import hashlib
import binascii
import ssl
import socket
# Using the deprecated ssl.wrap_socket method
ssl.wrap_socket(socket.socket(), ssl_version=ssl.PROTOCOL_SSLv2)
# Using SSLContext
context = ssl.SSLContext(ssl_version=ssl.PROTOCOL_SSLv3)
# Using pyOpenSSL
from pyOpenSSL import SSL
context = SSL.Context(SSL.TLSv1_METHOD)
CONFIG_FILE = 'passwords.json'
def redirect(args):
pass
def load_from_config(pass_key, config_file):
pass
def test_credentials_severity_error_lgtm(request):
password = request.GET["password"]
# BAD:
# Authentication made by comparison to string literal
# -*- coding: utf-8 -*-
import ssl
from pyOpenSSL import SSL
ssl.wrap_socket(ssl_version=ssl.PROTOCOL_SSLv2)
SSL.Context(method=SSL.SSLv2_METHOD)
SSL.Context(method=SSL.SSLv23_METHOD)
herp_derp(ssl_version=ssl.PROTOCOL_SSLv2)
herp_derp(method=SSL.SSLv2_METHOD)
herp_derp(method=SSL.SSLv23_METHOD)
# strict tests
ssl.wrap_socket(ssl_version=ssl.PROTOCOL_SSLv3)
ssl.wrap_socket(ssl_version=ssl.PROTOCOL_TLSv1)
SSL.Context(method=SSL.SSLv3_METHOD)
SSL.Context(method=SSL.TLSv1_METHOD)
herp_derp(ssl_version=ssl.PROTOCOL_SSLv3)
herp_derp(ssl_version=ssl.PROTOCOL_TLSv1)
herp_derp(method=SSL.SSLv3_METHOD)
herp_derp(method=SSL.TLSv1_METHOD)
ssl.wrap_socket()
def open_ssl_socket(version=ssl.PROTOCOL_SSLv2):
pass
def open_ssl_socket(version=SSL.SSLv2_METHOD):
import ssl from pyOpenSSL import SSL from ssl import SSLContext # true positives ssl.wrap_socket(ssl_version=ssl.PROTOCOL_SSLv2) ssl.wrap_socket(ssl_version=ssl.PROTOCOL_SSLv3) ssl.wrap_socket(ssl_version=ssl.PROTOCOL_TLSv1) SSLContext(protocol=ssl.PROTOCOL_SSLv2) SSLContext(protocol=ssl.PROTOCOL_SSLv3) SSLContext(protocol=ssl.PROTOCOL_TLSv1) SSL.Context(SSL.SSLv2_METHOD) SSL.Context(SSL.SSLv23_METHOD) SSL.Context(SSL.SSLv3_METHOD) SSL.Context(SSL.TLSv1_METHOD) # not relevant wrap_socket(ssl_version=ssl.PROTOCOL_SSLv3) wrap_socket(ssl_version=ssl.PROTOCOL_TLSv1) wrap_socket(ssl_version=ssl.PROTOCOL_SSLv2) Context(SSL.SSLv3_METHOD) Context(SSL.TLSv1_METHOD) Context(SSL.SSLv2_METHOD) Context(SSL.SSLv23_METHOD) # true positive using flow METHOD = SSL.SSLv2_METHOD