Re: Pylint checks not as static as one would think

[cve-assign () mitre org]

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

> Pylint is advertised as "a static code checker, meaning it can
> analyse your code without actually running it"[1] and that it "does
> not import live modules"[1].
>
> This is, unfortunately, far from reality. Here's a PoC:
>
> $ cat moo.py
> from _moo import *
>
> $ cat moo.c
> #include <stdio.h>
> #include <signal.h>
> void __attribute__((constructor)) moo() {
>         printf("moo!\n");
>         kill(0, SIGSEGV);
> }
>
> $ gcc -Wall -shared -fPIC moo.c -o _moo.so
>
> $ pylint moo.py
> No config file found, using default configuration
> moo!
>
> My understanding is that upstream Pylint maintainers consider this 
> behavior intentional[2]. But even then, I think it's a serious 
> documentation flaw.
>
> [1] http://docs.pylint.org/faq.html#about-pylint
> [2] https://bugs.debian.org/591676#28

We think there's a valid alternate interpretation of the
documentation:

> it can analyse your code without actually running it

This describes the general functionality of the product, without
commenting on whether code might be run in some circumstances. If the
user provides exclusively Python source code, and doesn't provide
mixed input containing both Python source code and potentially
malicious .so files, then the situation is different.

> There are a few other differences, such as the fact that Pylint does
> not import live modules while Pychecker does

This can be interpreted to mean "if you want a product with an
explicit strategy of importing live modules in order to find a wider
class of problems, then choose Pychecker instead of Pylint." A brief
statement that contrasts major features, in general terms, is not
equivalent to something like:

  [hypothetical] 6.x Is import of live modules always prevented?
  Yes, this is an explicit security constraint in our design.

We agree that it would be a significant security improvement to have
clearer documentation, e.g.,

  [hypothetical] 6.y Is import of live modules always prevented?
  No, astng does import live modules when source is unavailable.

but we feel there is no vulnerability and thus no CVE.

- -- 
CVE assignment team, MITRE CVE Numbering Authority
M/S M300
202 Burlington Road, Bedford, MA 01730 USA
[ PGP key available through http://cve.mitre.org/cve/request_id.html ]
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.14 (SunOS)

iQEcBAEBAgAGBQJUKbs7AAoJEKllVAevmvms5FYIAKJKORvzuEeNWW/AzAxQE3ZY
E9sffj45bqmuZ9vEPiOG21GvyvHr21WJ3JwVM4dcipuCBL+j3PvjwPuYB0JESkrr
AjOBh+Wa5vFwG1Vb+YoSeNYH50zS1RFpLFVFGXMrN+P6JcEfwNirZcbuzXDK4DCN
1XdgNNdBcLEYr5sR3KLJtGD97uJKDKoaJv/S9qTdUS+cMnlcgdhJmY+XQbgDp4Cf
950axM4DMXQWjg5ki8FSBZHOfYIDKUmJp2OE7i7OqDimsFKPQ5p/EKfz+B/yH+6R
UkiCOC/5Odr/uOwMg9qY9zN0DHhwGKkQvAUHfNrb3jExr/S805mO7azVyL3mr50=
=xUZH
-----END PGP SIGNATURE-----