Astvuln is a simple AST scanner which recursively scans a directory, parses each file as AST and runs specified method.

Overview

Astvuln

Astvuln is a simple AST scanner which recursively scans a directory, parses each file as AST and runs specified method. Some search methods are provided with the tool and can be found under ./src/visitors/ in common.py and custom.py but most methods are not included in the repository. To add a new search method edit one of existing files and add a new class. The simplest way is to extend it from AstVisitor class. Implement query logic using generic_visit/visit_{class}.

This tool was developed for research purposes with the idea to explore potential vulnerable patterns when a new type of bug is discovered in our code. We can use such patterns to potentially find new similar bugs. AST code patterns which have sufficiently low false positive rate should then be included in SAST automation.

Usage

Astvuln: Search Python code for AST patterns.
Usage: 
   
     [-a 
    
     ][-h][-e 
     
      ][-g][-c][-n][-p 
      
       ][-s 
       
        ] Options: -a|--args 
        
          Arguments for method -h|--help Show help and exit -e|--extensions 
         
           Extensions to process -g|--grepable Make results easier to grep -c|--no-colors Don't print colors -n|--no-source Don't print source code -p|--path 
          
            Starting directory -s|--skip 
           
             Paths to skip Common methods: assign Find assignements with matching names (name) call Find all function calls with matching name (name, path) class Find all classes with matching name (name) constant Find all constants with matching value (name) dict Find all dicts with matching item constant value (name) dump Dump AST function Find all functions and methods with matching name (name) list Find all lists with matching constant value (name) name Find all matching names (name) print Print node names test Do nothing Custom methods: forelse Search for `for` loops with `else` clause which seems to always trigger replace_with_substring Search for replace of a string with a substring or an empty string unused_classes Find classes which are never directly referenced by name (ignore) Reading methods from file: Run method "file" and pass filename in method arguments to run multiple methods in a single run. Each method needs to be specified in a single line and colon-seperated from arguments. E. g. "./astvuln foo -a bar,baz" would be translated to: foo:bar,baz Examples: ./astvuln -h # Print help ./astvuln print -c # Run method `print` without color output ./astvuln dump -p dir # Run method `dump` on directory `dir` ./astvuln call -a bytes # Run method `call` with argument `bytes` ./astvuln foo -a a=1,b=2 # Run method `foo` with arguments a = 1 and b = 2 ./astvuln file -a methods.txt # Run multiple methods specified in a file 
           
          
         
        
       
      
     
    
   

License

Astvuln is released under the MIT License.

Owner
Bitstamp Security
Security team at Bitstamp cryptocurrency exchange
Bitstamp Security
A simple python implementation of Decision Tree.

DecisionTree A simple python implementation of Decision Tree, using Gini index. Usage: import DecisionTree node = DecisionTree.trainDecisionTree(lab

1 Nov 12, 2021
✨ Un chois aléatoire d'un article sur Wikipedia totalement fait en Python par moi, et en français.

Wikipedia Random Article ❗ Un chois aléatoire d'un article sur Wikipedia totalement fait en Python par moi, et en français. 🔮 Grâce a une requète a w

MrGabin 4 Jul 18, 2021
Python implementation of Gorilla time series compression

Gorilla Time Series Compression This is an implementation (with some adaptations) of the compression algorithm described in section 4.1 (Time series c

Ghiles Meddour 19 Jan 01, 2023
Definitely legit social credit generator with python

definitely-legit-social-credit-generator I made this simple GUI program for a meme, no cap. Video: https://youtu.be/RmjxKtoli04 How to run: Clone this

Joshua Malabanan 8 Nov 01, 2021
Extends the pyranges module with operations on joined genomic intervals

tiedpyranges Extends the pyranges module with operations on joined genomic intervals (e.g. exons of same transcript) Install with: pip install tiedpyr

Marco Mariotti 4 Aug 05, 2022
Astvuln is a simple AST scanner which recursively scans a directory, parses each file as AST and runs specified method.

Astvuln Astvuln is a simple AST scanner which recursively scans a directory, parses each file as AST and runs specified method. Some search methods ar

Bitstamp Security 7 May 29, 2022
Animation retargeting tool for Autodesk Maya. Retargets mocap to a custom rig with a few clicks.

Animation Retargeting Tool for Maya A tool for transferring animation data and mocap from a skeleton to a custom rig in Autodesk Maya. Installation: A

Joaen 63 Jan 06, 2023
convert a dict-list object from / to a typed object(class instance with type annotation)

objtyping 带类型定义的对象转换器 由来 Python不是强类型语言,开发人员没有给数据定义类型的习惯。这样虽然灵活,但处理复杂业务逻辑的时候却不够方便——缺乏类型检查可能导致很难发现错误,在IDE里编码时也没

Song Hui 15 Dec 22, 2022
Python code to remove empty folders from Windows/Android.

Empty Folder Cleaner is a program that deletes empty folders from your computer or device and removes clutter to improve performance. It supports only windows and android for now.

Dark Coder Cat | Vansh 4 Sep 27, 2022
A tiny Python library for generating public IDs from integers

pids Create short public identifiers based on integer IDs. Installation pip install pids Usage from pids import pid public_id = pid.from_int(1234) #

Simon Willison 7 Nov 11, 2021
A python package containing all the basic functions and classes for python. From simple addition to advanced file encryption.

A python package containing all the basic functions and classes for python. From simple addition to advanced file encryption.

PyBash 11 May 22, 2022
✨ Un générateur d'adresse IP aléatoire totalement fait en Python par moi, et en français.

IP Generateur ❗ Un générateur d'adresse IP aléatoire totalement fait en Python par moi, et en français. 🔮 Avec l'utilisation du module "random", j'ai

MrGabin 3 Jun 06, 2021
A simple tool that updates your pubspec.yaml file, of a Flutter project, without altering the structure of your file.

A simple tool that updates your pubspec.yaml file, of a Flutter project, without altering the structure of your file.

3 Dec 10, 2021
This utility synchronises spelling dictionaries from various tools with each other.

This utility synchronises spelling dictionaries from various tools with each other. This way the words that have been trained on MS Office are also correctly checked in vim or Firefox. And vice versa

Patrice Neff 2 Feb 11, 2022
Helper script to bootstrap a Python environment with the tools required to build and install packages.

python-bootstrap Helper script to bootstrap a Python environment with the tools required to build and install packages. Usage $ python -m bootstrap.bu

Filipe Laíns 7 Oct 06, 2022
Program to extract signatures from documents.

Extracting Signatures from Bank Checks Introduction Ahmed et al. [1] suggest a connected components-based method for segmenting signatures in document

Muhammad Saif Ullah Khan 9 Jan 26, 2022
Attempts to crack the compression puzzle.

The Compression Puzzle One lovely Friday we were faced with this nice yet intriguing programming puzzle. One shall write a program that compresses str

Oto Brglez 14 Dec 29, 2022
This python program will display all SSID usernames and SSID passwords you once connected to your laptop

Windows-Wifi-password-extractor This python program will display all SSID usernames and SSID passwords you once connected to your laptop How to run th

Bhaskar Pal 3 Apr 26, 2022
A simple Python app that generates semi-random chord progressions.

chords-generator A simple Python app that generates semi-random chord progressions.

53 Sep 07, 2022
A library to easily convert climbing route grades between different grading systems.

pyclimb A library to easily convert climbing route grades between different grading systems. In rock climbing, mountaineering, and other climbing disc

Ilias Antonopoulos 4 Jan 26, 2022