Ruff
902 rules ruff@0.16.8
Complete effective rule inventory.
Rules
No enabled Ruff rules match this search.
-
S305Use of insecure block cipher mode, replace with a known secure mode such as CBC or CTR
-
S306Use of insecure and deprecated function (
mktemp) -
S307Use of possibly insecure function; consider using
ast.literal_eval -
S308Use of
mark_safemay expose cross-site scripting vulnerabilities -
S310Audit URL open for permitted schemes. Allowing use of
file:or custom schemes is often unexpected. -
S311Standard pseudo-random generators are not suitable for cryptographic purposes
-
S312Telnet is considered insecure. Use SSH or some other encrypted protocol.
-
S313Using
xmlto parse untrusted data is known to be vulnerable to XML attacks; usedefusedxmlequivalents -
S314Using
xmlto parse untrusted data is known to be vulnerable to XML attacks; usedefusedxmlequivalents -
S315Using
xmlto parse untrusted data is known to be vulnerable to XML attacks; usedefusedxmlequivalents -
S316Using
xmlto parse untrusted data is known to be vulnerable to XML attacks; usedefusedxmlequivalents -
S317Using
xmlto parse untrusted data is known to be vulnerable to XML attacks; usedefusedxmlequivalents -
S318Using
xmlto parse untrusted data is known to be vulnerable to XML attacks; usedefusedxmlequivalents -
S319Using
xmlto parse untrusted data is known to be vulnerable to XML attacks; usedefusedxmlequivalents -
S321FTP-related functions are being called. FTP is considered insecure. Use SSH/SFTP/SCP or some other encrypted protocol.
-
S323Python allows using an insecure context via the
_create_unverified_contextthat reverts to the previous behavior that does not validate certificates or perform hostname checks. -
S324Probable use of insecure hash functions in
{library}:{string} -
S401telnetliband related modules are considered insecure. Use SSH or another encrypted protocol. -
S402ftpliband related modules are considered insecure. Use SSH, SFTP, SCP, or another encrypted protocol. -
S403pickle,cPickle,dill, andshelvemodules are possibly insecure -
S404subprocessmodule is possibly insecure -
S405xml.etreemethods are vulnerable to XML attacks -
S406xml.saxmethods are vulnerable to XML attacks -
S407xml.dom.expatbuilderis vulnerable to XML attacks -
S408xml.dom.minidomis vulnerable to XML attacks -
S409xml.dom.pulldomis vulnerable to XML attacks -
S411XMLRPC is vulnerable to remote XML attacks
-
S412httpoxyis a set of vulnerabilities that affect application code running inCGI, or CGI-like environments. The use of CGI for web applications should be avoided -
S413pycryptolibrary is known to have publicly disclosed buffer overflow vulnerability -
S415An IPMI-related module is being imported. Prefer an encrypted protocol over IPMI.
-
S501Probable use of
{string}call withverify=Falsedisabling SSL certificate checks -
S502Call made with insecure SSL protocol:
{protocol} -
S503Argument default set to insecure SSL protocol:
{protocol} -
S504ssl.wrap_socketcalled without anssl_version -
S505{cryptographic_key} key sizes below {minimum_key_size} bits are considered breakable
-
S506Probable use of unsafe loader
{name}withyaml.load. Allows instantiation of arbitrary objects. Consideryaml.safe_load. -
S507Paramiko call with policy set to automatically trust the unknown host key
-
S508The use of SNMPv1 and SNMPv2 is insecure. Use SNMPv3 if able.
-
S509You should not use SNMPv3 without encryption.
noAuthNoPriv&authNoPrivis insecure. -
S601Possible shell injection via Paramiko call; check inputs are properly sanitized