I'd like to analyze if my Python command line application suffers from known security vulnerabilities (preferably with a tool written in Python, free Python cross-platform for Ubuntu Linux, Mac OS X, Windows 10). Right now I am using the static analyzer bandit which performs analysis based on the abstract syntax tree. I know another static analyzer pyt which analyzes the abstract syntax tree, generates the control flow graph (CFG) and analyzes the CFG. However as far as I know it is meant to be run with a web framework specific adapter. Is pyt
suitable/adaptable for/to command line applications as well? Does someone know other Python security vulnerability analysis tools?
1 Answer
pyt
is suitable for command line applications when using the adapter Every
via option -a
e.g. pyt -a Every -r <package>
. The adapter Every
restricts to inputs ("triggers") which include the command line app specific input sys.argv
. (Web framework specific adapters consider framework specific inputs /"triggers" as well which are not required in case of a command line applications.) For more info refer to this pyt repository issue.