Q
Detector Library
Python detectors (131/131)
Improper privilege managementSpawning a process without main moduleInteger overflowCatch and swallow exceptionInsufficient Logging CDKUnauthenticated LDAP requestsPath traversalLoose file permissionsExposure of Sensitive Information CDKFile injectionIncorrect use of Process.terminate APIXML External EntityPytorch use nondeterministic algoritmSet SNS Return Subscription ARNTensorflow enable ops determinismOutdated subprocess module APIImproper input validationImproper authenticationMissing paginationSemaphore overflow preventionInsecure cookieUsage of an API that is not recommended - Low SeveritySocket connection timeoutAWS client not reused in a Lambda functionPytorch assign in place modLeaky subprocess timeoutPytorch disable gradient calculationRisky use of dict get methodXPath injectionMissing authorizationMultidimensional list initialization using replication is error proneSQL injectionPytorch miss call to evalAWS AppConfigImproper certificate validationURL redirection to untrusted siteMutually exclusive callNotebook best practice violationStack trace exposureUse of a deprecated methodAWS api logging disabled cdkOS command injectionAWS credentials loggedMissing Authorization CDKZip bomb attackSensitive data stored unencrypted due to partial encryptionSynchronous publication of AWS Lambda metricsUnrestricted upload of dangerous file typePytorch redundant softmaxInsecure connection using unencrypted protocolUnauthenticated Amazon SNS unsubscribe requests might succeedInsecure Socket BindInsecure CORS policyCross-site request forgeryGarbage collection prevention in multiprocessingCatch and rethrow exceptionWeak algorithm used for Password HashingMissing none check on response metadataSensitive information leakClient-side KMS reencryptionOverride of reserved variable names in a Lambda functionDocker arbitrary container runDirect dict object modificationCatastrophic backtracking regexResource management errors cdkResource leakTensorflow redundant softmaxAWS insecure transmission CDKPublic method parameter validationImproper error handlingTime zone aware datetimesPytorch control sources of randomnessDeadlocks caused by improper multiprocessing API usageLow maintainability with low class cohesionUntrusted AMI imagesNotebook invalid execution orderConfusion between equality and identity in conditional expressionPytorch sigmoid before bcelossPytorch data loader with multiple workersPytorch avoid softmax with nlllossPytorch miss call to zero gradError prone sequence modificationAWS missing encryption of sensitive data cdkBad exception handlingUse of Default Credentials CDKNotebook variable redefinitionDo not pass generic exception ruleUsage of an API that is not recommended - High SeverityInsecure cryptographyS3 partial encrypt CDKCross-site scriptingMutable objects as default arguments of functionsImproper Access Control CDKViolation of PEP8 programming recommendationsInsecure temporary file or directoryComplex code hard to maintainaws kmskey encryption cdkUsage of an API that is not recommendedEnabling and overriding debug featureDeserialization of untrusted objectUse of an inefficient or incorrect APIAvoid using nondeterministic Tensorflow APIInefficient string concatenation inside loopImproper sanitization of wildcards or matching symbolsInsecure hashingUsing AutoAddPolicy or WarningPolicyLog injectionWeak obfuscation of web requestSocket close platform compatibilityUnsanitized input is run as codeBatch request with unchecked failuresInefficient polling of AWS resourceHardcoded interface bindingHardcoded IP addressHardcoded credentialsServer-side request forgeryModule injectionUnnecessary iterationTensorflow control sources of randomnessMissing Authentication for Critical Function CDKUsage of an API that is not recommended - Medium SeverityUnsafe Cloudpickle LoadIncorrect binding of SNS publish operationsPyTorch create tensors directly on deviceInefficient new method from hashlibDangerous global variablesMultiple values in return statement is prone to errorLDAP injectionClear text credentialsMissing S3 bucket owner conditionAWS missing encryption CDK
Tag: efficiency
Insufficient Logging CDK
In the case of a security-critical event, the product fails to either log the event or misses crucial details in the logged information.
Exposure of Sensitive Information CDK
The product unintentionally grants unauthorized actors access to a resource by placing it in the wrong control sphere.
AWS client not reused in a Lambda function
Recreating AWS clients in each Lambda function invocation is expensive.
Pytorch disable gradient calculation
Checks if gradient calculation is disabled during evaluation.
AWS api logging disabled cdk
Api Logging Disabled may lead to unable to access log and does not record the event.
Missing Authorization CDK
Improper Access Control.
Synchronous publication of AWS Lambda metrics
Synchronous publication of AWS Lambda metrics is inefficient.
Catch and rethrow exception
Catching and re-throwing an exception without further actions is redundant and wasteful.
Catastrophic backtracking regex
Inefficient regular expression patterns can lead to catastrophic backtracking.
Resource management errors cdk
Software system fails to properly track or release resources during its operation. This can lead to resource leaks.
AWS insecure transmission CDK
The product transmits sensitive or security-critical data in cleartext in a communication channel that can be sniffed by unauthorized actors.
Pytorch data loader with multiple workers
Using DataLoader with
num_workers greater than 0 can cause increased memory consumption over time when iterating over native Python objects such as list or dict.AWS missing encryption of sensitive data cdk
Sensitive or critical information is not encrypted before storage or transmission in the product.
Use of Default Credentials CDK
The product relies on default credentials(including passwords and cryptographic keys) for potentially vital functions.
Improper Access Control CDK
The software does not restrict or incorrectly restrict access to a resource from an unauthorized actor.
aws kmskey encryption cdk
Using an AWS KMS key helps follow the standard security advice of granting least privilege to objects generated by the project.
Enabling and overriding debug feature
The Debug feature should not be enabled or overridden.
Use of an inefficient or incorrect API
Incorrect use of API leads to ambiguity and inconsistency
Inefficient string concatenation inside loop
Inefficient string concatenation inside loops results in new object creation which adds quadratic runtime cost.
Inefficient polling of AWS resource
Custom polling can be inefficient and prone to error. Consider using AWS waiters instead.
Unnecessary iteration
Iteration when only one item is needed from a list is inefficient.
Missing Authentication for Critical Function CDK
Missing authentication checks can lead to unauthorized access to a resource or performance of an action.
PyTorch create tensors directly on device
Creating PyTorch tensors on the CPU and then moving them to the device is inefficient.
Inefficient new method from hashlib
The constructors for the
hashlib module are faster than new()