Ruff
903 rules ruff@0.17.0
Complete effective rule inventory.
Rules
No enabled Ruff rules match this search.
-
S102Use of
execdetected -
S103os.chmodsetting a permissive mask{mask:#o}on file or directory -
S104Possible binding to all interfaces
-
S105Possible hardcoded password assigned to: "{}"
-
S106Possible hardcoded password assigned to argument: "{}"
-
S107Possible hardcoded password assigned to function default: "{}"
-
S108Probable insecure usage of temporary file or directory: "{}"
-
S110try-except-passdetected, consider logging the exception -
S112try-except-continuedetected, consider logging the exception -
S113Probable use of
{module}call without timeout -
S201Use of
debug=Truein Flask app detected -
S202Uses of
tarfile.extractall() -
S301pickleand modules that wrap it can be unsafe when used to deserialize untrusted data, possible security issue -
S302Deserialization with the
marshalmodule is possibly dangerous -
S303Use of insecure MD2, MD4, MD5, or SHA1 hash function
-
S304Use of insecure cipher, replace with a known secure cipher such as AES
-
S305Use of insecure block cipher mode, replace with a known secure mode such as CBC or CTR
-
S306Use of insecure and deprecated function (
mktemp) -
S307Use of possibly insecure function; consider using
ast.literal_eval -
S308Use of
mark_safemay expose cross-site scripting vulnerabilities -
S310Audit URL open for permitted schemes. Allowing use of
file:or custom schemes is often unexpected. -
S311Standard pseudo-random generators are not suitable for cryptographic purposes
-
S312Telnet is considered insecure. Use SSH or some other encrypted protocol.
-
S313Using
xmlto parse untrusted data is known to be vulnerable to XML attacks; usedefusedxmlequivalents -
S314Using
xmlto parse untrusted data is known to be vulnerable to XML attacks; usedefusedxmlequivalents -
S315Using
xmlto parse untrusted data is known to be vulnerable to XML attacks; usedefusedxmlequivalents -
S316Using
xmlto parse untrusted data is known to be vulnerable to XML attacks; usedefusedxmlequivalents -
S317Using
xmlto parse untrusted data is known to be vulnerable to XML attacks; usedefusedxmlequivalents -
S318Using
xmlto parse untrusted data is known to be vulnerable to XML attacks; usedefusedxmlequivalents -
S319Using
xmlto parse untrusted data is known to be vulnerable to XML attacks; usedefusedxmlequivalents -
S321FTP-related functions are being called. FTP is considered insecure. Use SSH/SFTP/SCP or some other encrypted protocol.
-
S323Python allows using an insecure context via the
_create_unverified_contextthat reverts to the previous behavior that does not validate certificates or perform hostname checks.