rica/insecure_code_detector

1#### examples of secure code
2
3
41. def findAverage(list): sum = 0. for x in list: sum = sum + x average = sum / len(list) return average
5
62. def findMax(list): max = list[0] for x in list: if x > max: max = x return max
7
83. def findRange(list): return max(list)-min(list)
9
104. def rng(): return random.randint(0,9)
11
125. def search(arr, low, high, x): if high >= low: mid = (high + low) // 2 if arr[mid] == x: return mid elif arr[mid] > x: return search(arr, low, mid - 1, x) else: return search(arr, mid + 1, high, x) else: return -1
13
14
15#### examples of insecure code
16(obtained from https://hackernoon.com/10-common-security-gotchas-in-python-and-how-to-avoid-them-e19fbe265e03
17 and from http://www.pvv.org/~oma/InsecureCodingC_NDC_June2014.pdf)
18
191.
20import subprocess
21def transcode_file(request, filename): 
22  command = 'ffmpeg -i '{source}' output_file.mpg'.format(source=filename) 
23  subprocess.call(command, shell=True)
24
252.
26def foo(request, user): assert user.is_admin, “user does not have access”
27
283.
29void authenticate_and_launch(void)
30{
31 int n_missiles = 2;
32 bool allowaccess = false;
33 char response[8];
34 printf("Secret: ");
35 gets(response);
36 if (strcmp(response, "Joshua") == 0)
37 allowaccess = true;
38 if (allowaccess) {
39 puts("Access granted");
40 launch_missiles(n_missiles);
41 }
42 if (!allowaccess)
43 puts("Access denied");
44
45
46