Can Pysa work on Fastapi. Its fully type-hinted using pydantic
Pysa: An open source tool to detect and prevent security issues in Python code
21–28 of 28 posts
Re: Pysa: An open source tool to detect and prevent security issues in Python code
#22Re: Pysa: An open source tool to detect and prevent security issues in Python code
#23Re: Pysa: An open source tool to detect and prevent security issues in Python code
#24One of the authors of the blog post and software engineer working on Pysa here - happy to answer any questions you may have :)
It seems one of the major downfalls is that the user has to define all sources and sinks. I might have missed it but how do you systematically define/find these? Personally was interested in a similar topic for a thesis and stumbled upon deepcode.ai which started out of ETH Zurich (https://files.sri.inf.ethz.ch/website/papers/scalable-taint-...). Are there any plans or reasons why you would not want such a system?
Re: Pysa: An open source tool to detect and prevent security issues in Python code
#25One of the authors of the blog post and software engineer working on Pysa here - happy to answer any questions you may have :)
You guys use OCaml? Why?
Re: Pysa: An open source tool to detect and prevent security issues in Python code
#26One of the authors of the blog post and software engineer working on Pysa here - happy to answer any questions you may have :)
It seems one of the major downfalls is that the user has to define all sources and sinks. I might have missed it but how do you systematically define/find these? Personally was interested in a similar topic for a thesis and stumbled upon deepcode.ai which started out of ETH Zurich ( https://files.sri.inf.ethz.ch/website/papers/scalable-taint-... ). Are there any plans or reasons why you would not want such a system?
The article briefly mentions this, although it might not be super clear from the short description - "We regularly review issues reported through other avenues, such as our bug bounty program, to ensure that we correct any false negatives." We rely on these mechanisms to find places where we're missing taint coverage and write sources and sinks as necessary. As of right now, all the annotations are manual.
I hadn't looked too deeply into the literature there, the paper looks really interesting! We don't have any concrete plans to implement such a system, but I don't think there's any fundamental reason we wouldn't want automatic taint model generation. I'll give the paper a read on Monday to learn more :)
Re: Pysa: An open source tool to detect and prevent security issues in Python code
#27One of the authors of the blog post and software engineer working on Pysa here - happy to answer any questions you may have :)
You guys use OCaml? Why?
The reasons turn out to be decently boring here. Zoncolan [0] and Pyre [1], which Pysa shares core libraries with, are also written in OCaml, and the language made sense to use from the perspective of both sharing code and having people who are proficient and comfortable writing in OCaml working on the project.
Re: Pysa: An open source tool to detect and prevent security issues in Python code
#28One of the authors of the blog post and software engineer working on Pysa here - happy to answer any questions you may have :)
Can the CSS be fixed so that the right side of the text fit in the window? https://imgur.com/a/hnRpLZH