Hot answers tagged

14

The Python manual comes with a warning about the pickle module: Warning The pickle module is not secure against erroneous or maliciously constructed data. Never unpickle data received from an untrusted or unauthenticated source. This warning should be taken very seriously. If you unpickle untrusted data, an attacker will be able to exectue arbitrary code ...


3

Is there any way we can safely load a pickle? You've asked for any way, but it partly depends not only on the way, but on the pickle in question and on what you mean by "safely." Unless you mean something like "reasonably safely, given that I'll always know the provenance of the pickle," the answer is probably "no." However, here are some questions to ...


1

You should notice that WordPress is a content management system (CMS). Systems like that are designed for modifying web pages. That includes adding and modifying HTML, JavaScript, HTTP redirects etc. – and even working with databases. Therefore, your whole security scanning approach is flawed: the findings described as security problems are within the normal ...


1

So, I don't know why they did this, but knowing developers and their attitude towards third party software here's my speculation: Developers tend not care about the whole system, they want to know about the bugs in the code they wrote. Scanning third party code takes time. Why take time to discover things that the average developer doesn't care about? ...


1

As others have mentioned, Fortify and most scan tools don't just scan the delta of files changed. They scan the entire code base. With Fortify, it's a resource intensive tool by nature. And if you code base is sizeable, you'll need a strong machine to cut through it quickly. I suggest the following... Assuming you have access to AWS or Azure, spin up two ...


1

It can't be done with that tools. I have the same "problem" as you using exactly the same tools. Anyway, from a security point of view is not a problem. In my opinion to scan only certain part of code could lead you to not detect certain errors. I'll try to explain it later. Another story is to show incrementally new issues detected on SonarQube. That can ...


Only top voted, non community-wiki answers of a minimum length are eligible