Skip to content

Commit e6b794e

Browse files
nocomplexitynocomplexity
committed
doc update
1 parent 634f888 commit e6b794e

6 files changed

Lines changed: 218 additions & 22 deletions

File tree

‎docs/_toc.yml‎

Lines changed: 3 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -10,7 +10,9 @@ parts:
1010
- file: whatissast
1111
- file: whysast
1212
- url: https://securitytesting.nocomplexity.com/
13-
title: Mastering Security Testing for Python
13+
title: Security Testing for Python
14+
- url: http://securitybydesign.nocomplexity.com/
15+
title: Security By Design
1416

1517

1618

‎docs/codeauditcommands.md‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -1,6 +1,6 @@
11
% THIS FILE IS GENERATED! - Use CLIcommands.ipynb to make it better!
22
# Commands Overview
3-
Python Code Audit commands for: version: 1.6.5
3+
Python Code Audit commands for: version: 1.6.6
44
```
55
----------------------------------------------------
66
_ __ _

‎docs/examples/codeauditchecks.html‎

Lines changed: 22 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -252,10 +252,28 @@
252252
<td>Assertions are for debugging and development. Assertions can be disabled during runtime. Use in production can introduce vulnerabilities.</td>
253253
</tr>
254254
<tr>
255-
<td>Base64 Encoding</td>
256-
<td>base64</td>
255+
<td>Base64 Decoding</td>
256+
<td>base64.b64decode</td>
257+
<td>Medium</td>
258+
<td>Base64 encoding/decoding is not for security. It only visually hides data and provides no confidentiality. Often used to obfuscate malware in code.</td>
259+
</tr>
260+
<tr>
261+
<td>Base64 Decoding</td>
262+
<td>base64.b64encode</td>
257263
<td>Low</td>
258-
<td>Base64 encoding is not for security. It only visually hides data and provides no confidentiality. Often used to obfuscate malware in code.</td>
264+
<td>Base64 encoding/decoding is not for security. It only visually hides data and provides no confidentiality. Often used to obfuscate malware in code.</td>
265+
</tr>
266+
<tr>
267+
<td>Base64 Decoding</td>
268+
<td>base64.b85encode</td>
269+
<td>Low</td>
270+
<td>Base64 encoding/decoding is not for security. It only visually hides data and provides no confidentiality. Often used to obfuscate malware in code.</td>
271+
</tr>
272+
<tr>
273+
<td>Base64 Decoding</td>
274+
<td>base64.z85decode</td>
275+
<td>Medium</td>
276+
<td>Base64 encoding/decoding is not for security. It only visually hides data and provides no confidentiality. Often used to obfuscate malware in code.</td>
259277
</tr>
260278
<tr>
261279
<td>BZ2 File Handling</td>
@@ -744,4 +762,4 @@
744762
<td>Vulnerable to path traversal attacks if used with untrusted archives.</td>
745763
</tr>
746764
</tbody>
747-
</table><br><p>Number of implemented security validations:<b>84</b></p><p>Version of codeaudit: <b>1.6.5</b><p>Because Python and cybersecurity are constantly changing, issue reports <b>SHOULD</b> specify the codeaudit version used.</p><p><b>Disclaimer:</b> <i>This SAST tool <a href="https://github.com/nocomplexity/codeaudit" target="_blank"><b>Python Code Audit</b></a> provides a powerful, automatic security analysis for Python source code. However, it's not a substitute for human review in combination with business knowledge. Undetected vulnerabilities may still exist.</i></p><p>This Python security report was created on: <b>2026-05-11 16:42</b> with <a href="https://github.com/nocomplexity/codeaudit" target="_blank"><b>Python Code Audit</b></a> version <b>1.6.5</b></p><hr><footer><div class="footer-links">Check the <a href="https://nocomplexity.com/documents/codeaudit/intro.html" target="_blank">documentation</a> for help on found issues.<br>Codeaudit is made with <span class="heart">&#10084;</span> by cyber security professionals who advocate for <a href="https://nocomplexity.com/simplify-security/" target="_blank">open simple security solutions</a>.<br><a href="https://nocomplexity.com/documents/codeaudit/CONTRIBUTE.html" target="_blank">Join the community</a> and contribute to make this tool better!</div></footer></div></body></html>
765+
</table><br><p>Number of implemented security validations:<b>87</b></p><p>Version of codeaudit: <b>1.6.6</b><p>Because Python and cybersecurity are constantly changing, issue reports <b>SHOULD</b> specify the codeaudit version used.</p><p><b>Disclaimer:</b> <i>This SAST tool <a href="https://github.com/nocomplexity/codeaudit" target="_blank"><b>Python Code Audit</b></a> provides a powerful, automatic security analysis for Python source code. However, it's not a substitute for human review in combination with business knowledge. Undetected vulnerabilities may still exist.</i></p><p>This Python security report was created on: <b>2026-05-19 16:06</b> with <a href="https://github.com/nocomplexity/codeaudit" target="_blank"><b>Python Code Audit</b></a> version <b>1.6.6</b></p><hr><footer><div class="footer-links">Check the <a href="https://nocomplexity.com/documents/codeaudit/intro.html" target="_blank">documentation</a> for help on found issues.<br>Codeaudit is made with <span class="heart">&#10084;</span> by cyber security professionals who advocate for <a href="https://nocomplexity.com/simplify-security/" target="_blank">open simple security solutions</a>.<br><a href="https://nocomplexity.com/documents/codeaudit/CONTRIBUTE.html" target="_blank">Join the community</a> and contribute to make this tool better!</div></footer></div></body></html>

‎docs/examples/demoscan.json‎

Lines changed: 16 additions & 16 deletions
Original file line numberDiff line numberDiff line change
@@ -1,7 +1,7 @@
11
{
22
"name": "Python_Code_Audit",
3-
"version": "1.6.5",
4-
"generated_on": "2026-05-11 16:42",
3+
"version": "1.6.6",
4+
"generated_on": "2026-05-19 16:06",
55
"file_security_info": {
66
"0": {
77
"FileName": "demofile.py",
@@ -212,6 +212,20 @@
212212
"info": "This function can be used to execute arbitrary code or crash the Python interpreter.",
213213
"code": "<pre><code class='language-python'>compile(&#x27;nasty-string&#x27; ,&#x27;malware.bin&#x27;,mode=single, flags=0, dont_inherit=False, optimize=-1)</code></pre>"
214214
},
215+
"238": {
216+
"line": 238,
217+
"validation": "base64.b64encode",
218+
"severity": "Low",
219+
"info": "Base64 encoding/decoding is not for security. It only visually hides data and provides no confidentiality. Often used to obfuscate malware in code.",
220+
"code": "<pre><code class='language-python'>import base64\nencoded = base64.b64encode(b&#x27;data to be encoded&#x27;)\ndata = base64.b64decode(encoded)</code></pre>"
221+
},
222+
"239": {
223+
"line": 239,
224+
"validation": "base64.b64decode",
225+
"severity": "Medium",
226+
"info": "Base64 encoding/decoding is not for security. It only visually hides data and provides no confidentiality. Often used to obfuscate malware in code.",
227+
"code": "<pre><code class='language-python'>encoded = base64.b64encode(b&#x27;data to be encoded&#x27;)\ndata = base64.b64decode(encoded)</code></pre>"
228+
},
215229
"244": {
216230
"line": 244,
217231
"validation": "http.server.BaseHTTPRequestHandler",
@@ -459,20 +473,6 @@
459473
"info": "Parsing untrusted logging configurations can lead to vulnerabilities if not handled correctly.",
460474
"code": "<pre><code class='language-python'>logging.config.fileConfig(fname, defaults=None, disable_existing_loggers=True, encoding=None)\n#&lt;END LOGGING checks&gt;</code></pre>"
461475
},
462-
"238": {
463-
"line": 238,
464-
"validation": "base64",
465-
"severity": "Low",
466-
"info": "Base64 encoding is not for security. It only visually hides data and provides no confidentiality. Often used to obfuscate malware in code.",
467-
"code": "<pre><code class='language-python'>import base64\nencoded = base64.b64encode(b&#x27;data to be encoded&#x27;)\ndata = base64.b64decode(encoded)</code></pre>"
468-
},
469-
"239": {
470-
"line": 239,
471-
"validation": "base64",
472-
"severity": "Low",
473-
"info": "Base64 encoding is not for security. It only visually hides data and provides no confidentiality. Often used to obfuscate malware in code.",
474-
"code": "<pre><code class='language-python'>encoded = base64.b64encode(b&#x27;data to be encoded&#x27;)\ndata = base64.b64decode(encoded)</code></pre>"
475-
},
476476
"316": {
477477
"line": 316,
478478
"validation": "pickle.load",

‎src/dashboard/module_load_validation.html‎

Lines changed: 64 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,64 @@
1+
<!DOCTYPE html>
2+
<html lang="en">
3+
<head>
4+
<meta charset="UTF-8">
5+
<meta name="viewport" content="width=device-width, initial-scale=1.0">
6+
<title>Pyodide - Test codeaudit (WASM dashboard)</title>
7+
<script src="https://cdn.jsdelivr.net/pyodide/v0.29.4/full/pyodide.js"></script>
8+
<style>
9+
body { font-family: Arial, sans-serif; padding: 20px; }
10+
pre { background: #f4f4f4; padding: 10px; border-radius: 5px; }
11+
button { padding: 10px 16px; font-size: 16px; }
12+
</style>
13+
</head>
14+
<body>
15+
<h1>Testing your <code>codeaudit</code> package in Pyodide</h1>
16+
<button onclick="runTest()">Install & Test codeaudit</button>
17+
<pre id="output"></pre>
18+
19+
<script>
20+
async function runTest() {
21+
const output = document.getElementById("output");
22+
output.textContent = "Loading Pyodide...\n";
23+
24+
try {
25+
// Load Pyodide
26+
let pyodide = await loadPyodide({
27+
indexURL: "https://cdn.jsdelivr.net/pyodide/v0.29.4/full/"
28+
});
29+
30+
output.textContent += "Pyodide loaded successfully.\n";
31+
output.textContent += "Loading micropip...\n";
32+
33+
await pyodide.loadPackage("micropip");
34+
const micropip = pyodide.pyimport("micropip");
35+
36+
output.textContent += "Installing codeaudit from PyPI...\n";
37+
38+
// Install your package
39+
await micropip.install("codeaudit");
40+
41+
output.textContent += "✅ codeaudit installed successfully!\n\n";
42+
43+
// Run Python code to test it
44+
await pyodide.runPythonAsync(`
45+
import codeaudit
46+
print("Package imported successfully!")
47+
print("Version:", codeaudit.__version__ if hasattr(codeaudit, "__version__") else "Unknown")
48+
49+
# Add any basic test calls here
50+
# Example:
51+
# result = codeaudit.scan("example")
52+
# print(result)
53+
`);
54+
55+
output.textContent += "All tests passed! 🎉\n";
56+
57+
} catch (err) {
58+
output.textContent += "❌ Error: " + err.message + "\n";
59+
console.error(err);
60+
}
61+
}
62+
</script>
63+
</body>
64+
</html>

‎src/dashboard/module_load_validation2.html‎

Lines changed: 112 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,112 @@
1+
<!DOCTYPE html>
2+
<html lang="en">
3+
<head>
4+
<meta charset="UTF-8">
5+
<meta name="viewport" content="width=device-width, initial-scale=1.0">
6+
<title>Pyodide - Test codeaudit</title>
7+
<script src="https://cdn.jsdelivr.net/pyodide/v0.29.4/full/pyodide.js"></script>
8+
<style>
9+
body { font-family: Arial, sans-serif; padding: 20px; line-height: 1.6; }
10+
pre { background: #f4f4f4; padding: 12px; border-radius: 6px; overflow-x: auto; max-height: 500px; }
11+
button { padding: 10px 18px; font-size: 16px; margin: 5px; cursor: pointer; }
12+
h1 { color: #333; }
13+
.success { color: green; }
14+
.error { color: red; }
15+
</style>
16+
</head>
17+
<body>
18+
<h1>Pyodide Test Environment — <code>codeaudit</code></h1>
19+
20+
<button onclick="installAndTest()">1. Install & Test codeaudit</button>
21+
<button onclick="listPackages()">2. List All Installed Packages</button>
22+
<button onclick="clearOutput()">Clear Output</button>
23+
24+
<pre id="output">Click a button to start...</pre>
25+
26+
<script>
27+
let pyodideInstance = null;
28+
29+
async function getPyodide() {
30+
const output = document.getElementById("output");
31+
if (!pyodideInstance) {
32+
output.textContent = "Loading Pyodide (first time can take 10–20 seconds)...\n";
33+
34+
pyodideInstance = await loadPyodide({
35+
indexURL: "https://cdn.jsdelivr.net/pyodide/v0.29.4/full/"
36+
});
37+
38+
await pyodideInstance.loadPackage("micropip");
39+
output.textContent += "✅ Pyodide + micropip ready.\n";
40+
}
41+
return pyodideInstance;
42+
}
43+
44+
async function installAndTest() {
45+
const output = document.getElementById("output");
46+
try {
47+
const pyodide = await getPyodide();
48+
const micropip = pyodide.pyimport("micropip");
49+
50+
output.textContent += "\nInstalling codeaudit...\n";
51+
await micropip.install("codeaudit");
52+
53+
output.textContent += "✅ codeaudit installed successfully!\n\n";
54+
55+
await pyodide.runPythonAsync(`
56+
import codeaudit
57+
print("Package imported successfully!")
58+
print("Version :", getattr(codeaudit, "__version__", "Unknown"))
59+
`);
60+
61+
output.textContent += "🎉 Test completed!\n";
62+
63+
} catch (err) {
64+
output.textContent += "❌ Error: " + err.message + "\n";
65+
console.error(err);
66+
}
67+
}
68+
69+
async function listPackages() {
70+
const output = document.getElementById("output");
71+
try {
72+
const pyodide = await getPyodide();
73+
74+
output.textContent += "\nFetching list of installed packages...\n";
75+
76+
const pkgList = await pyodide.runPythonAsync(`
77+
import micropip
78+
import sys
79+
from io import StringIO
80+
81+
# Capture output properly
82+
old_stdout = sys.stdout
83+
sys.stdout = mystdout = StringIO()
84+
85+
packages = micropip.list()
86+
print("=== INSTALLED PACKAGES IN PYODIDE ===")
87+
print(f"Total packages: {len(packages)}")
88+
print("-" * 60)
89+
90+
for name in sorted(packages.keys()):
91+
pkg = packages[name]
92+
print(f"{name:25} {pkg.version:15} {pkg.source}")
93+
94+
sys.stdout = old_stdout
95+
mystdout.getvalue()
96+
`);
97+
98+
output.textContent += pkgList || "No output returned.";
99+
output.textContent += "\n✅ Package list retrieved.\n";
100+
101+
} catch (err) {
102+
output.textContent += "❌ Error listing packages: " + err.message + "\n";
103+
console.error(err);
104+
}
105+
}
106+
107+
function clearOutput() {
108+
document.getElementById("output").textContent = "";
109+
}
110+
</script>
111+
</body>
112+
</html>

0 commit comments

Comments
 (0)