The following issues were found

src/third_party/scons-3.1.2/scons-local-3.1.2/SCons/Tool/midl.py
4 issues
Attempted relative import beyond top-level package
Error

Line: 42 Column: 1

              import SCons.Scanner.IDL
import SCons.Util

from .MSCommon import msvc_exists

def midl_emitter(target, source, env):
    """Produces a list of outputs from the MIDL compiler"""
    base, _ = SCons.Util.splitext(str(target[0]))
    tlb = target[0]

            

Reported by Pylint.

Line too long (115/100)
Error

Line: 34 Column: 1

              # WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE SOFTWARE.
#

__revision__ = "src/engine/SCons/Tool/midl.py bee7caf9defd6e108fc2998a2520ddb36a967691 2019-12-17 02:07:09 bdeegan"

import SCons.Action
import SCons.Builder
import SCons.Defaults
import SCons.Scanner.IDL

            

Reported by Pylint.

Line too long (159/100)
Error

Line: 78 Column: 1

              
    env['MIDL']          = 'MIDL.EXE'
    env['MIDLFLAGS']     = SCons.Util.CLVar('/nologo')
    env['MIDLCOM']       = '$MIDL $MIDLFLAGS /tlb ${TARGETS[0]} /h ${TARGETS[1]} /iid ${TARGETS[2]} /proxy ${TARGETS[3]} /dlldata ${TARGETS[4]} $SOURCE 2> NUL'
    env['BUILDERS']['TypeLibrary'] = midl_builder

def exists(env):
    return msvc_exists(env)


            

Reported by Pylint.

Missing function or method docstring
Error

Line: 81 Column: 1

                  env['MIDLCOM']       = '$MIDL $MIDLFLAGS /tlb ${TARGETS[0]} /h ${TARGETS[1]} /iid ${TARGETS[2]} /proxy ${TARGETS[3]} /dlldata ${TARGETS[4]} $SOURCE 2> NUL'
    env['BUILDERS']['TypeLibrary'] = midl_builder

def exists(env):
    return msvc_exists(env)

# Local Variables:
# tab-width:4
# indent-tabs-mode:nil

            

Reported by Pylint.

src/mongo/db/storage/wiredtiger/wiredtiger_kv_engine.cpp
4 issues
char - Statically-sized arrays can be improperly restricted, leading to potential overflows or other issues
Security

Line: 473 Column: 9 CWE codes: 119 120
Suggestion: Perform bounds checking, use functions that limit length, or ensure that the size is larger than the maximum possible length

                  _wtOpenConfig = config;

    {
        char buf[(2 * 8 /*bytes in hex*/) + 1 /*nul terminator*/];
        invariantWTOK(_conn->query_timestamp(_conn, buf, "get=recovery"));

        std::uint64_t tmp;
        fassert(50758, NumberParser().base(16)(buf, &tmp));
        _recoveryTimestamp = Timestamp(tmp);

            

Reported by FlawFinder.

char - Statically-sized arrays can be improperly restricted, leading to potential overflows or other issues
Security

Line: 486 Column: 9 CWE codes: 119 120
Suggestion: Perform bounds checking, use functions that limit length, or ensure that the size is larger than the maximum possible length

                  }

    {
        char buf[(2 * 8 /*bytes in hex*/) + 1 /*nul terminator*/];
        int ret = _conn->query_timestamp(_conn, buf, "get=oldest");
        if (ret != WT_NOTFOUND) {
            invariantWTOK(ret);

            std::uint64_t tmp;

            

Reported by FlawFinder.

char - Statically-sized arrays can be improperly restricted, leading to potential overflows or other issues
Security

Line: 1974 Column: 5 CWE codes: 119 120
Suggestion: Perform bounds checking, use functions that limit length, or ensure that the size is larger than the maximum possible length

              uint64_t _fetchAllDurableValue(WT_CONNECTION* conn) {
    // Fetch the latest all_durable value from the storage engine. This value will be a timestamp
    // that has no holes (uncommitted transactions with lower timestamps) behind it.
    char buf[(2 * 8 /*bytes in hex*/) + 1 /*nul terminator*/];
    auto wtStatus = conn->query_timestamp(conn, buf, "get=all_durable");
    if (wtStatus == WT_NOTFOUND) {
        // Treat this as lowest possible timestamp; we need to see all preexisting data but no new
        // (timestamped) data.
        return StorageEngine::kMinimumTimestamp;

            

Reported by FlawFinder.

char - Statically-sized arrays can be improperly restricted, leading to potential overflows or other issues
Security

Line: 2508 Column: 5 CWE codes: 119 120
Suggestion: Perform bounds checking, use functions that limit length, or ensure that the size is larger than the maximum possible length

              }

std::uint64_t WiredTigerKVEngine::_getCheckpointTimestamp() const {
    char buf[(2 * 8 /*bytes in hex*/) + 1 /*nul terminator*/];
    invariantWTOK(_conn->query_timestamp(_conn, buf, "get=last_checkpoint"));

    std::uint64_t tmp;
    fassert(50963, NumberParser().base(16)(buf, &tmp));
    return tmp;

            

Reported by FlawFinder.

src/third_party/scons-3.1.2/scons-local-3.1.2/SCons/Tool/ifort.py
4 issues
Attempted relative import beyond top-level package
Error

Line: 39 Column: 1

              
import SCons.Defaults
from SCons.Scanner.Fortran import FortranScan
from .FortranCommon import add_all_to_env

def generate(env):
    """Add Builders and construction variables for ifort to an Environment."""
    # ifort supports Fortran 90 and Fortran 95
    # Additionally, ifort recognizes more file extensions.

            

Reported by Pylint.

Line too long (116/100)
Error

Line: 35 Column: 1

              # WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE SOFTWARE.
#

__revision__ = "src/engine/SCons/Tool/ifort.py bee7caf9defd6e108fc2998a2520ddb36a967691 2019-12-17 02:07:09 bdeegan"

import SCons.Defaults
from SCons.Scanner.Fortran import FortranScan
from .FortranCommon import add_all_to_env


            

Reported by Pylint.

Variable name "fc" doesn't conform to snake_case naming style
Error

Line: 61 Column: 5

              
    add_all_to_env(env)

    fc = 'ifort'

    for dialect in ['F77', 'F90', 'FORTRAN', 'F95']:
        env['%s' % dialect] = fc
        env['SH%s' % dialect] = '$%s' % dialect
        if env['PLATFORM'] == 'posix':

            

Reported by Pylint.

Missing function or method docstring
Error

Line: 81 Column: 1

                  else:
        env['FORTRANMODDIRPREFIX'] = "-module "

def exists(env):
    return env.Detect('ifort')

# Local Variables:
# tab-width:4
# indent-tabs-mode:nil

            

Reported by Pylint.

src/mongo/db/fts/unicode/gen_diacritic_list.py
4 issues
Missing module docstring
Error

Line: 1 Column: 1

              #!/usr/bin/env python3
# -*- coding: utf-8 -*-
import sys

from gen_helper import getCopyrightNotice, openNamespaces, closeNamespaces, \
    include


def generate(unicode_proplist_file, target):

            

Reported by Pylint.

Unnecessary parens after 'if' keyword
Error

Line: 29 Column: 1

                  for line in proplist_file:
        # Filter out blank lines and lines that start with #
        data = line[:line.find('#')]
        if (data == ""):
            continue

        # Parse the data on the line
        values = data.split("; ")
        assert (len(values) == 2)

            

Reported by Pylint.

Use of assert detected. The enclosed code will be removed when compiling to optimised byte code.
Security

Line: 34
Suggestion: https://bandit.readthedocs.io/en/latest/plugins/b101_assert_used.html

              
        # Parse the data on the line
        values = data.split("; ")
        assert (len(values) == 2)

        uproperty = values[1].strip()
        if uproperty in "Diacritic":
            if len(values[0].split('..')) == 2:
                codepoint_range = values[0].split('..')

            

Reported by Bandit.

Unnecessary parens after 'assert' keyword
Error

Line: 34 Column: 1

              
        # Parse the data on the line
        values = data.split("; ")
        assert (len(values) == 2)

        uproperty = values[1].strip()
        if uproperty in "Diacritic":
            if len(values[0].split('..')) == 2:
                codepoint_range = values[0].split('..')

            

Reported by Pylint.

src/third_party/scons-3.1.2/scons-local-3.1.2/SCons/Tool/default.py
4 issues
Unused argument 'env'
Error

Line: 43 Column: 12

                  for t in SCons.Tool.tool_list(env['PLATFORM'], env):
        SCons.Tool.Tool(t)(env)

def exists(env):
    return 1

# Local Variables:
# tab-width:4
# indent-tabs-mode:nil

            

Reported by Pylint.

Line too long (118/100)
Error

Line: 34 Column: 1

              # WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE SOFTWARE.
#

__revision__ = "src/engine/SCons/Tool/default.py bee7caf9defd6e108fc2998a2520ddb36a967691 2019-12-17 02:07:09 bdeegan"

import SCons.Tool

def generate(env):
    """Add default tools."""

            

Reported by Pylint.

Variable name "t" doesn't conform to snake_case naming style
Error

Line: 40 Column: 9

              
def generate(env):
    """Add default tools."""
    for t in SCons.Tool.tool_list(env['PLATFORM'], env):
        SCons.Tool.Tool(t)(env)

def exists(env):
    return 1


            

Reported by Pylint.

Missing function or method docstring
Error

Line: 43 Column: 1

                  for t in SCons.Tool.tool_list(env['PLATFORM'], env):
        SCons.Tool.Tool(t)(env)

def exists(env):
    return 1

# Local Variables:
# tab-width:4
# indent-tabs-mode:nil

            

Reported by Pylint.

buildscripts/eslint.py
4 issues
Audit url open for permitted schemes. Allowing use of file:/ or custom schemes is often unexpected.
Security blacklist

Line: 94
Suggestion: https://bandit.readthedocs.io/en/latest/blacklists/blacklist_calls.html#b310-urllib-urlopen

              
    # Download the file
    print("Downloading ESLint %s from %s, saving to %s" % (ESLINT_VERSION, url, temp_tar_file))
    urllib.request.urlretrieve(url, temp_tar_file)

    # pylint: disable=too-many-function-args
    print("Extracting ESLint %s to %s" % (ESLINT_VERSION, dest_file))
    eslint_distfile = ESLINT_SOURCE_TAR_BASE.substitute(platform=platform, arch=arch)
    extract_eslint(temp_tar_file, eslint_distfile)

            

Reported by Bandit.

Consider possible security implications associated with subprocess module.
Security blacklist

Line: 17
Suggestion: https://bandit.readthedocs.io/en/latest/blacklists/blacklist_imports.html#b404-import-subprocess

              import os
import shutil
import string
import subprocess
import sys
import tarfile
import tempfile
import threading
from typing import Optional

            

Reported by Bandit.

subprocess call - check for execution of untrusted input.
Security injection

Line: 67
Suggestion: https://bandit.readthedocs.io/en/latest/plugins/b603_subprocess_without_shell_equals_true.html

              
def callo(args):
    """Call a program, and capture its output."""
    return subprocess.check_output(args).decode('utf-8')


def extract_eslint(tar_path, target_file):
    """Extract ESLint tar file."""
    tarfp = tarfile.open(tar_path)

            

Reported by Bandit.

subprocess call - check for execution of untrusted input.
Security injection

Line: 201
Suggestion: https://bandit.readthedocs.io/en/latest/plugins/b603_subprocess_without_shell_equals_true.html

              
    def autofix(self, file_name):
        """Run ESLint in fix mode."""
        return not subprocess.call([self.path, "--fix", file_name])


def is_interesting_file(file_name):
    """Return true if this file should be checked."""
    return ((file_name.startswith("src/mongo") or file_name.startswith("jstests"))

            

Reported by Bandit.

src/third_party/scons-3.1.2/scons-local-3.1.2/SCons/Scanner/IDL.py
4 issues
Module name "IDL" doesn't conform to snake_case naming style
Error

Line: 1 Column: 1

              """SCons.Scanner.IDL

This module implements the dependency scanner for IDL (Interface
Definition Language) files.

"""

#
# Copyright (c) 2001 - 2019 The SCons Foundation

            

Reported by Pylint.

Line too long (117/100)
Error

Line: 31 Column: 1

              # WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE SOFTWARE.
#

__revision__ = "src/engine/SCons/Scanner/IDL.py bee7caf9defd6e108fc2998a2520ddb36a967691 2019-12-17 02:07:09 bdeegan"

import SCons.Node.FS
import SCons.Scanner

def IDLScan():

            

Reported by Pylint.

Function name "IDLScan" doesn't conform to snake_case naming style
Error

Line: 36 Column: 1

              import SCons.Node.FS
import SCons.Scanner

def IDLScan():
    """Return a prototype Scanner instance for scanning IDL source files"""
    cs = SCons.Scanner.ClassicCPP("IDLScan",
                                  "$IDLSUFFIXES",
                                  "CPPPATH",
                                  '^[ \t]*(?:#[ \t]*include|[ \t]*import)[ \t]+(<|")([^>"]+)(>|")')

            

Reported by Pylint.

Variable name "cs" doesn't conform to snake_case naming style
Error

Line: 38 Column: 5

              
def IDLScan():
    """Return a prototype Scanner instance for scanning IDL source files"""
    cs = SCons.Scanner.ClassicCPP("IDLScan",
                                  "$IDLSUFFIXES",
                                  "CPPPATH",
                                  '^[ \t]*(?:#[ \t]*include|[ \t]*import)[ \t]+(<|")([^>"]+)(>|")')
    return cs


            

Reported by Pylint.

src/mongo/db/sorter/sorter.cpp
4 issues
open - Check when opening files - can an attacker redirect it (via symlinks), force the opening of special file type (e.g., device files), move things around to create a race condition, control its ancestors, or change its contents?
Security

Line: 1066 Column: 11 CWE codes: 362

                  // We open the provided file in append mode so that SortedFileWriter instances can share
    // the same file, used serially. We want to share files in order to stay below system
    // open file limits.
    _file.open(_path.string(), std::ios::app | std::ios::binary | std::ios::in | std::ios::out);

    uassert(16818,
            str::stream() << "Error opening file " << _path.string() << ": "
                          << sorter::myErrnoWithDescription(),
            _file.good());

            

Reported by FlawFinder.

read - Check buffer boundaries if used in a loop including recursive loops
Security

Line: 339 Column: 16 CWE codes: 120 20

                                str::stream() << "Current file offset (" << _fileCurrentOffset
                                << ") greater than end offset (" << _fileEndOffset << ")");

        _file->read(_fileCurrentOffset, size, out);
        _fileCurrentOffset += size;
    }

    const Settings _settings;
    bool _done = false;

            

Reported by FlawFinder.

read - Check buffer boundaries if used in a loop including recursive loops
Security

Line: 995 Column: 32 CWE codes: 120 20

              }

template <typename Key, typename Value>
void Sorter<Key, Value>::File::read(std::streamoff offset, std::streamsize size, void* out) {
    if (!_file.is_open()) {
        _open();
    }

    if (_offset != -1) {

            

Reported by FlawFinder.

read - Check buffer boundaries if used in a loop including recursive loops
Security

Line: 1012 Column: 11 CWE codes: 120 20

                  }

    _file.seekg(offset);
    _file.read(reinterpret_cast<char*>(out), size);

    uassert(16817,
            str::stream() << "Error reading file " << _path.string() << ": "
                          << sorter::myErrnoWithDescription(),
            _file);

            

Reported by FlawFinder.

buildscripts/packager.py
4 issues
Consider possible security implications associated with subprocess module.
Security blacklist

Line: 38
Suggestion: https://bandit.readthedocs.io/en/latest/blacklists/blacklist_imports.html#b404-import-subprocess

              import os
import re
import shutil
import subprocess
import sys
import tempfile
import time

# The MongoDB names for the architectures we support.

            

Reported by Bandit.

Use of assert detected. The enclosed code will be removed when compiling to optimised byte code.
Security

Line: 464
Suggestion: https://bandit.readthedocs.io/en/latest/plugins/b101_assert_used.html

                  print("In %s, running %s" % (os.getcwd(), " ".join(argv)))
    sys.stdout.flush()
    sys.stderr.flush()
    assert subprocess.Popen(argv).wait() == 0


def backtick(argv):
    """Run argv and return its output string."""
    print("In %s, running %s" % (os.getcwd(), " ".join(argv)))

            

Reported by Bandit.

subprocess call - check for execution of untrusted input.
Security injection

Line: 464
Suggestion: https://bandit.readthedocs.io/en/latest/plugins/b603_subprocess_without_shell_equals_true.html

                  print("In %s, running %s" % (os.getcwd(), " ".join(argv)))
    sys.stdout.flush()
    sys.stderr.flush()
    assert subprocess.Popen(argv).wait() == 0


def backtick(argv):
    """Run argv and return its output string."""
    print("In %s, running %s" % (os.getcwd(), " ".join(argv)))

            

Reported by Bandit.

subprocess call - check for execution of untrusted input.
Security injection

Line: 472
Suggestion: https://bandit.readthedocs.io/en/latest/plugins/b603_subprocess_without_shell_equals_true.html

                  print("In %s, running %s" % (os.getcwd(), " ".join(argv)))
    sys.stdout.flush()
    sys.stderr.flush()
    return subprocess.Popen(argv, stdout=subprocess.PIPE).communicate()[0]


def tarfile(build_os, arch, spec):
    """Return the location where we store the downloaded tarball for this package."""
    return "dl/mongodb-linux-%s-%s-%s.tar.gz" % (spec.version(), build_os, arch)

            

Reported by Bandit.

src/third_party/scons-3.1.2/scons-configure-cache.py
4 issues
Module name "scons-configure-cache" doesn't conform to snake_case naming style
Error

Line: 1 Column: 1

              #! /usr/bin/env python
#
# SCons - a Software Constructor
#
# Copyright (c) 2001 - 2019 The SCons Foundation
#
# Permission is hereby granted, free of charge, to any person obtaining
# a copy of this software and associated documentation files (the
# "Software"), to deal in the Software without restriction, including

            

Reported by Pylint.

Line too long (121/100)
Error

Line: 40 Column: 1

              import json
import os

__revision__ = "src/script/scons-configure-cache.py bee7caf9defd6e108fc2998a2520ddb36a967691 2019-12-17 02:07:09 bdeegan"

__version__ = "3.1.2"

__build__ = "bee7caf9defd6e108fc2998a2520ddb36a967691"


            

Reported by Pylint.

Consider using a dictionary comprehension
Error

Line: 123 Column: 8

                                  help="show current configuration")

# Get the command line as a dict without any of the unspecified entries.
args = dict([x for x in vars(parser.parse_args()).items() if x[1]])

# It seems somewhat strange to me, but positional arguments don't get the -
# in the name changed to _, whereas optional arguments do...
cache = args['cache-dir']
if not os.path.isdir(cache):

            

Reported by Pylint.

Constant name "file_count" doesn't conform to UPPER_CASE naming style
Error

Line: 150 Column: 5

                  print(json.dumps(config, sort_keys=True,
                     indent=4, separators=(',', ': ')))
    # in case of the show argument, emit some stats as well
    file_count = 0
    for _, _, files in os.walk('.'):
        file_count += len(files)
    if file_count:  # skip config file if it exists
        file_count -= 1
    print("Cache contains %s files" % file_count)

            

Reported by Pylint.