mirror of
https://github.com/astral-sh/ruff.git
synced 2025-10-01 14:21:53 +00:00
6dfc1ccd6f
## Summary Adds S502 rule for the [flake8-bandit](https://github.com/tylerwince/flake8-bandit) plugin port. Checks for calls to any function with keywords arguments `ssl_version` or `method` or for kwargs `method` in calls to `OpenSSL.SSL.Context` and `ssl_version` in calls to `ssl.wrap_socket` which have an insecure ssl_version valu. See also https://bandit.readthedocs.io/en/latest/_modules/bandit/plugins/insecure_ssl_tls.html#ssl_with_bad_version ## Test Plan Fixture added ## Issue Link Refers: https://github.com/astral-sh/ruff/issues/1646
16 lines
582 B
Python
16 lines
582 B
Python
import ssl
|
|
from ssl import wrap_socket
|
|
from OpenSSL import SSL
|
|
from OpenSSL.SSL import Context
|
|
|
|
wrap_socket(ssl_version=ssl.PROTOCOL_SSLv3) # S502
|
|
ssl.wrap_socket(ssl_version=ssl.PROTOCOL_TLSv1) # S502
|
|
ssl.wrap_socket(ssl_version=ssl.PROTOCOL_SSLv2) # S502
|
|
SSL.Context(method=SSL.SSLv2_METHOD) # S502
|
|
SSL.Context(method=SSL.SSLv23_METHOD) # S502
|
|
Context(method=SSL.SSLv3_METHOD) # S502
|
|
Context(method=SSL.TLSv1_METHOD) # S502
|
|
|
|
wrap_socket(ssl_version=ssl.PROTOCOL_TLS_CLIENT) # OK
|
|
SSL.Context(method=SSL.TLS_SERVER_METHOD) # OK
|
|
func(ssl_version=ssl.PROTOCOL_TLSv1_2) # OK
|