1

I'd like to analyze if my Python command line application suffers from known security vulnerabilities (preferably with a tool written in Python, free Python cross-platform for Ubuntu Linux, Mac OS X, Windows 10). Right now I am using the static analyzer bandit which performs analysis based on the abstract syntax tree. I know another static analyzer pyt which analyzes the abstract syntax tree, generates the control flow graph (CFG) and analyzes the CFG. However as far as I know it is meant to be run with a web framework specific adapter. Is pyt suitable/adaptable for/to command line applications as well? Does someone know other Python security vulnerability analysis tools?

1 Answer 1

0

pyt is suitable for command line applications when using the adapter Every via option -a e.g. pyt -a Every -r <package>. The adapter Every restricts to inputs ("triggers") which include the command line app specific input sys.argv. (Web framework specific adapters consider framework specific inputs /"triggers" as well which are not required in case of a command line applications.) For more info refer to this pyt repository issue.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge that you have read and understand our privacy policy and code of conduct.

Not the answer you're looking for? Browse other questions tagged or ask your own question.