diff --git a/file/python/python-scanner.yaml b/file/python/python-scanner.yaml index 6f7b8770d6f..6542b337975 100644 --- a/file/python/python-scanner.yaml +++ b/file/python/python-scanner.yaml @@ -4,7 +4,7 @@ info: name: Python Scanner author: majidmc2 severity: info - description: Scan for dangerous Python functions + description: Indicators for dangerous Python functions reference: - https://www.kevinlondon.com/2015/07/26/dangerous-python-functions.html - https://www.kevinlondon.com/2015/08/15/dangerous-python-functions-pt2.html @@ -17,7 +17,8 @@ file: extractors: - type: regex - name: Possible Code Injection + name: code-injection + condition: or regex: - 'exec' - 'eval' @@ -25,7 +26,8 @@ file: - type: regex - name: Possible Command Injection + name: command-injection + condition: or regex: - 'subprocess.call\(.*shell=True.*\)' - 'os.system' @@ -33,18 +35,19 @@ file: - type: regex - name: Possibly Unpickling untrusted source + name: untrusted-source + condition: or regex: - 'pickle.loads' - 'cPickle.loads' - type: regex - name: Possibly loading dangerous YAMLs + name: dangerous-yaml regex: - 'yaml.load' - type: regex - name: Possible SQLi + name: sqli regex: - - 'cursor.execute' + - 'cursor.execute' \ No newline at end of file