Pysa: An open source tool to detect and prevent security issues in Python code
1–10 of 28 posts
Re: Pysa: An open source tool to detect and prevent security issues in Python code
#2One of the authors of the blog post and software engineer working on Pysa here - happy to answer any questions you may have :)
Re: Pysa: An open source tool to detect and prevent security issues in Python code
#3This seems like a good idea and the more open source static analyzers the better. (It really tempts me to eventually pay for GitLab high versions.)
Pysa is part of pyre-check and the documentation [0] seems like a lot of work to set up and hope it gets better.
I’m using to using safety [1] and bandit [2] and they are one line drop ins to my builds.
Pysa isn’t the same thing and seems much more powerful but I hope they get to a “Just give me something useful out of the box and I’ll customize my taint scans later.”
[0] https://pyre-check.org/docs/pysa-running [1] https://pypi.org/project/safety/ [2] https://pypi.org/project/bandit/
Re: Pysa: An open source tool to detect and prevent security issues in Python code
#4One of the authors of the blog post and software engineer working on Pysa here - happy to answer any questions you may have :)
Hi,
I have 2 questions:
1. The installation doc specified `watchman` as a dependency. Why is that used? without watchman, would pysa not work?
2. Also, why can the pysa become a separate stand alone tool instead of living in the pyre Github repo?
Re: Pysa: An open source tool to detect and prevent security issues in Python code
#5One of the authors of the blog post and software engineer working on Pysa here - happy to answer any questions you may have :)
Hi, I have 2 questions: 1. The installation doc specified `watchman` as a dependency. Why is that used? without watchman, would pysa not work? 2. Also, why can the pysa become a separate stand alone tool instead of living in the pyre Github repo?
1. Pysa should work without watchman - it shares some code and infrastructure with Pyre, but doesn't need Watchman to complete its analysis.
2. Hopefully the answer to (1) helps here. Pysa shares some code with Pyre, including the parallelization infrastructure - the same infrastructure that makes Pyre fast interactively makes Pysa fast on large codebases. Living on the Pyre GitHub repo allows Pysa to use the parallelization infra, in addition to the type checking APIs of Pyre as necessary.
See also our original post introducing Pyre - our goal from the outset was to build a platform for deeper static analyses: https://www.facebook.com/notes/protect-the-graph/pyre-fast-t...
Re: Pysa: An open source tool to detect and prevent security issues in Python code
#6One of the authors of the blog post and software engineer working on Pysa here - happy to answer any questions you may have :)
Does Pysa require the code to be fully type hinted? or will it work on non-type hinted code also?
Re: Pysa: An open source tool to detect and prevent security issues in Python code
#7One of the authors of the blog post and software engineer working on Pysa here - happy to answer any questions you may have :)
Does Pysa require the code to be fully type hinted? or will it work on non-type hinted code also?
Pysa will try to analyze all functions regardless of whether they have type hints, but it work better if the function under consideration is typed. Namely, without type hints, it won't be able to pick up on tainted method calls or attribute accesses. However, regular function calls, etc. and standard data structures like dicts and lists should still be tracked normally.
Re: Pysa: An open source tool to detect and prevent security issues in Python code
#8[deleted]
Re: Pysa: An open source tool to detect and prevent security issues in Python code
#9One of the authors of the blog post and software engineer working on Pysa here - happy to answer any questions you may have :)
How fast does Pysa typically run? If I want to run it as part of my CI system, how much additional time might I expect it to add? Obviously this varies from code base to code base, but I'm curious what the experience at Instagram is like?
Re: Pysa: An open source tool to detect and prevent security issues in Python code
#10One of the authors of the blog post and software engineer working on Pysa here - happy to answer any questions you may have :)
How fast does Pysa typically run? If I want to run it as part of my CI system, how much additional time might I expect it to add? Obviously this varies from code base to code base, but I'm curious what the experience at Instagram is like?
For Instagram (millions of LOC), the analysis gives feedback to engineers in about 65 minutes on average - note that this is in the context of a diff run: We compare the results of a run on the base revision to the proposed changes, running the tool once or twice depending on whether we hit the cache. It's hard to say how long it'll take on your repository as it depends on a lot of factors, but hopefully that provides some intuition.