604ca79759
This replaces the existing hardcoded password test with a number of smarter tests. None of the new tests utilize a word dictionary, we now trigger the warnings based on matching variable names and the like against a list of candidate names: - "password" - "pass" - "passwd" - "pwd" - "secret" - "token" hardcoded_password_string looks for: candidate = "some_string_literal" dict[candidate] = "some_string_literal" candidate == "some_string_literal" hardcoded_password_funcarg looks for: func_call(candidate="some_string_literal") hardcoded_password_default looks for: def func_def(candidate="some_string_literal"): All issues are reported as MEDIUM confidence, LOW severity Closes-bug: #1502348 Closes-bug: #1502343 Closes-bug: #1432887 Change-Id: I36d97ee838a7f08234b759c352649721d07e8ab0
19 lines
403 B
Python
19 lines
403 B
Python
def someFunction(user, password="Admin"):
|
|
print("Hi " + user)
|
|
|
|
def someFunction2(password):
|
|
if password == "root":
|
|
print("OK, logged in")
|
|
|
|
def noMatch(password):
|
|
if password == '':
|
|
print("No password!")
|
|
|
|
def NoMatch2(password):
|
|
if password == "ajklawejrkl42348swfgkg":
|
|
print("Nice password!")
|
|
|
|
doLogin(password="blerg")
|
|
password = "blerg"
|
|
d["password"] = "blerg"
|