Bandit and Gosec - Security Linters

©2018 VMware, Inc.
Bandit and Gosec – Security Linters
All Things Open 2018
Eric Brown
Staff Open Source Engineer / Open
Source Technology Center
October 22nd 2018

2©2018 VMware, Inc.
Moar Security

Cost to Fix Bugs

Types of Security Bugs
Source: National Institute of Standards and Technology

What’s the Struggle?
Source: https://www.bleepingcomputer.com/news/security/26-percent-of-companies-ignore-security-bugs-because-they-don-t-have-the-time-to-fix-them/

How to Catch Security Bugs Earlier
Education

● Courses
Education

● Courses
● Books
Education

● Courses
● Books
● Conference talks 😉
Education

Tooling

Tooling
● Unit testing

Tooling
● Unit testing
● Dependency checking

Tooling
● Unit testing
● Dependency checking
●

What is a Linter?
● A.K.A Static Code Analysis (SCA)
● Scans source code statically without running or building the
code
● Linters focus on finding common mistakes
● Might make use of a compilers AST (abstract syntax tree)
● Popular examples:

When to Run Linters?
● When coding
● Find linter plugins to your favorite IDE
● Fix as you code
● As part of a CI (continuous integration) system
● Catch mistakes when code is pushed to a repository for
review
● Travis-CI, Circle CI, Jenkins, etc

Downsides
● Linters are imperfect
● False positives
● Extra time
● Requires time to interpret the results
● Requires time during CI to scan code

What is Bandit?
● A Python security linter
● Project started early 2015
● Originally designed for OpenStack but now part of the Python
Code Quality Authority
● Python 2.7, 3.5, 3.6, 3.7 compatible
● Runs on Linux and macOS
● Easy to write new plugins
● Low resource requirements
● Runs quickly

Bandit: Issues It Finds
● Finds common security issues in Python code
● Use of assert
● Hardcoded passwords
● Command injection
● Insecure temporary file usage
● Promiscuous file permissions
● Usage of unsafe functions/libraries
● Binding to all interfaces
● Weak cryptography
● Bad SSL versions
● Requests without certificate validation
● Use of insecure protocols

Bandit: Formatters
● Many different output formatters
● CSV
● HTML
● JSON
● Text
● XML
● YAML
● Custom: using predefined tags

Bandit: Other Features
● Customizable filters on severity and confidence levels
● Allows creation of profiles to scan a subset of plugin tests
● Adjust lines of context shown in output
● Group results by file or vulnerability
● Output delta reports of previous scans
● Allows marking false positives using the “# nosec” comment

Bandit: Config

Bandit: Dependents

Bandit: Integrations
● SublimeLinter-bandit – Sublime Text linter plugin
● flake8-bandit – Flake8 plugin
● pyreportcard – Report card of Python projects quality
● bandit-plugin- - Hudson/Jenkins plugin
●
● Vim
● Emacs
● Atom
Wishlist:

Bandit: Sublime Text Linter

Bandit Alternatives
● Very few Python security linters
● Others:
○ RATS (rough-auditing-tool-for-security) - unmaintained as
of 2013
○ HP Fortify - not free

Bandit in Action

Contributing to Bandit
● https://github.com/PyCQA/bandit
● Bandit is participating in
● Core maintainers:
● Myself – ericwb
● Ian StapleTon Cordasco – sigmavirus24
● Gage Hugo – ghugo
● Luke Hinds – lukehinds
● Ideas:
● Documentation could be improved
● More integrations with IDEs

What is Gosec?
● A Golang security linter
● Project started mid 2016
● Started by one of the creators of Bandit
● Runs on Linux and macOS
● Low resource requirements
● Runs quickly

Gosec: Issues It Finds
● Finds common security issues in Go code
● Hardcoded credentials
● Binding to all interfaces
● SQL injection
● Command injection
● Insecure temporary file usage
● Promiscuous file permissions
● Usage of unsafe functions/libraries
● Weak cryptography
● Bad TLS/SSL versions
● Ignoring host keys

Gosec: Formatters
● Many different output formatters
● CSV
● JSON
● Text
● XML
● YAML

Gosec: Other Features
● Customizable filters on severity and confidence levels
● Allows creation of profiles to scan a subset of plugin tests
● Group results by severity
● Allows marking false positives using the “# nosec” comment
● Tool to generate TLS rules according to Mozilla
recommendations
● https://statics.tls.security.mozilla.org/server-side-tls-
conf.json

Gosec: Integrations
● SublimeLinter-contrib-gometallinter – Sublime Text linter plugin
● gometallinter – collection of linters
● – via a gometallinter plugin
● Go Report Card
● Vim
● Emacs
● Atom
Wishlist:

Gosec: Sublime Text Linter

Gosec: Visual Studio Code

Gosec: Go Report Card

Gosec in Action

Gosec: TLS rules

Gosec: Contributing
● https://github.com/securego/gosec
● Ideas:
● Documentation could use some work
● More integrations with IDEs

What is <Yet-To-Be-Named>?
● GitHub App
● Uses the GitHub Checks API
● Currently utilizes these linters:
● Bandit
● Gosec
● Automatically scans Pull Requests

<Yet-To-Be-Named> in Action

©2018 VMware, Inc.
Thank You!
Please be sure to rate my talk on the All Things Open App
Email: browne@vmware.com
IRC: browne
github.com/ericwb

Bandit and Gosec - Security Linters

Recommended

More Related Content

What's hot (20)

Similar to Bandit and Gosec - Security Linters (20)

Recently uploaded (20)

Bandit and Gosec - Security Linters

Editor's Notes