I'd like to analyze if my Python command line application suffers from known security vulnerabilities (preferably with a tool written in Python, free Python cross-platform for Ubuntu Linux, Mac OS X, Windows 10). Right now I am using the static analyzer bandit which performs analysis based on the abstract syntax tree. I know another static analyzer pyt which analyzes the abstract syntax tree, generates the control flow graph (CFG) and analyzes the CFG. However as far as I know it is meant to be run with a web framework specific adapter. Is pyt suitable/adaptable for/to command line applications as well? Does someone know other Python security vulnerability analysis tools?
Add a comment
|
1 Answer
pyt is suitable for command line applications when using the adapter Every via option -a e.g. pyt -a Every -r <package>. The adapter Every restricts to inputs ("triggers") which include the command line app specific input sys.argv. (Web framework specific adapters consider framework specific inputs /"triggers" as well which are not required in case of a command line applications.) For more info refer to this pyt repository issue.