The following issues were found

src/third_party/wiredtiger/test/suite/test_assert07.py
11 issues
Unable to import 'wiredtiger'
Error

Line: 35 Column: 1

              #

from suite_subprocess import suite_subprocess
import wiredtiger, wttest
from wtscenario import make_scenarios

class test_assert07(wttest.WiredTigerTestCase, suite_subprocess):
    key_format_values = [
        ('column', dict(key_format='r', usestrings=False)),

            

Reported by Pylint.

Unused import wiredtiger
Error

Line: 35 Column: 1

              #

from suite_subprocess import suite_subprocess
import wiredtiger, wttest
from wtscenario import make_scenarios

class test_assert07(wttest.WiredTigerTestCase, suite_subprocess):
    key_format_values = [
        ('column', dict(key_format='r', usestrings=False)),

            

Reported by Pylint.

Missing module docstring
Error

Line: 1 Column: 1

              #!/usr/bin/env python
#
# Public Domain 2014-present MongoDB, Inc.
# Public Domain 2008-2014 WiredTiger, Inc.
#
# This is free and unencumbered software released into the public domain.
#
# Anyone is free to copy, modify, publish, use, compile, sell, or
# distribute this software, either in source code form or as a compiled

            

Reported by Pylint.

Multiple imports on one line (wiredtiger, wttest)
Error

Line: 35 Column: 1

              #

from suite_subprocess import suite_subprocess
import wiredtiger, wttest
from wtscenario import make_scenarios

class test_assert07(wttest.WiredTigerTestCase, suite_subprocess):
    key_format_values = [
        ('column', dict(key_format='r', usestrings=False)),

            

Reported by Pylint.

third party import "import wiredtiger, wttest" should be placed before "from suite_subprocess import suite_subprocess"
Error

Line: 35 Column: 1

              #

from suite_subprocess import suite_subprocess
import wiredtiger, wttest
from wtscenario import make_scenarios

class test_assert07(wttest.WiredTigerTestCase, suite_subprocess):
    key_format_values = [
        ('column', dict(key_format='r', usestrings=False)),

            

Reported by Pylint.

Missing class docstring
Error

Line: 38 Column: 1

              import wiredtiger, wttest
from wtscenario import make_scenarios

class test_assert07(wttest.WiredTigerTestCase, suite_subprocess):
    key_format_values = [
        ('column', dict(key_format='r', usestrings=False)),
        ('string-row', dict(key_format='S', usestrings=True))
    ]
    scenarios = make_scenarios(key_format_values)

            

Reported by Pylint.

Class name "test_assert07" doesn't conform to PascalCase naming style
Error

Line: 38 Column: 1

              import wiredtiger, wttest
from wtscenario import make_scenarios

class test_assert07(wttest.WiredTigerTestCase, suite_subprocess):
    key_format_values = [
        ('column', dict(key_format='r', usestrings=False)),
        ('string-row', dict(key_format='S', usestrings=True))
    ]
    scenarios = make_scenarios(key_format_values)

            

Reported by Pylint.

Missing function or method docstring
Error

Line: 45 Column: 5

                  ]
    scenarios = make_scenarios(key_format_values)

    def apply_timestamps(self, timestamp):
        self.session.prepare_transaction(
            'prepare_timestamp=' + self.timestamp_str(timestamp))
        self.session.timestamp_transaction(
            'commit_timestamp=' + self.timestamp_str(timestamp))
        self.session.timestamp_transaction(

            

Reported by Pylint.

Too many statements (63/50)
Error

Line: 53 Column: 5

                      self.session.timestamp_transaction(
            'durable_timestamp=' + self.timestamp_str(timestamp))

    def test_timestamp_alter(self):
        base = 'assert07'
        uri = 'file:' + base

        key_ts1 = 'key_ts1' if self.usestrings else 1


            

Reported by Pylint.

Missing function or method docstring
Error

Line: 53 Column: 5

                      self.session.timestamp_transaction(
            'durable_timestamp=' + self.timestamp_str(timestamp))

    def test_timestamp_alter(self):
        base = 'assert07'
        uri = 'file:' + base

        key_ts1 = 'key_ts1' if self.usestrings else 1


            

Reported by Pylint.

src/third_party/wiredtiger/test/suite/test_txn16.py
11 issues
Unused import time
Error

Line: 34 Column: 1

              #   continue to generate more log files.
#

import fnmatch, os, shutil, time
from suite_subprocess import suite_subprocess
import wttest

class test_txn16(wttest.WiredTigerTestCase, suite_subprocess):
    t1 = 'table:test_txn16_1'

            

Reported by Pylint.

Missing module docstring
Error

Line: 1 Column: 1

              #!/usr/bin/env python
#
# Public Domain 2014-present MongoDB, Inc.
# Public Domain 2008-2014 WiredTiger, Inc.
#
# This is free and unencumbered software released into the public domain.
#
# Anyone is free to copy, modify, publish, use, compile, sell, or
# distribute this software, either in source code form or as a compiled

            

Reported by Pylint.

Multiple imports on one line (fnmatch, os, shutil, time)
Error

Line: 34 Column: 1

              #   continue to generate more log files.
#

import fnmatch, os, shutil, time
from suite_subprocess import suite_subprocess
import wttest

class test_txn16(wttest.WiredTigerTestCase, suite_subprocess):
    t1 = 'table:test_txn16_1'

            

Reported by Pylint.

Class name "test_txn16" doesn't conform to PascalCase naming style
Error

Line: 38 Column: 1

              from suite_subprocess import suite_subprocess
import wttest

class test_txn16(wttest.WiredTigerTestCase, suite_subprocess):
    t1 = 'table:test_txn16_1'
    t2 = 'table:test_txn16_2'
    t3 = 'table:test_txn16_3'
    nentries = 1000
    create_params = 'key_format=i,value_format=i'

            

Reported by Pylint.

Missing class docstring
Error

Line: 38 Column: 1

              from suite_subprocess import suite_subprocess
import wttest

class test_txn16(wttest.WiredTigerTestCase, suite_subprocess):
    t1 = 'table:test_txn16_1'
    t2 = 'table:test_txn16_2'
    t3 = 'table:test_txn16_3'
    nentries = 1000
    create_params = 'key_format=i,value_format=i'

            

Reported by Pylint.

Missing function or method docstring
Error

Line: 54 Column: 5

                      'transaction_sync=(method=dsync,enabled)'
    conn_off = 'config_base=false,log=(enabled=false)'

    def populate_table(self, uri):
        self.session.create(uri, self.create_params)
        c = self.session.open_cursor(uri, None, None)
        # Populate with an occasional checkpoint to generate
        # some varying LSNs.
        for i in range(self.nentries):

            

Reported by Pylint.

Variable name "c" doesn't conform to snake_case naming style
Error

Line: 56 Column: 9

              
    def populate_table(self, uri):
        self.session.create(uri, self.create_params)
        c = self.session.open_cursor(uri, None, None)
        # Populate with an occasional checkpoint to generate
        # some varying LSNs.
        for i in range(self.nentries):
            c[i] = i + 1
            if i % 900 == 0:

            

Reported by Pylint.

Missing function or method docstring
Error

Line: 81 Column: 5

                      # close the original connection.
        self.close_conn()

    def run_toggle(self, homedir):
        loop = 0
        # Record original log files.  There should never be overlap
        # with these even after they're removed.
        orig_logs = fnmatch.filter(os.listdir(homedir), "*gerLog*")
        while loop < 3:

            

Reported by Pylint.

Variable name "l" doesn't conform to snake_case naming style
Error

Line: 102 Column: 25

                              self.assertEqual(scur.isdisjoint(sorig), True)
                if loop > 1:
                    # We should be creating the same log files each time.
                    for l in cur_logs:
                        self.assertEqual(l in last_logs, True)
                    for l in last_logs:
                        self.assertEqual(l in cur_logs, True)
                last_logs = cur_logs
            loop += 1

            

Reported by Pylint.

Variable name "l" doesn't conform to snake_case naming style
Error

Line: 104 Column: 25

                                  # We should be creating the same log files each time.
                    for l in cur_logs:
                        self.assertEqual(l in last_logs, True)
                    for l in last_logs:
                        self.assertEqual(l in cur_logs, True)
                last_logs = cur_logs
            loop += 1
            # Remove all log files before opening without logging.
            cur_logs = fnmatch.filter(os.listdir(homedir), "*gerLog*")

            

Reported by Pylint.

src/third_party/unwind/dist/src/ptrace/_UPT_access_reg.c
11 issues
Uninitialized variable: nat_bits
Error

Line: 114 CWE codes: 908

                    if (write)
        {
          if (*val)
            nat_bits |= mask;
          else
            nat_bits &= ~mask;
#ifdef HAVE_TTRACE
#       warning No support for ttrace() yet.
#else

            

Reported by Cppcheck.

Uninitialized variable: nat_bits
Error

Line: 116 CWE codes: 908

                        if (*val)
            nat_bits |= mask;
          else
            nat_bits &= ~mask;
#ifdef HAVE_TTRACE
#       warning No support for ttrace() yet.
#else
          errno = 0;
          ptrace (PTRACE_POKEUSER, pid, PT_NAT_BITS, nat_bits);

            

Reported by Cppcheck.

Uninitialized variable: psr
Error

Line: 153 CWE codes: 908

                        if (write)
            {
              ip = *val & ~0xfUL;
              psr = (psr & ~0x3UL << 41) | (*val & 0x3);
#ifdef HAVE_TTRACE
#       warning No support for ttrace() yet.
#else
              errno = 0;
              ptrace (PTRACE_POKEUSER, pid, PT_CR_IIP, ip);

            

Reported by Cppcheck.

Uninitialized variable: ip
Error

Line: 174 CWE codes: 908

                            if (errno)
                goto badreg;
#endif
              *val = ip + ((psr >> 41) & 0x3);
            }
          goto out;
        }

      case UNW_IA64_AR_BSPSTORE:

            

Reported by Cppcheck.

Uninitialized variable: psr
Error

Line: 174 CWE codes: 908

                            if (errno)
                goto badreg;
#endif
              *val = ip + ((psr >> 41) & 0x3);
            }
          goto out;
        }

      case UNW_IA64_AR_BSPSTORE:

            

Reported by Cppcheck.

Uninitialized variable: cfm
Error

Line: 198 CWE codes: 908

                        if (errno)
            goto badreg;
#endif
          sof = (cfm & 0x7f);

          if (write)
            {
              bsp = rse_skip_regs (*val, sof);
#ifdef HAVE_TTRACE

            

Reported by Cppcheck.

Uninitialized variable: cfm
Error

Line: 243 CWE codes: 908

              #endif
            if (errno)
              goto badreg;
            old_sof = (cfm & 0x7f);
            new_sof = (*val & 0x7f);
            if (old_sof != new_sof)
              {
                bsp = rse_skip_regs (bsp, -old_sof + new_sof);
#ifdef HAVE_TTRACE

            

Reported by Cppcheck.

memcpy - Does not check for buffer overflows when copying to destination
Security

Line: 69 Column: 5 CWE codes: 120
Suggestion: Make sure destination can always hold the source data

                if (ptrace (PTRACE_GETREGSET, pid, NT_PRSTATUS, &loc) == -1)
    goto badreg;
  if (write) {
    memcpy(r, val, sizeof(unw_word_t));
    if (ptrace(PTRACE_SETREGSET, pid, NT_PRSTATUS, &loc) == -1)
      goto badreg;
  } else
    memcpy(val, r, sizeof(unw_word_t));
  return 0;

            

Reported by FlawFinder.

memcpy - Does not check for buffer overflows when copying to destination
Security

Line: 73 Column: 5 CWE codes: 120
Suggestion: Make sure destination can always hold the source data

                  if (ptrace(PTRACE_SETREGSET, pid, NT_PRSTATUS, &loc) == -1)
      goto badreg;
  } else
    memcpy(val, r, sizeof(unw_word_t));
  return 0;

badreg:
  Debug (1, "bad register %s [%u] (error: %s)\n", unw_regname(reg), reg, strerror (errno));
  return -UNW_EBADREG;

            

Reported by FlawFinder.

memcpy - Does not check for buffer overflows when copying to destination
Security

Line: 339 Column: 7 CWE codes: 120
Suggestion: Make sure destination can always hold the source data

                if (ptrace(PT_GETREGS, pid, (caddr_t)&regs, 0) == -1)
    goto badreg;
  if (write) {
      memcpy(r, val, sizeof(unw_word_t));
      if (ptrace(PT_SETREGS, pid, (caddr_t)&regs, 0) == -1)
        goto badreg;
  } else
      memcpy(val, r, sizeof(unw_word_t));
  return 0;

            

Reported by FlawFinder.

buildscripts/blackduck_hub.py
11 issues
Unexpected keyword argument 'allowed_methods' in constructor call
Error

Line: 110 Column: 21

              
        if should_retry:
            retry_status = [500, 502, 503, 504]  # Retry for these statuses.
            retry = urllib3_retry.Retry(
                backoff_factor=0.1,  # Enable backoff starting at 0.1s.
                allowed_methods=False,  # Support all HTTP verbs.
                status_forcelist=retry_status)

            adapter = requests.adapters.HTTPAdapter(max_retries=retry)

            

Reported by Pylint.

Use of unsafe yaml load. Allows instantiation of arbitrary objects. Consider yaml.safe_load().
Security criptography

Line: 874
Suggestion: https://bandit.readthedocs.io/en/latest/plugins/b506_yaml_load.html

              
def _read_third_party_components():
    with open(THIRD_PARTY_COMPONENTS_FILE) as rfh:
        yaml_file = yaml.load(rfh.read())

    third_party = []
    components = yaml_file["components"]
    for comp in components:
        cmap = components[comp]

            

Reported by Bandit.

Use of exec detected.
Security

Line: 1226
Suggestion: https://bandit.readthedocs.io/en/latest/plugins/b102_exec_used.html

              
    # The build logger config file is actually python
    # It is a mix of quoted strings and ints
    exec(compile(open(filename, "rb").read(), filename, 'exec'), tmp_globals, config)

    # Rename "slavename" to "username" if present.
    if "slavename" in config and "username" not in config:
        config["username"] = config["slavename"]
        del config["slavename"]

            

Reported by Bandit.

Consider possible security implications associated with subprocess module.
Security blacklist

Line: 12
Suggestion: https://bandit.readthedocs.io/en/latest/blacklists/blacklist_imports.html#b404-import-subprocess

              import logging
import os
import re
import subprocess
import sys
import tempfile
import time
import warnings


            

Reported by Bandit.

Use of assert detected. The enclosed code will be removed when compiling to optimised byte code.
Security

Line: 419
Suggestion: https://bandit.readthedocs.io/en/latest/plugins/b101_assert_used.html

                  VersionInfo('1.2.8-alt1.M80C.1')
    VersionInfo('1.2.8-alt2')

    assert VersionInfo('7.0.2.2') > VersionInfo('7.0.0.1')
    assert VersionInfo('7.0.2.2') > VersionInfo('7.0.2')
    assert VersionInfo('7.0.2.2') > VersionInfo('3.1')
    assert VersionInfo('7.0.2.2') <= VersionInfo('8.0.2')



            

Reported by Bandit.

Use of assert detected. The enclosed code will be removed when compiling to optimised byte code.
Security

Line: 420
Suggestion: https://bandit.readthedocs.io/en/latest/plugins/b101_assert_used.html

                  VersionInfo('1.2.8-alt2')

    assert VersionInfo('7.0.2.2') > VersionInfo('7.0.0.1')
    assert VersionInfo('7.0.2.2') > VersionInfo('7.0.2')
    assert VersionInfo('7.0.2.2') > VersionInfo('3.1')
    assert VersionInfo('7.0.2.2') <= VersionInfo('8.0.2')


def _retry_on_except(count, func):

            

Reported by Bandit.

Use of assert detected. The enclosed code will be removed when compiling to optimised byte code.
Security

Line: 421
Suggestion: https://bandit.readthedocs.io/en/latest/plugins/b101_assert_used.html

              
    assert VersionInfo('7.0.2.2') > VersionInfo('7.0.0.1')
    assert VersionInfo('7.0.2.2') > VersionInfo('7.0.2')
    assert VersionInfo('7.0.2.2') > VersionInfo('3.1')
    assert VersionInfo('7.0.2.2') <= VersionInfo('8.0.2')


def _retry_on_except(count, func):
    # Retry func() COUNT times until func() does not raise an exception

            

Reported by Bandit.

Use of assert detected. The enclosed code will be removed when compiling to optimised byte code.
Security

Line: 422
Suggestion: https://bandit.readthedocs.io/en/latest/plugins/b101_assert_used.html

                  assert VersionInfo('7.0.2.2') > VersionInfo('7.0.0.1')
    assert VersionInfo('7.0.2.2') > VersionInfo('7.0.2')
    assert VersionInfo('7.0.2.2') > VersionInfo('3.1')
    assert VersionInfo('7.0.2.2') <= VersionInfo('8.0.2')


def _retry_on_except(count, func):
    # Retry func() COUNT times until func() does not raise an exception
    # pylint: disable=bare-except

            

Reported by Bandit.

subprocess call - check for execution of untrusted input.
Security injection

Line: 573
Suggestion: https://bandit.readthedocs.io/en/latest/plugins/b603_subprocess_without_shell_equals_true.html

              """.encode())
        fp.flush()

        subprocess.call(["/bin/sh", fp.name])


def _scan_cmd_args(args):
    # pylint: disable=unused-argument
    LOGGER.info("Running Black Duck Scan")

            

Reported by Bandit.

Use of assert detected. The enclosed code will be removed when compiling to optimised byte code.
Security

Line: 632
Suggestion: https://bandit.readthedocs.io/en/latest/plugins/b101_assert_used.html

                      """Init test result."""
        # This matches the report.json schema
        # See https://github.com/evergreen-ci/evergreen/blob/789bee107d3ffb9f0f82ae344d72502945bdc914/model/task/task.go#L264-L284
        assert status in ["pass", "fail"]

        self.test_file = name
        self.status = status
        self.exit_code = 1


            

Reported by Bandit.

src/third_party/wiredtiger/test/suite/test_txn17.py
11 issues
Unable to import 'wiredtiger'
Error

Line: 36 Column: 1

              #

from suite_subprocess import suite_subprocess
import wiredtiger, wttest

class test_txn17(wttest.WiredTigerTestCase, suite_subprocess):
    def test_txn_api(self):
        # Test API functionality tagged as requires_transaction.
        # Cannot set a timestamp on a non-running transaction.

            

Reported by Pylint.

Lambda may not be necessary
Error

Line: 49 Column: 13

              
        # Cannot call commit on a non-running transaction.
        self.assertRaisesWithMessage(wiredtiger.WiredTigerError,
            lambda: self.session.commit_transaction(),
                '/only permitted in a running transaction/')

        # Cannot call rollback on a non-running transaction.
        self.assertRaisesWithMessage(wiredtiger.WiredTigerError,
            lambda: self.session.rollback_transaction(),

            

Reported by Pylint.

Lambda may not be necessary
Error

Line: 54 Column: 13

              
        # Cannot call rollback on a non-running transaction.
        self.assertRaisesWithMessage(wiredtiger.WiredTigerError,
            lambda: self.session.rollback_transaction(),
                '/only permitted in a running transaction/')

        # Cannot begin a transaction while a transaction is already running.
        self.session.begin_transaction()
        self.assertRaisesWithMessage(wiredtiger.WiredTigerError,

            

Reported by Pylint.

Lambda may not be necessary
Error

Line: 60 Column: 13

                      # Cannot begin a transaction while a transaction is already running.
        self.session.begin_transaction()
        self.assertRaisesWithMessage(wiredtiger.WiredTigerError,
            lambda: self.session.begin_transaction(),
                '/not permitted in a running transaction/')
        self.session.rollback_transaction()

        # Cannot take a checkpoint while a transaction is running.
        self.session.begin_transaction()

            

Reported by Pylint.

Lambda may not be necessary
Error

Line: 67 Column: 13

                      # Cannot take a checkpoint while a transaction is running.
        self.session.begin_transaction()
        self.assertRaisesWithMessage(wiredtiger.WiredTigerError,
            lambda: self.session.checkpoint(),
                '/not permitted in a running transaction/')
        self.session.rollback_transaction()

if __name__ == '__main__':
    wttest.run()

            

Reported by Pylint.

Missing module docstring
Error

Line: 1 Column: 1

              #!/usr/bin/env python
#
# Public Domain 2014-present MongoDB, Inc.
# Public Domain 2008-2014 WiredTiger, Inc.
#
# This is free and unencumbered software released into the public domain.
#
# Anyone is free to copy, modify, publish, use, compile, sell, or
# distribute this software, either in source code form or as a compiled

            

Reported by Pylint.

Multiple imports on one line (wiredtiger, wttest)
Error

Line: 36 Column: 1

              #

from suite_subprocess import suite_subprocess
import wiredtiger, wttest

class test_txn17(wttest.WiredTigerTestCase, suite_subprocess):
    def test_txn_api(self):
        # Test API functionality tagged as requires_transaction.
        # Cannot set a timestamp on a non-running transaction.

            

Reported by Pylint.

third party import "import wiredtiger, wttest" should be placed before "from suite_subprocess import suite_subprocess"
Error

Line: 36 Column: 1

              #

from suite_subprocess import suite_subprocess
import wiredtiger, wttest

class test_txn17(wttest.WiredTigerTestCase, suite_subprocess):
    def test_txn_api(self):
        # Test API functionality tagged as requires_transaction.
        # Cannot set a timestamp on a non-running transaction.

            

Reported by Pylint.

Missing class docstring
Error

Line: 38 Column: 1

              from suite_subprocess import suite_subprocess
import wiredtiger, wttest

class test_txn17(wttest.WiredTigerTestCase, suite_subprocess):
    def test_txn_api(self):
        # Test API functionality tagged as requires_transaction.
        # Cannot set a timestamp on a non-running transaction.
        self.assertRaisesWithMessage(wiredtiger.WiredTigerError,
            lambda: self.session.timestamp_transaction(

            

Reported by Pylint.

Class name "test_txn17" doesn't conform to PascalCase naming style
Error

Line: 38 Column: 1

              from suite_subprocess import suite_subprocess
import wiredtiger, wttest

class test_txn17(wttest.WiredTigerTestCase, suite_subprocess):
    def test_txn_api(self):
        # Test API functionality tagged as requires_transaction.
        # Cannot set a timestamp on a non-running transaction.
        self.assertRaisesWithMessage(wiredtiger.WiredTigerError,
            lambda: self.session.timestamp_transaction(

            

Reported by Pylint.

src/third_party/scons-3.1.2/scons-local-3.1.2/SCons/Tool/zip.py
10 issues
Redefining built-in 'zip'
Error

Line: 46 Column: 1

              import zipfile

zipcompression = zipfile.ZIP_DEFLATED
def zip(target, source, env):
    compression = env.get('ZIPCOMPRESSION', 0)
    zf = zipfile.ZipFile(str(target[0]), 'w', compression)
    for s in source:
        if s.isdir():
            for dirpath, dirnames, filenames in os.walk(str(s)):

            

Reported by Pylint.

Unused variable 'dirnames'
Error

Line: 51 Column: 26

                  zf = zipfile.ZipFile(str(target[0]), 'w', compression)
    for s in source:
        if s.isdir():
            for dirpath, dirnames, filenames in os.walk(str(s)):
                for fname in filenames:
                    path = os.path.join(dirpath, fname)
                    if os.path.isfile(path):

                        zf.write(path, os.path.relpath(path, str(env.get('ZIPROOT', ''))))

            

Reported by Pylint.

Unused argument 'env'
Error

Line: 85 Column: 12

                  env['ZIPSUFFIX']  = '.zip'
    env['ZIPROOT']    = SCons.Util.CLVar('')

def exists(env):
    return True

# Local Variables:
# tab-width:4
# indent-tabs-mode:nil

            

Reported by Pylint.

Line too long (114/100)
Error

Line: 34 Column: 1

              # WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE SOFTWARE.
#

__revision__ = "src/engine/SCons/Tool/zip.py bee7caf9defd6e108fc2998a2520ddb36a967691 2019-12-17 02:07:09 bdeegan"

import os.path

import SCons.Builder
import SCons.Defaults

            

Reported by Pylint.

standard import "import zipfile" should be placed before "import SCons.Builder"
Error

Line: 43 Column: 1

              import SCons.Node.FS
import SCons.Util

import zipfile

zipcompression = zipfile.ZIP_DEFLATED
def zip(target, source, env):
    compression = env.get('ZIPCOMPRESSION', 0)
    zf = zipfile.ZipFile(str(target[0]), 'w', compression)

            

Reported by Pylint.

Constant name "zipcompression" doesn't conform to UPPER_CASE naming style
Error

Line: 45 Column: 1

              
import zipfile

zipcompression = zipfile.ZIP_DEFLATED
def zip(target, source, env):
    compression = env.get('ZIPCOMPRESSION', 0)
    zf = zipfile.ZipFile(str(target[0]), 'w', compression)
    for s in source:
        if s.isdir():

            

Reported by Pylint.

Missing function or method docstring
Error

Line: 46 Column: 1

              import zipfile

zipcompression = zipfile.ZIP_DEFLATED
def zip(target, source, env):
    compression = env.get('ZIPCOMPRESSION', 0)
    zf = zipfile.ZipFile(str(target[0]), 'w', compression)
    for s in source:
        if s.isdir():
            for dirpath, dirnames, filenames in os.walk(str(s)):

            

Reported by Pylint.

Variable name "zf" doesn't conform to snake_case naming style
Error

Line: 48 Column: 5

              zipcompression = zipfile.ZIP_DEFLATED
def zip(target, source, env):
    compression = env.get('ZIPCOMPRESSION', 0)
    zf = zipfile.ZipFile(str(target[0]), 'w', compression)
    for s in source:
        if s.isdir():
            for dirpath, dirnames, filenames in os.walk(str(s)):
                for fname in filenames:
                    path = os.path.join(dirpath, fname)

            

Reported by Pylint.

Variable name "s" doesn't conform to snake_case naming style
Error

Line: 49 Column: 9

              def zip(target, source, env):
    compression = env.get('ZIPCOMPRESSION', 0)
    zf = zipfile.ZipFile(str(target[0]), 'w', compression)
    for s in source:
        if s.isdir():
            for dirpath, dirnames, filenames in os.walk(str(s)):
                for fname in filenames:
                    path = os.path.join(dirpath, fname)
                    if os.path.isfile(path):

            

Reported by Pylint.

Missing function or method docstring
Error

Line: 85 Column: 1

                  env['ZIPSUFFIX']  = '.zip'
    env['ZIPROOT']    = SCons.Util.CLVar('')

def exists(env):
    return True

# Local Variables:
# tab-width:4
# indent-tabs-mode:nil

            

Reported by Pylint.

src/third_party/mozjs-60/extract/mfbt/FStream.h
10 issues
open - Check when opening files - can an attacker redirect it (via symlinks), force the opening of special file type (e.g., device files), move things around to create a race condition, control its ancestors, or change its contents?
Security

Line: 40 Column: 8 CWE codes: 362

                std::filebuf* rdbuf() const { return mFileBuf.get(); }

  bool is_open() const { return mFileBuf && mFileBuf->is_open(); }
  void open(char16ptr_t filename, openmode mode = in);
  void close() { mFileBuf && mFileBuf->close(); }

private:
  UniquePtr<std::filebuf> mFileBuf;
};

            

Reported by FlawFinder.

open - Check when opening files - can an attacker redirect it (via symlinks), force the opening of special file type (e.g., device files), move things around to create a race condition, control its ancestors, or change its contents?
Security

Line: 51 Column: 3 CWE codes: 362

              IFStream::IFStream(char16ptr_t filename, openmode mode)
  : std::istream(nullptr)
{
  open(filename, mode);
}

inline void
IFStream::open(char16ptr_t filename, openmode mode)
{

            

Reported by FlawFinder.

open - Check when opening files - can an attacker redirect it (via symlinks), force the opening of special file type (e.g., device files), move things around to create a race condition, control its ancestors, or change its contents?
Security

Line: 55 Column: 11 CWE codes: 362

              }

inline void
IFStream::open(char16ptr_t filename, openmode mode)
{
  int fmode = _O_RDONLY;
  if (mode & binary) {
    fmode |= _O_BINARY;
  } else {

            

Reported by FlawFinder.

open - Check when opening files - can an attacker redirect it (via symlinks), force the opening of special file type (e.g., device files), move things around to create a race condition, control its ancestors, or change its contents?
Security

Line: 76 Column: 8 CWE codes: 362

                std::filebuf* rdbuf() const { return mFileBuf.get(); }

  bool is_open() const { return mFileBuf && mFileBuf->is_open(); }
  void open(char16ptr_t filename, openmode mode = out);
  void close() { mFileBuf && mFileBuf->close(); }

private:
  UniquePtr<std::filebuf> mFileBuf;
};

            

Reported by FlawFinder.

open - Check when opening files - can an attacker redirect it (via symlinks), force the opening of special file type (e.g., device files), move things around to create a race condition, control its ancestors, or change its contents?
Security

Line: 87 Column: 3 CWE codes: 362

              OFStream::OFStream(char16ptr_t filename, openmode mode)
  : std::ostream(nullptr)
{
  open(filename, mode);
}

inline void
OFStream::open(char16ptr_t filename, openmode mode)
{

            

Reported by FlawFinder.

open - Check when opening files - can an attacker redirect it (via symlinks), force the opening of special file type (e.g., device files), move things around to create a race condition, control its ancestors, or change its contents?
Security

Line: 91 Column: 11 CWE codes: 362

              }

inline void
OFStream::open(char16ptr_t filename, openmode mode)
{
  int fmode = _O_WRONLY;
  if (mode & binary) {
    fmode |= _O_BINARY;
  } else {

            

Reported by FlawFinder.

open - Check when opening files - can an attacker redirect it (via symlinks), force the opening of special file type (e.g., device files), move things around to create a race condition, control its ancestors, or change its contents?
Security

Line: 114 Column: 8 CWE codes: 362

                explicit IFStream(char16ptr_t filename, openmode mode = in)
    : std::ifstream(filename, mode) {}

  void open(char16ptr_t filename, openmode mode = in)
  {
    std::ifstream::open(filename, mode);
  }
};


            

Reported by FlawFinder.

open - Check when opening files - can an attacker redirect it (via symlinks), force the opening of special file type (e.g., device files), move things around to create a race condition, control its ancestors, or change its contents?
Security

Line: 116 Column: 20 CWE codes: 362

              
  void open(char16ptr_t filename, openmode mode = in)
  {
    std::ifstream::open(filename, mode);
  }
};

class OFStream : public std::ofstream
{

            

Reported by FlawFinder.

open - Check when opening files - can an attacker redirect it (via symlinks), force the opening of special file type (e.g., device files), move things around to create a race condition, control its ancestors, or change its contents?
Security

Line: 126 Column: 8 CWE codes: 362

                explicit OFStream(char16ptr_t filename, openmode mode = out)
    : std::ofstream(filename, mode) {}

  void open(char16ptr_t filename, openmode mode = out)
  {
    std::ofstream::open(filename, mode);
  }
};
#else

            

Reported by FlawFinder.

open - Check when opening files - can an attacker redirect it (via symlinks), force the opening of special file type (e.g., device files), move things around to create a race condition, control its ancestors, or change its contents?
Security

Line: 128 Column: 20 CWE codes: 362

              
  void open(char16ptr_t filename, openmode mode = out)
  {
    std::ofstream::open(filename, mode);
  }
};
#else
using IFStream = std::ifstream;
using OFStream = std::ofstream;

            

Reported by FlawFinder.

src/mongo/db/geo/r2_region_coverer_test.cpp
10 issues
syntax error
Error

Line: 74

              //
// GeoHash
//
TEST(R2RegionCoverer, GeoHashSubdivide) {
    GeoHash children[4];

    // Full plane -> 4 quadrants
    GeoHash fullPlane;
    ASSERT_TRUE(fullPlane.subdivide(children));

            

Reported by Cppcheck.

random - This function is not sufficiently random for security-related functions such as key and nonce creation
Security

Line: 66 Column: 9 CWE codes: 327
Suggestion: Use a more secure technique for acquiring random values

              
// Returns an integral number in [lower, upper]
template <typename NumType>
NumType random(NumType lower, NumType upper) {
    std::uniform_int_distribution<NumType> distribution(lower, upper);
    return distribution(generator);
}

//

            

Reported by FlawFinder.

random - This function is not sufficiently random for security-related functions such as key and nonce creation
Security

Line: 189 Column: 13 CWE codes: 327
Suggestion: Use a more secure technique for acquiring random values

                  // Test random cell ids at all levels.
    for (int i = 0; i < 10000; ++i) {
        GeoHash id(
            random(std::numeric_limits<long long>::lowest(), std::numeric_limits<long long>::max()),
            random(0U, GeoHash::kMaxBits));
        vector<GeoHash> covering;
        Box box = coverer.getHashConverter().unhashToBoxCovering(id);
        // Since the unhashed box is expanded by the error 8Mu, we need to shrink it.
        box.fudge(-GeoHashConverter::kMachinePrecision * MAXBOUND * 20);

            

Reported by FlawFinder.

random - This function is not sufficiently random for security-related functions such as key and nonce creation
Security

Line: 190 Column: 13 CWE codes: 327
Suggestion: Use a more secure technique for acquiring random values

                  for (int i = 0; i < 10000; ++i) {
        GeoHash id(
            random(std::numeric_limits<long long>::lowest(), std::numeric_limits<long long>::max()),
            random(0U, GeoHash::kMaxBits));
        vector<GeoHash> covering;
        Box box = coverer.getHashConverter().unhashToBoxCovering(id);
        // Since the unhashed box is expanded by the error 8Mu, we need to shrink it.
        box.fudge(-GeoHashConverter::kMachinePrecision * MAXBOUND * 20);
        HashBoxRegion region(box);

            

Reported by FlawFinder.

random - This function is not sufficiently random for security-related functions such as key and nonce creation
Security

Line: 207 Column: 9 CWE codes: 327
Suggestion: Use a more secure technique for acquiring random values

                  const int NUMBITS = 53;
    // Random double in [0, 1)
    long long randLong =
        random(std::numeric_limits<long long>::lowest(), std::numeric_limits<long long>::max());
    double r = ldexp(static_cast<double>(randLong & ((1ULL << NUMBITS) - 1ULL)), -NUMBITS);
    return lowerBound + r * (upperBound - lowerBound);
}

// Check the given region is covered by the covering completely.

            

Reported by FlawFinder.

random - This function is not sufficiently random for security-related functions such as key and nonce creation
Security

Line: 302 Column: 29 CWE codes: 327
Suggestion: Use a more secure technique for acquiring random values

                      // Using R2BoxRegion, the disjoint with circle gives poor results around the corner,
        // so many small cells are considered as intersected in the priority queue, which is
        // very slow for larger minLevel (smaller cell). So we limit minLevels in [0, 6].
        coverer.setMinLevel(random(0, 6));
        coverer.setMaxLevel(coverer.minLevel() + 4);

        double radius = randDouble(0.0, MAXBOUND / 2);
        std::unique_ptr<GeometryContainer> geometry(getRandomCircle(radius));
        const R2Region& region = geometry->getR2Region();

            

Reported by FlawFinder.

random - This function is not sufficiently random for security-related functions such as key and nonce creation
Security

Line: 321 Column: 25 CWE codes: 327
Suggestion: Use a more secure technique for acquiring random values

                  ASSERT_OK(result.getStatus());

    R2RegionCoverer coverer(std::move(result.getValue()));
    coverer.setMaxCells(random(1, 20));  // [1, 20]

    for (int i = 0; i < 10000; i++) {
        do {
            coverer.setMinLevel(random(0U, GeoHash::kMaxBits));
            coverer.setMaxLevel(random(0U, GeoHash::kMaxBits));

            

Reported by FlawFinder.

random - This function is not sufficiently random for security-related functions such as key and nonce creation
Security

Line: 325 Column: 33 CWE codes: 327
Suggestion: Use a more secure technique for acquiring random values

              
    for (int i = 0; i < 10000; i++) {
        do {
            coverer.setMinLevel(random(0U, GeoHash::kMaxBits));
            coverer.setMaxLevel(random(0U, GeoHash::kMaxBits));
        } while (coverer.minLevel() > coverer.maxLevel());

        // 100 * 2 ^ -32 ~= 2.3E-8 (cell edge length)
        double radius = randDouble(1E-15, ldexp(100.0, -32) * 10);

            

Reported by FlawFinder.

random - This function is not sufficiently random for security-related functions such as key and nonce creation
Security

Line: 326 Column: 33 CWE codes: 327
Suggestion: Use a more secure technique for acquiring random values

                  for (int i = 0; i < 10000; i++) {
        do {
            coverer.setMinLevel(random(0U, GeoHash::kMaxBits));
            coverer.setMaxLevel(random(0U, GeoHash::kMaxBits));
        } while (coverer.minLevel() > coverer.maxLevel());

        // 100 * 2 ^ -32 ~= 2.3E-8 (cell edge length)
        double radius = randDouble(1E-15, ldexp(100.0, -32) * 10);
        std::unique_ptr<GeometryContainer> geometry(getRandomCircle(radius));

            

Reported by FlawFinder.

random - This function is not sufficiently random for security-related functions such as key and nonce creation
Security

Line: 706 Column: 38 CWE codes: 327
Suggestion: Use a more secure technique for acquiring random values

                      // If selected, recurse on 4/12 = 1/3 child to add overlapping cells to the
        // normalized vector.
        // If not selected, recurse on 4 * 2/7 = 8/7 child.
        if ((selected ? oneIn(12) : (random(0, 6) < 2)) && numChildren < 3) {
            generateRandomCells(children[pos], selected, unnormalized, normalized);
            ++numChildren;
        }
        if (selected && !added) {
            generateRandomCells(children[pos], selected, unnormalized, normalized);

            

Reported by FlawFinder.

src/third_party/scons-3.1.2/scons-local-3.1.2/SCons/Variables/EnumVariable.py
10 issues
Unused argument 'env'
Error

Line: 47 Column: 26

              
import SCons.Errors

def _validator(key, val, env, vals):
    if val not in vals:
        raise SCons.Errors.UserError(
            'Invalid value for option %s: %s.  Valid values are: %s' % (key, val, vals))



            

Reported by Pylint.

Redefining built-in 'map'
Error

Line: 53 Column: 54

                          'Invalid value for option %s: %s.  Valid values are: %s' % (key, val, vals))


def EnumVariable(key, help, default, allowed_values, map={}, ignorecase=0):
    """
    The input parameters describe an option with only certain values
    allowed. They are returned with an appropriate converter and
    validator appended. The result is usable for input to
    Variables.Add().

            

Reported by Pylint.

Redefining built-in 'help'
Error

Line: 53 Column: 23

                          'Invalid value for option %s: %s.  Valid values are: %s' % (key, val, vals))


def EnumVariable(key, help, default, allowed_values, map={}, ignorecase=0):
    """
    The input parameters describe an option with only certain values
    allowed. They are returned with an appropriate converter and
    validator appended. The result is usable for input to
    Variables.Add().

            

Reported by Pylint.

Dangerous default value {} as argument
Error

Line: 53 Column: 1

                          'Invalid value for option %s: %s.  Valid values are: %s' % (key, val, vals))


def EnumVariable(key, help, default, allowed_values, map={}, ignorecase=0):
    """
    The input parameters describe an option with only certain values
    allowed. They are returned with an appropriate converter and
    validator appended. The result is usable for input to
    Variables.Add().

            

Reported by Pylint.

Module name "EnumVariable" doesn't conform to snake_case naming style
Error

Line: 1 Column: 1

              """engine.SCons.Variables.EnumVariable

This file defines the option type for SCons allowing only specified
input-values.

Usage example::

    opts = Variables()
    opts.Add(EnumVariable('debug', 'debug output and symbols', 'no',

            

Reported by Pylint.

Line too long (128/100)
Error

Line: 40 Column: 1

              # WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE SOFTWARE.
#

__revision__ = "src/engine/SCons/Variables/EnumVariable.py bee7caf9defd6e108fc2998a2520ddb36a967691 2019-12-17 02:07:09 bdeegan"

__all__ = ['EnumVariable',]


import SCons.Errors

            

Reported by Pylint.

Too many arguments (6/5)
Error

Line: 53 Column: 1

                          'Invalid value for option %s: %s.  Valid values are: %s' % (key, val, vals))


def EnumVariable(key, help, default, allowed_values, map={}, ignorecase=0):
    """
    The input parameters describe an option with only certain values
    allowed. They are returned with an appropriate converter and
    validator appended. The result is usable for input to
    Variables.Add().

            

Reported by Pylint.

Function name "EnumVariable" doesn't conform to snake_case naming style
Error

Line: 53 Column: 1

                          'Invalid value for option %s: %s.  Valid values are: %s' % (key, val, vals))


def EnumVariable(key, help, default, allowed_values, map={}, ignorecase=0):
    """
    The input parameters describe an option with only certain values
    allowed. They are returned with an appropriate converter and
    validator appended. The result is usable for input to
    Variables.Add().

            

Reported by Pylint.

Line too long (122/100)
Error

Line: 74 Column: 1

              
        If ignorecase == 0, the validator/converter are case-sensitive.
        If ignorecase == 1, the validator/converter are case-insensitive.
        If ignorecase == 2, the validator/converter is case-insensitive and the converted value will always be lower-case.

    The 'validator' tests whether the value is in the list of allowed values. The 'converter' converts input values
    according to the given 'map'-dictionary (unmapped input values are returned unchanged).
    """


            

Reported by Pylint.

Line too long (115/100)
Error

Line: 76 Column: 1

                      If ignorecase == 1, the validator/converter are case-insensitive.
        If ignorecase == 2, the validator/converter is case-insensitive and the converted value will always be lower-case.

    The 'validator' tests whether the value is in the list of allowed values. The 'converter' converts input values
    according to the given 'map'-dictionary (unmapped input values are returned unchanged).
    """

    help = '%s (%s)' % (help, '|'.join(allowed_values))
    # define validator

            

Reported by Pylint.

src/third_party/boost/libs/locale/src/shared/message.cpp
10 issues
open - Check when opening files - can an attacker redirect it (via symlinks), force the opening of special file type (e.g., device files), move things around to create a race condition, control its ancestors, or change its contents?
Security

Line: 72 Column: 22 CWE codes: 362

              
                #if defined(BOOST_WINDOWS)

                bool open(std::string const &file_name,std::string const &encoding)
                {
                    close();

                    //
                    // Under windows we have to use "_wfopen" to get

            

Reported by FlawFinder.

open - Check when opening files - can an attacker redirect it (via symlinks), force the opening of special file type (e.g., device files), move things around to create a race condition, control its ancestors, or change its contents?
Security

Line: 94 Column: 22 CWE codes: 362

              
                // We do not use encoding as we use native file name encoding
                
                bool open(std::string const &file_name,std::string const &/* encoding */)
                {
                    close();

                    file = fopen(file_name.c_str(),"rb");


            

Reported by FlawFinder.

fopen - Check when opening files - can an attacker redirect it (via symlinks), force the opening of special file type (e.g., device files), move things around to create a race condition, control its ancestors, or change its contents?
Security

Line: 98 Column: 28 CWE codes: 362

                              {
                    close();

                    file = fopen(file_name.c_str(),"rb");

                    return file!=0;
                }

                #endif

            

Reported by FlawFinder.

memcpy - Does not check for buffer overflows when copying to destination
Security

Line: 227 Column: 21 CWE codes: 120
Suggestion: Make sure destination can always hold the source data

                                  if(file_size_ < 4 )
                        throw std::runtime_error("invalid 'mo' file format - the file is too short");
                    uint32_t magic=0;
                    memcpy(&magic,data_,4);
                    if(magic == 0x950412de)
                        native_byteorder_ = true;
                    else if(magic == 0xde120495)
                        native_byteorder_ = false;
                    else

            

Reported by FlawFinder.

memcpy - Does not check for buffer overflows when copying to destination
Security

Line: 270 Column: 21 CWE codes: 120
Suggestion: Make sure destination can always hold the source data

                                  if(offset > file_size_ - 4) {
                        throw std::runtime_error("Bad mo-file format");
                    }
                    memcpy(&tmp,data_ + offset,4);
                    convert(tmp);
                    return tmp;
                }

                void convert(uint32_t &v) const

            

Reported by FlawFinder.

open - Check when opening files - can an attacker redirect it (via symlinks), force the opening of special file type (e.g., device files), move things around to create a race condition, control its ancestors, or change its contents?
Security

Line: 641 Column: 34 CWE codes: 362

                                  }
                    else {
                        c_file the_file;
                        the_file.open(file_name,locale_encoding);
                        if(!the_file.file)
                            return false;
                        mo.reset(new mo_file(the_file.file));
                    }
                    

            

Reported by FlawFinder.

strlen - Does not handle strings that are not \0-terminated; if given one it may perform an over-read (it could cause a crash if unprotected)
Security

Line: 166 Column: 43 CWE codes: 126

                                  if(cntx == 0)
                        return strcmp(real_key,key) == 0;
                    else {
                        size_t real_len = strlen(real_key);
                        size_t cntx_len = strlen(cntx);
                        size_t key_len = strlen(key);
                        if(cntx_len + 1 + key_len != real_len)
                            return false;
                        return 

            

Reported by FlawFinder.

strlen - Does not handle strings that are not \0-terminated; if given one it may perform an over-read (it could cause a crash if unprotected)
Security

Line: 167 Column: 43 CWE codes: 126

                                      return strcmp(real_key,key) == 0;
                    else {
                        size_t real_len = strlen(real_key);
                        size_t cntx_len = strlen(cntx);
                        size_t key_len = strlen(key);
                        if(cntx_len + 1 + key_len != real_len)
                            return false;
                        return 
                            memcmp(real_key,cntx,cntx_len) == 0

            

Reported by FlawFinder.

strlen - Does not handle strings that are not \0-terminated; if given one it may perform an over-read (it could cause a crash if unprotected)
Security

Line: 168 Column: 42 CWE codes: 126

                                  else {
                        size_t real_len = strlen(real_key);
                        size_t cntx_len = strlen(cntx);
                        size_t key_len = strlen(key);
                        if(cntx_len + 1 + key_len != real_len)
                            return false;
                        return 
                            memcmp(real_key,cntx,cntx_len) == 0
                            && real_key[cntx_len] == '\4'

            

Reported by FlawFinder.

strlen - Does not handle strings that are not \0-terminated; if given one it may perform an over-read (it could cause a crash if unprotected)
Security

Line: 667 Column: 66 CWE codes: 126

                                      converter<CharType> cvt_key(key_encoding,mo_encoding);
                        for(unsigned i=0;i<mo->size();i++) {
                            char const *ckey = mo->key(i);
                            string_type skey = cvt_key(ckey,ckey+strlen(ckey));
                            key_type key(skey);
                            
                            mo_file::pair_type tmp = mo->value(i);
                            string_type value = cvt_value(tmp.first,tmp.second);
                            catalogs_[id][key].swap(value);

            

Reported by FlawFinder.