Astvuln is a simple AST scanner which recursively scans a directory, parses each file as AST and runs specified method.

Overview

Astvuln

Astvuln is a simple AST scanner which recursively scans a directory, parses each file as AST and runs specified method. Some search methods are provided with the tool and can be found under ./src/visitors/ in common.py and custom.py but most methods are not included in the repository. To add a new search method edit one of existing files and add a new class. The simplest way is to extend it from AstVisitor class. Implement query logic using generic_visit/visit_{class}.

This tool was developed for research purposes with the idea to explore potential vulnerable patterns when a new type of bug is discovered in our code. We can use such patterns to potentially find new similar bugs. AST code patterns which have sufficiently low false positive rate should then be included in SAST automation.

Usage

Astvuln: Search Python code for AST patterns.
Usage: 
   
     [-a 
    
     ][-h][-e 
     
      ][-g][-c][-n][-p 
      
       ][-s 
       
        ] Options: -a|--args 
        
          Arguments for method -h|--help Show help and exit -e|--extensions 
         
           Extensions to process -g|--grepable Make results easier to grep -c|--no-colors Don't print colors -n|--no-source Don't print source code -p|--path 
          
            Starting directory -s|--skip 
           
             Paths to skip Common methods: assign Find assignements with matching names (name) call Find all function calls with matching name (name, path) class Find all classes with matching name (name) constant Find all constants with matching value (name) dict Find all dicts with matching item constant value (name) dump Dump AST function Find all functions and methods with matching name (name) list Find all lists with matching constant value (name) name Find all matching names (name) print Print node names test Do nothing Custom methods: forelse Search for `for` loops with `else` clause which seems to always trigger replace_with_substring Search for replace of a string with a substring or an empty string unused_classes Find classes which are never directly referenced by name (ignore) Reading methods from file: Run method "file" and pass filename in method arguments to run multiple methods in a single run. Each method needs to be specified in a single line and colon-seperated from arguments. E. g. "./astvuln foo -a bar,baz" would be translated to: foo:bar,baz Examples: ./astvuln -h # Print help ./astvuln print -c # Run method `print` without color output ./astvuln dump -p dir # Run method `dump` on directory `dir` ./astvuln call -a bytes # Run method `call` with argument `bytes` ./astvuln foo -a a=1,b=2 # Run method `foo` with arguments a = 1 and b = 2 ./astvuln file -a methods.txt # Run multiple methods specified in a file 
           
          
         
        
       
      
     
    
   

License

Astvuln is released under the MIT License.

Owner
Bitstamp Security
Security team at Bitstamp cryptocurrency exchange
Bitstamp Security
Adding two matrix from scratch using python.

Adding-two-matrix-from-scratch-using-python. Here, I have take two matrix from user and add it without using any library. I made this program from scr

Sachin Vinayak Dabhade 4 Sep 24, 2021
Random Name and Slug Generator

Random Name and Slug Generator

Alexander Lukanin 104 Nov 30, 2022
DUQ is a python package for working with physical Dimensions, Units, and Quantities.

DUQ is a python package for working with physical Dimensions, Units, and Quantities.

2 Nov 02, 2022
Simple script to export contacts from telegram into vCard file

Telegram Contacts Exporter Simple script to export contacts from telegram into vCard file Getting Started Prerequisites You must to put your Telegram

Pere Antoni 1 Oct 17, 2021
Hot reloading for Python

Hot reloading for Python

Olivier Breuleux 769 Jan 03, 2023
Random Number Generator Analysis With Python

Random-Number-Generator-Analysis Governor's Honors Program Project to determine

Jack Prewitt 2 Jan 23, 2022
Etherium unit conversation and arithmetic library

etherunit Etherium unit conversation and arithmetic library Install pip install -u etherunit Usage from etherunit import Ether, Gwei, Wei, E Creat

Yasin Özel 1 Nov 10, 2021
UUID version 7, which are time-sortable (following the Peabody RFC4122 draft)

uuid7 - time-sortable UUIDs This module implements the version 7 UUIDs, proposed by Peabody and Davis in https://www.ietf.org/id/draft-peabody-dispatc

Steve Simmons 22 Dec 20, 2022
Export watched content from Tautulli to the Letterboxd CSV Import Format

Export watched content from Tautulli to the Letterboxd CSV Import Format

Evan J 5 Aug 31, 2022
Install, run, and update apps without root and only in your home directory

Qube Apps Install, run, and update apps in the private storage of a Qube Building instrutions

Micah Lee 26 Dec 27, 2022
A Randomizer Oracle

Tezos Randomizer Tezod Randomizer "Oracle". It's a smart contract that you can call to get a random number between X and Y (for now). It uses entropy

Asbjorn Enge 19 Sep 13, 2022
The git for the Python Story Utility Package library.

SUP The git for the Python Story Utility Package library. Installation: Install SUP by simply running pip install psup in your terminal. Check out our

Enoki 6 Nov 27, 2022
Run async workflows using pytest-fixtures-style dependency injection

Run async workflows using pytest-fixtures-style dependency injection

Simon Willison 26 Jun 26, 2022
Report Bobcat Status to Google Sheets

bobcat-status-reporter Report Bobcat Status to Google Sheets Why? I recently relocated my miner from my root into the attic. Bobcat recommends operati

Jasmit Tarang 3 Sep 22, 2021
Daiho Tool is a Script Gathering for Windows/Linux systems written in Python.

Daiho is a Script Developed with Python3. It gathers a total of 22 Discord tools (including a RAT, a Raid Tool, a Nuker Tool, a Token Grabberr, etc). It has a pleasant and intuitive interface to faci

AstraaDev 32 Jan 05, 2023
Let's renew the puzzle collection. We'll produce a collection of new puzzles out of the lichess game database.

Let's renew the puzzle collection. We'll produce a collection of new puzzles out of the lichess game database.

Thibault Duplessis 96 Jan 03, 2023
The Black shade analyser and comparison tool.

diff-shades The Black shade analyser and comparison tool. AKA Richard's personal take at a better black-primer (by stealing ideas from mypy-primer) :p

Richard Si 10 Apr 29, 2022
A color library based on pokemons colors!

pokepalette A simple pokemon color chooser " This repo is based on CDWimmer/PokePalette and was originated from this tweet. If you don't remember your

Thomas Capelle 5 Aug 30, 2021
Python script to get some stats on nodes in a Blender material nodetree

Python script to get some stats on nodes in a Blender material nodetree. It counts the nodes, the node types and the max deep level for group nodes.

Alek Mugnozzo 2 Sep 03, 2022
Trying to replicate (albeit unsuccessfully) the phenomenon of boids using Ursina in a naive manner.

Boids_Boi Trying to replicate (albeit unsuccessfully) the phenomenon of boids using Ursina in a naive manner. Please install the Ursina module before

2 Oct 19, 2021