The following issues were found

buildscripts/make_archive.py
3 issues
Consider possible security implications associated with Popen module.
Security blacklist

Line: 35
Suggestion: https://bandit.readthedocs.io/en/latest/blacklists/blacklist_imports.html#b404-import-subprocess

              import shutil
import zipfile
import tempfile
from subprocess import (Popen, PIPE, STDOUT)


def main(argv):
    """Execute Main program."""
    args = []

            

Reported by Bandit.

Try, Except, Pass detected.
Security

Line: 63
Suggestion: https://bandit.readthedocs.io/en/latest/plugins/b110_try_except_pass.html

                  """Recursively deletes a directory and its contents."""
    try:
        shutil.rmtree(directory)
    except Exception:  # pylint: disable=broad-except
        pass


def make_tar_archive(opts):
    """Generate tar archive.

            

Reported by Bandit.

subprocess call - check for execution of untrusted input.
Security injection

Line: 109
Suggestion: https://bandit.readthedocs.io/en/latest/plugins/b603_subprocess_without_shell_equals_true.html

                  print(" ".join(tar_command))
    # execute the full tar command
    run_directory = os.path.join(os.getcwd(), enclosing_archive_directory)
    proc = Popen(tar_command, stdout=PIPE, stderr=STDOUT, bufsize=0, cwd=run_directory)
    proc.wait()

    # delete temp directory
    delete_directory(enclosing_archive_directory)


            

Reported by Bandit.

src/third_party/scons-3.1.2/scons-local-3.1.2/SCons/Tool/sunf90.py
3 issues
Attempted relative import beyond top-level package
Error

Line: 38 Column: 1

              
import SCons.Util

from .FortranCommon import add_all_to_env

compilers = ['sunf90', 'f90']

def generate(env):
    """Add Builders and construction variables for sun f90 compiler to an

            

Reported by Pylint.

Line too long (117/100)
Error

Line: 34 Column: 1

              # WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE SOFTWARE.
#

__revision__ = "src/engine/SCons/Tool/sunf90.py bee7caf9defd6e108fc2998a2520ddb36a967691 2019-12-17 02:07:09 bdeegan"

import SCons.Util

from .FortranCommon import add_all_to_env


            

Reported by Pylint.

Missing function or method docstring
Error

Line: 57 Column: 1

                  env['SHFORTRANFLAGS'] = SCons.Util.CLVar('$FORTRANFLAGS -KPIC')
    env['SHF90FLAGS'] = SCons.Util.CLVar('$F90FLAGS -KPIC')

def exists(env):
    return env.Detect(compilers)

# Local Variables:
# tab-width:4
# indent-tabs-mode:nil

            

Reported by Pylint.

src/third_party/scons-3.1.2/scons-local-3.1.2/SCons/Tool/nasm.py
3 issues
Unused variable 'shared_obj'
Error

Line: 49 Column: 17

              
def generate(env):
    """Add Builders and construction variables for nasm to an Environment."""
    static_obj, shared_obj = SCons.Tool.createObjBuilders(env)

    for suffix in ASSuffixes:
        static_obj.add_action(suffix, SCons.Defaults.ASAction)
        static_obj.add_emitter(suffix, SCons.Defaults.StaticObjectEmitter)


            

Reported by Pylint.

Line too long (115/100)
Error

Line: 34 Column: 1

              # WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE SOFTWARE.
#

__revision__ = "src/engine/SCons/Tool/nasm.py bee7caf9defd6e108fc2998a2520ddb36a967691 2019-12-17 02:07:09 bdeegan"

import SCons.Defaults
import SCons.Tool
import SCons.Util


            

Reported by Pylint.

Missing function or method docstring
Error

Line: 65 Column: 1

                  env['ASCOM']     = '$AS $ASFLAGS -o $TARGET $SOURCES'
    env['ASPPCOM']   = '$CC $ASPPFLAGS $CPPFLAGS $_CPPDEFFLAGS $_CPPINCFLAGS -c -o $TARGET $SOURCES'

def exists(env):
    return env.Detect('nasm')

# Local Variables:
# tab-width:4
# indent-tabs-mode:nil

            

Reported by Pylint.

src/mongo/db/exec/sbe/stages/merge_join.cpp
3 issues
open - Check when opening files - can an attacker redirect it (via symlinks), force the opening of special file type (e.g., device files), move things around to create a race condition, control its ancestors, or change its contents?
Security

Line: 175 Column: 22 CWE codes: 362

                  return ctx.getAccessor(slot);
}

void MergeJoinStage::open(bool reOpen) {
    auto optTimer(getOptTimer(_opCtx));

    _commonStats.opens++;
    _children[0]->open(reOpen);
    _children[1]->open(reOpen);

            

Reported by FlawFinder.

open - Check when opening files - can an attacker redirect it (via symlinks), force the opening of special file type (e.g., device files), move things around to create a race condition, control its ancestors, or change its contents?
Security

Line: 179 Column: 19 CWE codes: 362

                  auto optTimer(getOptTimer(_opCtx));

    _commonStats.opens++;
    _children[0]->open(reOpen);
    _children[1]->open(reOpen);

    // Start with an initially empty buffer.
    _outerProjectsBuffer.clear();
    _outerProjectsBufferIt = 0;

            

Reported by FlawFinder.

open - Check when opening files - can an attacker redirect it (via symlinks), force the opening of special file type (e.g., device files), move things around to create a race condition, control its ancestors, or change its contents?
Security

Line: 180 Column: 19 CWE codes: 362

              
    _commonStats.opens++;
    _children[0]->open(reOpen);
    _children[1]->open(reOpen);

    // Start with an initially empty buffer.
    _outerProjectsBuffer.clear();
    _outerProjectsBufferIt = 0;


            

Reported by FlawFinder.

src/third_party/abseil-cpp-master/abseil-cpp/absl/random/gaussian_distribution_test.cc
3 issues
syntax error
Error

Line: 59

                                   ::testing::Types<float, double, long double>>::type;
TYPED_TEST_CASE(GaussianDistributionInterfaceTest, RealTypes);

TYPED_TEST(GaussianDistributionInterfaceTest, SerializeTest) {
  using param_type =
      typename absl::gaussian_distribution<TypeParam>::param_type;

  const TypeParam kParams[] = {
      // Cases around 1.

            

Reported by Cppcheck.

StrCat - Does not check for buffer overflows when concatenating to destination [MS-banned]
Security

Line: 306 Column: 21 CWE codes: 120

                  }

    ABSL_INTERNAL_LOG(
        INFO, absl::StrCat("mean=", mean(), " stddev=", stddev(), "\n",   //
                           " expected ", expected, "\n",                  //
                           kChiSquared, " ", chi_square, " (", p, ")\n",  //
                           kChiSquared, " @ 0.98 = ", threshold));
  }
  return p;

            

Reported by FlawFinder.

StrCat - Does not check for buffer overflows when concatenating to destination [MS-banned]
Security

Line: 382 Column: 28 CWE codes: 120

              
std::string ParamName(const ::testing::TestParamInfo<Param>& info) {
  const auto& p = info.param;
  std::string name = absl::StrCat("mean_", absl::SixDigits(p.mean), "__stddev_",
                                  absl::SixDigits(p.stddev));
  return absl::StrReplaceAll(name, {{"+", "_"}, {"-", "_"}, {".", "_"}});
}

INSTANTIATE_TEST_SUITE_P(All, GaussianDistributionTests,

            

Reported by FlawFinder.

src/third_party/abseil-cpp-master/abseil-cpp/absl/random/exponential_distribution_test.cc
3 issues
syntax error
Error

Line: 62

                                   ::testing::Types<float, double, long double>>::type;
TYPED_TEST_CASE(ExponentialDistributionTypedTest, RealTypes);

TYPED_TEST(ExponentialDistributionTypedTest, SerializeTest) {
  using param_type =
      typename absl::exponential_distribution<TypeParam>::param_type;

  const TypeParam kParams[] = {
      // Cases around 1.

            

Reported by Cppcheck.

StrCat - Does not check for buffer overflows when concatenating to destination [MS-banned]
Security

Line: 282 Column: 29 CWE codes: 120

                  }

    ABSL_INTERNAL_LOG(INFO,
                      absl::StrCat("lambda ", lambda(), "\n",     //
                                   " expected ", expected, "\n",  //
                                   kChiSquared, " ", chi_square, " (", p, ")\n",
                                   kChiSquared, " @ 0.98 = ", threshold));
  }
  return p;

            

Reported by FlawFinder.

StrCat - Does not check for buffer overflows when concatenating to destination [MS-banned]
Security

Line: 341 Column: 28 CWE codes: 120

              
std::string ParamName(const ::testing::TestParamInfo<Param>& info) {
  const auto& p = info.param;
  std::string name = absl::StrCat("lambda_", absl::SixDigits(p.lambda));
  return absl::StrReplaceAll(name, {{"+", "_"}, {"-", "_"}, {".", "_"}});
}

INSTANTIATE_TEST_CASE_P(All, ExponentialDistributionTests,
                        ::testing::ValuesIn(GenParams()), ParamName);

            

Reported by FlawFinder.

src/third_party/scons-3.1.2/scons-local-3.1.2/SCons/Tool/mslib.py
3 issues
Attempted relative import beyond top-level package
Error

Line: 44 Column: 1

              import SCons.Tool.msvc
import SCons.Util

from .MSCommon import msvc_exists, msvc_setup_env_once

def generate(env):
    """Add Builders and construction variables for lib to an Environment."""
    SCons.Tool.createStaticLibBuilder(env)


            

Reported by Pylint.

Line too long (116/100)
Error

Line: 34 Column: 1

              # WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE SOFTWARE.
#

__revision__ = "src/engine/SCons/Tool/mslib.py bee7caf9defd6e108fc2998a2520ddb36a967691 2019-12-17 02:07:09 bdeegan"

import os

import SCons.Defaults
import SCons.Tool

            

Reported by Pylint.

Missing function or method docstring
Error

Line: 66 Column: 1

                  env['TEMPFILEARGJOIN'] = os.linesep


def exists(env):
    return msvc_exists(env)

# Local Variables:
# tab-width:4
# indent-tabs-mode:nil

            

Reported by Pylint.

src/third_party/scons-3.1.2/scons-local-3.1.2/SCons/Tool/m4.py
3 issues
Line too long (113/100)
Error

Line: 34 Column: 1

              # WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE SOFTWARE.
#

__revision__ = "src/engine/SCons/Tool/m4.py bee7caf9defd6e108fc2998a2520ddb36a967691 2019-12-17 02:07:09 bdeegan"

import SCons.Action
import SCons.Builder
import SCons.Util


            

Reported by Pylint.

Variable name "M4Action" doesn't conform to snake_case naming style
Error

Line: 42 Column: 5

              
def generate(env):
    """Add Builders and construction variables for m4 to an Environment."""
    M4Action = SCons.Action.Action('$M4COM', '$M4COMSTR')
    bld = SCons.Builder.Builder(action = M4Action, src_suffix = '.m4')

    env['BUILDERS']['M4'] = bld

    # .m4 files might include other files, and it would be pretty hard

            

Reported by Pylint.

Missing function or method docstring
Error

Line: 56 Column: 1

                  env['M4FLAGS'] = SCons.Util.CLVar('-E')
    env['M4COM']   = 'cd ${SOURCE.rsrcdir} && $M4 $M4FLAGS < ${SOURCE.file} > ${TARGET.abspath}'

def exists(env):
    return env.Detect('m4')

# Local Variables:
# tab-width:4
# indent-tabs-mode:nil

            

Reported by Pylint.

src/mongo/db/exec/sbe/stages/makeobj.cpp
3 issues
open - Check when opening files - can an attacker redirect it (via symlinks), force the opening of special file type (e.g., device files), move things around to create a race condition, control its ancestors, or change its contents?
Security

Line: 130 Column: 27 CWE codes: 362

              }

template <MakeObjOutputType O>
void MakeObjStageBase<O>::open(bool reOpen) {
    auto optTimer(getOptTimer(_opCtx));

    _commonStats.opens++;
    _children[0]->open(reOpen);
}

            

Reported by FlawFinder.

open - Check when opening files - can an attacker redirect it (via symlinks), force the opening of special file type (e.g., device files), move things around to create a race condition, control its ancestors, or change its contents?
Security

Line: 134 Column: 19 CWE codes: 362

                  auto optTimer(getOptTimer(_opCtx));

    _commonStats.opens++;
    _children[0]->open(reOpen);
}

template <>
void MakeObjStageBase<MakeObjOutputType::object>::produceObject() {
    auto [tag, val] = value::makeNewObject();

            

Reported by FlawFinder.

read - Check buffer boundaries if used in a loop including recursive loops
Security

Line: 153 Column: 47 CWE codes: 120 20

                      if (tag == value::TypeTags::bsonObject) {
            if (!(nFieldsNeededIfInclusion == 0 && _fieldBehavior == FieldBehavior::keep)) {
                auto be = value::bitcastTo<const char*>(val);
                auto size = ConstDataView(be).read<LittleEndian<uint32_t>>();
                auto end = be + size;

                // Simple heuristic to determine number of fields.
                size_t approximatedNumFieldsInRoot = (size / 16);
                // If the field behaviour is 'keep', then we know that the output will have

            

Reported by FlawFinder.

src/third_party/scons-3.1.2/scons-local-3.1.2/SCons/Tool/ilink.py
3 issues
Line too long (116/100)
Error

Line: 34 Column: 1

              # WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE SOFTWARE.
#

__revision__ = "src/engine/SCons/Tool/ilink.py bee7caf9defd6e108fc2998a2520ddb36a967691 2019-12-17 02:07:09 bdeegan"

import SCons.Defaults
import SCons.Tool
import SCons.Util


            

Reported by Pylint.

Trailing whitespace
Error

Line: 43 Column: 1

              def generate(env):
    """Add Builders and construction variables for ilink to an Environment."""
    SCons.Tool.createProgBuilder(env)
    
    env['LINK']        = 'ilink'
    env['LINKFLAGS']   = SCons.Util.CLVar('')
    env['LINKCOM']     = '$LINK $LINKFLAGS /O:$TARGET $SOURCES $_LIBDIRFLAGS $_LIBFLAGS'
    env['LIBDIRPREFIX']='/LIBPATH:'
    env['LIBDIRSUFFIX']=''

            

Reported by Pylint.

Missing function or method docstring
Error

Line: 52 Column: 1

                  env['LIBLINKPREFIX']=''
    env['LIBLINKSUFFIX']='$LIBSUFFIX'

def exists(env):
    return env.Detect('ilink')

# Local Variables:
# tab-width:4
# indent-tabs-mode:nil

            

Reported by Pylint.