You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
The BadNameAttributeUseLinter helper currently supports normal variable instantiation of an object, e.g.
deffunc():
foo=Foo()
bar=foo.bad_function() # Caught by BadNameAttributeUseLinterprint(bar)
However, the helper does not support instantiation via the with statement, e.g.
deffunc():
withFoo() asfoo:
bar=foo.bad_function() # Not caught by BadNameAttributeUseLinter, yetprint(bar)
This pattern is not as common as normal variable instantiation, however, it is worth detecting. One of our initial reasons for adding this helper was to catch insecure behavior in tarfile and zipfile, and both of these libraries have a common pattern of instantiation via the with statement.
Let's add context manager variable instantiation support to BadNameAttributeUseLinter.
The text was updated successfully, but these errors were encountered:
mschwager
changed the title
Code Issues 14 Pull requests 1 Actions Projects 0 Wiki Security Insights Add 'with' variable instantiation detection to BadNameAttributeUseLinter
Add 'with' variable instantiation detection to BadNameAttributeUseLinter
Jan 10, 2020
I.e. Context managers.
The
BadNameAttributeUseLinter
helper currently supports normal variable instantiation of an object, e.g.However, the helper does not support instantiation via the
with
statement, e.g.This pattern is not as common as normal variable instantiation, however, it is worth detecting. One of our initial reasons for adding this helper was to catch insecure behavior in
tarfile
andzipfile
, and both of these libraries have a common pattern of instantiation via thewith
statement.Let's add context manager variable instantiation support to
BadNameAttributeUseLinter
.The text was updated successfully, but these errors were encountered: