search

securesauce / precli

Precaution CLI - command line static application security testing tool
https://precli.readthedocs.io/
Other
22 stars 3 forks source link

Rule check on SimpleXMLRPCServer.register_instance with allow_dotted_names parameter #399

Open ericwb opened 7 months ago

ericwb commented 7 months ago

Is your feature request related to a problem? Please describe. As stated in the Python docs:

"Enabling the allow_dotted_names option allows intruders to access your module’s global variables and may allow intruders to execute arbitrary code on your machine. Only use this option on a secure, closed network. "

Describe the solution you'd like New rule to check for this call and parameter.

Describe alternatives you've considered n/a

Additional context https://docs.python.org/3/library/xmlrpc.server.html#xmlrpc.server.SimpleXMLRPCServer.register_instance

Love this idea? Give it a 👍. We prioritize fulfilling features with the most 👍.