Skip to content
Sarj Sarj Sarj Standards

Ruff

903 rules ruff@0.17.0

Complete effective rule inventory.

Docs

Rules

32 rules on this page · 903 total

  • S324

    Probable use of insecure hash functions in {library}: {string}

    No autofix
  • S401

    telnetlib and related modules are considered insecure. Use SSH or another encrypted protocol.

    No autofix
  • S402

    ftplib and related modules are considered insecure. Use SSH, SFTP, SCP, or another encrypted protocol.

    No autofix
  • S403

    pickle, cPickle, dill, and shelve modules are possibly insecure

    No autofix
  • S404

    subprocess module is possibly insecure

    No autofix
  • S405

    xml.etree methods are vulnerable to XML attacks

    No autofix
  • S406

    xml.sax methods are vulnerable to XML attacks

    No autofix
  • S407

    xml.dom.expatbuilder is vulnerable to XML attacks

    No autofix
  • S408

    xml.dom.minidom is vulnerable to XML attacks

    No autofix
  • S409

    xml.dom.pulldom is vulnerable to XML attacks

    No autofix
  • S411

    XMLRPC is vulnerable to remote XML attacks

    No autofix
  • S412

    httpoxy is a set of vulnerabilities that affect application code running inCGI, or CGI-like environments. The use of CGI for web applications should be avoided

    No autofix
  • S413

    pycrypto library is known to have publicly disclosed buffer overflow vulnerability

    No autofix
  • S415

    An IPMI-related module is being imported. Prefer an encrypted protocol over IPMI.

    No autofix
  • S501

    Probable use of {string} call with verify=False disabling SSL certificate checks

    No autofix
  • S502

    Call made with insecure SSL protocol: {protocol}

    No autofix
  • S503

    Argument default set to insecure SSL protocol: {protocol}

    No autofix
  • S504

    ssl.wrap_socket called without an ssl_version

    No autofix
  • S505

    {cryptographic_key} key sizes below {minimum_key_size} bits are considered breakable

    No autofix
  • S506

    Probable use of unsafe loader {name} with yaml.load. Allows instantiation of arbitrary objects. Consider yaml.safe_load.

    No autofix
  • S507

    Paramiko call with policy set to automatically trust the unknown host key

    No autofix
  • S508

    The use of SNMPv1 and SNMPv2 is insecure. Use SNMPv3 if able.

    No autofix
  • S509

    You should not use SNMPv3 without encryption. noAuthNoPriv & authNoPriv is insecure.

    No autofix
  • S601

    Possible shell injection via Paramiko call; check inputs are properly sanitized

    No autofix
  • S602

    subprocess call with shell=True seems safe, but may be changed in the future; consider rewriting without shell

    No autofix
  • S603

    subprocess call: check for execution of untrusted input

    No autofix
  • S604

    Function call with shell=True parameter identified, security issue

    No autofix
  • S605

    Starting a process with a shell: seems safe, but may be changed in the future; consider rewriting without shell

    No autofix
  • S606

    Starting a process without a shell

    No autofix
  • S607

    Starting a process with a partial executable path

    No autofix
  • S608

    Possible SQL injection vector through string-based query construction

    No autofix
  • S609

    Possible wildcard injection in call due to * usage

    No autofix