Node / ReticulumProjects / MeshChatX.git / files / meshchatx / src / backend / plugin_security_scan.py

Displaying Raw • Download

T8b949e# SPDX-License-Identifier: 0BSD

T8b949e"""Heuristic security assessment for plugin packages and Sideband scripts."""

Tff7b72from T7ee787__future__ Tff7b72import Te6edf3annotations

Tff7b72import T7ee787os

Tff7b72import T7ee787re

Tff7b72from T7ee787dataclasses Tff7b72import Te6edf3dataclassTb4b4b4, Te6edf3field

Tff7b72from T7ee787typing Tff7b72import Te6edf3Any

Tff7b72from T7ee787meshchatxT7ee787.T7ee787srcT7ee787.T7ee787backendT7ee787.T7ee787plugin_permissions Tff7b72import Tb4b4b4(

Te6edf3collect_network_endpointsTb4b4b4,

Te6edf3declared_permission_idsTb4b4b4,

Te6edf3extract_urls_from_textTb4b4b4,

Te6edf3normalize_network_modeTb4b4b4,

Te6edf3requires_network_fetchTb4b4b4,

Tb4b4b4)

Tff7b72from T7ee787meshchatxT7ee787.T7ee787srcT7ee787.T7ee787backendT7ee787.T7ee787plugin_signature Tff7b72import Te6edf3SignatureInfo

Te6edf3_JS_EVAL_RE Tff7b72= Te6edf3reTff7b72.Td2a8ffcompileTb4b4b4(Ta5d6ffrTa5d6ff"Ta5d6ff\Ta5d6ffbevalTa5d6ff\Ta5d6ffs*Ta5d6ff\Ta5d6ff(Ta5d6ff"Tb4b4b4)

Te6edf3_JS_FUNCTION_CTOR_RE Tff7b72= Te6edf3reTff7b72.Td2a8ffcompileTb4b4b4(Ta5d6ffrTa5d6ff"Ta5d6ff\Ta5d6ffbnewTa5d6ff\Ta5d6ffs+FunctionTa5d6ff\Ta5d6ffs*Ta5d6ff\Ta5d6ff(Ta5d6ff"Tb4b4b4)

Te6edf3_JS_ATOB_RE Tff7b72= Te6edf3reTff7b72.Td2a8ffcompileTb4b4b4(Ta5d6ffrTa5d6ff"Ta5d6ff\Ta5d6ffbatobTa5d6ff\Ta5d6ffs*Ta5d6ff\Ta5d6ff(Ta5d6ff"Tb4b4b4)

Te6edf3_JS_DOC_WRITE_RE Tff7b72= Te6edf3reTff7b72.Td2a8ffcompileTb4b4b4(Ta5d6ffrTa5d6ff"Ta5d6ff\Ta5d6ffbdocumentTa5d6ff\Ta5d6ff.writeTa5d6ff\Ta5d6ffs*Ta5d6ff\Ta5d6ff(Ta5d6ff"Tb4b4b4)

Te6edf3_PY_EVAL_RE Tff7b72= Te6edf3reTff7b72.Td2a8ffcompileTb4b4b4(Ta5d6ffrTa5d6ff"Ta5d6ff\Ta5d6ffbevalTa5d6ff\Ta5d6ffs*Ta5d6ff\Ta5d6ff(Ta5d6ff"Tb4b4b4)

Te6edf3_PY_EXEC_RE Tff7b72= Te6edf3reTff7b72.Td2a8ffcompileTb4b4b4(Ta5d6ffrTa5d6ff"Ta5d6ff\Ta5d6ffbexecTa5d6ff\Ta5d6ffs*Ta5d6ff\Ta5d6ff(Ta5d6ff"Tb4b4b4)

Te6edf3_PY_SUBPROCESS_RE Tff7b72= Te6edf3reTff7b72.Td2a8ffcompileTb4b4b4(Ta5d6ffrTa5d6ff"Ta5d6ff\Ta5d6ffbsubprocessTa5d6ff\Ta5d6ffbTa5d6ff"Tb4b4b4)

Te6edf3_PY_SOCKET_RE Tff7b72= Te6edf3reTff7b72.Td2a8ffcompileTb4b4b4(Ta5d6ffrTa5d6ff"Ta5d6ff\Ta5d6ffbsocketTa5d6ff\Ta5d6ffbTa5d6ff"Tb4b4b4)

Te6edf3_PY_REQUESTS_RE Tff7b72= Te6edf3reTff7b72.Td2a8ffcompileTb4b4b4(Ta5d6ffrTa5d6ff"Ta5d6ff\Ta5d6ffbrequestsTa5d6ff\Ta5d6ffb|Ta5d6ff\Ta5d6ffburllibTa5d6ff\Ta5d6ff.requestTa5d6ff\Ta5d6ffbTa5d6ff"Tb4b4b4)

Te6edf3_SCAN_EXTENSIONS Tff7b72= Tffa657frozensetTb4b4b4(

Tb4b4b4{Ta5d6ff"Ta5d6ff.jsTa5d6ff"Tb4b4b4, Ta5d6ff"Ta5d6ff.mjsTa5d6ff"Tb4b4b4, Ta5d6ff"Ta5d6ff.jsonTa5d6ff"Tb4b4b4, Ta5d6ff"Ta5d6ff.wasmTa5d6ff"Tb4b4b4, Ta5d6ff"Ta5d6ff.tsTa5d6ff"Tb4b4b4, Ta5d6ff"Ta5d6ff.goTa5d6ff"Tb4b4b4, Ta5d6ff"Ta5d6ff.pyTa5d6ff"Tb4b4b4, Ta5d6ff"Ta5d6ff.watTa5d6ff"Tb4b4b4}Tb4b4b4,

Tb4b4b4)

Tf0883e@dataclass

Tff7b72class T56d364SecurityFindingTb4b4b4:

Tffa657idTb4b4b4: Tffa657str

Te6edf3severityTb4b4b4: Tffa657str

Te6edf3messageTb4b4b4: Tffa657str

Tff7b72def Td2a8ffto_dictTb4b4b4(Tff7b72selfTb4b4b4) Tff7b72-Tff7b72> Tffa657dictTb4b4b4[Tffa657strTb4b4b4, Tffa657strTb4b4b4]Tb4b4b4:

Tff7b72return Tb4b4b4{Ta5d6ff"Ta5d6ffidTa5d6ff"Tb4b4b4: Tff7b72selfTff7b72.Td2a8ffidTb4b4b4, Ta5d6ff"Ta5d6ffseverityTa5d6ff"Tb4b4b4: Tff7b72selfTff7b72.Td2a8ffseverityTb4b4b4, Ta5d6ff"Ta5d6ffmessageTa5d6ff"Tb4b4b4: Tff7b72selfTff7b72.Td2a8ffmessageTb4b4b4}

Tf0883e@dataclass

Tff7b72class T56d364SecurityAssessmentTb4b4b4:

Te6edf3risk_levelTb4b4b4: Tffa657str Tff7b72= Ta5d6ff"Ta5d6fflowTa5d6ff"

Te6edf3scoreTb4b4b4: Tffa657int Tff7b72= T79c0ff0

Te6edf3findingsTb4b4b4: Tffa657listTb4b4b4[Te6edf3SecurityFindingTb4b4b4] Tff7b72= Te6edf3fieldTb4b4b4(Te6edf3default_factoryTff7b72=Tffa657listTb4b4b4)

Tff7b72def Td2a8ffto_dictTb4b4b4(Tff7b72selfTb4b4b4) Tff7b72-Tff7b72> Tffa657dictTb4b4b4[Tffa657strTb4b4b4, Te6edf3AnyTb4b4b4]Tb4b4b4:

Tff7b72return Tb4b4b4{

Ta5d6ff"Ta5d6ffrisk_levelTa5d6ff"Tb4b4b4: Tff7b72selfTff7b72.Td2a8ffrisk_levelTb4b4b4,

Ta5d6ff"Ta5d6ffscoreTa5d6ff"Tb4b4b4: Tff7b72selfTff7b72.Td2a8ffscoreTb4b4b4,

Ta5d6ff"Ta5d6fffindingsTa5d6ff"Tb4b4b4: Tb4b4b4[Te6edf3itemTff7b72.Td2a8ffto_dictTb4b4b4(Tb4b4b4) Tff7b72for Te6edf3item Tff7b72in Tff7b72selfTff7b72.Td2a8fffindingsTb4b4b4]Tb4b4b4,

Tb4b4b4}

Tff7b72def Td2a8ffassess_pluginTb4b4b4(

Te6edf3manifestTb4b4b4: Tffa657dictTb4b4b4[Tffa657strTb4b4b4, Te6edf3AnyTb4b4b4]Tb4b4b4,

Te6edf3directoryTb4b4b4: Tffa657str Tff7b72= Ta5d6ff"Ta5d6ff"Tb4b4b4,

Te6edf3embeddedTb4b4b4: Tffa657dictTb4b4b4[Tffa657strTb4b4b4, Tffa657bytesTb4b4b4] Tff7b72| Tff7b72None Tff7b72= Tff7b72NoneTb4b4b4,

Te6edf3signatureTb4b4b4: Te6edf3SignatureInfo Tff7b72| Tff7b72None Tff7b72= Tff7b72NoneTb4b4b4,

Tb4b4b4) Tff7b72-Tff7b72> Te6edf3SecurityAssessmentTb4b4b4:

Te6edf3signature Tff7b72= Te6edf3signature Tff7b72or Te6edf3SignatureInfoTb4b4b4(Tb4b4b4)

Te6edf3findingsTb4b4b4: Tffa657listTb4b4b4[Te6edf3SecurityFindingTb4b4b4] Tff7b72= Tb4b4b4[Tb4b4b4]

Te6edf3score Tff7b72= T79c0ff0

Tff7b72def Td2a8ffaddTb4b4b4(Te6edf3finding_idTb4b4b4: Tffa657strTb4b4b4, Te6edf3severityTb4b4b4: Tffa657strTb4b4b4, Te6edf3messageTb4b4b4: Tffa657strTb4b4b4, Te6edf3pointsTb4b4b4: Tffa657intTb4b4b4) Tff7b72-Tff7b72> Tff7b72NoneTb4b4b4:

Tff7b72nonlocal Te6edf3score

Te6edf3findingsTff7b72.Td2a8ffappendTb4b4b4(

Te6edf3SecurityFindingTb4b4b4(Tffa657idTff7b72=Te6edf3finding_idTb4b4b4, Te6edf3severityTff7b72=Te6edf3severityTb4b4b4, Te6edf3messageTff7b72=Te6edf3messageTb4b4b4)Tb4b4b4,

Tb4b4b4)

Te6edf3score Tff7b72+Tff7b72= Te6edf3points

Tff7b72if Tff7b72not Tffa657strTb4b4b4(Te6edf3manifestTff7b72.Td2a8ffgetTb4b4b4(Ta5d6ff"Ta5d6ffidTa5d6ff"Tb4b4b4) Tff7b72or Ta5d6ff"Ta5d6ff"Tb4b4b4)Tff7b72.Td2a8ffstripTb4b4b4(Tb4b4b4)Tb4b4b4:

Te6edf3addTb4b4b4(Ta5d6ff"Ta5d6ffmissing-idTa5d6ff"Tb4b4b4, Ta5d6ff"Ta5d6ffhighTa5d6ff"Tb4b4b4, Ta5d6ff"Ta5d6ffplugin manifest is missing an idTa5d6ff"Tb4b4b4, T79c0ff40Tb4b4b4)

Tff7b72if Te6edf3signatureTff7b72.Td2a8ffpresent Tff7b72and Tff7b72not Te6edf3signatureTff7b72.Td2a8ffvalidTb4b4b4:

Te6edf3addTb4b4b4(

Ta5d6ff"Ta5d6ffinvalid-signatureTa5d6ff"Tb4b4b4,

Ta5d6ff"Ta5d6ffhighTa5d6ff"Tb4b4b4,

Ta5d6ff"Ta5d6ffplugin signature is present but invalidTa5d6ff"Tb4b4b4,

T79c0ff50Tb4b4b4,

Tb4b4b4)

Te6edf3declared Tff7b72= Te6edf3declared_permission_idsTb4b4b4(Te6edf3manifestTb4b4b4)

Te6edf3network_mode Tff7b72= Te6edf3normalize_network_modeTb4b4b4(

Tb4b4b4(Te6edf3manifestTff7b72.Td2a8ffgetTb4b4b4(Ta5d6ff"Ta5d6ffpermissionsTa5d6ff"Tb4b4b4) Tff7b72or Tb4b4b4{Tb4b4b4}Tb4b4b4)Tff7b72.Td2a8ffgetTb4b4b4(Ta5d6ff"Ta5d6ffnetworkTa5d6ff"Tb4b4b4)Tb4b4b4,

Tb4b4b4)

Te6edf3endpoints Tff7b72= Te6edf3collect_network_endpointsTb4b4b4(Te6edf3manifestTb4b4b4, Te6edf3directoryTb4b4b4) Tff7b72if Te6edf3directory Tff7b72else Tb4b4b4[Tb4b4b4]

Tff7b72if Te6edf3embeddedTb4b4b4:

Tff7b72for Te6edf3_pathTb4b4b4, Te6edf3data Tff7b72in Te6edf3embeddedTff7b72.Td2a8ffitemsTb4b4b4(Tb4b4b4)Tb4b4b4:

Tff7b72for Te6edf3url Tff7b72in Te6edf3extract_urls_from_textTb4b4b4(Te6edf3dataTff7b72.Td2a8ffdecodeTb4b4b4(Ta5d6ff"Ta5d6ffutf-8Ta5d6ff"Tb4b4b4, Te6edf3errorsTff7b72=Ta5d6ff"Ta5d6ffignoreTa5d6ff"Tb4b4b4)Tb4b4b4)Tb4b4b4:

Tff7b72if Te6edf3url Tff7b72not Tff7b72in Te6edf3endpointsTb4b4b4:

Te6edf3endpointsTff7b72.Td2a8ffappendTb4b4b4(Te6edf3urlTb4b4b4)

Tff7b72if Te6edf3network_mode Tff7b72== Ta5d6ff"Ta5d6fffetchTa5d6ff" Tff7b72and Tff7b72not Te6edf3signatureTff7b72.Td2a8ffvalidTb4b4b4:

Te6edf3addTb4b4b4(

Ta5d6ff"Ta5d6ffunsigned-networkTa5d6ff"Tb4b4b4,

Ta5d6ff"Ta5d6ffwarnTa5d6ff"Tb4b4b4,

Ta5d6ff"Ta5d6ffunsigned plugin requests outbound network accessTa5d6ff"Tb4b4b4,

T79c0ff20Tb4b4b4,

Tb4b4b4)

Tff7b72if Tffa657lenTb4b4b4(Te6edf3declaredTb4b4b4) Tff7b72>Tff7b72= T79c0ff6Tb4b4b4:

Te6edf3addTb4b4b4(Ta5d6ff"Ta5d6ffmany-permissionsTa5d6ff"Tb4b4b4, Ta5d6ff"Ta5d6ffwarnTa5d6ff"Tb4b4b4, Ta5d6ff"Ta5d6ffplugin requests many permissionsTa5d6ff"Tb4b4b4, T79c0ff10Tb4b4b4)

Tff7b72if Tffa657lenTb4b4b4(Te6edf3endpointsTb4b4b4) Tff7b72> T79c0ff15Tb4b4b4:

Te6edf3addTb4b4b4(

Ta5d6ff"Ta5d6ffmany-endpointsTa5d6ff"Tb4b4b4,

Ta5d6ff"Ta5d6ffwarnTa5d6ff"Tb4b4b4,

Ta5d6ff"Ta5d6ffplugin references many external network endpointsTa5d6ff"Tb4b4b4,

T79c0ff10Tb4b4b4,

Tb4b4b4)

Tff7b72if Te6edf3network_mode Tff7b72== Ta5d6ff"Ta5d6fffetchTa5d6ff"Tb4b4b4:

Te6edf3declared_endpointsTb4b4b4: Tffa657setTb4b4b4[Tffa657strTb4b4b4] Tff7b72= Tffa657setTb4b4b4(Tb4b4b4)

Te6edf3network Tff7b72= Te6edf3manifestTff7b72.Td2a8ffgetTb4b4b4(Ta5d6ff"Ta5d6ffnetworkTa5d6ff"Tb4b4b4) Tff7b72or Tb4b4b4{Tb4b4b4}

Tff7b72if Tffa657isinstanceTb4b4b4(Te6edf3networkTb4b4b4, Tffa657dictTb4b4b4)Tb4b4b4:

Tff7b72for Te6edf3endpoint Tff7b72in Te6edf3networkTff7b72.Td2a8ffgetTb4b4b4(Ta5d6ff"Ta5d6ffendpointsTa5d6ff"Tb4b4b4) Tff7b72or Tb4b4b4[Tb4b4b4]Tb4b4b4:

Tff7b72if Tffa657isinstanceTb4b4b4(Te6edf3endpointTb4b4b4, Tffa657strTb4b4b4)Tb4b4b4:

Te6edf3declared_endpointsTff7b72.Td2a8ffaddTb4b4b4(Te6edf3endpointTff7b72.Td2a8ffstripTb4b4b4(Tb4b4b4)Tb4b4b4)

Te6edf3declared_endpointsTff7b72.Td2a8ffupdateTb4b4b4(Te6edf3extract_urls_from_textTb4b4b4(Te6edf3endpointTb4b4b4)Tb4b4b4)

Tff7b72if Tffa657anyTb4b4b4(

Tb4b4b4(Te6edf3epTff7b72.Td2a8ffstartswithTb4b4b4(Ta5d6ff"Ta5d6ffhttp://Ta5d6ff"Tb4b4b4) Tff7b72or Te6edf3epTff7b72.Td2a8ffstartswithTb4b4b4(Ta5d6ff"Ta5d6ffhttps://Ta5d6ff"Tb4b4b4)Tb4b4b4)

Tff7b72and Te6edf3ep Tff7b72not Tff7b72in Te6edf3declared_endpoints

Tff7b72for Te6edf3ep Tff7b72in Te6edf3endpoints

Tb4b4b4)Tb4b4b4:

Te6edf3addTb4b4b4(

Ta5d6ff"Ta5d6ffundeclared-networkTa5d6ff"Tb4b4b4,

Ta5d6ff"Ta5d6ffwarnTa5d6ff"Tb4b4b4,

Ta5d6ff"Ta5d6ffplugin code references network endpoints not declared in the manifestTa5d6ff"Tb4b4b4,

T79c0ff15Tb4b4b4,

Tb4b4b4)

Tff7b72for Te6edf3pattern Tff7b72in Te6edf3_scan_suspicious_codeTb4b4b4(Te6edf3directoryTb4b4b4, Te6edf3embeddedTb4b4b4)Tb4b4b4:

Te6edf3addTb4b4b4(Te6edf3patternTb4b4b4[T79c0ff0Tb4b4b4]Tb4b4b4, Te6edf3patternTb4b4b4[T79c0ff1Tb4b4b4]Tb4b4b4, Te6edf3patternTb4b4b4[T79c0ff2Tb4b4b4]Tb4b4b4, Te6edf3patternTb4b4b4[T79c0ff3Tb4b4b4]Tb4b4b4)

Tff7b72if Te6edf3requires_network_fetchTb4b4b4(Te6edf3manifestTb4b4b4, Te6edf3endpointsTb4b4b4) Tff7b72and Tff7b72not Te6edf3declaredTb4b4b4:

Te6edf3addTb4b4b4(

Ta5d6ff"Ta5d6ffimplicit-networkTa5d6ff"Tb4b4b4,

Ta5d6ff"Ta5d6ffwarnTa5d6ff"Tb4b4b4,

Ta5d6ff"Ta5d6ffplugin appears to use network endpoints without declared permissionsTa5d6ff"Tb4b4b4,

T79c0ff10Tb4b4b4,

Tb4b4b4)

Te6edf3risk Tff7b72= Ta5d6ff"Ta5d6fflowTa5d6ff"

Tff7b72if Te6edf3score Tff7b72>Tff7b72= T79c0ff50Tb4b4b4:

Te6edf3risk Tff7b72= Ta5d6ff"Ta5d6ffhighTa5d6ff"

Tff7b72elif Te6edf3score Tff7b72>Tff7b72= T79c0ff20Tb4b4b4:

Te6edf3risk Tff7b72= Ta5d6ff"Ta5d6ffmediumTa5d6ff"

Tff7b72return Te6edf3SecurityAssessmentTb4b4b4(Te6edf3risk_levelTff7b72=Te6edf3riskTb4b4b4, Te6edf3scoreTff7b72=Te6edf3scoreTb4b4b4, Te6edf3findingsTff7b72=Te6edf3findingsTb4b4b4)

Tff7b72def Td2a8ffassess_sideband_scriptTb4b4b4(

Te6edf3pathTb4b4b4: Tffa657strTb4b4b4,

Te6edf3sourceTb4b4b4: Tffa657str Tff7b72| Tffa657bytesTb4b4b4,

Te6edf3signatureTb4b4b4: Te6edf3SignatureInfo Tff7b72| Tff7b72None Tff7b72= Tff7b72NoneTb4b4b4,

Tb4b4b4) Tff7b72-Tff7b72> Te6edf3SecurityAssessmentTb4b4b4:

Te6edf3signature Tff7b72= Te6edf3signature Tff7b72or Te6edf3SignatureInfoTb4b4b4(Tb4b4b4)

Tff7b72if Tffa657isinstanceTb4b4b4(Te6edf3sourceTb4b4b4, Tffa657bytesTb4b4b4)Tb4b4b4:

Te6edf3text Tff7b72= Te6edf3sourceTff7b72.Td2a8ffdecodeTb4b4b4(Ta5d6ff"Ta5d6ffutf-8Ta5d6ff"Tb4b4b4, Te6edf3errorsTff7b72=Ta5d6ff"Ta5d6ffignoreTa5d6ff"Tb4b4b4)

Tff7b72elseTb4b4b4:

Te6edf3text Tff7b72= Te6edf3source

Te6edf3findingsTb4b4b4: Tffa657listTb4b4b4[Te6edf3SecurityFindingTb4b4b4] Tff7b72= Tb4b4b4[Tb4b4b4]

Te6edf3score Tff7b72= T79c0ff0

Tff7b72def Td2a8ffaddTb4b4b4(Te6edf3finding_idTb4b4b4: Tffa657strTb4b4b4, Te6edf3severityTb4b4b4: Tffa657strTb4b4b4, Te6edf3messageTb4b4b4: Tffa657strTb4b4b4, Te6edf3pointsTb4b4b4: Tffa657intTb4b4b4) Tff7b72-Tff7b72> Tff7b72NoneTb4b4b4:

Tff7b72nonlocal Te6edf3score

Te6edf3findingsTff7b72.Td2a8ffappendTb4b4b4(

Te6edf3SecurityFindingTb4b4b4(Tffa657idTff7b72=Te6edf3finding_idTb4b4b4, Te6edf3severityTff7b72=Te6edf3severityTb4b4b4, Te6edf3messageTff7b72=Te6edf3messageTb4b4b4)Tb4b4b4,

Tb4b4b4)

Te6edf3score Tff7b72+Tff7b72= Te6edf3points

Te6edf3addTb4b4b4(

Ta5d6ff"Ta5d6ffsideband-full-accessTa5d6ff"Tb4b4b4,

Ta5d6ff"Ta5d6ffhighTa5d6ff"Tb4b4b4,

Ta5d6ff"Ta5d6ffSideband plugins run in-process with full host accessTa5d6ff"Tb4b4b4,

T79c0ff40Tb4b4b4,

Tb4b4b4)

Tff7b72if Te6edf3signatureTff7b72.Td2a8ffpresent Tff7b72and Tff7b72not Te6edf3signatureTff7b72.Td2a8ffvalidTb4b4b4:

Te6edf3addTb4b4b4(

Ta5d6ff"Ta5d6ffinvalid-signatureTa5d6ff"Tb4b4b4,

Ta5d6ff"Ta5d6ffhighTa5d6ff"Tb4b4b4,

Ta5d6fffTa5d6ff"Ta5d6ffSideband script signature is invalid for Tffd700{Te6edf3osTff7b72.Td2a8ffpathTff7b72.Td2a8ffbasenameTb4b4b4(Te6edf3pathTb4b4b4)Tffd700}Ta5d6ff"Tb4b4b4,

T79c0ff50Tb4b4b4,

Tb4b4b4)

Tff7b72if Te6edf3_PY_EVAL_RETff7b72.Td2a8ffsearchTb4b4b4(Te6edf3textTb4b4b4)Tb4b4b4:

Te6edf3addTb4b4b4(Ta5d6ff"Ta5d6ffpy-evalTa5d6ff"Tb4b4b4, Ta5d6ff"Ta5d6ffhighTa5d6ff"Tb4b4b4, Ta5d6ff"Ta5d6ffSideband script uses eval()Ta5d6ff"Tb4b4b4, T79c0ff25Tb4b4b4)

Tff7b72if Te6edf3_PY_EXEC_RETff7b72.Td2a8ffsearchTb4b4b4(Te6edf3textTb4b4b4)Tb4b4b4:

Te6edf3addTb4b4b4(Ta5d6ff"Ta5d6ffpy-execTa5d6ff"Tb4b4b4, Ta5d6ff"Ta5d6ffhighTa5d6ff"Tb4b4b4, Ta5d6ff"Ta5d6ffSideband script uses exec()Ta5d6ff"Tb4b4b4, T79c0ff25Tb4b4b4)

Tff7b72if Te6edf3_PY_SUBPROCESS_RETff7b72.Td2a8ffsearchTb4b4b4(Te6edf3textTb4b4b4)Tb4b4b4:

Te6edf3addTb4b4b4(Ta5d6ff"Ta5d6ffpy-subprocessTa5d6ff"Tb4b4b4, Ta5d6ff"Ta5d6ffwarnTa5d6ff"Tb4b4b4, Ta5d6ff"Ta5d6ffSideband script references subprocessTa5d6ff"Tb4b4b4, T79c0ff15Tb4b4b4)

Tff7b72if Te6edf3_PY_SOCKET_RETff7b72.Td2a8ffsearchTb4b4b4(Te6edf3textTb4b4b4)Tb4b4b4:

Te6edf3addTb4b4b4(Ta5d6ff"Ta5d6ffpy-socketTa5d6ff"Tb4b4b4, Ta5d6ff"Ta5d6ffwarnTa5d6ff"Tb4b4b4, Ta5d6ff"Ta5d6ffSideband script references socketTa5d6ff"Tb4b4b4, T79c0ff15Tb4b4b4)

Tff7b72if Te6edf3_PY_REQUESTS_RETff7b72.Td2a8ffsearchTb4b4b4(Te6edf3textTb4b4b4)Tb4b4b4:

Te6edf3addTb4b4b4(

Ta5d6ff"Ta5d6ffpy-networkTa5d6ff"Tb4b4b4,

Ta5d6ff"Ta5d6ffwarnTa5d6ff"Tb4b4b4,

Ta5d6ff"Ta5d6ffSideband script references outbound HTTP librariesTa5d6ff"Tb4b4b4,

T79c0ff15Tb4b4b4,

Tb4b4b4)

Te6edf3risk Tff7b72= Ta5d6ff"Ta5d6fflowTa5d6ff"

Tff7b72if Te6edf3score Tff7b72>Tff7b72= T79c0ff50Tb4b4b4:

Te6edf3risk Tff7b72= Ta5d6ff"Ta5d6ffhighTa5d6ff"

Tff7b72elif Te6edf3score Tff7b72>Tff7b72= T79c0ff20Tb4b4b4:

Te6edf3risk Tff7b72= Ta5d6ff"Ta5d6ffmediumTa5d6ff"

Tff7b72return Te6edf3SecurityAssessmentTb4b4b4(Te6edf3risk_levelTff7b72=Te6edf3riskTb4b4b4, Te6edf3scoreTff7b72=Te6edf3scoreTb4b4b4, Te6edf3findingsTff7b72=Te6edf3findingsTb4b4b4)

Tff7b72def Td2a8ff_scan_suspicious_codeTb4b4b4(

Te6edf3directoryTb4b4b4: Tffa657strTb4b4b4,

Te6edf3embeddedTb4b4b4: Tffa657dictTb4b4b4[Tffa657strTb4b4b4, Tffa657bytesTb4b4b4] Tff7b72| Tff7b72NoneTb4b4b4,

Tb4b4b4) Tff7b72-Tff7b72> Tffa657listTb4b4b4[Tffa657tupleTb4b4b4[Tffa657strTb4b4b4, Tffa657strTb4b4b4, Tffa657strTb4b4b4, Tffa657intTb4b4b4]Tb4b4b4]Tb4b4b4:

Te6edf3seenTb4b4b4: Tffa657setTb4b4b4[Tffa657strTb4b4b4] Tff7b72= Tffa657setTb4b4b4(Tb4b4b4)

Te6edf3outTb4b4b4: Tffa657listTb4b4b4[Tffa657tupleTb4b4b4[Tffa657strTb4b4b4, Tffa657strTb4b4b4, Tffa657strTb4b4b4, Tffa657intTb4b4b4]Tb4b4b4] Tff7b72= Tb4b4b4[Tb4b4b4]

Tff7b72def Td2a8ffrecordTb4b4b4(Te6edf3finding_idTb4b4b4: Tffa657strTb4b4b4, Te6edf3severityTb4b4b4: Tffa657strTb4b4b4, Te6edf3messageTb4b4b4: Tffa657strTb4b4b4, Te6edf3pointsTb4b4b4: Tffa657intTb4b4b4) Tff7b72-Tff7b72> Tff7b72NoneTb4b4b4:

Tff7b72if Te6edf3finding_id Tff7b72in Te6edf3seenTb4b4b4:

Tff7b72return

Te6edf3seenTff7b72.Td2a8ffaddTb4b4b4(Te6edf3finding_idTb4b4b4)

Te6edf3outTff7b72.Td2a8ffappendTb4b4b4(Tb4b4b4(Te6edf3finding_idTb4b4b4, Te6edf3severityTb4b4b4, Te6edf3messageTb4b4b4, Te6edf3pointsTb4b4b4)Tb4b4b4)

Tff7b72def Td2a8ffscan_textTb4b4b4(Te6edf3pathTb4b4b4: Tffa657strTb4b4b4, Te6edf3textTb4b4b4: Tffa657strTb4b4b4) Tff7b72-Tff7b72> Tff7b72NoneTb4b4b4:

Te6edf3lower_path Tff7b72= Te6edf3pathTff7b72.Td2a8fflowerTb4b4b4(Tb4b4b4)

Tff7b72if Te6edf3lower_pathTff7b72.Td2a8ffendswithTb4b4b4(Ta5d6ff"Ta5d6ff.pyTa5d6ff"Tb4b4b4)Tb4b4b4:

Tff7b72if Te6edf3_PY_EVAL_RETff7b72.Td2a8ffsearchTb4b4b4(Te6edf3textTb4b4b4)Tb4b4b4:

Te6edf3recordTb4b4b4(Ta5d6ff"Ta5d6ffpy-evalTa5d6ff"Tb4b4b4, Ta5d6ff"Ta5d6ffhighTa5d6ff"Tb4b4b4, Ta5d6ff"Ta5d6ffplugin Python uses eval()Ta5d6ff"Tb4b4b4, T79c0ff25Tb4b4b4)

Tff7b72if Te6edf3_PY_EXEC_RETff7b72.Td2a8ffsearchTb4b4b4(Te6edf3textTb4b4b4)Tb4b4b4:

Te6edf3recordTb4b4b4(Ta5d6ff"Ta5d6ffpy-execTa5d6ff"Tb4b4b4, Ta5d6ff"Ta5d6ffhighTa5d6ff"Tb4b4b4, Ta5d6ff"Ta5d6ffplugin Python uses exec()Ta5d6ff"Tb4b4b4, T79c0ff25Tb4b4b4)

Tff7b72if Te6edf3_PY_SUBPROCESS_RETff7b72.Td2a8ffsearchTb4b4b4(Te6edf3textTb4b4b4)Tb4b4b4:

Te6edf3recordTb4b4b4(

Ta5d6ff"Ta5d6ffpy-subprocessTa5d6ff"Tb4b4b4,

Ta5d6ff"Ta5d6ffwarnTa5d6ff"Tb4b4b4,

Ta5d6ff"Ta5d6ffplugin Python references subprocessTa5d6ff"Tb4b4b4,

T79c0ff15Tb4b4b4,

Tb4b4b4)

Tff7b72if Te6edf3_PY_SOCKET_RETff7b72.Td2a8ffsearchTb4b4b4(Te6edf3textTb4b4b4)Tb4b4b4:

Te6edf3recordTb4b4b4(Ta5d6ff"Ta5d6ffpy-socketTa5d6ff"Tb4b4b4, Ta5d6ff"Ta5d6ffwarnTa5d6ff"Tb4b4b4, Ta5d6ff"Ta5d6ffplugin Python references socketTa5d6ff"Tb4b4b4, T79c0ff15Tb4b4b4)

Tff7b72return

Tff7b72if Te6edf3_JS_EVAL_RETff7b72.Td2a8ffsearchTb4b4b4(Te6edf3textTb4b4b4)Tb4b4b4:

Te6edf3recordTb4b4b4(Ta5d6ff"Ta5d6ffjs-evalTa5d6ff"Tb4b4b4, Ta5d6ff"Ta5d6ffhighTa5d6ff"Tb4b4b4, Ta5d6ff"Ta5d6ffplugin JavaScript uses eval()Ta5d6ff"Tb4b4b4, T79c0ff25Tb4b4b4)

Tff7b72if Te6edf3_JS_FUNCTION_CTOR_RETff7b72.Td2a8ffsearchTb4b4b4(Te6edf3textTb4b4b4)Tb4b4b4:

Te6edf3recordTb4b4b4(

Ta5d6ff"Ta5d6ffjs-function-ctorTa5d6ff"Tb4b4b4,

Ta5d6ff"Ta5d6ffwarnTa5d6ff"Tb4b4b4,

Ta5d6ff"Ta5d6ffplugin JavaScript uses the Function constructorTa5d6ff"Tb4b4b4,

T79c0ff15Tb4b4b4,

Tb4b4b4)

Tff7b72if Te6edf3_JS_ATOB_RETff7b72.Td2a8ffsearchTb4b4b4(Te6edf3textTb4b4b4)Tb4b4b4:

Te6edf3recordTb4b4b4(

Ta5d6ff"Ta5d6ffjs-atobTa5d6ff"Tb4b4b4,

Ta5d6ff"Ta5d6ffwarnTa5d6ff"Tb4b4b4,

Ta5d6ff"Ta5d6ffplugin JavaScript uses atob() which may decode obfuscated payloadsTa5d6ff"Tb4b4b4,

T79c0ff10Tb4b4b4,

Tb4b4b4)

Tff7b72if Te6edf3_JS_DOC_WRITE_RETff7b72.Td2a8ffsearchTb4b4b4(Te6edf3textTb4b4b4)Tb4b4b4:

Te6edf3recordTb4b4b4(

Ta5d6ff"Ta5d6ffjs-document-writeTa5d6ff"Tb4b4b4,

Ta5d6ff"Ta5d6ffwarnTa5d6ff"Tb4b4b4,

Ta5d6ff"Ta5d6ffplugin JavaScript uses document.write()Ta5d6ff"Tb4b4b4,

T79c0ff10Tb4b4b4,

Tb4b4b4)

Tff7b72if Te6edf3embeddedTb4b4b4:

Tff7b72for Te6edf3pathTb4b4b4, Te6edf3data Tff7b72in Te6edf3embeddedTff7b72.Td2a8ffitemsTb4b4b4(Tb4b4b4)Tb4b4b4:

Te6edf3scan_textTb4b4b4(Te6edf3pathTb4b4b4, Te6edf3dataTff7b72.Td2a8ffdecodeTb4b4b4(Ta5d6ff"Ta5d6ffutf-8Ta5d6ff"Tb4b4b4, Te6edf3errorsTff7b72=Ta5d6ff"Ta5d6ffignoreTa5d6ff"Tb4b4b4)Tb4b4b4)

Tff7b72if Te6edf3directory Tff7b72and Te6edf3osTff7b72.Td2a8ffpathTff7b72.Td2a8ffisdirTb4b4b4(Te6edf3directoryTb4b4b4)Tb4b4b4:

Tff7b72for Te6edf3rootTb4b4b4, Te6edf3_dirsTb4b4b4, Te6edf3files Tff7b72in Te6edf3osTff7b72.Td2a8ffwalkTb4b4b4(Te6edf3directoryTb4b4b4)Tb4b4b4:

Tff7b72for Te6edf3name Tff7b72in Te6edf3filesTb4b4b4:

Te6edf3path Tff7b72= Te6edf3osTff7b72.Td2a8ffpathTff7b72.Td2a8ffjoinTb4b4b4(Te6edf3rootTb4b4b4, Te6edf3nameTb4b4b4)

Te6edf3_Tb4b4b4, Te6edf3ext Tff7b72= Te6edf3osTff7b72.Td2a8ffpathTff7b72.Td2a8ffsplitextTb4b4b4(Te6edf3nameTff7b72.Td2a8fflowerTb4b4b4(Tb4b4b4)Tb4b4b4)

Tff7b72if Te6edf3ext Tff7b72not Tff7b72in Te6edf3_SCAN_EXTENSIONSTb4b4b4:

Tff7b72continue

Tff7b72tryTb4b4b4:

Tff7b72with Tffa657openTb4b4b4(Te6edf3pathTb4b4b4, Ta5d6ff"Ta5d6ffrbTa5d6ff"Tb4b4b4) Tff7b72as Te6edf3handleTb4b4b4:

Te6edf3data Tff7b72= Te6edf3handleTff7b72.Td2a8ffreadTb4b4b4(T79c0ff2_000_000Tb4b4b4)

Tff7b72except Tf85149OSErrorTb4b4b4:

Tff7b72continue

Te6edf3scan_textTb4b4b4(Te6edf3pathTb4b4b4, Te6edf3dataTff7b72.Td2a8ffdecodeTb4b4b4(Ta5d6ff"Ta5d6ffutf-8Ta5d6ff"Tb4b4b4, Te6edf3errorsTff7b72=Ta5d6ff"Ta5d6ffignoreTa5d6ff"Tb4b4b4)Tb4b4b4)

Tff7b72return Te6edf3out