Q
Detector Library
Python detectors (131/131)
Improper privilege managementSpawning a process without main moduleInteger overflowCatch and swallow exceptionInsufficient Logging CDKUnauthenticated LDAP requestsPath traversalLoose file permissionsExposure of Sensitive Information CDKFile injectionIncorrect use of Process.terminate APIXML External EntityPytorch use nondeterministic algoritmSet SNS Return Subscription ARNTensorflow enable ops determinismOutdated subprocess module APIImproper input validationImproper authenticationMissing paginationSemaphore overflow preventionInsecure cookieUsage of an API that is not recommended - Low SeveritySocket connection timeoutAWS client not reused in a Lambda functionPytorch assign in place modLeaky subprocess timeoutPytorch disable gradient calculationRisky use of dict get methodXPath injectionMissing authorizationMultidimensional list initialization using replication is error proneSQL injectionPytorch miss call to evalAWS AppConfigImproper certificate validationURL redirection to untrusted siteMutually exclusive callNotebook best practice violationStack trace exposureUse of a deprecated methodAWS api logging disabled cdkOS command injectionAWS credentials loggedMissing Authorization CDKZip bomb attackSensitive data stored unencrypted due to partial encryptionSynchronous publication of AWS Lambda metricsUnrestricted upload of dangerous file typePytorch redundant softmaxInsecure connection using unencrypted protocolUnauthenticated Amazon SNS unsubscribe requests might succeedInsecure Socket BindInsecure CORS policyCross-site request forgeryGarbage collection prevention in multiprocessingCatch and rethrow exceptionWeak algorithm used for Password HashingMissing none check on response metadataSensitive information leakClient-side KMS reencryptionOverride of reserved variable names in a Lambda functionDocker arbitrary container runDirect dict object modificationCatastrophic backtracking regexResource management errors cdkResource leakTensorflow redundant softmaxAWS insecure transmission CDKPublic method parameter validationImproper error handlingTime zone aware datetimesPytorch control sources of randomnessDeadlocks caused by improper multiprocessing API usageLow maintainability with low class cohesionUntrusted AMI imagesNotebook invalid execution orderConfusion between equality and identity in conditional expressionPytorch sigmoid before bcelossPytorch data loader with multiple workersPytorch avoid softmax with nlllossPytorch miss call to zero gradError prone sequence modificationAWS missing encryption of sensitive data cdkBad exception handlingUse of Default Credentials CDKNotebook variable redefinitionDo not pass generic exception ruleUsage of an API that is not recommended - High SeverityInsecure cryptographyS3 partial encrypt CDKCross-site scriptingMutable objects as default arguments of functionsImproper Access Control CDKViolation of PEP8 programming recommendationsInsecure temporary file or directoryComplex code hard to maintainaws kmskey encryption cdkUsage of an API that is not recommendedEnabling and overriding debug featureDeserialization of untrusted objectUse of an inefficient or incorrect APIAvoid using nondeterministic Tensorflow APIInefficient string concatenation inside loopImproper sanitization of wildcards or matching symbolsInsecure hashingUsing AutoAddPolicy or WarningPolicyLog injectionWeak obfuscation of web requestSocket close platform compatibilityUnsanitized input is run as codeBatch request with unchecked failuresInefficient polling of AWS resourceHardcoded interface bindingHardcoded IP addressHardcoded credentialsServer-side request forgeryModule injectionUnnecessary iterationTensorflow control sources of randomnessMissing Authentication for Critical Function CDKUsage of an API that is not recommended - Medium SeverityUnsafe Cloudpickle LoadIncorrect binding of SNS publish operationsPyTorch create tensors directly on deviceInefficient new method from hashlibDangerous global variablesMultiple values in return statement is prone to errorLDAP injectionClear text credentialsMissing S3 bucket owner conditionAWS missing encryption CDK
Code Quality detectors
Catch and swallow exception
Swallowing exceptions, without re-throwing or logging them, is a bad practice.
Insufficient Logging CDK
In the case of a security-critical event, the product fails to either log the event or misses crucial details in the logged information.
Exposure of Sensitive Information CDK
The product unintentionally grants unauthorized actors access to a resource by placing it in the wrong control sphere.
Incorrect use of Process.terminate API
The
Process.terminate API might cause data corruption of shared resources.Pytorch use nondeterministic algoritm
APIs with nondeterministic algorithm are used
Set SNS Return Subscription ARN
To always return the subscription ARN, set the
ReturnSubscriptionArn argument to True.Tensorflow enable ops determinism
Non-deterministic ops might return different outputs when run with the same inputs.
Outdated subprocess module API
Using outdated multiprocessing API calls and parameters is not recommended.
Semaphore overflow prevention
When you process and remove an item from the
JoinableQueue without calling JoinableQueue.task_done(), a semaphore overflow exception might be thrown.AWS client not reused in a Lambda function
Recreating AWS clients in each Lambda function invocation is expensive.
Pytorch assign in place mod
Detects if a torch variable is modified in place inside an assignment.
Leaky subprocess timeout
Failure to end a child process that doesn't terminate before its timeout expires can result in leaked resources.
Pytorch disable gradient calculation
Checks if gradient calculation is disabled during evaluation.
Risky use of dict get method
Using the
get method from the dict class without default values can cause runtime exceptions.Multidimensional list initialization using replication is error prone
list replication using replication operator creates references to the existing objects, not copies, which could introduce bugs.Pytorch miss call to eval
Checks if eval() is called before validating or testing a model.
AWS AppConfig
Always check for new version before fetching the latest version directly.
Notebook best practice violation
Best practices to improve the maintainability of notebooks.
Use of a deprecated method
This code uses deprecated methods, which suggests that it has not been recently reviewed or maintained.
Synchronous publication of AWS Lambda metrics
Synchronous publication of AWS Lambda metrics is inefficient.
Pytorch redundant softmax
Detects if Softmax is used with CrossEntropyLoss.
Catch and rethrow exception
Catching and re-throwing an exception without further actions is redundant and wasteful.
Missing none check on response metadata
Response metadata was not checked to verify that it is not
None.Direct dict object modification
Directly modifying the
__dict__ object might cause undesirable behavior due to symbol table modification.Catastrophic backtracking regex
Inefficient regular expression patterns can lead to catastrophic backtracking.
Tensorflow redundant softmax
Detects if Softmax is explicitly computed.
Improper error handling
Improper error handling can enable attacks and lead to unwanted behavior.
Time zone aware datetimes
Using naive datetime objects might cause time zone related issues.
Pytorch control sources of randomness
Not setting seeds for the random number generators in Pytorch can lead to reproducibility issues.
Deadlocks caused by improper multiprocessing API usage
Improper multiprocessing API usage with wrong parameters might lead to deadlocks.
Low maintainability with low class cohesion
Classes with low class cohesion contain unrelated operations which make them difficult to understand and less likely to be used.
Notebook invalid execution order
Notebook has uninitialized variable usage given the execution order
Confusion between equality and identity in conditional expression
Confusion between equality
==, != and identity is in conditional expressions can lead to unintended behavior.Pytorch sigmoid before bceloss
The computation of the bceloss using sigmoid values as inputs can be replaced by a single BCEWithLogitsLoss which is numerically more stable.
Pytorch data loader with multiple workers
Using DataLoader with
num_workers greater than 0 can cause increased memory consumption over time when iterating over native Python objects such as list or dict.Pytorch avoid softmax with nllloss
Checks if
Softmax is used with NLLLoss function.Pytorch miss call to zero grad
Zero out the gradients before doing a backward pass
Error prone sequence modification
Sequence modification while iterating over it might cause unexpected bugs.
Bad exception handling
Throwing a base or generic exception might cause important error information to be lost. This can make your code difficult to maintain.
Use of Default Credentials CDK
The product relies on default credentials(including passwords and cryptographic keys) for potentially vital functions.
Notebook variable redefinition
A variable is re-defined in multiple cells with different types.
Do not pass generic exception rule
Do not pass generic exception.
Mutable objects as default arguments of functions
Default values in Python are created exactly once, when the function is defined. If that object is changed, subsequent calls to the function will refer to the changed object, leading to confusion.
Improper Access Control CDK
The software does not restrict or incorrectly restrict access to a resource from an unauthorized actor.
Violation of PEP8 programming recommendations
Violating PEP8 programming recommendations might make code difficult to read and can introduce ambiguity.
Complex code hard to maintain
Complex code can be difficult to read and hard to maintain.
Enabling and overriding debug feature
The Debug feature should not be enabled or overridden.
Use of an inefficient or incorrect API
Incorrect use of API leads to ambiguity and inconsistency
Avoid using nondeterministic Tensorflow API
Detects if nondeterministic tensorflow APIs are used.
Inefficient string concatenation inside loop
Inefficient string concatenation inside loops results in new object creation which adds quadratic runtime cost.
Socket close platform compatibility
The
os.close() does not work on some platforms.Batch request with unchecked failures
Not checking which items have failed can lead to loss of data.
Inefficient polling of AWS resource
Custom polling can be inefficient and prone to error. Consider using AWS waiters instead.
Unnecessary iteration
Iteration when only one item is needed from a list is inefficient.
Tensorflow control sources of randomness
Detects if a random seed is set before random number generation.
Missing Authentication for Critical Function CDK
Missing authentication checks can lead to unauthorized access to a resource or performance of an action.
Incorrect binding of SNS publish operations
Incorrect binding of SNS publish operations with the
subscribe or create_topic operations might lead to latency issues.PyTorch create tensors directly on device
Creating PyTorch tensors on the CPU and then moving them to the device is inefficient.
Inefficient new method from hashlib
The constructors for the
hashlib module are faster than new()Dangerous global variables
Global variables can be dangerous and cause bugs because they can be simultaneously accessed from multiple sections of a program.
Multiple values in return statement is prone to error
Methods that return multiple values can be difficult to read and prone to error.