advanced-threat-research/creosote

Creosote is our solution to searching for the tarfile vulnerability described by CVE-2007-4559.

creosote's Issues

Just use Bandit or Semgrep

Hi,

Instead of creating yet another scanning tool (in order to spam repositories and get publicity), you could have used existing free and open source tools like Bandit or Semgrep.

support for older python versions

There are several widely used distros that don't have python 3.9, and it doesn't seem to work with even 3.8 never mind even older.

On Ubuntu 18.04 with python 3.6.9 and
on ubuntu 20.04 with python 3.8.10

Starting scan of:/
Scanning for Vulnerabilities:
Traceback (most recent call last):
File "creosote.py", line 226, in
main()
File "creosote.py", line 206, in main
scan(directory)
File "creosote.py", line 50, in scan
analyzer = Analyzer(filename, text)
File "creosote.py", line 83, in init
self.visit(root)
File "/usr/lib/python3.6/ast.py", line 253, in visit
return visitor(node)
File "/usr/lib/python3.6/ast.py", line 261, in generic_visit
self.visit(item)
File "/usr/lib/python3.6/ast.py", line 253, in visit
return visitor(node)
File "/usr/lib/python3.6/ast.py", line 261, in generic_visit
self.visit(item)
File "/usr/lib/python3.6/ast.py", line 253, in visit
return visitor(node)
File "/usr/lib/python3.6/ast.py", line 261, in generic_visit
self.visit(item)
File "/usr/lib/python3.6/ast.py", line 253, in visit
return visitor(node)
File "/usr/lib/python3.6/ast.py", line 261, in generic_visit
self.visit(item)
File "/usr/lib/python3.6/ast.py", line 253, in visit
return visitor(node)
File "/usr/lib/python3.6/ast.py", line 263, in generic_visit
self.visit(value)
File "/usr/lib/python3.6/ast.py", line 253, in visit
return visitor(node)
File "/usr/lib/python3.6/ast.py", line 263, in generic_visit
self.visit(value)
File "/usr/lib/python3.6/ast.py", line 253, in visit
return visitor(node)
File "creosote.py", line 132, in visit_Attribute
if ".getmembers()" in ast.unparse(for_node.iter) and for_node.parent.body:
AttributeError: module 'ast' has no attribute 'unparse'

cp950 codec runtime error on Windows platform

Error reading file:{file}
                        'cp950' codec can't decode byte 0xe5 in position {number}: illegal multibyte sequence