The following issues were found

src/third_party/boost/boost/log/detail/snprintf.hpp
10 issues
vsnprintf - If format strings can be influenced by an attacker, they can be exploited, and note that sprintf variations do not always \0-terminate
Security

Line: 42 Column: 12 CWE codes: 134
Suggestion: Use a constant for the format specification

              
// MSVC snprintfs are not conforming but they are good enough for our cases.
// MinGW32, at least the older versions up until gcc 4.7, also provide the non-conforming interface.
inline int vsnprintf(char* buf, std::size_t size, const char* format, std::va_list args)
{
    int n = _vsnprintf(buf, size, format, args);
    if (static_cast< unsigned int >(n) >= size)
    {
        n = static_cast< int >(size);

            

Reported by FlawFinder.

vswprintf - Potential format string problem
Security

Line: 54 Column: 12 CWE codes: 134
Suggestion: Make format string constant

              }

#   ifdef BOOST_LOG_USE_WCHAR_T
inline int vswprintf(wchar_t* buf, std::size_t size, const wchar_t* format, std::va_list args)
{
    int n = _vsnwprintf(buf, size, format, args);
    if (static_cast< unsigned int >(n) >= size)
    {
        n = static_cast< int >(size);

            

Reported by FlawFinder.

snprintf - If format strings can be influenced by an attacker, they can be exploited, and note that sprintf variations do not always \0-terminate
Security

Line: 66 Column: 12 CWE codes: 134
Suggestion: Use a constant for the format specification

              }
#   endif // BOOST_LOG_USE_WCHAR_T

inline int snprintf(char* buf, std::size_t size, const char* format, ...)
{
    std::va_list args;
    va_start(args, format);
    int n = vsnprintf(buf, size, format, args);
    va_end(args);

            

Reported by FlawFinder.

vsnprintf - If format strings can be influenced by an attacker, they can be exploited, and note that sprintf variations do not always \0-terminate
Security

Line: 70 Column: 13 CWE codes: 134
Suggestion: Use a constant for the format specification

              {
    std::va_list args;
    va_start(args, format);
    int n = vsnprintf(buf, size, format, args);
    va_end(args);
    return n;
}

#   ifdef BOOST_LOG_USE_WCHAR_T

            

Reported by FlawFinder.

swprintf - Potential format string problem
Security

Line: 76 Column: 12 CWE codes: 134
Suggestion: Make format string constant

              }

#   ifdef BOOST_LOG_USE_WCHAR_T
inline int swprintf(wchar_t* buf, std::size_t size, const wchar_t* format, ...)
{
    std::va_list args;
    va_start(args, format);
    int n = vswprintf(buf, size, format, args);
    va_end(args);

            

Reported by FlawFinder.

vswprintf - Potential format string problem
Security

Line: 80 Column: 13 CWE codes: 134
Suggestion: Make format string constant

              {
    std::va_list args;
    va_start(args, format);
    int n = vswprintf(buf, size, format, args);
    va_end(args);
    return n;
}
#   endif // BOOST_LOG_USE_WCHAR_T


            

Reported by FlawFinder.

snprintf - If format strings can be influenced by an attacker, they can be exploited, and note that sprintf variations do not always \0-terminate
Security

Line: 89 Column: 9 CWE codes: 134
Suggestion: Use a constant for the format specification

              #else

// Standard-conforming compilers already have the correct snprintfs
using ::snprintf;
using ::vsnprintf;

#   ifdef BOOST_LOG_USE_WCHAR_T
using ::swprintf;
using ::vswprintf;

            

Reported by FlawFinder.

vsnprintf - If format strings can be influenced by an attacker, they can be exploited, and note that sprintf variations do not always \0-terminate
Security

Line: 90 Column: 9 CWE codes: 134
Suggestion: Use a constant for the format specification

              
// Standard-conforming compilers already have the correct snprintfs
using ::snprintf;
using ::vsnprintf;

#   ifdef BOOST_LOG_USE_WCHAR_T
using ::swprintf;
using ::vswprintf;
#   endif // BOOST_LOG_USE_WCHAR_T

            

Reported by FlawFinder.

swprintf - Does not check for buffer overflows
Security

Line: 93 Column: 9 CWE codes: 120
Suggestion: Use sprintf_s, snprintf, or vsnprintf

              using ::vsnprintf;

#   ifdef BOOST_LOG_USE_WCHAR_T
using ::swprintf;
using ::vswprintf;
#   endif // BOOST_LOG_USE_WCHAR_T

#endif


            

Reported by FlawFinder.

vswprintf - Does not check for buffer overflows
Security

Line: 94 Column: 9 CWE codes: 120
Suggestion: Use sprintf_s, snprintf, or vsnprintf

              
#   ifdef BOOST_LOG_USE_WCHAR_T
using ::swprintf;
using ::vswprintf;
#   endif // BOOST_LOG_USE_WCHAR_T

#endif

} // namespace aux

            

Reported by FlawFinder.

src/third_party/wiredtiger/test/suite/test_cursor14.py
10 issues
Unable to import 'wiredtiger'
Error

Line: 29 Column: 1

              # ARISING FROM, OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR
# OTHER DEALINGS IN THE SOFTWARE.

import wiredtiger, wttest
from wtdataset import SimpleDataSet, ComplexDataSet, ComplexLSMDataSet
from wtscenario import make_scenarios

# test_cursor14.py
#    Test that more than 64K cursors can be opened on a data source

            

Reported by Pylint.

Unused import wiredtiger
Error

Line: 29 Column: 1

              # ARISING FROM, OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR
# OTHER DEALINGS IN THE SOFTWARE.

import wiredtiger, wttest
from wtdataset import SimpleDataSet, ComplexDataSet, ComplexLSMDataSet
from wtscenario import make_scenarios

# test_cursor14.py
#    Test that more than 64K cursors can be opened on a data source

            

Reported by Pylint.

Unused variable 'i'
Error

Line: 56 Column: 13

                      ds = self.dataset(self, uri, 100, key_format=self.keyfmt)
        ds.populate()

        for i in range(66000):
            cursor = self.session.open_cursor(uri, None, None)

if __name__ == '__main__':
    wttest.run()

            

Reported by Pylint.

Unused variable 'cursor'
Error

Line: 57 Column: 13

                      ds.populate()

        for i in range(66000):
            cursor = self.session.open_cursor(uri, None, None)

if __name__ == '__main__':
    wttest.run()

            

Reported by Pylint.

Missing module docstring
Error

Line: 1 Column: 1

              #!/usr/bin/env python
#
# Public Domain 2014-present MongoDB, Inc.
# Public Domain 2008-2014 WiredTiger, Inc.
#
# This is free and unencumbered software released into the public domain.
#
# Anyone is free to copy, modify, publish, use, compile, sell, or
# distribute this software, either in source code form or as a compiled

            

Reported by Pylint.

Multiple imports on one line (wiredtiger, wttest)
Error

Line: 29 Column: 1

              # ARISING FROM, OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR
# OTHER DEALINGS IN THE SOFTWARE.

import wiredtiger, wttest
from wtdataset import SimpleDataSet, ComplexDataSet, ComplexLSMDataSet
from wtscenario import make_scenarios

# test_cursor14.py
#    Test that more than 64K cursors can be opened on a data source

            

Reported by Pylint.

Missing class docstring
Error

Line: 35 Column: 1

              
# test_cursor14.py
#    Test that more than 64K cursors can be opened on a data source
class test_cursor14(wttest.WiredTigerTestCase):
    scenarios = make_scenarios([
        ('file-r', dict(type='file:', keyfmt='r', dataset=SimpleDataSet)),
        ('file-S', dict(type='file:', keyfmt='S', dataset=SimpleDataSet)),
        ('lsm-S', dict(type='lsm:', keyfmt='S', dataset=SimpleDataSet)),
        ('table-r', dict(type='table:', keyfmt='r', dataset=SimpleDataSet)),

            

Reported by Pylint.

Class name "test_cursor14" doesn't conform to PascalCase naming style
Error

Line: 35 Column: 1

              
# test_cursor14.py
#    Test that more than 64K cursors can be opened on a data source
class test_cursor14(wttest.WiredTigerTestCase):
    scenarios = make_scenarios([
        ('file-r', dict(type='file:', keyfmt='r', dataset=SimpleDataSet)),
        ('file-S', dict(type='file:', keyfmt='S', dataset=SimpleDataSet)),
        ('lsm-S', dict(type='lsm:', keyfmt='S', dataset=SimpleDataSet)),
        ('table-r', dict(type='table:', keyfmt='r', dataset=SimpleDataSet)),

            

Reported by Pylint.

Missing function or method docstring
Error

Line: 50 Column: 5

                          dataset=ComplexLSMDataSet)),
    ])

    def test_cursor14(self):
        uri = self.type + 'cursor14'

        ds = self.dataset(self, uri, 100, key_format=self.keyfmt)
        ds.populate()


            

Reported by Pylint.

Variable name "ds" doesn't conform to snake_case naming style
Error

Line: 53 Column: 9

                  def test_cursor14(self):
        uri = self.type + 'cursor14'

        ds = self.dataset(self, uri, 100, key_format=self.keyfmt)
        ds.populate()

        for i in range(66000):
            cursor = self.session.open_cursor(uri, None, None)


            

Reported by Pylint.

src/third_party/mozjs-60/extract/js/src/jsfriendapi.cpp
10 issues
Syntax Error: AST broken, 'for' doesn't have two operands.
Error

Line: 1107

                  bool initializedAny = false;
    NativeObject* nobj = &obj->as<NativeObject>();

    for (Shape::Range<NoGC> r(nobj->lastProperty()); !r.empty(); r.popFront()) {
        Shape* s = &r.front();
        Value v = nobj->getSlot(s->slot());
        if (s->isDataProperty() && v.isMagic() && v.whyMagic() == JS_UNINITIALIZED_LEXICAL) {
            nobj->setSlot(s->slot(), UndefinedValue());
            initializedAny = true;

            

Reported by Cppcheck.

getenv - Environment variables are untrustable input if they can be set by an attacker. They can have any content and length, and the same variable can be set more than once
Security

Line: 1123 Column: 38 CWE codes: 807 20
Suggestion: Check environment variables carefully before using them

              JS::IsGCPoisoning()
{
#ifdef JS_GC_POISONING
    static bool disablePoison = bool(getenv("JSGC_DISABLE_POISONING"));
    return !disablePoison;
#else
    return false;
#endif
}

            

Reported by FlawFinder.

char - Statically-sized arrays can be improperly restricted, leading to potential overflows or other issues
Security

Line: 1176 Column: 5 CWE codes: 119 120
Suggestion: Perform bounds checking, use functions that limit length, or ensure that the size is larger than the maximum possible length

              static void
DumpHeapVisitCompartment(JSContext* cx, void* data, JSCompartment* comp)
{
    char name[1024];
    if (cx->runtime()->compartmentNameCallback)
        (*cx->runtime()->compartmentNameCallback)(cx, comp, name, sizeof(name));
    else
        strcpy(name, "<unknown>");


            

Reported by FlawFinder.

strcpy - Does not check for buffer overflows when copying to destination [MS-banned]
Security

Line: 1180 Column: 9 CWE codes: 120
Suggestion: Consider using snprintf, strcpy_s, or strlcpy (warning: strncpy easily misused)

                  if (cx->runtime()->compartmentNameCallback)
        (*cx->runtime()->compartmentNameCallback)(cx, comp, name, sizeof(name));
    else
        strcpy(name, "<unknown>");

    DumpHeapTracer* dtrc = static_cast<DumpHeapTracer*>(data);
    fprintf(dtrc->output, "# compartment %s [in zone %p]\n", name, (void*)comp->zone());
}


            

Reported by FlawFinder.

char - Statically-sized arrays can be improperly restricted, leading to potential overflows or other issues
Security

Line: 1200 Column: 5 CWE codes: 119 120
Suggestion: Perform bounds checking, use functions that limit length, or ensure that the size is larger than the maximum possible length

                                JS::TraceKind traceKind, size_t thingSize)
{
    DumpHeapTracer* dtrc = static_cast<DumpHeapTracer*>(data);
    char cellDesc[1024 * 32];
    JS_GetTraceThingInfo(cellDesc, sizeof(cellDesc), dtrc, thing, traceKind, true);
    fprintf(dtrc->output, "%p %c %s\n", thing, MarkDescriptor(thing), cellDesc);
    js::TraceChildren(dtrc, thing, traceKind);
}


            

Reported by FlawFinder.

char - Statically-sized arrays can be improperly restricted, leading to potential overflows or other issues
Security

Line: 1212 Column: 5 CWE codes: 119 120
Suggestion: Perform bounds checking, use functions that limit length, or ensure that the size is larger than the maximum possible length

                  if (gc::IsInsideNursery(thing.asCell()))
        return;

    char buffer[1024];
    getTracingEdgeName(buffer, sizeof(buffer));
    fprintf(output, "%s%p %c %s\n", prefix, thing.asCell(), MarkDescriptor(thing.asCell()), buffer);
}

void

            

Reported by FlawFinder.

strlen - Does not handle strings that are not \0-terminated; if given one it may perform an over-read (it could cause a crash if unprotected)
Security

Line: 235 Column: 44 CWE codes: 126

              static bool
DefineHelpProperty(JSContext* cx, HandleObject obj, const char* prop, const char* value)
{
    RootedAtom atom(cx, Atomize(cx, value, strlen(value)));
    if (!atom)
        return false;
    return JS_DefineProperty(cx, obj, prop, atom, JSPROP_READONLY | JSPROP_PERMANENT);
}


            

Reported by FlawFinder.

strlen - Does not handle strings that are not \0-terminated; if given one it may perform an over-read (it could cause a crash if unprotected)
Security

Line: 249 Column: 46 CWE codes: 126

                  CHECK_REQUEST(cx);
    assertSameCompartment(cx, obj);
    for (; fs->name; fs++) {
        JSAtom* atom = Atomize(cx, fs->name, strlen(fs->name));
        if (!atom)
            return false;

        Rooted<jsid> id(cx, AtomToId(atom));
        RootedFunction fun(cx, DefineFunction(cx, obj, id, fs->call, fs->nargs,

            

Reported by FlawFinder.

strlen - Does not handle strings that are not \0-terminated; if given one it may perform an over-read (it could cause a crash if unprotected)
Security

Line: 430 Column: 38 CWE codes: 126

                  MOZ_ASSERT(!cx->runtime()->isAtomsCompartment(cx->compartment()));
    CHECK_REQUEST(cx);
    assertSameCompartment(cx, obj);
    JSAtom* atom = Atomize(cx, name, strlen(name));
    if (!atom)
        return nullptr;
    Rooted<jsid> id(cx, AtomToId(atom));
    return DefineFunction(cx, obj, id, call, nargs, attrs, gc::AllocKind::FUNCTION_EXTENDED);
}

            

Reported by FlawFinder.

strlen - Does not handle strings that are not \0-terminated; if given one it may perform an over-read (it could cause a crash if unprotected)
Security

Line: 447 Column: 34 CWE codes: 126

              
    RootedAtom atom(cx);
    if (name) {
        atom = Atomize(cx, name, strlen(name));
        if (!atom)
            return nullptr;
    }

    return (flags & JSFUN_CONSTRUCTOR) ?

            

Reported by FlawFinder.

src/third_party/wiredtiger/test/suite/test_import06.py
10 issues
An attribute defined in wttest line 401 hides this method
Error

Line: 89 Column: 5

                      extlist.extension('compressors', self.compressor)
        extlist.extension('encryptors', self.encryptor)

    def conn_config(self):
        return 'cache_size=50MB,log=(enabled),encryption=(name={})'.format(
            self.encryptor + self.encryptor_args)

    def test_import_repair(self):
        self.session.create(self.uri,

            

Reported by Pylint.

Missing module docstring
Error

Line: 1 Column: 1

              #!/usr/bin/env python
#
# Public Domain 2014-present MongoDB, Inc.
# Public Domain 2008-2014 WiredTiger, Inc.
#
# This is free and unencumbered software released into the public domain.
#
# Anyone is free to copy, modify, publish, use, compile, sell, or
# distribute this software, either in source code form or as a compiled

            

Reported by Pylint.

Multiple imports on one line (os, shutil)
Error

Line: 32 Column: 1

              # test_import06.py
# Import a file with the repair option (without the file metadata).

import os, shutil
from test_import01 import test_import_base
from wtscenario import make_scenarios

class test_import06(test_import_base):
    session_config = 'isolation=snapshot'

            

Reported by Pylint.

Missing class docstring
Error

Line: 36 Column: 1

              from test_import01 import test_import_base
from wtscenario import make_scenarios

class test_import06(test_import_base):
    session_config = 'isolation=snapshot'

    original_db_file = 'original_db_file'
    uri = 'file:' + original_db_file


            

Reported by Pylint.

Class name "test_import06" doesn't conform to PascalCase naming style
Error

Line: 36 Column: 1

              from test_import01 import test_import_base
from wtscenario import make_scenarios

class test_import06(test_import_base):
    session_config = 'isolation=snapshot'

    original_db_file = 'original_db_file'
    uri = 'file:' + original_db_file


            

Reported by Pylint.

Missing function or method docstring
Error

Line: 84 Column: 5

                  scenarios = make_scenarios(allocsizes, compressors, encryptors)

    # Load the compressor extension, skip the test if missing.
    def conn_extensions(self, extlist):
        extlist.skip_if_missing = True
        extlist.extension('compressors', self.compressor)
        extlist.extension('encryptors', self.encryptor)

    def conn_config(self):

            

Reported by Pylint.

Missing function or method docstring
Error

Line: 89 Column: 5

                      extlist.extension('compressors', self.compressor)
        extlist.extension('encryptors', self.encryptor)

    def conn_config(self):
        return 'cache_size=50MB,log=(enabled),encryption=(name={})'.format(
            self.encryptor + self.encryptor_args)

    def test_import_repair(self):
        self.session.create(self.uri,

            

Reported by Pylint.

Missing function or method docstring
Error

Line: 93 Column: 5

                      return 'cache_size=50MB,log=(enabled),encryption=(name={})'.format(
            self.encryptor + self.encryptor_args)

    def test_import_repair(self):
        self.session.create(self.uri,
            self.create_config.format(self.allocsize, self.compressor, self.encryptor))

        # Add data and perform a checkpoint.
        min_idx = 0

            

Reported by Pylint.

Variable name "c" doesn't conform to snake_case naming style
Error

Line: 115 Column: 9

                      #
        # We're not going to use it as the "file_metadata" argument this time but we will use it to
        # compare with the reconstructed metadata after importing.
        c = self.session.open_cursor('metadata:', None, None)
        original_db_file_config = c[self.uri]
        c.close()

        self.printVerbose(3, '\nFile configuration:\n' + original_db_file_config)


            

Reported by Pylint.

Variable name "c" doesn't conform to snake_case naming style
Error

Line: 154 Column: 9

                      self.check(self.uri, self.keys[:max_idx], self.values[:max_idx])

        # Compare configuration metadata.
        c = self.session.open_cursor('metadata:', None, None)
        current_db_file_config = c[self.uri]
        c.close()
        self.config_compare(original_db_file_config, current_db_file_config)

        # Add some data and check that the table operates as usual after importing.

            

Reported by Pylint.

src/third_party/boost/boost/iostreams/detail/adapter/concept_adapter.hpp
10 issues
read - Check buffer boundaries if used in a loop including recursive loops
Security

Line: 73 Column: 21 CWE codes: 120 20

                  T& operator*() { return t_; }
    T* operator->() { return &t_; }

    std::streamsize read(char_type* s, std::streamsize n)
    { return this->read(s, n, (basic_null_source<char_type>*) 0); }

    template<typename Source>
    std::streamsize read(char_type* s, std::streamsize n, Source* src)
    { return input_impl::read(t_, src, s, n); }

            

Reported by FlawFinder.

read - Check buffer boundaries if used in a loop including recursive loops
Security

Line: 74 Column: 20 CWE codes: 120 20

                  T* operator->() { return &t_; }

    std::streamsize read(char_type* s, std::streamsize n)
    { return this->read(s, n, (basic_null_source<char_type>*) 0); }

    template<typename Source>
    std::streamsize read(char_type* s, std::streamsize n, Source* src)
    { return input_impl::read(t_, src, s, n); }


            

Reported by FlawFinder.

read - Check buffer boundaries if used in a loop including recursive loops
Security

Line: 77 Column: 21 CWE codes: 120 20

                  { return this->read(s, n, (basic_null_source<char_type>*) 0); }

    template<typename Source>
    std::streamsize read(char_type* s, std::streamsize n, Source* src)
    { return input_impl::read(t_, src, s, n); }

    std::streamsize write(const char_type* s, std::streamsize n)
    { return this->write(s, n, (basic_null_sink<char_type>*) 0); }


            

Reported by FlawFinder.

read - Check buffer boundaries if used in a loop including recursive loops
Security

Line: 78 Column: 26 CWE codes: 120 20

              
    template<typename Source>
    std::streamsize read(char_type* s, std::streamsize n, Source* src)
    { return input_impl::read(t_, src, s, n); }

    std::streamsize write(const char_type* s, std::streamsize n)
    { return this->write(s, n, (basic_null_sink<char_type>*) 0); }

    template<typename Sink>

            

Reported by FlawFinder.

read - Check buffer boundaries if used in a loop including recursive loops
Security

Line: 170 Column: 5 CWE codes: 120 20

              struct device_wrapper_impl<input> : device_wrapper_impl<any_tag>  {
    template<typename Device, typename Dummy>
    static std::streamsize
    read( Device& dev, Dummy*, typename char_type_of<Device>::type* s,
          std::streamsize n )
    { return iostreams::read(dev, s, n); }

    template<typename Device, typename Dummy>
    static std::streamsize 

            

Reported by FlawFinder.

read - Check buffer boundaries if used in a loop including recursive loops
Security

Line: 172 Column: 25 CWE codes: 120 20

                  static std::streamsize
    read( Device& dev, Dummy*, typename char_type_of<Device>::type* s,
          std::streamsize n )
    { return iostreams::read(dev, s, n); }

    template<typename Device, typename Dummy>
    static std::streamsize 
    write( Device&, Dummy*, const typename char_type_of<Device>::type*,
           std::streamsize )

            

Reported by FlawFinder.

read - Check buffer boundaries if used in a loop including recursive loops
Security

Line: 186 Column: 5 CWE codes: 120 20

              struct device_wrapper_impl<output> {
    template<typename Device, typename Dummy>
    static std::streamsize
    read(Device&, Dummy*, typename char_type_of<Device>::type*, std::streamsize)
    { boost::throw_exception(cant_read());
      BOOST_IOSTREAMS_UNREACHABLE_RETURN(0) }

    template<typename Device, typename Dummy>
    static std::streamsize 

            

Reported by FlawFinder.

read - Check buffer boundaries if used in a loop including recursive loops
Security

Line: 254 Column: 5 CWE codes: 120 20

              struct flt_wrapper_impl<input> {
    template<typename Filter, typename Source>
    static std::streamsize
    read( Filter& f, Source* src, typename char_type_of<Filter>::type* s,
          std::streamsize n )
    { return iostreams::read(f, *src, s, n); }

    template<typename Filter, typename Sink>
    static std::streamsize 

            

Reported by FlawFinder.

read - Check buffer boundaries if used in a loop including recursive loops
Security

Line: 256 Column: 25 CWE codes: 120 20

                  static std::streamsize
    read( Filter& f, Source* src, typename char_type_of<Filter>::type* s,
          std::streamsize n )
    { return iostreams::read(f, *src, s, n); }

    template<typename Filter, typename Sink>
    static std::streamsize 
    write( Filter&, Sink*, const typename char_type_of<Filter>::type*, 
           std::streamsize )

            

Reported by FlawFinder.

read - Check buffer boundaries if used in a loop including recursive loops
Security

Line: 270 Column: 5 CWE codes: 120 20

              struct flt_wrapper_impl<output> {
    template<typename Filter, typename Source>
    static std::streamsize
    read(Filter&, Source*, typename char_type_of<Filter>::type*,std::streamsize)
    { boost::throw_exception(cant_read());
      BOOST_IOSTREAMS_UNREACHABLE_RETURN(0) }

    template<typename Filter, typename Sink>
    static std::streamsize 

            

Reported by FlawFinder.

src/mongo/db/repl/idempotency_update_sequence_test.cpp
10 issues
syntax error
Error

Line: 56

              
PseudoRandom random(SecureRandom().nextInt64());

TEST(UpdateGenTest, FindsAllPaths) {
    std::set<StringData> fields{"a", "b"};
    size_t depth = 1;
    size_t length = 1;

    TrivialScalarGenerator trivialScalarGenerator;

            

Reported by Cppcheck.

random - This function is not sufficiently random for security-related functions such as key and nonce creation
Security

Line: 54 Column: 14 CWE codes: 327
Suggestion: Use a more secure technique for acquiring random values

              
namespace {

PseudoRandom random(SecureRandom().nextInt64());

TEST(UpdateGenTest, FindsAllPaths) {
    std::set<StringData> fields{"a", "b"};
    size_t depth = 1;
    size_t length = 1;

            

Reported by FlawFinder.

random - This function is not sufficiently random for security-related functions such as key and nonce creation
Security

Line: 62 Column: 64 CWE codes: 327
Suggestion: Use a more secure technique for acquiring random values

                  size_t length = 1;

    TrivialScalarGenerator trivialScalarGenerator;
    UpdateSequenceGenerator generator({fields, depth, length}, random, &trivialScalarGenerator);

    ASSERT_EQ(generator.getPaths().size(), 5U);

    std::vector<std::string> expectedPaths{"a", "a.0", "a.b", "b", "b.0"};
    std::vector<std::string> foundPaths(generator.getPaths());

            

Reported by FlawFinder.

random - This function is not sufficiently random for security-related functions such as key and nonce creation
Security

Line: 93 Column: 64 CWE codes: 327
Suggestion: Use a more secure technique for acquiring random values

                  size_t length = 2;

    TrivialScalarGenerator trivialScalarGenerator;
    UpdateSequenceGenerator generator({fields, depth, length}, random, &trivialScalarGenerator);

    auto paths = generator.getPaths();
    for (size_t i = 0; i < paths.size(); i++) {
        for (size_t j = i + 1; j < paths.size(); j++) {
            if (paths[i] == paths[j]) {

            

Reported by FlawFinder.

random - This function is not sufficiently random for security-related functions such as key and nonce creation
Security

Line: 114 Column: 64 CWE codes: 327
Suggestion: Use a more secure technique for acquiring random values

                  size_t length = 1;

    TrivialScalarGenerator trivialScalarGenerator;
    UpdateSequenceGenerator generator({fields, depth, length}, random, &trivialScalarGenerator);
    auto update = generator.generateUpdate();

    BSONObj updateArg;
    if (auto setElem = update["$set"]) {
        updateArg = setElem.Obj();

            

Reported by FlawFinder.

random - This function is not sufficiently random for security-related functions such as key and nonce creation
Security

Line: 152 Column: 64 CWE codes: 327
Suggestion: Use a more secure technique for acquiring random values

                  size_t length = 1;

    TrivialScalarGenerator trivialScalarGenerator;
    UpdateSequenceGenerator generator({fields, depth, length}, random, &trivialScalarGenerator);
    auto update = generator.generateUpdate();

    BSONObj updateArg;
    if (auto setElem = update["$set"]) {
        updateArg = setElem.Obj();

            

Reported by FlawFinder.

random - This function is not sufficiently random for security-related functions such as key and nonce creation
Security

Line: 200 Column: 55 CWE codes: 327
Suggestion: Use a more secure technique for acquiring random values

              
    TrivialScalarGenerator trivialScalarGenerator;
    UpdateSequenceGenerator generator(
        {fields, depth, length, 0.333, 0.333, 0.334}, random, &trivialScalarGenerator);

    BSONElement setElem;
    BSONObj update;
    // Because our probabilities sum to 1, we are guaranteed to always get a $set.
    update = generator.generateUpdate();

            

Reported by FlawFinder.

random - This function is not sufficiently random for security-related functions such as key and nonce creation
Security

Line: 236 Column: 49 CWE codes: 327
Suggestion: Use a more secure technique for acquiring random values

              
    TrivialScalarGenerator trivialScalarGenerator;
    UpdateSequenceGenerator generatorNoSet(
        {fields, depth, length, 0.0, 0.0, 0.0}, random, &trivialScalarGenerator);

    for (size_t i = 0; i < 100; i++) {
        auto update = generatorNoSet.generateUpdate();
        if (!update["$unset"]) {
            StringBuilder sb;

            

Reported by FlawFinder.

random - This function is not sufficiently random for security-related functions such as key and nonce creation
Security

Line: 257 Column: 49 CWE codes: 327
Suggestion: Use a more secure technique for acquiring random values

              
    TrivialScalarGenerator trivialScalarGenerator;
    UpdateSequenceGenerator generatorNoUnsetAndOnlyScalar(
        {fields, depth, length, 1.0, 0.0, 0.0}, random, &trivialScalarGenerator);

    for (size_t i = 0; i < 100; i++) {
        auto update = generatorNoUnsetAndOnlyScalar.generateUpdate();
        if (!update["$set"]) {
            StringBuilder sb;

            

Reported by FlawFinder.

random - This function is not sufficiently random for security-related functions such as key and nonce creation
Security

Line: 284 Column: 49 CWE codes: 327
Suggestion: Use a more secure technique for acquiring random values

              
    TrivialScalarGenerator trivialScalarGenerator;
    UpdateSequenceGenerator generatorNeverScalar(
        {fields, depth, length, 0.0, 0.5, 0.5}, random, &trivialScalarGenerator);

    for (size_t i = 0; i < 100; i++) {
        auto update = generatorNeverScalar.generateUpdate();
        for (auto elem : update["$set"].Obj()) {
            StringData fieldName = elem.fieldNameStringData();

            

Reported by FlawFinder.

src/third_party/wiredtiger/test/suite/test_import08.py
10 issues
Anomalous backslash in string: '\d'. String constant might be missing an r prefix.
Error

Line: 58 Column: 42

                  def parse_write_gen(self, config):
        # The search string will look like: 'write_gen=<num>'.
        # Just reverse the string and take the digits from the back until we hit '='.
        write_gen = re.search("write_gen=\d+", config)
        self.assertTrue(write_gen is not None)
        write_gen_str = str()
        for c in reversed(write_gen.group(0)):
            if not c.isdigit():
                self.assertEqual(c, '=')

            

Reported by Pylint.

Missing module docstring
Error

Line: 1 Column: 1

              #!/usr/bin/env python
#
# Public Domain 2014-present MongoDB, Inc.
# Public Domain 2008-2014 WiredTiger, Inc.
#
# This is free and unencumbered software released into the public domain.
#
# Anyone is free to copy, modify, publish, use, compile, sell, or
# distribute this software, either in source code form or as a compiled

            

Reported by Pylint.

Multiple imports on one line (os, re, shutil)
Error

Line: 32 Column: 1

              # test_import08.py
# Check that transaction ids from imported files are ignored regardless of write generation.

import os, re, shutil
from test_import01 import test_import_base
from wtscenario import make_scenarios

class test_import08(test_import_base):
    conn_config = 'cache_size=50MB,log=(enabled)'

            

Reported by Pylint.

Class name "test_import08" doesn't conform to PascalCase naming style
Error

Line: 36 Column: 1

              from test_import01 import test_import_base
from wtscenario import make_scenarios

class test_import08(test_import_base):
    conn_config = 'cache_size=50MB,log=(enabled)'
    session_config = 'isolation=snapshot'

    original_db_file = 'original_db_file'
    uri = 'file:' + original_db_file

            

Reported by Pylint.

Missing class docstring
Error

Line: 36 Column: 1

              from test_import01 import test_import_base
from wtscenario import make_scenarios

class test_import08(test_import_base):
    conn_config = 'cache_size=50MB,log=(enabled)'
    session_config = 'isolation=snapshot'

    original_db_file = 'original_db_file'
    uri = 'file:' + original_db_file

            

Reported by Pylint.

Missing function or method docstring
Error

Line: 55 Column: 5

                      ('repair', dict(repair=True)),
    ])

    def parse_write_gen(self, config):
        # The search string will look like: 'write_gen=<num>'.
        # Just reverse the string and take the digits from the back until we hit '='.
        write_gen = re.search("write_gen=\d+", config)
        self.assertTrue(write_gen is not None)
        write_gen_str = str()

            

Reported by Pylint.

Variable name "c" doesn't conform to snake_case naming style
Error

Line: 61 Column: 13

                      write_gen = re.search("write_gen=\d+", config)
        self.assertTrue(write_gen is not None)
        write_gen_str = str()
        for c in reversed(write_gen.group(0)):
            if not c.isdigit():
                self.assertEqual(c, '=')
                break
            write_gen_str = c + write_gen_str
        return int(write_gen_str)

            

Reported by Pylint.

Missing function or method docstring
Error

Line: 68 Column: 5

                          write_gen_str = c + write_gen_str
        return int(write_gen_str)

    def test_import_write_gen(self):
        # Make a bunch of files and fill them with data. This has the side effect of allocating a
        # lot of transaction ids which is important for our test.
        self.populate(self.ntables, self.nrows)

        # Find the URI of one of the generated tables.

            

Reported by Pylint.

Variable name "c" doesn't conform to snake_case naming style
Error

Line: 109 Column: 9

                          self.session.checkpoint()

        # Export the metadata for the table.
        c = self.session.open_cursor('metadata:', None, None)
        original_db_file_config = c[self.uri]
        c.close()

        self.printVerbose(3, '\nFile configuration:\n' + original_db_file_config)


            

Reported by Pylint.

Variable name "c" doesn't conform to snake_case naming style
Error

Line: 152 Column: 9

                      #
        # The important thing to check is that it is greater than 1 (the current connection-wide
        # base write gen).
        c = self.session.open_cursor('metadata:')
        original_db_file_config = c[self.uri]
        c.close()
        write_gen = self.parse_write_gen(original_db_file_config)
        self.printVerbose(3, 'IMPORTED WRITE GEN: {}'.format(write_gen))
        self.assertGreater(write_gen, 1)

            

Reported by Pylint.

src/third_party/wiredtiger/test/suite/test_upgrade.py
10 issues
Unable to import 'wiredtiger'
Error

Line: 30 Column: 1

              # OTHER DEALINGS IN THE SOFTWARE.

import os, time
import wiredtiger, wttest
from wtdataset import SimpleDataSet, ComplexDataSet
from wtscenario import make_scenarios

# test_upgrade.py
#    session level upgrade operation

            

Reported by Pylint.

Unused import os
Error

Line: 29 Column: 1

              # ARISING FROM, OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR
# OTHER DEALINGS IN THE SOFTWARE.

import os, time
import wiredtiger, wttest
from wtdataset import SimpleDataSet, ComplexDataSet
from wtscenario import make_scenarios

# test_upgrade.py

            

Reported by Pylint.

Unused import time
Error

Line: 29 Column: 1

              # ARISING FROM, OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR
# OTHER DEALINGS IN THE SOFTWARE.

import os, time
import wiredtiger, wttest
from wtdataset import SimpleDataSet, ComplexDataSet
from wtscenario import make_scenarios

# test_upgrade.py

            

Reported by Pylint.

Missing module docstring
Error

Line: 1 Column: 1

              #!/usr/bin/env python
#
# Public Domain 2014-present MongoDB, Inc.
# Public Domain 2008-2014 WiredTiger, Inc.
#
# This is free and unencumbered software released into the public domain.
#
# Anyone is free to copy, modify, publish, use, compile, sell, or
# distribute this software, either in source code form or as a compiled

            

Reported by Pylint.

Multiple imports on one line (os, time)
Error

Line: 29 Column: 1

              # ARISING FROM, OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR
# OTHER DEALINGS IN THE SOFTWARE.

import os, time
import wiredtiger, wttest
from wtdataset import SimpleDataSet, ComplexDataSet
from wtscenario import make_scenarios

# test_upgrade.py

            

Reported by Pylint.

Multiple imports on one line (wiredtiger, wttest)
Error

Line: 30 Column: 1

              # OTHER DEALINGS IN THE SOFTWARE.

import os, time
import wiredtiger, wttest
from wtdataset import SimpleDataSet, ComplexDataSet
from wtscenario import make_scenarios

# test_upgrade.py
#    session level upgrade operation

            

Reported by Pylint.

Missing class docstring
Error

Line: 36 Column: 1

              
# test_upgrade.py
#    session level upgrade operation
class test_upgrade(wttest.WiredTigerTestCase):
    name = 'test_upgrade'

    scenarios = make_scenarios([
        ('file', dict(uri='file:')),
        ('table', dict(uri='table:'))

            

Reported by Pylint.

Class name "test_upgrade" doesn't conform to PascalCase naming style
Error

Line: 36 Column: 1

              
# test_upgrade.py
#    session level upgrade operation
class test_upgrade(wttest.WiredTigerTestCase):
    name = 'test_upgrade'

    scenarios = make_scenarios([
        ('file', dict(uri='file:')),
        ('table', dict(uri='table:'))

            

Reported by Pylint.

Missing function or method docstring
Error

Line: 45 Column: 5

                  ])

    # Populate an object, then upgrade it.
    def upgrade(self, dataset, with_cursor):
        uri = self.uri + self.name
        dataset(self, uri, 10).populate()

        # Open cursors should cause failure.
        if with_cursor:

            

Reported by Pylint.

Missing function or method docstring
Error

Line: 60 Column: 5

                      self.session.drop(uri)

    # Test upgrade of an object.
    def test_upgrade(self):
        # Simple file or table object.
        self.upgrade(SimpleDataSet, False)
        self.upgrade(SimpleDataSet, True)

        # A complex, multi-file table object.

            

Reported by Pylint.

src/third_party/wiredtiger/test/suite/test_rollback_to_stable06.py
10 issues
Unable to import 'wiredtiger'
Error

Line: 29 Column: 1

              # ARISING FROM, OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR
# OTHER DEALINGS IN THE SOFTWARE.

from wiredtiger import stat
from wtdataset import SimpleDataSet
from wtscenario import make_scenarios
from test_rollback_to_stable01 import test_rollback_to_stable_base

# test_rollback_to_stable06.py

            

Reported by Pylint.

An attribute defined in wttest line 401 hides this method
Error

Line: 57 Column: 5

              
    scenarios = make_scenarios(key_format_values, in_memory_values, prepare_values)

    def conn_config(self):
        config = 'cache_size=50MB,statistics=(all)'
        if self.in_memory:
            config += ',in_memory=true'
        else:
            config += ',log=(enabled),in_memory=false'

            

Reported by Pylint.

Undefined variable 'wttest'
Error

Line: 126 Column: 5

                          self.assertGreaterEqual(upd_aborted + hs_removed + keys_removed, nrows * 4)

if __name__ == '__main__':
    wttest.run()

            

Reported by Pylint.

Missing module docstring
Error

Line: 1 Column: 1

              #!/usr/bin/env python
#
# Public Domain 2014-present MongoDB, Inc.
# Public Domain 2008-2014 WiredTiger, Inc.
#
# This is free and unencumbered software released into the public domain.
#
# Anyone is free to copy, modify, publish, use, compile, sell, or
# distribute this software, either in source code form or as a compiled

            

Reported by Pylint.

Class name "test_rollback_to_stable06" doesn't conform to PascalCase naming style
Error

Line: 37 Column: 1

              # test_rollback_to_stable06.py
# Test that rollback to stable removes all keys when the stable timestamp is earlier than
# all commit timestamps.
class test_rollback_to_stable06(test_rollback_to_stable_base):
    session_config = 'isolation=snapshot'

    key_format_values = [
        ('column', dict(key_format='r')),
        ('integer_row', dict(key_format='i')),

            

Reported by Pylint.

Missing class docstring
Error

Line: 37 Column: 1

              # test_rollback_to_stable06.py
# Test that rollback to stable removes all keys when the stable timestamp is earlier than
# all commit timestamps.
class test_rollback_to_stable06(test_rollback_to_stable_base):
    session_config = 'isolation=snapshot'

    key_format_values = [
        ('column', dict(key_format='r')),
        ('integer_row', dict(key_format='i')),

            

Reported by Pylint.

Missing function or method docstring
Error

Line: 57 Column: 5

              
    scenarios = make_scenarios(key_format_values, in_memory_values, prepare_values)

    def conn_config(self):
        config = 'cache_size=50MB,statistics=(all)'
        if self.in_memory:
            config += ',in_memory=true'
        else:
            config += ',log=(enabled),in_memory=false'

            

Reported by Pylint.

Missing function or method docstring
Error

Line: 65 Column: 5

                          config += ',log=(enabled),in_memory=false'
        return config

    def test_rollback_to_stable(self):
        nrows = 1000

        # Create a table without logging.
        uri = "table:rollback_to_stable06"
        ds = SimpleDataSet(

            

Reported by Pylint.

Variable name "ds" doesn't conform to snake_case naming style
Error

Line: 70 Column: 9

              
        # Create a table without logging.
        uri = "table:rollback_to_stable06"
        ds = SimpleDataSet(
            self, uri, 0, key_format=self.key_format, value_format="S", config='log=(enabled=false)')
        ds.populate()

        # Pin oldest and stable to timestamp 10.
        self.conn.set_timestamp('oldest_timestamp=' + self.timestamp_str(10) +

            

Reported by Pylint.

Line too long (101/100)
Error

Line: 71 Column: 1

                      # Create a table without logging.
        uri = "table:rollback_to_stable06"
        ds = SimpleDataSet(
            self, uri, 0, key_format=self.key_format, value_format="S", config='log=(enabled=false)')
        ds.populate()

        # Pin oldest and stable to timestamp 10.
        self.conn.set_timestamp('oldest_timestamp=' + self.timestamp_str(10) +
            ',stable_timestamp=' + self.timestamp_str(10))

            

Reported by Pylint.

src/third_party/wiredtiger/test/format/salvage.c
10 issues
system - This causes a new program to execute and is difficult to use safely
Security

Line: 96 Column: 16 CWE codes: 78
Suggestion: try using a library call that implements the same functionality if available

                  /*
     * Save a copy of the corrupted file so we can replay the salvage step as necessary.
     */
    if ((ret = system(copycmd)) != 0)
        testutil_die(ret, "salvage corrupt copy step failed");

    return (1);
}


            

Reported by FlawFinder.

system - This causes a new program to execute and is difficult to use safely
Security

Line: 135 Column: 16 CWE codes: 78
Suggestion: try using a library call that implements the same functionality if available

                  len = strlen(g.home) + strlen(SALVAGE_COPY_CMD) + 1;
    cmd = dmalloc(len);
    testutil_check(__wt_snprintf(cmd, len, SALVAGE_COPY_CMD, g.home));
    if ((ret = system(cmd)) != 0)
        testutil_die(ret, "salvage copy (\"%s\"), failed", cmd);
    free(cmd);

    /* Salvage, then verify. */
    wts_open(g.home, &conn, &session, true);

            

Reported by FlawFinder.

char - Statically-sized arrays can be improperly restricted, leading to potential overflows or other issues
Security

Line: 43 Column: 5 CWE codes: 119 120
Suggestion: Perform bounds checking, use functions that limit length, or ensure that the size is larger than the maximum possible length

                  wt_off_t offset;
    size_t len, nw;
    int fd, ret;
    char copycmd[2 * 1024], path[1024];
    const char *smash;

    /*
     * If it's a single Btree file (not LSM), open the file, and corrupt roughly 2% of the file at a
     * random spot, including the beginning of the file and overlapping the end.

            

Reported by FlawFinder.

open - Check when opening files - can an attacker redirect it (via symlinks), force the opening of special file type (e.g., device files), move things around to create a race condition, control its ancestors, or change its contents?
Security

Line: 54 Column: 15 CWE codes: 362

                   * source is a table, we're looking for "wt.wt".
     */
    testutil_check(__wt_snprintf(path, sizeof(path), "%s/%s", g.home, WT_NAME));
    if ((fd = open(path, O_RDWR)) != -1) {
        testutil_check(__wt_snprintf(copycmd, sizeof(copycmd),
          "cp %s/%s %s/SALVAGE.copy/%s.corrupted", g.home, WT_NAME, g.home, WT_NAME));
        goto found;
    }
    testutil_check(__wt_snprintf(path, sizeof(path), "%s/%s.wt", g.home, WT_NAME));

            

Reported by FlawFinder.

open - Check when opening files - can an attacker redirect it (via symlinks), force the opening of special file type (e.g., device files), move things around to create a race condition, control its ancestors, or change its contents?
Security

Line: 60 Column: 15 CWE codes: 362

                      goto found;
    }
    testutil_check(__wt_snprintf(path, sizeof(path), "%s/%s.wt", g.home, WT_NAME));
    if ((fd = open(path, O_RDWR)) != -1) {
        testutil_check(__wt_snprintf(copycmd, sizeof(copycmd),
          "cp %s/%s.wt %s/SALVAGE.copy/%s.wt.corrupted", g.home, WT_NAME, g.home, WT_NAME));
        goto found;
    }
    return (0);

            

Reported by FlawFinder.

fopen - Check when opening files - can an attacker redirect it (via symlinks), force the opening of special file type (e.g., device files), move things around to create a race condition, control its ancestors, or change its contents?
Security

Line: 74 Column: 15 CWE codes: 362

                  offset = mmrand(NULL, 0, (u_int)sb.st_size);
    len = (size_t)(20 + (sb.st_size / 100) * 2);
    testutil_check(__wt_snprintf(path, sizeof(path), "%s/SALVAGE.corrupt", g.home));
    if ((fp = fopen(path, "w")) == NULL)
        testutil_die(errno, "salvage-corrupt: open: %s", path);
    (void)fprintf(fp, "salvage-corrupt: offset %" PRIuMAX ", length %" WT_SIZET_FMT "\n",
      (uintmax_t)offset, len);
    fclose_and_clear(&fp);


            

Reported by FlawFinder.

strlen - Does not handle strings that are not \0-terminated; if given one it may perform an over-read (it could cause a crash if unprotected)
Security

Line: 85 Column: 29 CWE codes: 126

              
    smash = "!!! memory corrupted by format to test salvage ";
    for (; len > 0; len -= nw) {
        nw = (size_t)(len > strlen(smash) ? strlen(smash) : len);
        if (write(fd, smash, nw) == -1)
            testutil_die(errno, "salvage-corrupt: write");
    }

    if (close(fd) == -1)

            

Reported by FlawFinder.

strlen - Does not handle strings that are not \0-terminated; if given one it may perform an over-read (it could cause a crash if unprotected)
Security

Line: 85 Column: 45 CWE codes: 126

              
    smash = "!!! memory corrupted by format to test salvage ";
    for (; len > 0; len -= nw) {
        nw = (size_t)(len > strlen(smash) ? strlen(smash) : len);
        if (write(fd, smash, nw) == -1)
            testutil_die(errno, "salvage-corrupt: write");
    }

    if (close(fd) == -1)

            

Reported by FlawFinder.

strlen - Does not handle strings that are not \0-terminated; if given one it may perform an over-read (it could cause a crash if unprotected)
Security

Line: 132 Column: 11 CWE codes: 126

                  track("salvage", 0ULL, NULL);

    /* Save a copy of the interesting files so we can replay the salvage step as necessary. */
    len = strlen(g.home) + strlen(SALVAGE_COPY_CMD) + 1;
    cmd = dmalloc(len);
    testutil_check(__wt_snprintf(cmd, len, SALVAGE_COPY_CMD, g.home));
    if ((ret = system(cmd)) != 0)
        testutil_die(ret, "salvage copy (\"%s\"), failed", cmd);
    free(cmd);

            

Reported by FlawFinder.

strlen - Does not handle strings that are not \0-terminated; if given one it may perform an over-read (it could cause a crash if unprotected)
Security

Line: 132 Column: 28 CWE codes: 126

                  track("salvage", 0ULL, NULL);

    /* Save a copy of the interesting files so we can replay the salvage step as necessary. */
    len = strlen(g.home) + strlen(SALVAGE_COPY_CMD) + 1;
    cmd = dmalloc(len);
    testutil_check(__wt_snprintf(cmd, len, SALVAGE_COPY_CMD, g.home));
    if ((ret = system(cmd)) != 0)
        testutil_die(ret, "salvage copy (\"%s\"), failed", cmd);
    free(cmd);

            

Reported by FlawFinder.