-S6725.md b/docs/codemods/python/sonar_python_numpy-nan-equality-S6725.md index 55ca59e..c2fc591 100644 --- a/docs/codemods/python/sonar_python_numpy-nan-equality-S6725.md +++ b/docs/codemods/python/sonar_python_numpy-nan-equality-S6725.md @@ -6,7 +6,7 @@ sidebar_position: 1 ## sonar:python/numpy-nan-equality-S6725 | Importance | Review Guidance | Requires Scanning Tool | -|------------|----------------------|------------------------| +| ---------- | -------------------- | ---------------------- | | Medium | Merge Without Review | Yes (Sonar) | This codemod acts upon the following Sonar rules: 'python:S6725'. @@ -38,5 +38,5 @@ N/A ## References -* [https://numpy.org/doc/stable/reference/constants.html#numpy.nan](https://numpy.org/doc/stable/reference/constants.html#numpy.nan) -* [https://rules.sonarsource.com/python/type/Bug/RSPEC-6725/](https://rules.sonarsource.com/python/type/Bug/RSPEC-6725/) +- [https://numpy.org/doc/stable/reference/constants.html#numpy.nan](https://numpy.org/doc/stable/reference/constants.html#numpy.nan) +- [https://rules.sonarsource.com/python/type/Bug/RSPEC-6725/](https://rules.sonarsource.com/python/type/Bug/RSPEC-6725/) diff --git a/docs/codemods/python/sonar_python_remove-assertion-in-pytest-raises-S5915.md b/docs/codemods/python/sonar_python_remove-assertion-in-pytest-raises-S5915.md index 804e2b0..94c2e52 100644 --- a/docs/codemods/python/sonar_python_remove-assertion-in-pytest-raises-S5915.md +++ b/docs/codemods/python/sonar_python_remove-assertion-in-pytest-raises-S5915.md @@ -6,12 +6,12 @@ sidebar_position: 1 ## sonar:python/remove-assertion-in-pytest-raises-S5915 | Importance | Review Guidance | Requires Scanning Tool | -|------------|----------------------|------------------------| +| ---------- | -------------------- | ---------------------- | | Low | Merge Without Review | Yes (Sonar) | This codemod acts upon the following Sonar rules: 'python:S5915'. -The context manager object `pytest.raises()` will assert if the code contained within its scope will raise an exception of type ``. The documentation points that the exception must be raised in the last line of its scope and any line afterwards won't be executed. +The context manager object `pytest.raises()` will assert if the code contained within its scope will raise an exception of type ``. The documentation points that the exception must be raised in the last line of its scope and any line afterwards won't be executed. Including asserts at the end of the scope is a common error. This codemod addresses that by moving them out of the scope. Our changes look something like this: @@ -41,5 +41,5 @@ N/A ## References -* [https://docs.pytest.org/en/7.4.x/reference/reference.html#pytest-raises](https://docs.pytest.org/en/7.4.x/reference/reference.html#pytest-raises) -* [https://rules.sonarsource.com/python/type/Bug/RSPEC-5915/](https://rules.sonarsource.com/python/type/Bug/RSPEC-5915/) +- [https://docs.pytest.org/en/7.4.x/reference/reference.html#pytest-raises](https://docs.pytest.org/en/7.4.x/reference/reference.html#pytest-raises) +- [https://rules.sonarsource.com/python/type/Bug/RSPEC-5915/](https://rules.sonarsource.com/python/type/Bug/RSPEC-5915/) diff --git a/docs/configuring.md b/docs/configuring.md index ff7a049..e7bf8ec 100644 --- a/docs/configuring.md +++ b/docs/configuring.md @@ -13,6 +13,7 @@ There are two approaches to configuring Pixeebot: Alternatively, you can create the `pixeebot.yaml` file in the `.github` directory of your `.github` repository. This will serve as a global configuration that applies to multiple repositories. ## YAML + A typical `.yaml` configuration file might look like this: ```yaml @@ -24,7 +25,7 @@ ai: ### `ai` -Contains settings related to AI functionality. +Contains settings related to AI functionality. #### `allow_llm_access` diff --git a/docs/faqs.md b/docs/faqs.md index be5894e..55c432c 100644 --- a/docs/faqs.md +++ b/docs/faqs.md @@ -5,6 +5,7 @@ sidebar_position: 7 # FAQs ### What are Pixee's AI features? + We utilize Large Language Models (LLMs) to provide context-aware code fixes and to add code-specific comments, helping developers understand why a change is being recommended. ### What is Pixee's AI policy? @@ -13,14 +14,16 @@ At Pixee, we take your data privacy and security seriously. To ensure your trust By default, we enable the use of Large Language Models (LLMs) for an enhanced user experience. However, if you prefer not to use them, you can easily [disable](configuring.md) this feature at your convenience. We believe in providing you with the flexibility to tailor your experience according to your preferences and needs. - ### How does Pixee handle my data? + Pixee is a platform focused on helping developers deliver higher quality code and places the utmost importance on our own security, including secure software development practices, IT practices, corporate controls and partner assessments. In case anyone asks, yes -- all data is encrypted in transit and at rest, and guaranteed to be destroyed. As an aside, many of us have been in security our whole careers, and we're quite passionate about it! We document all of this and more in our [Security and Trust Center](https://trust.pixee.ai/). ### How will my information (i.e. code, projects, etc.) be used? + Each party agrees to hold data and confidential information of the other party in confidence and not to disclose, retain, or distribute such information to third parties or to use such information for any purpose whatsoever. Please take a look at our full [Privacy Policy](https://www.pixee.ai/privacy) for more detail. ### Where can I learn more and discuss Pixeebot? + Users can join the Pixee community [on Slack](https://join.slack.com/t/openpixee/shared_invite/zt-1pnk7jqdd-kfwilrfG7Ov4M8rorfOnUA). This channel can be used to engage with peers who are also interested in Pixee. Feel free to email us at help@pixee.ai with any questions or comments. diff --git a/docs/installing.md b/docs/installing.md index 8534c36..981e50b 100644 --- a/docs/installing.md +++ b/docs/installing.md @@ -6,35 +6,28 @@ sidebar_position: 2 To install Pixeebot, visit our [GitHub App page](https://github.com/apps/pixeebot/). From there, click **Install** (or **Configure**) and follow the prompts from GitHub. You'll be directed to your Pixee dashboard once the installation process is complete. - - - ## Repository access -During installation, you’ll need to specify which of your repositories Pixeebot can access. This can be done in one of two ways: - -* **All repositories -** By selecting this option, Pixeebot will monitor all your existing and future repositories. -* **Select repositories -** Opting for this choice will present you with a list of your current repositories. From there, you can choose the specific repositories Pixeebot can access. - - +During installation, you’ll need to specify which of your repositories Pixeebot can access. This can be done in one of two ways: +- **All repositories -** By selecting this option, Pixeebot will monitor all your existing and future repositories. +- **Select repositories -** Opting for this choice will present you with a list of your current repositories. From there, you can choose the specific repositories Pixeebot can access. ## Updating repository access To update repository access for Pixeebot: **From Pixee Dashboard:** -* Click the "+Add installation" link at the bottom of your Installations page. + +- Click the "+Add installation" link at the bottom of your Installations page. **From GitHub:** -* Go to your GitHub homepage. -* Navigate to Settings > Integrations > Applications. -* Select "Pixeebot" from the list of applications. -* Click the configure button to access Pixeebot settings. +- Go to your GitHub homepage. +- Navigate to Settings > Integrations > Applications. +- Select "Pixeebot" from the list of applications. +- Click the configure button to access Pixeebot settings. Repository access selection can be managed at any time by adjusting settings through either of these paths. - - diff --git a/docs/intro.md b/docs/intro.md index ab40ce7..00975b7 100644 --- a/docs/intro.md +++ b/docs/intro.md @@ -4,7 +4,7 @@ sidebar_position: 1 # Introducing Pixeebot 👋 -Pixeebot is a [GitHub app](https://github.com/apps/pixeebot/) that automatically improves your code. It acts like a developer on your team by reviewing your code, and recommending changes to enhance code quality, performance, and security. Pixeebot opens merge-ready pull requests (PRs) for each recommendation, so all you have to do is review and merge. +Pixeebot is a [GitHub app](https://github.com/apps/pixeebot/) that automatically improves your code. It acts like a developer on your team by reviewing your code, and recommending changes to enhance code quality, performance, and security. Pixeebot opens merge-ready pull requests (PRs) for each recommendation, so all you have to do is review and merge. Pixeebot is powered by our open source toolkit [codemodder](https://codemodder.io/), a pluggable framework for building expressive codemods. These codemods help power Pixeebot’s recommendations, and are continuously updated to ensure Pixeebot’s recommendations align with industry standards and best practices. @@ -15,27 +15,27 @@ Pixeebot monitors your repositories and provides fixes in two different ways: 1. :on: **Continuous Improvement:** monitors your default branch and sends you pull requests with fixes. 2. :seedling: **PR Improvement:** checks each new pull request (PR) and recommends improvements. -### What types of recommendations does Pixeebot make? +### What types of recommendations does Pixeebot make? Pixeebot is built to find and fix a variety of problems, whether they are performance and quality issues or known security vulnerabilities. Here are a few of the most common issues Pixeebot resolves: -* NullPointerExceptions -* Cross Site Scripting (XSS) and XML External Entity (XXE) attack vulnerabilities -* Denial of Service (DoS) attack vulnerabilities -* SQL injection vulnerailities -* Removal of unnecessary F-strings +- NullPointerExceptions +- Cross Site Scripting (XSS) and XML External Entity (XXE) attack vulnerabilities +- Denial of Service (DoS) attack vulnerabilities +- SQL injection vulnerailities +- Removal of unnecessary F-strings ### How can I test Pixeebot? -Pixeebot is quick to install and starts working immediately upon activation. While Pixeebot is designed for repositories of all sizes, it is most effective at identifying vulnerabilities in active medium to large-sized projects. +Pixeebot is quick to install and starts working immediately upon activation. While Pixeebot is designed for repositories of all sizes, it is most effective at identifying vulnerabilities in active medium to large-sized projects. If you need a repository to test with, we recommend trying Pixeebot out with a deliberately insecure application. Template repositories containing Java and Python test applications are available in PixeeSandbox: [https://github.com/PixeeSandbox](https://github.com/PixeeSandbox) -Testing with these deliberately insecure applications can give you an idea of how Pixeebot works, before installing it directly on your personal or professional repositories. +Testing with these deliberately insecure applications can give you an idea of how Pixeebot works, before installing it directly on your personal or professional repositories. ### What environment & languages does Pixeebot support? -Pixeebot is currently available for Java and Python repositories on GitHub, with support for additional languages coming soon. Have a language you’d like to see supported? Let us know in an email to [hi@pixee.ai](mailto:hi@pixee.ai). We’d love to hear from you! +Pixeebot is currently available for Java and Python repositories on GitHub, with support for additional languages coming soon. Have a language you’d like to see supported? Let us know in an email to [hi@pixee.ai](mailto:hi@pixee.ai). We’d love to hear from you! ### What does Pixeebot cost? diff --git a/docs/release-notes.md b/docs/release-notes.md index 5882c27..0489c21 100644 --- a/docs/release-notes.md +++ b/docs/release-notes.md @@ -6,29 +6,31 @@ sidebar_position: 8 We're working hard to bring you new features, enhancements, and reliability to the Pixee Platform. We'd ❤️ to hear from you. Drop us a note at [hi@pixee.ai](mailto:hi@pixee.ai)! -## March 1, 2024 +## March 1, 2024 ### Pixeebot App + Platform {#2024-03-01---pixeebot-app--platform} #### 🚀 New Features & Enhancements {#2024-03-01---new-features--enhancements} -* Implemented changes to optimize codemod performance +- Implemented changes to optimize codemod performance #### 🐛 Bug Fixes {#2024-03-01---bug-fixes} -* Fixed an issue that caused Pixeebot to open multiple pull requests for a single issue +- Fixed an issue that caused Pixeebot to open multiple pull requests for a single issue ### Codemodder {#2024-03-01---codemodder} #### 🐍 Python {#2024-03-01---codemodder-python} -* New codemod: `str-concat-in-sequence-literals` fixes cases of implicit string concatenation inside lists, sets, or tuples. See codemod documentation [here](https://docs.pixee.ai/codemods/python/pixee_python_str-concat-in-sequence-literals) -* New codemod: `fix-async-task-instantiation` replaces manual instantiation of a `Task` with a `create_task` call per the asyncio [documentation](https://docs.python.org/3/library/asyncio-task.html#asyncio.Task). See codemod documentation [here](https://docs.pixee.ai/codemods/python/pixee_python_fix-async-task-instantiation) + +- New codemod: `str-concat-in-sequence-literals` fixes cases of implicit string concatenation inside lists, sets, or tuples. See codemod documentation [here](https://docs.pixee.ai/codemods/python/pixee_python_str-concat-in-sequence-literals) +- New codemod: `fix-async-task-instantiation` replaces manual instantiation of a `Task` with a `create_task` call per the asyncio [documentation](https://docs.python.org/3/library/asyncio-task.html#asyncio.Task). See codemod documentation [here](https://docs.pixee.ai/codemods/python/pixee_python_fix-async-task-instantiation) #### ☕️ Java {#2024-03-01---codemodder-java} -* Fixed a hang issue that caused stalls in code analysis +- Fixed a hang issue that caused stalls in code analysis + +## February 22, 2024 -## February 22, 2024 > 🔏 > **Now Supporting Signed Commits:** > @@ -40,35 +42,35 @@ We're working hard to bring you new features, enhancements, and reliability to t #### 🚀 New Features & Enhancements {#2024-02-22---new-features--enhancements} -* Implemented a change to the installation flow so that more repositories skip the waitlist -* Added a search and filter functionality to the installations page of the user platform, allowing users to search for specific Pixeebot installations and filter results +- Implemented a change to the installation flow so that more repositories skip the waitlist +- Added a search and filter functionality to the installations page of the user platform, allowing users to search for specific Pixeebot installations and filter results #### 🐛 Bug Fixes {#2024-02-22---bug-fixes} -* Fixed a bug affecting Java repositories that caused contextual comments included in Pixeebot fixes to contain incorrect line numbers +- Fixed a bug affecting Java repositories that caused contextual comments included in Pixeebot fixes to contain incorrect line numbers ### Codemodder {#2024-02-22---codemodder} #### 🐍 Python {#2024-02-22---codemodder-python} -* Updated `requests-verify` codemod to support the [httpx](https://www.python-httpx.org/) library. See codemod documentation [here](https://docs.pixee.ai/codemods/python/pixee_python_requests-verify) -* Updated `fix-file-resource-leak` codemod for better handling of indent blocks containing multiple open statements. See codemod documentation [here](https://docs.pixee.ai/codemods/python/pixee_python_fix-file-resource-leak) -#### ☕️ Java {#2024-02-22---codemodder-java} - -* New codemod: `overrides-match-synchronization` adds missing synchronized keyword to methods that override a synchronized method in the parent class, ensuring [proper synchronization](https://wiki.sei.cmu.edu/confluence/display/java/TSM00-J.+Do+not+override+thread-safe+methods+with+methods+that+are+not+thread-safe). This improves code maintainability, and reduces the risk of issues like race conditions and data corruption. (for Sonar) See codemod documentation [here](https://docs.pixee.ai/codemods/java/sonar_java_overrides-match-synchronization-s3551) -* Updated `define-constant-for-duplicate-literal` codemod to inject new literals at the end of a file, rather than the beginning. This change improves the style of code generated by this codemod. See codemod documentation [here](https://docs.pixee.ai/codemods/java/sonar_java_define-constant-for-duplicate-literal-s1192) +- Updated `requests-verify` codemod to support the [httpx](https://www.python-httpx.org/) library. See codemod documentation [here](https://docs.pixee.ai/codemods/python/pixee_python_requests-verify) +- Updated `fix-file-resource-leak` codemod for better handling of indent blocks containing multiple open statements. See codemod documentation [here](https://docs.pixee.ai/codemods/python/pixee_python_fix-file-resource-leak) +#### ☕️ Java {#2024-02-22---codemodder-java} +- New codemod: `overrides-match-synchronization` adds missing synchronized keyword to methods that override a synchronized method in the parent class, ensuring [proper synchronization](https://wiki.sei.cmu.edu/confluence/display/java/TSM00-J.+Do+not+override+thread-safe+methods+with+methods+that+are+not+thread-safe). This improves code maintainability, and reduces the risk of issues like race conditions and data corruption. (for Sonar) See codemod documentation [here](https://docs.pixee.ai/codemods/java/sonar_java_overrides-match-synchronization-s3551) +- Updated `define-constant-for-duplicate-literal` codemod to inject new literals at the end of a file, rather than the beginning. This change improves the style of code generated by this codemod. See codemod documentation [here](https://docs.pixee.ai/codemods/java/sonar_java_define-constant-for-duplicate-literal-s1192) -## January 26, 2024 +## January 26, 2024 > 🌟 > **Introducing the Activity Dashboard:** > -> This dashboard exists as a GitHub Issue, and is your source of truth for Pixeebot’s functionality within your repository. Use the Activity dashboard to: -> * Easily manage the open pull requests Pixeebot has created for you -> * Check for available fixes in the continuous improvement queue, and summon Pixeebot to create pull requests for them -> * Review the work that Pixeebot has already completed in your repository +> This dashboard exists as a GitHub Issue, and is your source of truth for Pixeebot’s functionality within your repository. Use the Activity dashboard to: +> +> - Easily manage the open pull requests Pixeebot has created for you +> - Check for available fixes in the continuous improvement queue, and summon Pixeebot to create pull requests for them +> - Review the work that Pixeebot has already completed in your repository > > The dashboard is automatically enabled upon installation, provided that GitHub Issues are also enabled for your repository. See Activity dashboard documentation [here](https://docs.pixee.ai/using-pixeebot/#pixeebot-activity). @@ -76,32 +78,29 @@ We're working hard to bring you new features, enhancements, and reliability to t #### 🚀 New Features & Enhancements {#2024-01-26---new-features--enhancements} -* Released performance improvement for navigating between pages on the user dashboard. +- Released performance improvement for navigating between pages on the user dashboard. #### 🐛 Bug Fixes {#2024-01-26---bug-fixes} -* Resolved a bug that occurred when users requested a continuous improvement changes using `@pixeebot next`, Pixeebot would analyze the user’s repository twice and potentially send two PRs. - +- Resolved a bug that occurred when users requested a continuous improvement changes using `@pixeebot next`, Pixeebot would analyze the user’s repository twice and potentially send two PRs. ### Codemodder {#2024-01-26---codemodder} #### 🐍 Python {#2024-01-26---codemodder-python} -* `security` package updates and release -* New codemod: `combine-startswith-endswith` Simplifies boolean expressions used with the `startswith` and `endswith` methods of `str` objects. A lot of code uses boolean expressions such as `x.startswith('foo')` or `x.startswith('bar')` , which is unnecessary since these objects can accept a tuple of strings to match. Where possible, this codemod replaces such boolean expressions with `x.startswith(('foo', 'bar))` for cleaner, more concise code. See codemod documentation [here](https://docs.pixee.ai/codemods/python/pixee_python_combine-startswith-endswith) -* New codemod: `fix-deprecated-logging-warn` Updates usage of the `warn` method from `logging` (which has been [deprecated](https://docs.python.org/3/library/logging.html#logging.Logger.warning) since Python 3.3) in favor of `warning`. See codemod documentation [here](https://docs.pixee.ai/codemods/python/pixee_python_fix-deprecated-logging-warn) -* New codemod: `flask-enable-csrf-protection` Introduces protections against cross-site forgery (CSRF) attacks by embedding an additional token into HTTP requests to identify requests from unauthorized locations. See codemod documentation [here](https://docs.pixee.ai/codemods/python/pixee_python_flask-enable-csrf-protection) -* New codemod: `remove-debug-breakpoint` removes any calls to `breakpoint()` or `pdb.set_trace()` which are generally only used for interactive debugging and should not be deployed in production. See codemod documentation [here](https://docs.pixee.ai/codemods/python/pixee_python_remove-debug-breakpoint). -* New codemod: `replace-flask-send-fil`e Introduces protections against path traversal attacks when using the `Flask` `send_file` function. This codemod uses Flasks’s `flask.send_from_directory` function for input path validation. See codemod documentation [here](https://docs.pixee.ai/codemods/python/pixee_python_replace-flask-send-file) -* New codemod: `use-set-literal` Converts Python set constructions using literal list arguments into more efficient and readable set literals. It simplifies expressions like `set([1, 2, 3])` to `{1, 2, 3}`, enhancing both performance and code clarity. See codemod documentation [here](https://docs.pixee.ai/codemods/python/pixee_python_use-set-literal#pixeepythonuse-set-literal) - - #### ☕️ Java {#2024-01-26---codemodder-java} - * Added short-circuiting to improve performance of composed codemods - * New codemod: `sonar:java/remove-unused-private-method` removes unused `private` methods. These can increase both the mental load and maintenance burden of maintainers, as you have to keep compiling the unused code when making sweeping changes to the APIs used within the method. (for Sonar) See codemod documentation [here](https://docs.pixee.ai/codemods/java/sonar_java_remove-unused-private-method-s1144) - * New codemod: `sonar:java/declare-variable-on-separate-line` splits variable assignments onto their own lines. [Many](https://wiki.sei.cmu.edu/confluence/display/java/DCL52-J.+Do+not+declare+more+than+one+variable+per+declaration) [sources](https://rules.sonarsource.com/java/RSPEC-1659/) [believe](https://dart.dev/tools/linter-rules/avoid_multiple_declarations_per_line) it is easier to review code where the variables are separate statements on their own individual line. (for Sonar) See codemod documentation [here](https://docs.pixee.ai/codemods/java/sonar_java_declare-variable-on-separate-line-s1659) - +- `security` package updates and release +- New codemod: `combine-startswith-endswith` Simplifies boolean expressions used with the `startswith` and `endswith` methods of `str` objects. A lot of code uses boolean expressions such as `x.startswith('foo')` or `x.startswith('bar')` , which is unnecessary since these objects can accept a tuple of strings to match. Where possible, this codemod replaces such boolean expressions with `x.startswith(('foo', 'bar))` for cleaner, more concise code. See codemod documentation [here](https://docs.pixee.ai/codemods/python/pixee_python_combine-startswith-endswith) +- New codemod: `fix-deprecated-logging-warn` Updates usage of the `warn` method from `logging` (which has been [deprecated](https://docs.python.org/3/library/logging.html#logging.Logger.warning) since Python 3.3) in favor of `warning`. See codemod documentation [here](https://docs.pixee.ai/codemods/python/pixee_python_fix-deprecated-logging-warn) +- New codemod: `flask-enable-csrf-protection` Introduces protections against cross-site forgery (CSRF) attacks by embedding an additional token into HTTP requests to identify requests from unauthorized locations. See codemod documentation [here](https://docs.pixee.ai/codemods/python/pixee_python_flask-enable-csrf-protection) +- New codemod: `remove-debug-breakpoint` removes any calls to `breakpoint()` or `pdb.set_trace()` which are generally only used for interactive debugging and should not be deployed in production. See codemod documentation [here](https://docs.pixee.ai/codemods/python/pixee_python_remove-debug-breakpoint). +- New codemod: `replace-flask-send-fil`e Introduces protections against path traversal attacks when using the `Flask` `send_file` function. This codemod uses Flasks’s `flask.send_from_directory` function for input path validation. See codemod documentation [here](https://docs.pixee.ai/codemods/python/pixee_python_replace-flask-send-file) +- New codemod: `use-set-literal` Converts Python set constructions using literal list arguments into more efficient and readable set literals. It simplifies expressions like `set([1, 2, 3])` to `{1, 2, 3}`, enhancing both performance and code clarity. See codemod documentation [here](https://docs.pixee.ai/codemods/python/pixee_python_use-set-literal#pixeepythonuse-set-literal) +#### ☕️ Java {#2024-01-26---codemodder-java} +- Added short-circuiting to improve performance of composed codemods +- New codemod: `sonar:java/remove-unused-private-method` removes unused `private` methods. These can increase both the mental load and maintenance burden of maintainers, as you have to keep compiling the unused code when making sweeping changes to the APIs used within the method. (for Sonar) See codemod documentation [here](https://docs.pixee.ai/codemods/java/sonar_java_remove-unused-private-method-s1144) +- New codemod: `sonar:java/declare-variable-on-separate-line` splits variable assignments onto their own lines. [Many](https://wiki.sei.cmu.edu/confluence/display/java/DCL52-J.+Do+not+declare+more+than+one+variable+per+declaration) [sources](https://rules.sonarsource.com/java/RSPEC-1659/) [believe](https://dart.dev/tools/linter-rules/avoid_multiple_declarations_per_line) it is easier to review code where the variables are separate statements on their own individual line. (for Sonar) See codemod documentation [here](https://docs.pixee.ai/codemods/java/sonar_java_declare-variable-on-separate-line-s1659) ## December 29, 2023 @@ -220,7 +219,7 @@ General support for Python is live! Some updates that made Python support possib - Java is Generally Available! Your Java repos will no longer be waitlisted #### 🐛 Bug Fixes {#2023-09-29---bug-fixes} - + - GitHub Comment Errors: We've resolved the issue where 422 errors were encountered while leaving comments on GitHub. You can now interact seamlessly without errors ## September 22, 2023 diff --git a/docs/running-your-own.md b/docs/running-your-own.md index aba9fba..d271add 100644 --- a/docs/running-your-own.md +++ b/docs/running-your-own.md @@ -4,4 +4,4 @@ sidebar_position: 6 # Running Custom Codemods -Coming soon! \ No newline at end of file +Coming soon! diff --git a/docs/using-pixeebot.md b/docs/using-pixeebot.md index 220abea..b43c213 100644 --- a/docs/using-pixeebot.md +++ b/docs/using-pixeebot.md @@ -26,16 +26,16 @@ Within a couple of minutes, Pixeebot will open a new pull request with additiona ![Summon from issue](/img/summon3.png) +## Pull request reminders -## Pull request reminders +If a Pixeebot pull request remains open, two automatic reminders will occur over time in the form of comments on the pull request. -If a Pixeebot pull request remains open, two automatic reminders will occur over time in the form of comments on the pull request. +If the pull request is still not merged or closed after two weeks, Pixeebot will close it automatically with a final comment. -If the pull request is still not merged or closed after two weeks, Pixeebot will close it automatically with a final comment. - -If a closed pull request indicates additional recommendations are available, Pixeebot can still be summoned after the pull request has been reopened. +If a closed pull request indicates additional recommendations are available, Pixeebot can still be summoned after the pull request has been reopened. ## Pixeebot status + When a pull request is opened, Pixeebot will initiate its run, and you can monitor progress in the status checks section of your pull request. If Pixeebot does not have any recommendations, it will mark the check as Successful. If recommendations are found, a separate pull request will be generated, and the check will be marked as Neutral. Review the check details to access the new pull request link and additional information regarding the recommendations. If you merge the new pull request, the original check will register this and be updated to Successful. @@ -45,6 +45,7 @@ If Pixeebot does not have any recommendations, it will mark the check as Success ![checks in progress](/img/checks_in_progress.png) ## Pixeebot activity -The Activity dashboard exists as a GitHub Issue and offers a holistic perspective on Pixeebot's functionality within your repository. Through this interface, you can conveniently monitor your open pull requests, other available recommendations, and more. The dashboard is automatically enabled upon installation, provided that GitHub Issues are also enabled for your repository. + +The Activity dashboard exists as a GitHub Issue and offers a holistic perspective on Pixeebot's functionality within your repository. Through this interface, you can conveniently monitor your open pull requests, other available recommendations, and more. The dashboard is automatically enabled upon installation, provided that GitHub Issues are also enabled for your repository. The issue can remain open, and the data will automatically refresh with each Pixeebot analysis that occurs. If the issue is closed, the feature will be disabled and the data will become stale. Reopening it will reactivate the dashboard, and resume auto-updates when Pixeebot runs. diff --git a/docusaurus.config.js b/docusaurus.config.js index 8a67605..e63eaf1 100644 --- a/docusaurus.config.js +++ b/docusaurus.config.js @@ -1,61 +1,61 @@ // @ts-check // Note: type annotations allow type checking and IDEs autocompletion -const lightCodeTheme = require('prism-react-renderer/themes/github'); -const darkCodeTheme = require('prism-react-renderer/themes/dracula'); +const lightCodeTheme = require("prism-react-renderer/themes/github"); +const darkCodeTheme = require("prism-react-renderer/themes/dracula"); /** @type {import('@docusaurus/types').Config} */ const config = { - title: 'Pixee', - tagline: 'Pixee is your automated product security engineer', //TODO: We need a tag line! - url: 'https://docs.pixee.ai', - baseUrl: '/', - onBrokenLinks: 'throw', - onBrokenMarkdownLinks: 'warn', - favicon: 'img/favicon.ico', + title: "Pixee", + tagline: "Pixee is your automated product security engineer", //TODO: We need a tag line! + url: "https://docs.pixee.ai", + baseUrl: "/", + onBrokenLinks: "throw", + onBrokenMarkdownLinks: "warn", + favicon: "img/favicon.ico", // GitHub pages deployment config. // If you aren't using GitHub pages, you don't need these. - organizationName: 'pixee', // Usually your GitHub org/user name. - projectName: 'internal-docs', // Usually your repo name. - deploymentBranch: 'main', + organizationName: "pixee", // Usually your GitHub org/user name. + projectName: "internal-docs", // Usually your repo name. + deploymentBranch: "main", // Even if you don't use internalization, you can use this field to set useful // metadata like html lang. For example, if your site is Chinese, you may want // to replace "en" with "zh-Hans". i18n: { - defaultLocale: 'en', - locales: ['en'], + defaultLocale: "en", + locales: ["en"], }, stylesheets: [ - 'https://fonts.googleapis.com/css2?family=Poppins:wght@300;700&display=swap', - 'https://fonts.googleapis.com/css?family=Source+Sans+Pro:200,200i,300,300i,400,400i,600,600i,700,700i,900,900i&display=swap', + "https://fonts.googleapis.com/css2?family=Poppins:wght@300;700&display=swap", + "https://fonts.googleapis.com/css?family=Source+Sans+Pro:200,200i,300,300i,400,400i,600,600i,700,700i,900,900i&display=swap", ], presets: [ [ - '@docusaurus/preset-classic', + "@docusaurus/preset-classic", /** @type {import('@docusaurus/preset-classic').Options} */ ({ docs: { - sidebarPath: require.resolve('./sidebars.js'), - routeBasePath: '/', + sidebarPath: require.resolve("./sidebars.js"), + routeBasePath: "/", // Please change this to your repo. // Remove this to remove the "edit this page" links. - editUrl: 'https://github.com/pixee/docs/edit/main/', + editUrl: "https://github.com/pixee/docs/edit/main/", }, blog: { showReadingTime: true, // Please change this to your repo. // Remove this to remove the "edit this page" links. - editUrl: 'https://github.com/pixee/docs/edit/main/', + editUrl: "https://github.com/pixee/docs/edit/main/", }, theme: { - customCss: require.resolve('./src/css/custom.css'), + customCss: require.resolve("./src/css/custom.css"), }, gtag: { - trackingID: 'G-1M7HM648QD', + trackingID: "G-1M7HM648QD", anonymizeIP: true, }, }), @@ -66,44 +66,44 @@ const config = { /** @type {import('@docusaurus/preset-classic').ThemeConfig} */ ({ announcementBar: { - id: 'CLI_launch', - content: - '🎉 Introducing the Pixee CLI. Bring the power of Pixee\'s Codemodder framework to your local development environment. Learn more', - backgroundColor: 'fbfafb', - textColor: '1c1533', + id: "CLI_launch", + content: + '🎉 Introducing the Pixee CLI. Bring the power of Pixee\'s Codemodder framework to your local development environment. Learn more', + backgroundColor: "fbfafb", + textColor: "1c1533", isCloseable: true, }, navbar: { - title: 'Pixee', + title: "Pixee", logo: { - alt: 'Pixee', - src: 'img/pixee-logo.png', - href: 'https://pixee.ai', + alt: "Pixee", + src: "img/pixee-logo.png", + href: "https://pixee.ai", }, items: [ { - type: 'doc', - docId: 'intro', - position: 'left', - label: 'Docs', - className: 'header-routes', + type: "doc", + docId: "intro", + position: "left", + label: "Docs", + className: "header-routes", }, { - to: '/status', - label: 'Status', - position: 'left', - className: 'header-routes', + to: "/status", + label: "Status", + position: "left", + className: "header-routes", }, { - type: 'html', - position: 'right', + type: "html", + position: "right", value: '
', }, { - type: 'html', - position: 'right', + type: "html", + position: "right", value: '
', }, @@ -143,7 +143,7 @@ const config = { scripts: [ { - src: '/js/loadtags.js', + src: "/js/loadtags.js", async: true, }, ], diff --git a/renovate.json b/renovate.json index 39a2b6e..4bd832f 100644 --- a/renovate.json +++ b/renovate.json @@ -1,6 +1,4 @@ { "$schema": "https://docs.renovatebot.com/renovate-schema.json", - "extends": [ - "config:base" - ] + "extends": ["config:base"] } diff --git a/sidebars.js b/sidebars.js index 64869eb..48f851b 100644 --- a/sidebars.js +++ b/sidebars.js @@ -14,10 +14,10 @@ /** @type {import('@docusaurus/plugin-content-docs').SidebarsConfig} */ const sidebars = { // By default, Docusaurus generates a sidebar from the docs folder structure - tutorialSidebar: [{type: 'autogenerated', dirName: '.'}], + tutorialSidebar: [{ type: "autogenerated", dirName: "." }], // But you can create a sidebar manually - + /*tutorialSidebar: [ 'intro', 'getting-started', @@ -27,7 +27,6 @@ const sidebars = { items: ['tutorial-basics/create-a-document'], }, ],*/ - }; module.exports = sidebars; diff --git a/src/components/HomepageFeatures/index.js b/src/components/HomepageFeatures/index.js index c8b9c69..0eff88c 100644 --- a/src/components/HomepageFeatures/index.js +++ b/src/components/HomepageFeatures/index.js @@ -1,25 +1,25 @@ -import React from 'react'; -import styles from './styles.module.css'; -import Link from '@docusaurus/Link'; +import React from "react"; +import styles from "./styles.module.css"; +import Link from "@docusaurus/Link"; export default function HomepageFeatures() { const navigateToDocs = (type) => { if (type === 1) { - window.location = '/installing'; + window.location = "/installing"; } else if (type === 2) { - window.location = '/codemods/overview'; + window.location = "/codemods/overview"; } else if (type === 3) { - window.location = 'https://github.com/pixee/pixee-cli'; + window.location = "https://github.com/pixee/pixee-cli"; } else if (type === 4) { - window.location = '/configuring'; + window.location = "/configuring"; } else if (type === 5) { - window.location = '/running-your-own'; + window.location = "/running-your-own"; } else if (type === 6) { - window.location = '/faqs'; + window.location = "/faqs"; } else if (type === 7) { - window.location = '/using-pixeebot'; + window.location = "/using-pixeebot"; } else { - window.location = '/release-notes'; + window.location = "/release-notes"; } }; return ( @@ -30,7 +30,7 @@ export default function HomepageFeatures() { ⬇ Install Pixeebot

- Pixeebot installation begins by visiting our{' '} + Pixeebot installation begins by visiting our{" "} GitHub App page. From there, click the Configure button and follow the prompts from GitHub. You’ll be directed to your Pixee dashboard once @@ -58,8 +58,9 @@ export default function HomepageFeatures() { 💻 Pixee CLI

- Try out the power of Pixee codemods locally with our command line interface. See how - Pixee can improve and harden your code before installing the GitHub app. + Try out the power of Pixee codemods locally with our command line + interface. See how Pixee can improve and harden your code before + installing the GitHub app.

navigateToDocs(4)}> @@ -81,9 +82,7 @@ export default function HomepageFeatures() {

❓ FAQs

-

- Addressing common topics such as data handling and use of LLMs. -

+

Addressing common topics such as data handling and use of LLMs.

navigateToDocs(7)}>

@@ -99,7 +98,8 @@ export default function HomepageFeatures() { 📄 Release notes

-
We are constantly updating our product. Check out our weekly release notes here. +
We are constantly updating our product. Check out our weekly + release notes here.

diff --git a/src/components/HomepageFeatures/styles.module.css b/src/components/HomepageFeatures/styles.module.css index c14fb60..c676fd9 100644 --- a/src/components/HomepageFeatures/styles.module.css +++ b/src/components/HomepageFeatures/styles.module.css @@ -42,7 +42,7 @@ .grid h1 span, .lastGrid h1 span { - font-family: 'Poppins', sans-serif; + font-family: "Poppins", sans-serif; font-weight: 700; color: var(--ifr-color-neutral-90); } @@ -57,7 +57,7 @@ } /* Dark mode styles */ -[data-theme='dark'] .item { +[data-theme="dark"] .item { border: 1px solid #ccc; border-radius: 16px; border: 1px solid #463b68; @@ -65,14 +65,14 @@ padding: 24px; } -[data-theme='dark'] .grid h1 span, -[data-theme='dark'] .lastGrid h1 span, -[data-theme='dark'] .grid p, -[data-theme='dark'] .lastGrid p { +[data-theme="dark"] .grid h1 span, +[data-theme="dark"] .lastGrid h1 span, +[data-theme="dark"] .grid p, +[data-theme="dark"] .lastGrid p { color: var(--ifr-color-neutral-10); } -[data-theme='dark'] .item:hover { +[data-theme="dark"] .item:hover { background: var( --backgrounds-iris-focus, radial-gradient(80.33% 96.88% at 84.06% -18.59%, #6000fe 0%, #2c2541 91.18%) diff --git a/src/css/custom.css b/src/css/custom.css index e7b31a5..2e1317b 100644 --- a/src/css/custom.css +++ b/src/css/custom.css @@ -7,11 +7,11 @@ /* You can override the default Infima variables here. */ body { - font-family: 'Source Sans Pro'; + font-family: "Source Sans Pro"; color: var(--ifr-color-neutral-90); } -[data-theme='dark'] body { +[data-theme="dark"] body { color: var(--ifr-color-neutral-10); } @@ -32,12 +32,12 @@ body { } .navbar__title { - font-family: 'Poppins', sans-serif; + font-family: "Poppins", sans-serif; font-size: 20px; color: var(--ifr-color-neutral-90); } -[data-theme='dark'] .navbar__title { +[data-theme="dark"] .navbar__title { color: var(--ifr-color-neutral-10); } @@ -61,31 +61,31 @@ body { } .custom-navbar-logo-class { - content: ''; + content: ""; width: 24px; height: 24px; display: flex; - background: url('./../../static/img/pixee-logo.png') no-repeat; + background: url("./../../static/img/pixee-logo.png") no-repeat; background-size: cover; } -[data-theme='dark'] .header-routes { +[data-theme="dark"] .header-routes { color: #fbfafb; } -[data-theme='dark'] .navbar__link:hover { +[data-theme="dark"] .navbar__link:hover { color: var(--ifm-navbar-link-hover-color); text-decoration: none; font-weight: 400; } -[data-theme='dark'] .navbar__link--active { +[data-theme="dark"] .navbar__link--active { color: var(--ifm-navbar-link-hover-color); text-decoration: none; font-weight: 700; } -[data-theme='dark'] .navbar__link--active:hover { +[data-theme="dark"] .navbar__link--active:hover { color: var(--ifm-navbar-link-hover-color); text-decoration: none; font-weight: 700; @@ -110,30 +110,30 @@ body { } .header-github-link::before { - content: ''; + content: ""; width: 24px; height: 24px; display: flex; - background: url('./../../static/img/github-icon-light.svg') no-repeat; + background: url("./../../static/img/github-icon-light.svg") no-repeat; background-size: cover; } .header-slack-link::before { - content: ''; + content: ""; width: 24px; height: 24px; display: flex; - background: url('./../../static/img/slack-icon-light.svg') no-repeat; + background: url("./../../static/img/slack-icon-light.svg") no-repeat; background-size: cover; } -[data-theme='dark'] .header-github-link::before { - background: url('./../../static/img/github-icon-dark.svg') no-repeat; +[data-theme="dark"] .header-github-link::before { + background: url("./../../static/img/github-icon-dark.svg") no-repeat; background-size: cover; } -[data-theme='dark'] .header-slack-link::before { - background: url('./../../static/img/slack-icon-dark.svg') no-repeat; +[data-theme="dark"] .header-slack-link::before { + background: url("./../../static/img/slack-icon-dark.svg") no-repeat; background-size: cover; } @@ -143,7 +143,7 @@ body { padding-bottom: 24px; padding: 10px 80px 10px 80px; font-size: 14px; - font-family: 'Source Sans Pro'; + font-family: "Source Sans Pro"; font-weight: 400; color: #656074; } @@ -185,30 +185,30 @@ body { } .footer-twitter-link::before { - content: ''; + content: ""; width: 16px; height: 16px; display: flex; - background: url('./../../static/img/twitter-icon-light.svg') no-repeat; + background: url("./../../static/img/twitter-icon-light.svg") no-repeat; background-size: cover; } -[data-theme='dark'] .footer-twitter-link::before { - background: url('./../../static/img/twitter-icon-dark.svg') no-repeat; +[data-theme="dark"] .footer-twitter-link::before { + background: url("./../../static/img/twitter-icon-dark.svg") no-repeat; background-size: cover; } .footer-linkedin-link::before { - content: ''; + content: ""; width: 16px; height: 16px; display: flex; - background: url('./../../static/img/linkedin-icon-light.svg') no-repeat; + background: url("./../../static/img/linkedin-icon-light.svg") no-repeat; background-size: cover; } -[data-theme='dark'] .footer-linkedin-link::before { - background: url('./../../static/img/linkedin-icon-dark.svg') no-repeat; +[data-theme="dark"] .footer-linkedin-link::before { + background: url("./../../static/img/linkedin-icon-dark.svg") no-repeat; background-size: cover; } @@ -248,12 +248,12 @@ body { --ifr-color-neutral-90: #1c1533; --ifr-color-neutral-white: #fff; --ifm-link-color: var(--ifm-color-primary); - --ifm-heading-font-family: 'Poppins', sans-serif; + --ifm-heading-font-family: "Poppins", sans-serif; --ifm-background-color: var(--ifr-color-neutral-10); } /* Dark mode styles */ -[data-theme='dark'] { +[data-theme="dark"] { --ifm-color-primary: #39e7ad; --ifm-color-primary-dark: #1fe4a2; --ifm-color-primary-darker: #1ada9a; @@ -264,29 +264,33 @@ body { --docusaurus-highlighted-code-line-bg: rgb(10, 46, 146); } -html[data-theme='dark'] { +html[data-theme="dark"] { --ifm-background-color: #1c1533; } -[data-theme='dark'] .landingPage { - background: radial-gradient(circle, rgba(52, 52, 79, 1) 0%, rgba(28, 21, 51, 1) 60%); +[data-theme="dark"] .landingPage { + background: radial-gradient( + circle, + rgba(52, 52, 79, 1) 0%, + rgba(28, 21, 51, 1) 60% + ); } -[data-theme='dark'] .navbar { +[data-theme="dark"] .navbar { background-color: var(--ifr-color-neutral-80); } -[data-theme='dark'] .footer { +[data-theme="dark"] .footer { background-color: #1c1533; color: #aeabb6; } -[data-theme='dark'] .footer .links, -[data-theme='dark'] .footer .links a { +[data-theme="dark"] .footer .links, +[data-theme="dark"] .footer .links a { color: #aeabb6; } -[data-theme='dark'] .footer a:hover { +[data-theme="dark"] .footer a:hover { color: var(--ifm-color-primary); text-decoration: none; } @@ -302,12 +306,12 @@ html[data-theme='dark'] { --prism-background-color: var(--ifr-color-neutral-white); } -[data-theme='dark'] .language-diff, -[data-theme='dark'] .language-python, -[data-theme='dark'] .language-yaml, -[data-theme='dark'] .language-java, -[data-theme='dark'] .language-xml, -[data-theme='dark'] .language-binary { +[data-theme="dark"] .language-diff, +[data-theme="dark"] .language-python, +[data-theme="dark"] .language-yaml, +[data-theme="dark"] .language-java, +[data-theme="dark"] .language-xml, +[data-theme="dark"] .language-binary { --prism-background-color: var(--ifr-color-neutral-80); } @@ -322,12 +326,12 @@ html[data-theme='dark'] { --prism-background-color: var(--ifr-color-neutral-white); } -[data-theme='dark'] .language-diff, -[data-theme='dark'] .language-python, -[data-theme='dark'] .language-yaml, -[data-theme='dark'] .language-java, -[data-theme='dark'] .language-xml, -[data-theme='dark'] .language-binary { +[data-theme="dark"] .language-diff, +[data-theme="dark"] .language-python, +[data-theme="dark"] .language-yaml, +[data-theme="dark"] .language-java, +[data-theme="dark"] .language-xml, +[data-theme="dark"] .language-binary { --prism-background-color: var(--ifr-color-neutral-80); } @@ -366,41 +370,54 @@ html[data-theme='dark'] { } /* dark mode default */ -[data-theme='dark'] .theme-doc-sidebar-item-category li .menu__link, -[data-theme='dark'] .theme-doc-sidebar-menu li .menu__link { +[data-theme="dark"] .theme-doc-sidebar-item-category li .menu__link, +[data-theme="dark"] .theme-doc-sidebar-menu li .menu__link { border-left: 4px solid #1c1533; color: var(--ifr-color-neutral-10); font-weight: 400; } /* dark mode default hover */ -[data-theme='dark'] .theme-doc-sidebar-item-category li .menu__link:hover, -[data-theme='dark'] .theme-doc-sidebar-menu li .menu__link:hover { +[data-theme="dark"] .theme-doc-sidebar-item-category li .menu__link:hover, +[data-theme="dark"] .theme-doc-sidebar-menu li .menu__link:hover { border-left: 4px solid #2c2541; color: #39e7ad; font-weight: 400; } /* dark mode active */ -[data-theme='dark'] .theme-doc-sidebar-item-category li .menu__link.menu__link--active, -[data-theme='dark'] .theme-doc-sidebar-menu li .menu__link.menu__link--active { +[data-theme="dark"] + .theme-doc-sidebar-item-category + li + .menu__link.menu__link--active, +[data-theme="dark"] .theme-doc-sidebar-menu li .menu__link.menu__link--active { border-left: 4px solid #39e7ad; color: var(--ifm-color-primary); font-weight: 700; } /* dark mode active hover */ -[data-theme='dark'] .theme-doc-sidebar-item-category li .menu__link.menu__link--active:hover, -[data-theme='dark'] .theme-doc-sidebar-menu li .menu__link.menu__link--active:hover { +[data-theme="dark"] + .theme-doc-sidebar-item-category + li + .menu__link.menu__link--active:hover, +[data-theme="dark"] + .theme-doc-sidebar-menu + li + .menu__link.menu__link--active:hover { color: #39e7ad; font-weight: 700; } -[data-theme='dark'] .theme-doc-sidebar-item-category li .menu__link, -[data-theme='dark'] .theme-doc-sidebar-menu li .menu__link { +[data-theme="dark"] .theme-doc-sidebar-item-category li .menu__link, +[data-theme="dark"] .theme-doc-sidebar-menu li .menu__link { color: var(--ifr-color-neutral-10); } -[data-theme='dark'] .theme-doc-sidebar-item-category li [data-theme='dark'] .menu__link.menu__link--active, +[data-theme="dark"] + .theme-doc-sidebar-item-category + li + [data-theme="dark"] + .menu__link.menu__link--active, .theme-doc-sidebar-menu li .menu__link.menu__link--active { color: var(--ifm-color-primary); } @@ -410,7 +427,7 @@ html[data-theme='dark'] { background-color: var(--ifr-color-neutral-20); } -[data-theme='dark'] .menu__link--active:not(.menu__link--sublist) { +[data-theme="dark"] .menu__link--active:not(.menu__link--sublist) { border-left: 4px solid #39e7ad; background: var(--ifr-color-neutral-80); } @@ -425,11 +442,11 @@ html[data-theme='dark'] { color: var(--ifm-color-primary); } -[data-theme='dark'] .table-of-contents li a { +[data-theme="dark"] .table-of-contents li a { color: var(--ifr-color-neutral-10); } -[data-theme='dark'] .table-of-contents li a.table-of-contents__link--active { +[data-theme="dark"] .table-of-contents li a.table-of-contents__link--active { color: var(--ifm-color-primary); } @@ -437,6 +454,6 @@ html[data-theme='dark'] { border-color: var(--ifr-color-neutral-20); } -[data-theme='dark'] .table-of-contents { +[data-theme="dark"] .table-of-contents { border-color: var(--ifr-color-neutral-70); } diff --git a/src/pages/index.js b/src/pages/index.js index 9fd0ef2..67e893b 100644 --- a/src/pages/index.js +++ b/src/pages/index.js @@ -1,8 +1,8 @@ -import React from 'react'; -import Layout from '@theme/Layout'; -import HomepageFeatures from '@site/src/components/HomepageFeatures'; +import React from "react"; +import Layout from "@theme/Layout"; +import HomepageFeatures from "@site/src/components/HomepageFeatures"; -import styles from './index.module.css'; +import styles from "./index.module.css"; function HomepageHeader() { return ( diff --git a/src/pages/index.module.css b/src/pages/index.module.css index 624ceec..a3a2940 100644 --- a/src/pages/index.module.css +++ b/src/pages/index.module.css @@ -11,7 +11,7 @@ } .heroBanner h1 { - font-family: 'Poppins', sans-serif; + font-family: "Poppins", sans-serif; font-size: 64px; font-style: normal; font-weight: 700; @@ -28,8 +28,8 @@ } /* Dark mode styles */ -[data-theme='dark'] .heroBanner h1, -[data-theme='dark'] .heroBanner p { +[data-theme="dark"] .heroBanner h1, +[data-theme="dark"] .heroBanner p { color: var(--ifr-color-neutral-10); } @@ -44,7 +44,7 @@ } .heroBanner h1 { - font-family: 'Poppins', sans-serif; + font-family: "Poppins", sans-serif; font-size: 32px; font-style: normal; font-weight: 700; diff --git a/src/pages/status.md b/src/pages/status.md index a8eeb0a..00aa805 100644 --- a/src/pages/status.md +++ b/src/pages/status.md @@ -1,8 +1,8 @@ # Pixeebot Status | Component | Status | -|:--------------------|:------------------:| +| :------------------ | :----------------: | | App Installation | :white_check_mark: | | Repository Review | :white_check_mark: | | Pull Request Review | :white_check_mark: | -| Comment Commands | :white_check_mark: | \ No newline at end of file +| Comment Commands | :white_check_mark: | diff --git a/src/pages/welcome.md b/src/pages/welcome.md index 7c9160d..a232f3f 100644 --- a/src/pages/welcome.md +++ b/src/pages/welcome.md @@ -10,13 +10,12 @@ :mailbox_with_mail: **Pull Request in Two:** In 2 minutes, Pixeebot will submit a Pull Request with improvements you can merge in right away. If your code is already rockin', Pixeebot will just give you a comment on your latest commit.
:zap: **Improvements on the Regular:** Pixeebot will keep an eye on your default branch and any future Pull Requests to make sure you're always putting out the best code. -:eyes: **See the Results:** Lets see if Pixeebot came back with any improvements by checking your :point_right: [**GitHub Pull Requests**](https://github.com/pulls?q=is%3Aopen+is%3Apr+archived%3Afalse+author%3Aapp%2Fpixeebot) :point_left: +:eyes: **See the Results:** Lets see if Pixeebot came back with any improvements by checking your :point_right: [**GitHub Pull Requests**](https://github.com/pulls?q=is%3Aopen+is%3Apr+archived%3Afalse+author%3Aapp%2Fpixeebot) :point_left:


-*

With Pixeebot, you can level up your code with ease. We hope you :heart: it and hope to hear from you at feedback@pixee.ai

* +_

With Pixeebot, you can level up your code with ease. We hope you :heart: it and hope to hear from you at feedback@pixee.ai

_ - diff --git a/static/r/index.html b/static/r/index.html index d8361d2..2faff65 100644 --- a/static/r/index.html +++ b/static/r/index.html @@ -1,19 +1,20 @@ Redirecting to rule page... \ No newline at end of file + } else { + document.write("no rule"); + } +