Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

Not all use of ftplib is insecure #148

Closed
ericwb opened this issue Apr 27, 2018 · 2 comments · Fixed by #1149
Closed

Not all use of ftplib is insecure #148

ericwb opened this issue Apr 27, 2018 · 2 comments · Fixed by #1149
Labels
bug Something isn't working

Comments

@ericwb
Copy link
Member

ericwb commented Apr 27, 2018

Some use of ftplib is properly secure. See https://docs.python.org/2/library/ftplib.html

Specifically using ftplib.FTP_TLS mode is okay, where as ftplib.FTP is not.
@ericwb ericwb closed this as completed Apr 27, 2018
@strugee
Copy link

strugee commented Jan 25, 2024

@ericwb was this closed by mistake? At $work we're hitting this false positive in Bandit 1.7.5.

@ericwb
Copy link
Member Author

ericwb commented Jan 25, 2024

Possibly. We do have the following that finds cases of ftplib calls, but it doesn't distinguish between FTP and FTP_TLS.

https://bandit.readthedocs.io/en/latest/blacklists/blacklist_calls.html#b321-ftplib

@ericwb ericwb reopened this Jan 25, 2024
ericwb added a commit to ericwb/bandit that referenced this issue Jun 23, 2024
@ericwb
Add test for usage of FTP_TLS
a339b15 
This change adds an FTP_TLS call to the examples. A high severity
error is no longer reported as a result of the fix in PR PyCQA#1148
that explicitly now matches blacklist call qualified names rather
than using a file glob.

However, you will notice that there is one more high severity
issue reported in the tests as a result of the import of
ftplib.FTP_TLS because the blacklist import is only checking for
"ftplib".

Fixes: PyCQA#148

Signed-off-by: Eric Brown <eric_wade_brown@yahoo.com>
@ericwb ericwb mentioned this issue Jun 23, 2024
Merged
@ericwb ericwb added the bug Something isn't working label Jun 23, 2024
@ericwb ericwb closed this as completed in 6142b7a Jun 24, 2024
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Assignees
No one assigned
Labels
bug Something isn't working
Projects
None yet
Milestone
No milestone
Development

Successfully merging a pull request may close this issue.

Add test for usage of FTP_TLS ericwb/bandit
2 participants
@strugee @ericwb