Using the spawn or forkserver start method without importing the main module might lead to unexpected behavior (for example, it might cause a RuntimeError).

Integer overflow

An integer overflow might might cause security issues when it is used for resource management or execution control.

Catch and swallow exception

Swallowing exceptions, without re-throwing or logging them, is a bad practice.

Insufficient Logging CDK

In the case of a security-critical event, the product fails to either log the event or misses crucial details in the logged information.

Unauthenticated LDAP requests

Unauthenticated LDAP requests can allow untrusted access to LDAP servers.

Path traversal

Constructing path names with unsanitized user input can lead to path traversal attacks (for example, ../../..) that allow an attacker access to file system resources.

Loose file permissions

Weak file permissions can lead to privilege escalation.

Exposure of Sensitive Information CDK

The product unintentionally grants unauthorized actors access to a resource by placing it in the wrong control sphere.

File injection

Writing unsanitized user data to a file is unsafe.

Incorrect use of Process.terminate API

The Process.terminate API might cause data corruption of shared resources.

XML External Entity

Objects that parse or handle XML can lead to XML External Entity (XXE) attacks when misconfigured.

Pytorch use nondeterministic algoritm

APIs with nondeterministic algorithm are used

Set SNS Return Subscription ARN

To always return the subscription ARN, set the ReturnSubscriptionArn argument to True.

Tensorflow enable ops determinism

Non-deterministic ops might return different outputs when run with the same inputs.

Outdated subprocess module API

Using outdated multiprocessing API calls and parameters is not recommended.

Improper input validation

Improper input validation can enable attacks and lead to unwanted behavior.

Improper authentication

Your code doesn't sufficiently authenticate identities provided by its users.

Missing pagination

Missing pagination on a paginated call can lead to inaccurate results.

Semaphore overflow prevention

When you process and remove an item from the JoinableQueue without calling JoinableQueue.task_done(), a semaphore overflow exception might be thrown.

Insecure cookie

Insecure cookies can lead to unencrypted transmission of sensitive data.

Usage of an API that is not recommended - Low Severity

APIs that are not recommended were found - Low Severity.

Socket connection timeout

Not setting the connection timeout parameter can cause a blocking socket connection.

AWS client not reused in a Lambda function

Recreating AWS clients in each Lambda function invocation is expensive.

Pytorch assign in place mod

Detects if a torch variable is modified in place inside an assignment.

Leaky subprocess timeout

Failure to end a child process that doesn't terminate before its timeout expires can result in leaked resources.

Pytorch disable gradient calculation

Checks if gradient calculation is disabled during evaluation.

Risky use of dict get method

Using the get method from the dict class without default values can cause runtime exceptions.

XPath injection

Potentially unsanitized user input in XPath queries can allow an attacker to control the query in unwanted or insecure ways.

Missing authorization

Missing authorization checks can lead to unauthorized access to a resource or performance of an action.

Multidimensional list initialization using replication is error prone

list replication using replication operator creates references to the existing objects, not copies, which could introduce bugs.

SQL injection

Use of untrusted inputs in a SQL database query can enable attackers to read, modify, or delete sensitive data in the database

Pytorch miss call to eval

Checks if eval() is called before validating or testing a model.

AWS AppConfig

Always check for new version before fetching the latest version directly.

Improper certificate validation

Lack of validation of a security certificate can lead to host impersonation and sensitive data leaks.

URL redirection to untrusted site

User-controlled input that specifies a link to an external site could lead to phishing attacks and allow user credentials to be stolen.

Mutually exclusive call

Calls to mutually exclusive methods were found in the code.

Notebook best practice violation

Best practices to improve the maintainability of notebooks.

Stack trace exposure

Stack traces can be hard to use for debugging.

Use of a deprecated method

This code uses deprecated methods, which suggests that it has not been recently reviewed or maintained.

AWS api logging disabled cdk

Api Logging Disabled may lead to unable to access log and does not record the event.

OS command injection

Constructing operating system or shell commands with unsanitized user input can lead to inadvertently running malicious code.

AWS credentials logged

Logging unencrypted AWS credentials can expose them to an attacker.

Missing Authorization CDK

Improper Access Control.

Zip bomb attack

Expanding unsanitized archive files taken as input can lead to zip bomb attacks.

Sensitive data stored unencrypted due to partial encryption

Encryption that is dependent on conditional logic, such as an if...then clause, might cause unencrypted sensitive data to be stored.

Synchronous publication of AWS Lambda metrics

Synchronous publication of AWS Lambda metrics is inefficient.

Unrestricted upload of dangerous file type

Insufficiently restrictive file uploads can lead to inadvertently running malicious code.

Pytorch redundant softmax

Detects if Softmax is used with CrossEntropyLoss.

Insecure connection using unencrypted protocol

Connections that use insecure protocols transmit data in cleartext, which can leak sensitive information.

Unauthenticated Amazon SNS unsubscribe requests might succeed

Failing to set the AuthenticateOnUnsubscribe flag to True when confirming an SNS subscription can lead to unauthenticated cancellations.

Insecure Socket Bind

Binding the socket with an empty IP address can introduce security risks.

Insecure CORS policy

Cross-Origin Resource Sharing policies that are too permissive may lead to security vulnerabilities.

Cross-site request forgery

Insecure configuration can lead to a cross-site request forgery (CRSF) vulnerability.

Garbage collection prevention in multiprocessing

Passing a parent process object in a child process can prevent its garbage collection.

Catch and rethrow exception

Catching and re-throwing an exception without further actions is redundant and wasteful.

Weak algorithm used for Password Hashing

Weak algorithm used for Password Hashing. Consider using stronger algorithms, such as Argon2, PBKDF2, or scrypt.

Missing none check on response metadata

Response metadata was not checked to verify that it is not None.

Sensitive information leak

Exposure of sensitive information can lead to an unauthorized actor having access to the information.

Client-side KMS reencryption

Client-side decryption followed by reencryption is inefficient and can lead to sensitive data leaks.

Override of reserved variable names in a Lambda function

Overriding environment variables that are reserved by AWS Lambda might lead to unexpected behavior.

Docker arbitrary container run

Passing an unsanitized user argument to a function call makes your code insecure.

Direct dict object modification

Directly modifying the __dict__ object might cause undesirable behavior due to symbol table modification.

Catastrophic backtracking regex

Inefficient regular expression patterns can lead to catastrophic backtracking.

Resource management errors cdk

Software system fails to properly track or release resources during its operation. This can lead to resource leaks.

Resource leak

Allocated resources are not released properly.

Tensorflow redundant softmax

Detects if Softmax is explicitly computed.

AWS insecure transmission CDK

The product transmits sensitive or security-critical data in cleartext in a communication channel that can be sniffed by unauthorized actors.

Public method parameter validation

Public method parameters should be validated for nullness, unexpected values, and malicious values.

Improper error handling

Improper error handling can enable attacks and lead to unwanted behavior.

Time zone aware datetimes

Using naive datetime objects might cause time zone related issues.

Pytorch control sources of randomness

Not setting seeds for the random number generators in Pytorch can lead to reproducibility issues.

Deadlocks caused by improper multiprocessing API usage

Improper multiprocessing API usage with wrong parameters might lead to deadlocks.

Low maintainability with low class cohesion

Classes with low class cohesion contain unrelated operations which make them difficult to understand and less likely to be used.

Untrusted AMI images

Improper filtering of Amazon Machine Images (AMIs) can result in loading an untrusted image, a potential security vulnerability.

Notebook invalid execution order

Notebook has uninitialized variable usage given the execution order

Confusion between equality and identity in conditional expression

Confusion between equality ==, != and identity is in conditional expressions can lead to unintended behavior.

Pytorch sigmoid before bceloss

The computation of the bceloss using sigmoid values as inputs can be replaced by a single BCEWithLogitsLoss which is numerically more stable.

Pytorch data loader with multiple workers

Using DataLoader with num_workers greater than 0 can cause increased memory consumption over time when iterating over native Python objects such as list or dict.

Pytorch avoid softmax with nllloss

Checks if Softmax is used with NLLLoss function.

Pytorch miss call to zero grad

Zero out the gradients before doing a backward pass

Error prone sequence modification

Sequence modification while iterating over it might cause unexpected bugs.

AWS missing encryption of sensitive data cdk

Sensitive or critical information is not encrypted before storage or transmission in the product.

Bad exception handling

Throwing a base or generic exception might cause important error information to be lost. This can make your code difficult to maintain.

Use of Default Credentials CDK

The product relies on default credentials(including passwords and cryptographic keys) for potentially vital functions.

Notebook variable redefinition

A variable is re-defined in multiple cells with different types.

Do not pass generic exception rule

Do not pass generic exception.

Usage of an API that is not recommended - High Severity

APIs that are not recommended were found - High Severity.

Insecure cryptography

Weak, broken, or misconfigured cryptography can lead to security vulnerabilities.

S3 partial encrypt CDK

An unencrypted bucket could lead to sensitive data exposure.

Cross-site scripting

Relying on potentially untrusted user inputs when constructing web application outputs can lead to cross-site scripting vulnerabilities.

Mutable objects as default arguments of functions

Default values in Python are created exactly once, when the function is defined. If that object is changed, subsequent calls to the function will refer to the changed object, leading to confusion.

Improper Access Control CDK

The software does not restrict or incorrectly restrict access to a resource from an unauthorized actor.

Violation of PEP8 programming recommendations

Violating PEP8 programming recommendations might make code difficult to read and can introduce ambiguity.

Insecure temporary file or directory

Insecure ways of creating temporary files and directories can lead to race conditions, privilege escalation, and other security vulnerabilities.

Complex code hard to maintain

Complex code can be difficult to read and hard to maintain.

aws kmskey encryption cdk

Using an AWS KMS key helps follow the standard security advice of granting least privilege to objects generated by the project.

Usage of an API that is not recommended

APIs that are not recommended were found.

Enabling and overriding debug feature

The Debug feature should not be enabled or overridden.

Deserialization of untrusted object

Deserialization of untrusted objects can lead to security vulnerabilities such as inadvertently running remote code.

Use of an inefficient or incorrect API

Incorrect use of API leads to ambiguity and inconsistency

Avoid using nondeterministic Tensorflow API

Detects if nondeterministic tensorflow APIs are used.

Inefficient string concatenation inside loop

Inefficient string concatenation inside loops results in new object creation which adds quadratic runtime cost.

Improper sanitization of wildcards or matching symbols

Unsanitized wildcards or special matching symbols in user-provided strings can enable attacks and lead to unwanted behavior.

Insecure hashing

Obsolete, broken, or weak hashing algorithms can lead to security vulnerabilities.

Using AutoAddPolicy or WarningPolicy

Using AutoAddPolicy or WarningPolicy can allow a malicious server to impersonate a trusted server.

Log injection

Using untrusted inputs in a log statement can enable attackers to break the log's format, forge log entries, and bypass log monitors.

Weak obfuscation of web request

Weak obfuscation while configuring a web request.

Socket close platform compatibility

The os.close() does not work on some platforms.

Unsanitized input is run as code

Scripts generated from unsanitized inputs can lead to malicious behavior and inadvertently running code remotely.

Batch request with unchecked failures

Not checking which items have failed can lead to loss of data.

Inefficient polling of AWS resource

Custom polling can be inefficient and prone to error. Consider using AWS waiters instead.

Hardcoded interface binding

Binding to all network interfaces can open a service up to traffic on interfaces that are not properly documented or secured.

Hardcoded IP address

Hardcoding an IP address can cause security problems.

Hardcoded credentials

Credentials, such as passwords and access keys, should not be hardcoded in source code.

Server-side request forgery

Insufficient sanitization of potentially untrusted URLs on the server side can allow server requests to unwanted destinations.

Module injection

Untrusted user imports in the importlib.import_module() function allow attacks.

Unnecessary iteration

Iteration when only one item is needed from a list is inefficient.

Tensorflow control sources of randomness

Detects if a random seed is set before random number generation.

Missing Authentication for Critical Function CDK

Missing authentication checks can lead to unauthorized access to a resource or performance of an action.

Usage of an API that is not recommended - Medium Severity

APIs that are not recommended were found - Medium Severity.

Unsafe Cloudpickle Load

Pickling issues on Cloudpickle Load.

Incorrect binding of SNS publish operations

Incorrect binding of SNS publish operations with the subscribe or create_topic operations might lead to latency issues.

PyTorch create tensors directly on device

Creating PyTorch tensors on the CPU and then moving them to the device is inefficient.

Inefficient new method from hashlib

The constructors for the hashlib module are faster than new()

Dangerous global variables

Global variables can be dangerous and cause bugs because they can be simultaneously accessed from multiple sections of a program.

Multiple values in return statement is prone to error

Methods that return multiple values can be difficult to read and prone to error.

LDAP injection

LDAP queries that rely on potentially untrusted inputs can allow attackers to read or modify sensitive data, run code, and perform other unwanted actions.

Clear text credentials

Credentials that are stored in clear text can be intercepted by a malicious actor.

Missing S3 bucket owner condition

Not setting the S3 bucket owner condition might introduce a risk of accidentally using a wrong bucket.

AWS missing encryption CDK

The AWS resource is missing appropriate encryption.