Skip to content

Conversation

@arkid15r
Copy link
Collaborator

@arkid15r arkid15r commented Aug 8, 2024

This is a refactor of existing Nettacker code I've been working on this spring/summer.

The (incomplete) list of changes:

  • add pre-commit checks
  • apply OOP approach to the application architecture
  • consolidate common modules logic into a base class
  • extract YAML parsing logic into a separate module
  • fix some typos
  • get rid of (not all) misused try/except blocks
  • migrate to poetry, remove requirements.* files
  • re-design configuration module
  • re-design logging module
  • split application logic into classes
  • use pathlib for path related manipulations
  • use context-based naming for variables, modules, directories, etc
  • use module level imports (vs function level)
  • use the base class for specific protocol libraries

This is a refactor of existing Nettacker code I've been working on recently. The (incomplete) list of changes:

          - add pre-commit checks
          - apply OOP approach to the application architecture
          - consolidate common modules logic into a base class
          - extract YAML parsing logic into a separate module
          - fix some typos
          - get rid of (not all) misused try/except blocks
          - migrate to poetry, remove requirements.* files
          - re-design configuration module
          - re-design logging module
          - split application logic into classes
          - use `pathlib` for path related manipulations
          - use context-based naming for variables, modules, directories, etc
          - use module level imports (vs function level)
          - use the base class for specific protocol libraries
@arkid15r arkid15r requested a review from securestep9 August 8, 2024 18:33
return None

try:
socket_connection = ssl.wrap_socket(socket_connection)

Check failure

Code scanning / CodeQL

Default version of SSL/TLS may be insecure

Call to deprecated method ssl.wrap_socket does not specify a protocol, which may result in an insecure default being used.
password = kwargs["password"]

connection = SSHClient()
connection.set_missing_host_key_policy(AutoAddPolicy())

Check failure

Code scanning / CodeQL

Accepting unknown SSH host keys when using Paramiko

Setting missing host key policy to AutoAddPolicy may be unsafe.

@staticmethod
def log(text):
print(text, end="", flush=True) # noqa: T201

Check failure

Code scanning / CodeQL

Clear-text logging of sensitive information

This expression logs [sensitive data (password)](1) as clear text.
@Ali-Razmjoo Ali-Razmjoo self-requested a review August 11, 2024 23:20
@securestep9 securestep9 merged commit 477d520 into OWASP:master Aug 24, 2024
@arkid15r arkid15r deleted the code-base-refactoring branch August 24, 2024 23:41
@arkid15r arkid15r mentioned this pull request Sep 1, 2024
8 tasks
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

2 participants