The following issues were found
buildscripts/resmokelib/powercycle/powercycle.py
9 issues
Line: 623
Suggestion:
https://bandit.readthedocs.io/en/latest/plugins/b104_hardcoded_bind_all_interfaces.html
self.set_mongod_option("logappend")
self.port = port
self.set_mongod_option("port", port)
self.set_mongod_option("bind_ip", "0.0.0.0")
if _IS_WINDOWS:
self.set_mongod_option("service")
self._service = WindowsService
else:
self.set_mongod_option("fork")
Reported by Bandit.
Line: 117
Suggestion:
https://bandit.readthedocs.io/en/latest/plugins/b110_try_except_pass.html
with open(REPORT_JSON_FILE, "w") as jstream:
json.dump(REPORT_JSON, jstream)
LOGGER.debug("Exit handler: report file contents %s", REPORT_JSON)
except: # pylint: disable=bare-except
pass
if EXIT_YML_FILE:
LOGGER.debug("Exit handler: Saving exit file %s", EXIT_YML_FILE)
try:
Reported by Bandit.
Line: 126
Suggestion:
https://bandit.readthedocs.io/en/latest/plugins/b110_try_except_pass.html
with open(EXIT_YML_FILE, "w") as yaml_stream:
yaml.safe_dump(EXIT_YML, yaml_stream)
LOGGER.debug("Exit handler: report file contents %s", EXIT_YML)
except: # pylint: disable=bare-except
pass
LOGGER.debug("Exit handler: Killing processes")
try:
Processes.kill_all()
Reported by Bandit.
Line: 133
Suggestion:
https://bandit.readthedocs.io/en/latest/plugins/b110_try_except_pass.html
try:
Processes.kill_all()
LOGGER.debug("Exit handler: Killing processes finished")
except: # pylint: disable=bare-except
pass
LOGGER.debug("Exit handler: Cleaning up temporary files")
try:
NamedTempFile.delete_all()
Reported by Bandit.
Line: 140
Suggestion:
https://bandit.readthedocs.io/en/latest/plugins/b110_try_except_pass.html
try:
NamedTempFile.delete_all()
LOGGER.debug("Exit handler: Cleaning up temporary files finished")
except: # pylint: disable=bare-except
pass
def register_signal_handler(handler):
"""Register the signal handler."""
Reported by Bandit.
Line: 1062
Suggestion:
https://bandit.readthedocs.io/en/latest/blacklists/blacklist_calls.html#b311-random
task_config, crash_canary, local_ops, script_name, client_args):
"""Crash server or kill mongod and optionally write canary doc. Return tuple (ret, output)."""
crash_wait_time = powercycle_constants.CRASH_WAIT_TIME + random.randint(
0, powercycle_constants.CRASH_WAIT_TIME_JITTER)
message_prefix = "Killing mongod" if task_config.crash_method == "kill" else "Crashing server"
LOGGER.info("%s in %d seconds", message_prefix, crash_wait_time)
time.sleep(crash_wait_time)
Reported by Bandit.
Line: 1221
Suggestion:
https://bandit.readthedocs.io/en/latest/blacklists/blacklist_calls.html#b311-random
def rand_string(max_length=1024):
"""Return random string of random length."""
return ''.join(
random.choice(string.ascii_letters) for _ in range(random.randint(1, max_length)))
LOGGER.info("Seeding DB '%s' collection '%s' with %d documents, %d already exist", db_name,
coll_name, num_docs, mongo[db_name][coll_name].count())
random.seed()
base_num = 100000
Reported by Bandit.
Line: 1221
Suggestion:
https://bandit.readthedocs.io/en/latest/blacklists/blacklist_calls.html#b311-random
def rand_string(max_length=1024):
"""Return random string of random length."""
return ''.join(
random.choice(string.ascii_letters) for _ in range(random.randint(1, max_length)))
LOGGER.info("Seeding DB '%s' collection '%s' with %d documents, %d already exist", db_name,
coll_name, num_docs, mongo[db_name][coll_name].count())
random.seed()
base_num = 100000
Reported by Bandit.
Line: 1234
Suggestion:
https://bandit.readthedocs.io/en/latest/blacklists/blacklist_calls.html#b311-random
if num_coll_docs >= num_docs:
break
mongo[db_name][coll_name].insert_many(
[{"x": random.randint(0, base_num), "doc": rand_string(1024)} for _ in range(bulk_num)])
LOGGER.info("After seeding there are %d documents in the collection",
mongo[db_name][coll_name].count())
return 0
Reported by Bandit.
src/third_party/mozjs-60/extract/js/src/builtin/SIMD.h
9 issues
Line: 133
Column: 5
CWE codes:
126
Suggestion:
This function is often discouraged by most C++ coding standards in favor of its safer alternatives provided since C++14. Consider using a form of this function that checks the second iterator before potentially overflowing it
#define FLOAT32X4_BINARY_FUNCTION_LIST(V) \
V(add, (BinaryFunc<Float32x4, Add, Float32x4>), 2) \
V(div, (BinaryFunc<Float32x4, Div, Float32x4>), 2) \
V(equal, (CompareFunc<Float32x4, Equal, Bool32x4>), 2) \
V(extractLane, (ExtractLane<Float32x4>), 2) \
V(greaterThan, (CompareFunc<Float32x4, GreaterThan, Bool32x4>), 2) \
V(greaterThanOrEqual, (CompareFunc<Float32x4, GreaterThanOrEqual, Bool32x4>), 2) \
V(lessThan, (CompareFunc<Float32x4, LessThan, Bool32x4>), 2) \
V(lessThanOrEqual, (CompareFunc<Float32x4, LessThanOrEqual, Bool32x4>), 2) \
Reported by FlawFinder.
Line: 189
Column: 5
CWE codes:
126
Suggestion:
This function is often discouraged by most C++ coding standards in favor of its safer alternatives provided since C++14. Consider using a form of this function that checks the second iterator before potentially overflowing it
#define FLOAT64X2_BINARY_FUNCTION_LIST(V) \
V(add, (BinaryFunc<Float64x2, Add, Float64x2>), 2) \
V(div, (BinaryFunc<Float64x2, Div, Float64x2>), 2) \
V(equal, (CompareFunc<Float64x2, Equal, Bool64x2>), 2) \
V(extractLane, (ExtractLane<Float64x2>), 2) \
V(greaterThan, (CompareFunc<Float64x2, GreaterThan, Bool64x2>), 2) \
V(greaterThanOrEqual, (CompareFunc<Float64x2, GreaterThanOrEqual, Bool64x2>), 2) \
V(lessThan, (CompareFunc<Float64x2, LessThan, Bool64x2>), 2) \
V(lessThanOrEqual, (CompareFunc<Float64x2, LessThanOrEqual, Bool64x2>), 2) \
Reported by FlawFinder.
Line: 239
Column: 5
CWE codes:
126
Suggestion:
This function is often discouraged by most C++ coding standards in favor of its safer alternatives provided since C++14. Consider using a form of this function that checks the second iterator before potentially overflowing it
V(add, (BinaryFunc<Int8x16, Add, Int8x16>), 2) \
V(addSaturate, (BinaryFunc<Int8x16, AddSaturate, Int8x16>), 2) \
V(and, (BinaryFunc<Int8x16, And, Int8x16>), 2) \
V(equal, (CompareFunc<Int8x16, Equal, Bool8x16>), 2) \
V(extractLane, (ExtractLane<Int8x16>), 2) \
V(greaterThan, (CompareFunc<Int8x16, GreaterThan, Bool8x16>), 2) \
V(greaterThanOrEqual, (CompareFunc<Int8x16, GreaterThanOrEqual, Bool8x16>), 2) \
V(lessThan, (CompareFunc<Int8x16, LessThan, Bool8x16>), 2) \
V(lessThanOrEqual, (CompareFunc<Int8x16, LessThanOrEqual, Bool8x16>), 2) \
Reported by FlawFinder.
Line: 288
Column: 5
CWE codes:
126
Suggestion:
This function is often discouraged by most C++ coding standards in favor of its safer alternatives provided since C++14. Consider using a form of this function that checks the second iterator before potentially overflowing it
V(add, (BinaryFunc<Uint8x16, Add, Uint8x16>), 2) \
V(addSaturate, (BinaryFunc<Uint8x16, AddSaturate, Uint8x16>), 2) \
V(and, (BinaryFunc<Uint8x16, And, Uint8x16>), 2) \
V(equal, (CompareFunc<Uint8x16, Equal, Bool8x16>), 2) \
V(extractLane, (ExtractLane<Uint8x16>), 2) \
V(greaterThan, (CompareFunc<Uint8x16, GreaterThan, Bool8x16>), 2) \
V(greaterThanOrEqual, (CompareFunc<Uint8x16, GreaterThanOrEqual, Bool8x16>), 2) \
V(lessThan, (CompareFunc<Uint8x16, LessThan, Bool8x16>), 2) \
V(lessThanOrEqual, (CompareFunc<Uint8x16, LessThanOrEqual, Bool8x16>), 2) \
Reported by FlawFinder.
Line: 337
Column: 5
CWE codes:
126
Suggestion:
This function is often discouraged by most C++ coding standards in favor of its safer alternatives provided since C++14. Consider using a form of this function that checks the second iterator before potentially overflowing it
V(add, (BinaryFunc<Int16x8, Add, Int16x8>), 2) \
V(addSaturate, (BinaryFunc<Int16x8, AddSaturate, Int16x8>), 2) \
V(and, (BinaryFunc<Int16x8, And, Int16x8>), 2) \
V(equal, (CompareFunc<Int16x8, Equal, Bool16x8>), 2) \
V(extractLane, (ExtractLane<Int16x8>), 2) \
V(greaterThan, (CompareFunc<Int16x8, GreaterThan, Bool16x8>), 2) \
V(greaterThanOrEqual, (CompareFunc<Int16x8, GreaterThanOrEqual, Bool16x8>), 2) \
V(lessThan, (CompareFunc<Int16x8, LessThan, Bool16x8>), 2) \
V(lessThanOrEqual, (CompareFunc<Int16x8, LessThanOrEqual, Bool16x8>), 2) \
Reported by FlawFinder.
Line: 386
Column: 5
CWE codes:
126
Suggestion:
This function is often discouraged by most C++ coding standards in favor of its safer alternatives provided since C++14. Consider using a form of this function that checks the second iterator before potentially overflowing it
V(add, (BinaryFunc<Uint16x8, Add, Uint16x8>), 2) \
V(addSaturate, (BinaryFunc<Uint16x8, AddSaturate, Uint16x8>), 2) \
V(and, (BinaryFunc<Uint16x8, And, Uint16x8>), 2) \
V(equal, (CompareFunc<Uint16x8, Equal, Bool16x8>), 2) \
V(extractLane, (ExtractLane<Uint16x8>), 2) \
V(greaterThan, (CompareFunc<Uint16x8, GreaterThan, Bool16x8>), 2) \
V(greaterThanOrEqual, (CompareFunc<Uint16x8, GreaterThanOrEqual, Bool16x8>), 2) \
V(lessThan, (CompareFunc<Uint16x8, LessThan, Bool16x8>), 2) \
V(lessThanOrEqual, (CompareFunc<Uint16x8, LessThanOrEqual, Bool16x8>), 2) \
Reported by FlawFinder.
Line: 435
Column: 5
CWE codes:
126
Suggestion:
This function is often discouraged by most C++ coding standards in favor of its safer alternatives provided since C++14. Consider using a form of this function that checks the second iterator before potentially overflowing it
#define INT32X4_BINARY_FUNCTION_LIST(V) \
V(add, (BinaryFunc<Int32x4, Add, Int32x4>), 2) \
V(and, (BinaryFunc<Int32x4, And, Int32x4>), 2) \
V(equal, (CompareFunc<Int32x4, Equal, Bool32x4>), 2) \
V(extractLane, (ExtractLane<Int32x4>), 2) \
V(greaterThan, (CompareFunc<Int32x4, GreaterThan, Bool32x4>), 2) \
V(greaterThanOrEqual, (CompareFunc<Int32x4, GreaterThanOrEqual, Bool32x4>), 2) \
V(lessThan, (CompareFunc<Int32x4, LessThan, Bool32x4>), 2) \
V(lessThanOrEqual, (CompareFunc<Int32x4, LessThanOrEqual, Bool32x4>), 2) \
Reported by FlawFinder.
Line: 489
Column: 5
CWE codes:
126
Suggestion:
This function is often discouraged by most C++ coding standards in favor of its safer alternatives provided since C++14. Consider using a form of this function that checks the second iterator before potentially overflowing it
#define UINT32X4_BINARY_FUNCTION_LIST(V) \
V(add, (BinaryFunc<Uint32x4, Add, Uint32x4>), 2) \
V(and, (BinaryFunc<Uint32x4, And, Uint32x4>), 2) \
V(equal, (CompareFunc<Uint32x4, Equal, Bool32x4>), 2) \
V(extractLane, (ExtractLane<Uint32x4>), 2) \
V(greaterThan, (CompareFunc<Uint32x4, GreaterThan, Bool32x4>), 2) \
V(greaterThanOrEqual, (CompareFunc<Uint32x4, GreaterThanOrEqual, Bool32x4>), 2) \
V(lessThan, (CompareFunc<Uint32x4, LessThan, Bool32x4>), 2) \
V(lessThanOrEqual, (CompareFunc<Uint32x4, LessThanOrEqual, Bool32x4>), 2) \
Reported by FlawFinder.
Line: 613
Column: 7
CWE codes:
126
Suggestion:
This function is often discouraged by most C++ coding standards in favor of its safer alternatives provided since C++14. Consider using a form of this function that checks the second iterator before potentially overflowing it
#define FOREACH_COMP_SIMD_OP(_) \
_(lessThan) \
_(lessThanOrEqual) \
_(equal) \
_(notEqual) \
_(greaterThan) \
_(greaterThanOrEqual)
/*
Reported by FlawFinder.
src/third_party/mozjs-60/extract/js/src/builtin/TestingFunctions.cpp
9 issues
Line: 85
Column: 25
CWE codes:
807
20
Suggestion:
Check environment variables carefully before using them
static bool
EnvVarIsDefined(const char* name)
{
const char* value = getenv(name);
return value && *value;
}
#if defined(DEBUG) || defined(JS_OOM_BREAKPOINT)
static bool
Reported by FlawFinder.
Line: 96
Column: 22
CWE codes:
807
20
Suggestion:
Check environment variables carefully before using them
if (!EnvVarIsDefined(name))
return false;
*valueOut = atoi(getenv(name));
return true;
}
#endif
static bool
Reported by FlawFinder.
Line: 96
Column: 17
CWE codes:
190
Suggestion:
If source untrusted, check both minimum and maximum, even if the input had no minus sign (large numbers can roll over into negative number; consider saving to an unsigned value if that is intended)
if (!EnvVarIsDefined(name))
return false;
*valueOut = atoi(getenv(name));
return true;
}
#endif
static bool
Reported by FlawFinder.
Line: 340
Column: 5
CWE codes:
119
120
Suggestion:
Perform bounds checking, use functions that limit length, or ensure that the size is larger than the maximum possible length
JSGCInvocationKind gckind = shrinking ? GC_SHRINK : GC_NORMAL;
JS::GCForReason(cx, gckind, JS::gcreason::API);
char buf[256] = { '\0' };
#ifndef JS_MORE_DETERMINISTIC
SprintfLiteral(buf, "before %zu, after %zu\n",
preBytes, cx->runtime()->gc.usage.gcBytes());
#endif
return ReturnStringCopy(cx, args, buf);
Reported by FlawFinder.
Line: 650
Column: 5
CWE codes:
120
Suggestion:
Make sure destination can always hold the source data
if (!obj)
return false;
memcpy(obj->as<TypedArrayObject>().viewDataUnshared(), bytes.begin(), bytes.length());
args.rval().setObject(*obj);
return true;
}
Reported by FlawFinder.
Line: 2235
Column: 28
CWE codes:
362
if (!fileNameBytes.encodeLatin1(cx, str))
return false;
const char* fileName = fileNameBytes.ptr();
dumpFile = fopen(fileName, "w");
if (!dumpFile) {
fileNameBytes.clear();
if (!fileNameBytes.encodeUtf8(cx, str))
return false;
JS_ReportErrorUTF8(cx, "can't open %s", fileNameBytes.ptr());
Reported by FlawFinder.
Line: 3238
Column: 5
CWE codes:
119
120
Suggestion:
Perform bounds checking, use functions that limit length, or ensure that the size is larger than the maximum possible length
return true;
#else
void* ptr = js::UncheckedUnwrap(&args[0].toObject(), true);
char buffer[64];
SprintfLiteral(buffer, "%p", ptr);
return ReturnStringCopy(cx, args, buffer);
#endif
}
Reported by FlawFinder.
Line: 3272
Column: 5
CWE codes:
119
120
Suggestion:
Perform bounds checking, use functions that limit length, or ensure that the size is larger than the maximum possible length
JS_ReportErrorASCII(cx, "Argument must be a SharedArrayBuffer");
return false;
}
char buffer[64];
uint32_t nchar =
SprintfLiteral(buffer, "%p",
obj->as<SharedArrayBufferObject>().dataPointerShared().unwrap(/*safeish*/));
JSString* str = JS_NewStringCopyN(cx, buffer, nchar);
Reported by FlawFinder.
Line: 2375
Column: 29
CWE codes:
126
if (!JS_DefineProperty(cx, inlineFrameInfo, "kind", frameKind, propAttrs))
return false;
size_t length = strlen(inlineFrame.label.get());
auto label = reinterpret_cast<Latin1Char*>(inlineFrame.label.release());
frameLabel = NewString<CanGC>(cx, label, length);
if (!frameLabel)
return false;
Reported by FlawFinder.
src/third_party/wiredtiger/src/utilities/util_verify.c
9 issues
Line: 52
Column: 46
CWE codes:
126
stderr, "%s: only a single 'dump_offsets' argument supported\n", progname);
return (usage());
}
dump_offsets = __wt_optarg + strlen("dump_offsets=");
} else if (strcmp(__wt_optarg, "dump_pages") == 0)
dump_pages = true;
else
return (usage());
break;
Reported by FlawFinder.
Line: 79
Column: 16
CWE codes:
126
if (dump_address || dump_blocks || dump_layout || dump_offsets != NULL || dump_pages ||
stable_timestamp) {
size = strlen("dump_address,") + strlen("dump_blocks,") + strlen("dump_layout,") +
strlen("dump_pages,") + strlen("dump_offsets[],") +
(dump_offsets == NULL ? 0 : strlen(dump_offsets)) + strlen("history_store") +
strlen("stable_timestamp,") + 20;
if ((config = malloc(size)) == NULL) {
ret = util_err(session, errno, NULL);
Reported by FlawFinder.
Line: 79
Column: 42
CWE codes:
126
if (dump_address || dump_blocks || dump_layout || dump_offsets != NULL || dump_pages ||
stable_timestamp) {
size = strlen("dump_address,") + strlen("dump_blocks,") + strlen("dump_layout,") +
strlen("dump_pages,") + strlen("dump_offsets[],") +
(dump_offsets == NULL ? 0 : strlen(dump_offsets)) + strlen("history_store") +
strlen("stable_timestamp,") + 20;
if ((config = malloc(size)) == NULL) {
ret = util_err(session, errno, NULL);
Reported by FlawFinder.
Line: 79
Column: 67
CWE codes:
126
if (dump_address || dump_blocks || dump_layout || dump_offsets != NULL || dump_pages ||
stable_timestamp) {
size = strlen("dump_address,") + strlen("dump_blocks,") + strlen("dump_layout,") +
strlen("dump_pages,") + strlen("dump_offsets[],") +
(dump_offsets == NULL ? 0 : strlen(dump_offsets)) + strlen("history_store") +
strlen("stable_timestamp,") + 20;
if ((config = malloc(size)) == NULL) {
ret = util_err(session, errno, NULL);
Reported by FlawFinder.
Line: 80
Column: 35
CWE codes:
126
if (dump_address || dump_blocks || dump_layout || dump_offsets != NULL || dump_pages ||
stable_timestamp) {
size = strlen("dump_address,") + strlen("dump_blocks,") + strlen("dump_layout,") +
strlen("dump_pages,") + strlen("dump_offsets[],") +
(dump_offsets == NULL ? 0 : strlen(dump_offsets)) + strlen("history_store") +
strlen("stable_timestamp,") + 20;
if ((config = malloc(size)) == NULL) {
ret = util_err(session, errno, NULL);
goto err;
Reported by FlawFinder.
Line: 80
Column: 11
CWE codes:
126
if (dump_address || dump_blocks || dump_layout || dump_offsets != NULL || dump_pages ||
stable_timestamp) {
size = strlen("dump_address,") + strlen("dump_blocks,") + strlen("dump_layout,") +
strlen("dump_pages,") + strlen("dump_offsets[],") +
(dump_offsets == NULL ? 0 : strlen(dump_offsets)) + strlen("history_store") +
strlen("stable_timestamp,") + 20;
if ((config = malloc(size)) == NULL) {
ret = util_err(session, errno, NULL);
goto err;
Reported by FlawFinder.
Line: 81
Column: 39
CWE codes:
126
stable_timestamp) {
size = strlen("dump_address,") + strlen("dump_blocks,") + strlen("dump_layout,") +
strlen("dump_pages,") + strlen("dump_offsets[],") +
(dump_offsets == NULL ? 0 : strlen(dump_offsets)) + strlen("history_store") +
strlen("stable_timestamp,") + 20;
if ((config = malloc(size)) == NULL) {
ret = util_err(session, errno, NULL);
goto err;
}
Reported by FlawFinder.
Line: 81
Column: 63
CWE codes:
126
stable_timestamp) {
size = strlen("dump_address,") + strlen("dump_blocks,") + strlen("dump_layout,") +
strlen("dump_pages,") + strlen("dump_offsets[],") +
(dump_offsets == NULL ? 0 : strlen(dump_offsets)) + strlen("history_store") +
strlen("stable_timestamp,") + 20;
if ((config = malloc(size)) == NULL) {
ret = util_err(session, errno, NULL);
goto err;
}
Reported by FlawFinder.
Line: 82
Column: 11
CWE codes:
126
size = strlen("dump_address,") + strlen("dump_blocks,") + strlen("dump_layout,") +
strlen("dump_pages,") + strlen("dump_offsets[],") +
(dump_offsets == NULL ? 0 : strlen(dump_offsets)) + strlen("history_store") +
strlen("stable_timestamp,") + 20;
if ((config = malloc(size)) == NULL) {
ret = util_err(session, errno, NULL);
goto err;
}
if ((ret = __wt_snprintf(config, size, "%s%s%s%s%s%s%s%s",
Reported by FlawFinder.
src/third_party/wiredtiger/test/suite/test_hs23.py
9 issues
Line: 73
Column: 9
cursor.set_value(value2)
self.session.timestamp_transaction(
'commit_timestamp=' + self.timestamp_str(10))
self.assertEquals(cursor.update(), 0)
cursor.set_key(key)
cursor.set_value(value3)
self.session.timestamp_transaction(
'commit_timestamp=' + self.timestamp_str(20))
Reported by Pylint.
Line: 79
Column: 9
cursor.set_value(value3)
self.session.timestamp_transaction(
'commit_timestamp=' + self.timestamp_str(20))
self.assertEquals(cursor.update(), 0)
cursor.set_key(key)
cursor.set_value(value4)
self.session.timestamp_transaction(
'commit_timestamp=' + self.timestamp_str(15))
Reported by Pylint.
Line: 85
Column: 9
cursor.set_value(value4)
self.session.timestamp_transaction(
'commit_timestamp=' + self.timestamp_str(15))
self.assertEquals(cursor.update(), 0)
cursor.set_key(key)
cursor.set_value(value5)
self.session.timestamp_transaction(
'commit_timestamp=' + self.timestamp_str(20))
Reported by Pylint.
Line: 91
Column: 9
cursor.set_value(value5)
self.session.timestamp_transaction(
'commit_timestamp=' + self.timestamp_str(20))
self.assertEquals(cursor.update(), 0)
self.session.commit_transaction()
# Do a checkpoint to trigger
# history store reconciliation.
self.session.checkpoint()
Reported by Pylint.
Line: 1
Column: 1
#!/usr/bin/env python
#
# Public Domain 2014-present MongoDB, Inc.
# Public Domain 2008-2014 WiredTiger, Inc.
#
# This is free and unencumbered software released into the public domain.
#
# Anyone is free to copy, modify, publish, use, compile, sell, or
# distribute this software, either in source code form or as a compiled
Reported by Pylint.
Line: 35
Column: 1
# test_hs23.py
# Test the case that we have update, out of order timestamp
# update, and update again in the same transaction
class test_hs23(wttest.WiredTigerTestCase):
conn_config = 'cache_size=50MB'
session_config = 'isolation=snapshot'
key_format_values = [
('column', dict(key_format='r', key=1)),
Reported by Pylint.
Line: 35
Column: 1
# test_hs23.py
# Test the case that we have update, out of order timestamp
# update, and update again in the same transaction
class test_hs23(wttest.WiredTigerTestCase):
conn_config = 'cache_size=50MB'
session_config = 'isolation=snapshot'
key_format_values = [
('column', dict(key_format='r', key=1)),
Reported by Pylint.
Line: 46
Column: 5
scenarios = make_scenarios(key_format_values)
def test(self):
uri = 'table:test_hs23'
self.session.create(uri, 'key_format={},value_format=S'.format(self.key_format))
cursor = self.session.open_cursor(uri)
self.conn.set_timestamp(
'oldest_timestamp=' + self.timestamp_str(1) + ',stable_timestamp=' + self.timestamp_str(1))
Reported by Pylint.
Line: 51
Column: 1
self.session.create(uri, 'key_format={},value_format=S'.format(self.key_format))
cursor = self.session.open_cursor(uri)
self.conn.set_timestamp(
'oldest_timestamp=' + self.timestamp_str(1) + ',stable_timestamp=' + self.timestamp_str(1))
key = self.key
value1 = 'a'
value2 = 'b'
Reported by Pylint.
site_scons/site_tools/forceincludes.py
8 issues
Line: 23
Column: 1
# WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE SOFTWARE.
#
import SCons
def _add_scanner(builder):
# We are taking over the target scanner here. If we want to not do
# that we need to invent a ListScanner concept to inject. What if
# the other scanner wants a different path_function?
Reported by Pylint.
Line: 54
Column: 1
argument=builder.source_scanner,
)
def generate(env, **kwargs):
if not 'FORCEINCLUDEPREFIX' in env:
if 'msvc' in env.get('TOOLS', []):
env['FORCEINCLUDEPREFIX'] = '/FI'
else:
env['FORCEINCLUDEPREFIX'] = '-include '
Reported by Pylint.
Line: 82
Column: 12
for object_builder in SCons.Tool.createObjBuilders(env):
_add_scanner(object_builder)
def exists(env):
return True
Reported by Pylint.
Line: 1
Column: 1
# Copyright 2021 MongoDB Inc.
#
# Permission is hereby granted, free of charge, to any person obtaining
# a copy of this software and associated documentation files (the
# "Software"), to deal in the Software without restriction, including
# without limitation the rights to use, copy, modify, merge, publish,
# distribute, sublicense, and/or sell copies of the Software, and to
# permit persons to whom the Software is furnished to do so, subject to
# the following conditions:
Reported by Pylint.
Line: 29
Suggestion:
https://bandit.readthedocs.io/en/latest/plugins/b101_assert_used.html
# We are taking over the target scanner here. If we want to not do
# that we need to invent a ListScanner concept to inject. What if
# the other scanner wants a different path_function?
assert builder.target_scanner is None
def new_scanner(node, env, path, argument):
# Use the path information that FindPathDirs gave us to resolve
# the forced includes into nodes given the search path.
fis = [env.FindFile(f, path) for f in env.get('FORCEINCLUDES', [])]
Reported by Bandit.
Line: 54
Column: 1
argument=builder.source_scanner,
)
def generate(env, **kwargs):
if not 'FORCEINCLUDEPREFIX' in env:
if 'msvc' in env.get('TOOLS', []):
env['FORCEINCLUDEPREFIX'] = '/FI'
else:
env['FORCEINCLUDEPREFIX'] = '-include '
Reported by Pylint.
Line: 65
Column: 1
env['FORCEINCLUDESUFFIX'] = ''
# Expand FORCEINCLUDES with the indicated prefixes and suffixes.
env['_FORCEINCLUDES'] = '${_concat(FORCEINCLUDEPREFIX, FORCEINCLUDES, FORCEINCLUDESUFFIX, __env__, lambda x: x, TARGET, SOURCE)}'
env.Append(
# It might be better if this went in _CPPINCFLAGS, but it
# breaks the MSVC RC builder because the `rc` tool doesn't
# honor /FI. It should be OK to put it in CCFLAGS, unless
Reported by Pylint.
Line: 82
Column: 1
for object_builder in SCons.Tool.createObjBuilders(env):
_add_scanner(object_builder)
def exists(env):
return True
Reported by Pylint.
src/third_party/icu4c-57.1/source/i18n/timezone.cpp
8 issues
Line: 329
// class TimeZone
// *****************************************************************************
UOBJECT_DEFINE_ABSTRACT_RTTI_IMPLEMENTATION(TimeZone)
TimeZone::TimeZone()
: UObject(), fID()
{
}
Reported by Cppcheck.
Line: 58
Column: 3
CWE codes:
134
Suggestion:
Use a constant for the format specification
{
va_list ap;
va_start(ap, pat);
vfprintf(stderr, pat, ap);
fflush(stderr);
}
static char gStrBuf[256];
#define U_DEBUG_TZ_STR(x) u_austrncpy(gStrBuf,x,sizeof(gStrBuf)-1)
// must use double parens, i.e.: U_DEBUG_TZ_MSG(("four is: %d",4));
Reported by FlawFinder.
Line: 61
Column: 8
CWE codes:
119
120
Suggestion:
Perform bounds checking, use functions that limit length, or ensure that the size is larger than the maximum possible length
vfprintf(stderr, pat, ap);
fflush(stderr);
}
static char gStrBuf[256];
#define U_DEBUG_TZ_STR(x) u_austrncpy(gStrBuf,x,sizeof(gStrBuf)-1)
// must use double parens, i.e.: U_DEBUG_TZ_MSG(("four is: %d",4));
#define U_DEBUG_TZ_MSG(x) {debug_tz_loc(__FILE__,__LINE__);debug_tz_msg x;}
#else
#define U_DEBUG_TZ_MSG(x)
Reported by FlawFinder.
Line: 120
Column: 8
CWE codes:
119
120
Suggestion:
Perform bounds checking, use functions that limit length, or ensure that the size is larger than the maximum possible length
static icu::TimeZone* _UNKNOWN_ZONE = NULL;
static icu::UInitOnce gStaticZonesInitOnce = U_INITONCE_INITIALIZER;
static char TZDATA_VERSION[16];
static icu::UInitOnce gTZDataVersionInitOnce = U_INITONCE_INITIALIZER;
static int32_t* MAP_SYSTEM_ZONES = NULL;
static int32_t* MAP_CANONICAL_SYSTEM_ZONES = NULL;
static int32_t* MAP_CANONICAL_SYSTEM_LOCATION_ZONES = NULL;
Reported by FlawFinder.
Line: 251
Column: 5
CWE codes:
119
120
Suggestion:
Perform bounds checking, use functions that limit length, or ensure that the size is larger than the maximum possible length
UResourceBundle* TimeZone::loadRule(const UResourceBundle* top, const UnicodeString& ruleid, UResourceBundle* oldbundle, UErrorCode& status) {
char key[64];
ruleid.extract(0, sizeof(key)-1, key, (int32_t)sizeof(key)-1, US_INV);
U_DEBUG_TZ_MSG(("loadRule(%s)\n", key));
UResourceBundle *r = ures_getByKey(top, kRULES, oldbundle, &status);
U_DEBUG_TZ_MSG(("loadRule(%s) -> kRULES [%s]\n", key, u_errorName(status)));
r = ures_getByKey(r, key, r, &status);
Reported by FlawFinder.
Line: 274
Column: 5
CWE codes:
119
120
Suggestion:
Perform bounds checking, use functions that limit length, or ensure that the size is larger than the maximum possible length
UErrorCode& ec)
{
#if U_DEBUG_TZ
char buf[128];
id.extract(0, sizeof(buf)-1, buf, sizeof(buf), "");
#endif
UResourceBundle *top = ures_openDirect(0, kZONEINFO, &ec);
U_DEBUG_TZ_MSG(("pre: res sz=%d\n", ures_getSize(&res)));
/* &res = */ getZoneByName(top, id, &res, ec);
Reported by FlawFinder.
Line: 828
Column: 21
CWE codes:
119
120
Suggestion:
Perform bounds checking, use functions that limit length, or ensure that the size is larger than the maximum possible length
}
if (region != NULL) {
// Filter by region
char tzregion[4]; // max 3 letters + null term
TimeZone::getRegion(id, tzregion, sizeof(tzregion), ec);
if (U_FAILURE(ec)) {
break;
}
if (uprv_stricmp(tzregion, region) != 0) {
Reported by FlawFinder.
Line: 1645
Column: 5
CWE codes:
119
120
Suggestion:
Perform bounds checking, use functions that limit length, or ensure that the size is larger than the maximum possible length
}
UErrorCode tmperr = U_ZERO_ERROR;
char winidKey[MAX_WINDOWS_ID_SIZE];
int32_t winKeyLen = winid.extract(0, winid.length(), winidKey, sizeof(winidKey) - 1, US_INV);
if (winKeyLen == 0 || winKeyLen >= (int32_t)sizeof(winidKey)) {
ures_close(zones);
return id;
Reported by FlawFinder.
src/third_party/wiredtiger/test/suite/test_bug003.py
8 issues
Line: 32
Column: 1
# test_bug003.py
# Regression tests.
import wiredtiger, wttest
from wtscenario import make_scenarios
# Regression tests.
class test_bug003(wttest.WiredTigerTestCase):
types = [
Reported by Pylint.
Line: 32
Column: 1
# test_bug003.py
# Regression tests.
import wiredtiger, wttest
from wtscenario import make_scenarios
# Regression tests.
class test_bug003(wttest.WiredTigerTestCase):
types = [
Reported by Pylint.
Line: 55
Column: 9
self.session.checkpoint("name=ckpt")
else:
self.session.checkpoint()
cursor = self.session.open_cursor(self.uri, None, "bulk")
if __name__ == '__main__':
wttest.run()
Reported by Pylint.
Line: 1
Column: 1
#!/usr/bin/env python
#
# Public Domain 2014-present MongoDB, Inc.
# Public Domain 2008-2014 WiredTiger, Inc.
#
# This is free and unencumbered software released into the public domain.
#
# Anyone is free to copy, modify, publish, use, compile, sell, or
# distribute this software, either in source code form or as a compiled
Reported by Pylint.
Line: 32
Column: 1
# test_bug003.py
# Regression tests.
import wiredtiger, wttest
from wtscenario import make_scenarios
# Regression tests.
class test_bug003(wttest.WiredTigerTestCase):
types = [
Reported by Pylint.
Line: 36
Column: 1
from wtscenario import make_scenarios
# Regression tests.
class test_bug003(wttest.WiredTigerTestCase):
types = [
('file', dict(uri='file:data')),
('table', dict(uri='table:data')),
]
ckpt = [
Reported by Pylint.
Line: 36
Column: 1
from wtscenario import make_scenarios
# Regression tests.
class test_bug003(wttest.WiredTigerTestCase):
types = [
('file', dict(uri='file:data')),
('table', dict(uri='table:data')),
]
ckpt = [
Reported by Pylint.
Line: 49
Column: 5
scenarios = make_scenarios(types, ckpt)
# Confirm bulk-load isn't stopped by checkpoints.
def test_bug003(self):
self.session.create(self.uri, "key_format=S,value_format=S")
if self.name == 1:
self.session.checkpoint("name=ckpt")
else:
self.session.checkpoint()
Reported by Pylint.
src/third_party/scons-3.1.2/scons-local-3.1.2/SCons/Tool/hpcxx.py
8 issues
Line: 71
Suggestion:
https://bandit.readthedocs.io/en/latest/plugins/b605_start_process_with_a_shell.html
env['CXX'] = acc or 'aCC'
env['SHCXXFLAGS'] = SCons.Util.CLVar('$CXXFLAGS +Z')
# determine version of aCC
with os.popen(acc + ' -V 2>&1') as p:
line = p.readline().rstrip()
if line.find('aCC: HP ANSI C++') == 0:
env['CXXVERSION'] = line.split()[-1]
if env['PLATFORM'] == 'cygwin':
Reported by Bandit.
Line: 56
Column: 5
# (IOError) or isn't readable (OSError) is okay.
dirs = []
for dir in dirs:
cc = '/opt/' + dir + '/bin/aCC'
if os.path.exists(cc):
acc = cc
break
Reported by Pylint.
Line: 81
Column: 12
else:
env['SHCXXFLAGS'] = SCons.Util.CLVar('$CXXFLAGS +Z')
def exists(env):
return acc
# Local Variables:
# tab-width:4
# indent-tabs-mode:nil
Reported by Pylint.
Line: 34
Column: 1
# WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE SOFTWARE.
#
__revision__ = "src/engine/SCons/Tool/hpcxx.py bee7caf9defd6e108fc2998a2520ddb36a967691 2019-12-17 02:07:09 bdeegan"
import os.path
import SCons.Util
Reported by Pylint.
Line: 45
Column: 1
#cplusplus = __import__('cxx', globals(), locals(), [])
acc = None
# search for the acc compiler and linker front end
try:
dirs = os.listdir('/opt')
Reported by Pylint.
Line: 62
Column: 1
acc = cc
break
def generate(env):
"""Add Builders and construction variables for g++ to an Environment."""
cplusplus.generate(env)
if acc:
Reported by Pylint.
Line: 71
Column: 44
env['CXX'] = acc or 'aCC'
env['SHCXXFLAGS'] = SCons.Util.CLVar('$CXXFLAGS +Z')
# determine version of aCC
with os.popen(acc + ' -V 2>&1') as p:
line = p.readline().rstrip()
if line.find('aCC: HP ANSI C++') == 0:
env['CXXVERSION'] = line.split()[-1]
if env['PLATFORM'] == 'cygwin':
Reported by Pylint.
Line: 81
Column: 1
else:
env['SHCXXFLAGS'] = SCons.Util.CLVar('$CXXFLAGS +Z')
def exists(env):
return acc
# Local Variables:
# tab-width:4
# indent-tabs-mode:nil
Reported by Pylint.
src/third_party/icu4c-57.1/source/i18n/plurrule.cpp
8 issues
Line: 59
static const UChar PK_DECIMAL[]={LOW_D,LOW_E,LOW_C,LOW_I,LOW_M,LOW_A,LOW_L,0};
static const UChar PK_INTEGER[]={LOW_I,LOW_N,LOW_T,LOW_E,LOW_G,LOW_E,LOW_R,0};
UOBJECT_DEFINE_RTTI_IMPLEMENTATION(PluralRules)
UOBJECT_DEFINE_RTTI_IMPLEMENTATION(PluralKeywordEnumeration)
PluralRules::PluralRules(UErrorCode& /*status*/)
: UObject(),
mRules(NULL)
Reported by Cppcheck.
Line: 664
Column: 9
CWE codes:
119
120
Suggestion:
Perform bounds checking, use functions that limit length, or ensure that the size is larger than the maximum possible length
if (s == NULL) {
// Check parent locales.
UErrorCode status = U_ZERO_ERROR;
char parentLocaleName[ULOC_FULLNAME_CAPACITY];
const char *curLocaleName=locale.getName();
uprv_strcpy(parentLocaleName, curLocaleName);
while (uloc_getParent(parentLocaleName, parentLocaleName,
ULOC_FULLNAME_CAPACITY, &status) > 0) {
Reported by FlawFinder.
Line: 683
Column: 5
CWE codes:
119
120
Suggestion:
Perform bounds checking, use functions that limit length, or ensure that the size is larger than the maximum possible length
return emptyStr;
}
char setKey[256];
u_UCharsToChars(s, setKey, resLen + 1);
// printf("\n PluralRule: %s\n", setKey);
LocalUResourceBundlePointer ruleRes(ures_getByKey(rb.getAlias(), "rules", NULL, &errCode));
if(U_FAILURE(errCode)) {
Reported by FlawFinder.
Line: 1059
Column: 5
CWE codes:
119
120
Suggestion:
Perform bounds checking, use functions that limit length, or ensure that the size is larger than the maximum possible length
int32_t
PluralRuleParser::getNumberValue(const UnicodeString& token) {
int32_t i;
char digits[128];
i = token.extract(0, token.length(), digits, UPRV_LENGTHOF(digits), US_INV);
digits[i]='\0';
return((int32_t)atoi(digits));
Reported by FlawFinder.
Line: 1064
Column: 21
CWE codes:
190
Suggestion:
If source untrusted, check both minimum and maximum, even if the input had no minus sign (large numbers can roll over into negative number; consider saving to an unsigned value if that is intended)
i = token.extract(0, token.length(), digits, UPRV_LENGTHOF(digits), US_INV);
digits[i]='\0';
return((int32_t)atoi(digits));
}
void
PluralRuleParser::checkSyntax(UErrorCode &status)
Reported by FlawFinder.
Line: 1530
Column: 5
CWE codes:
119
120
Suggestion:
Perform bounds checking, use functions that limit length, or ensure that the size is larger than the maximum possible length
}
// Slow path, convert with sprintf, parse converted output.
char buf[30] = {0};
sprintf(buf, "%1.15e", n);
// formatted number looks like this: 1.234567890123457e-01
int exponent = atoi(buf+18);
int numFractionDigits = 15;
for (int i=16; ; --i) {
Reported by FlawFinder.
Line: 1531
Column: 5
CWE codes:
120
Suggestion:
Use sprintf_s, snprintf, or vsnprintf
// Slow path, convert with sprintf, parse converted output.
char buf[30] = {0};
sprintf(buf, "%1.15e", n);
// formatted number looks like this: 1.234567890123457e-01
int exponent = atoi(buf+18);
int numFractionDigits = 15;
for (int i=16; ; --i) {
if (buf[i] != '0') {
Reported by FlawFinder.
Line: 1533
Column: 20
CWE codes:
190
Suggestion:
If source untrusted, check both minimum and maximum, even if the input had no minus sign (large numbers can roll over into negative number; consider saving to an unsigned value if that is intended)
char buf[30] = {0};
sprintf(buf, "%1.15e", n);
// formatted number looks like this: 1.234567890123457e-01
int exponent = atoi(buf+18);
int numFractionDigits = 15;
for (int i=16; ; --i) {
if (buf[i] != '0') {
break;
}
Reported by FlawFinder.