visma-prodsec / confused

Tool to check for dependency confusion vulnerabilities in multiple package management systems
MIT License
701 stars 93 forks source link

pip false positive #26

Open geeknik opened 3 years ago

geeknik commented 3 years ago

Hello and thank you for a great research project. I have found that if a requirements.txt includes a package followed by a ;, it will alert on said package even if said package does exist.

Example:

affine~=2.3.0
attrs>=19.2.0
boto3>=1.2.4
click~=7.1.0
click-plugins
cligj>=0.5
enum34; python_version < "3.4"
matplotlib
numpy>=1.10
snuggs~=1.4.0
setuptools>=20.0

Result:

confused -l pip requirements.txt
Issues found, the following packages are not available in public package repositories:
 [!] enum34;