python dependency vulnerability scanner, written in Rust.

Last update: Jun 4, 2023

Overview

🐍 Pyscan

A dependency vulnerability scanner for your python projects, straight from the terminal.

🚀 blazingly fast scanner that can be used within large projects quickly.
🤖 automatically uses requirements.txt, pyproject.toml or, the source code.
🧑‍💻 can be integrated into existing build processes.
💽 In its alpha stage, some features may not work correctly. PRs and issue makers welcome.

🕊️ Install

> pip install pyscan-rs

look out for the "-rs" part or

> cargo install pyscan

check out the releases.

🐇 Usage

Go to your python source directory (or wherever you keep your requirements.txt/pyproject.toml) and run:

> pyscan

> pyscan -d path/to/src

Docker

Pyscan can scan inside docker images given you provide the correct path inside. This is still in its early stage and may break easily.

> pyscan docker -n my-docker-image -p /path/inside/container/to/source

by "source" I mean requirements.txt, pyproject.toml or your python files. Note: Your docker engine/daemon should be running as pyscan utilizes the docker create command.

Here's the order of precedence for a "source" file:

requirements.txt
pyproject.toml
your python source code (.py) [highly discouraged]

Pyscan will find dependency versions from pip if not provided within the source file. Even though, Make sure you version-ize your requirements and use proper pep-508 syntax.

🦀 Note

pyscan uses OSV as its database for now. There are plans to add a few more.

pyscan doesn't make sure your code is safe from everything. Use all resources available to you like Dependabot, pip-audit or trivy.

🐰 Todo

🐹 Sponsor

While not coding, I am a broke high school student with nothing else to do. I appreciate all the help I can get.

Comments

Crashing on my machine

Python 3.11 in a conda environment on Windows, pip installed pyscan-rs:

pyscan v0.1.3 | by Aswin (github.com/aswinnnn)
Found 9 dependencies...
|-| fasteners [0.18] -> No vulnerabilities found.
thread 'main' panicked at 'Could not retrive package version.: PipError("could not retrive package version from Pip")', src\scanner\mod.rs:28:69
stack backtrace:
   0:           0x973780 - <unknown>
   1:           0x9cbc1b - <unknown>
   2:           0x965605 - <unknown>
   3:           0x97698f - <unknown>
   4:           0x976647 - <unknown>
   5:           0x9771bf - <unknown>
   6:           0x9770c5 - <unknown>
   7:           0x9742bf - <unknown>
   8:           0x976de0 - <unknown>
   9:           0x9c86a5 - <unknown>
  10:           0x9c8a73 - <unknown>
  11:           0x422bc9 - <unknown>
  12:           0x42ebf8 - <unknown>
  13:           0x4410a5 - <unknown>
  14:           0x447be6 - <unknown>
  15:           0x41cecc - <unknown>
  16:           0x958097 - <unknown>
  17:           0x44524d - <unknown>
  18:           0x4013f8 - <unknown>
  19:           0x40151b - <unknown>
  20:     0x7ffffab07614 - <unknown>
  21:     0x7ffffc0a26a1 - <unknown>

Any idea?

bug

opened by ArneBachmannDLR 8

Incorrect version detection of requests package

Describe the bug When running pyscan does tell me there is a vulnerability in my requests dependency, although the version that is specified is not the version that is installed. In the installed version this vulnerability has been patched.

I am getting the following result back after running pyscan:

pyscan v0.1.1 | by Aswin (github.com/aswinnnn)
Found 6 dependencies...
|-| netaddr [0.8.0] -> No vulnerabilities found.
|-| defusedxml [0.7.1] -> No vulnerabilities found.
|-| dnspython [2.3.0rc1] -> No vulnerabilities found.
|-| pandas [2.0.1] -> No vulnerabilities found.
|-| requests [2.9.2] -> Found vulnerabilities!
|-| python-evtx [0.7.4] -> No vulnerabilities found.
SUMMARY

Dependency: requests
ID: GHSA-x84v-xcm2-53pg
Details: The Requests package through 2.19.1 before 2018-09-14 for Python sends an HTTP Authorization header to an http URI upon receiving a same-hostname https-to-http redirect, which makes it easier for remote attackers to discover credentials by sniffing the network.
Versions affected: 0.0.1 to 2.9.2

Dependency: requests
ID: PYSEC-2018-28
Details: The Requests package before 2.20.0 for Python sends an HTTP Authorization header to an http URI upon receiving a same-hostname https-to-http redirect, which makes it easier for remote attackers to discover credentials by sniffing the network.
Versions affected: 0.0.1 to 2.9.2

Running a pip3 freeze yields:

defusedxml==0.7.1
dnspython==2.3.0
netaddr==0.8.0
pandas==2.0.1
pyscan-rs==0.1.1
python-evtx==0.7.4
requests==2.30.0

Yet when running pyscan package -n requests -v 2.30.0 I am getting the expected response:

Found 1 dependencies...
|-| requests [2.30.0] -> No vulnerabilities found.

To Reproduce Steps to reproduce the behavior:

Create a vritual environment

Install the following requirements.txt:

netaddr
defusedxml
dnspython
pandas
requests
python-evtx

Run pip3 install pyscan-rs
Scanning the project: pyscan

Expected behavior It is expected that the version number of the currently installed package is identified correctly.

Desktop (please complete the following information):

OS: macOS Ventura

bug good first issue

opened by anotherbridge 4

Exit with zero in case of vulnerability found
Describe the bug When a vulnerability was found the exit code of the program is zero. Thus it makes it hard to integrate the tool into an automation that should raise an alert in case a vulnerability was found. This is the case when running pyscan either for a specific package or within a repository.

To Reproduce Steps to reproduce the behavior:

Run pyscan package -n requests -v 2.30.0

Run echo $?

Observe that 0 is returned

Expected behavior It is expected that a non-zero exit code is returned in case a vulnerability is found.

Desktop (please complete the following information):

OS: macOS Ventura ARM architecture, Debian 11.7 x86 architecture
opened by anotherbridge 1
Use batch API for OSV

pyscan is very slow for a repo with 429 3rd-party packages (which is claimed to be the #1 feature of pyscan according to the homepage). If I am not mistaken, it makes one HTTP request to the OSV API per scanned packages despite the fact that we know all scanned packages and versions in advance. OSV as a batch API which could be leveraged to make pyscan IMO much faster: https://google.github.io/osv.dev/post-v1-querybatch/

BTW: What is the added value of Rust in app that just parses a text file, makes a HTTP call and formats the results? Compiling the pyscan-rs takes ages and perhaps a pure Python code could be fast enough?
enhancement question

opened by sarimak 4
Add support for constraints.txt

Names and version of Python packages can be specified also in a constraints.txt file and pyscan doesn't detect it by name. Please search also for constraints.txt in addition to requirements.txt.

Workaround: ln -s constraints.txt requirements.txt; pyscan (both files use the same syntax)

Context: A monorepo containing several Python packages which need to be installable into the same virtual environment needs a central place for pinning the 3rd-party package versions (in addition to per-package setup.cfg/pyproject.toml). There is a standard mechanism for that: https://pip.pypa.io/en/stable/user_guide/#constraints-files
enhancement

opened by sarimak 1
prompt/default to when dependency conflict occurs
Describe the bug Although #1 is now fixed, I still encountered a similar issue that I didn't recognize before (since I didn't test this case). When a minimum version is specified in the requirements.txt, then the tool will take the version that is specified instead of checking which version is actually used.

To Reproduce Steps to reproduce the behavior:

Install the following requirements file into a separate environment:
pandas>=1.5.0 requests>=2.30.0 beautifulsoup4>=4.12.2 lxml>=4.9.2

Run pip freeze to investigate the installed versions:
pandas==2.0.1 requests==2.31.0 beautifulsoup4==4.12.2 lxml==4.9.2

Run pyscan and investigate the output:
pyscan v0.1.3 | by Aswin (github.com/aswinnnn) Found 4 dependencies... |-| pandas [1.5.0] -> No vulnerabilities found. |-| requests [2.30.0] -> Found vulnerabilities! |-| beautifulsoup4 [4.12.2] -> No vulnerabilities found. |-| lxml [4.9.2] -> No vulnerabilities found. SUMMARY ...

Expected behavior The version number of the currently installed packages should be taken instead of the minimum required version specified in the requirements.txt file.

Desktop (please complete the following information):

OS: macOS Ventura ARM architecture

pyscan version v0.1.3
enhancement
opened by anotherbridge 9

Releases(v0.1.3)

v0.1.3(May 22, 2023)
v0.1.3

added docker subcommand, usage:

> pyscan docker -n my-docker-image -p /path/inside/container/to/source

by "source" I mean requirements.txt, pyproject.toml or your python files.

other changes:

pyscan will not be using deps.dev API anymore to retrive latest stable versions. Will be using pip instead to get the installed package version from the user. Should've thought of that sooner. [credits to @anotherbridge for #1 ]

better error messages, though panics are the main way of displaying them.

This release was pretty rushed to fix that issue and get the docker feature on. I will be taking my sweet time with the next release to get:

github actions integration

make it easier for other tools to interact with pyscan

code complexity analyzer (not doing a linter cuz any respectable python dev already has one)

finally get to do tests, and lots of more ideas in my head. Thanks for the awesome support so far!

v0.1.2 was skipped because it contained a terrible mishandling of the docker command which left remnants and did not perform a complete cleanup job. v0.1.3 has the fix and all the other things 0.1.2 introduced. Again, thanks for the awesome support.
Source code(tar.gz)
Source code(zip)
pyscan_rs-0.1.3-py3-none-manylinux_2_31_x86_64.whl(26.52 MB)
pyscan_rs-0.1.3-py3-none-win_amd64.whl(3.27 MB)
pyscan_rs-0.1.3.tar.gz(30.69 KB)
pyscan_v0.1.3_linux(12.34 MB)
pyscan_v1.0.3_x86_64.exe(17.76 MB)
v0.1.1(May 17, 2023)
v0.1.1

added package sub-command to query individual packages, here's a quick usage:

> pyscan package -n jinja2 -v 2.4.1

slight logic improvments

notes for next release:

if pyscan detects pyproject.toml but it doesn't find the dependencies table it panics, deserves an err handle next release

I should probably start using the anyhow crate.

get_latest_package_version should become its own function and be moved to utils.rs in the next version

That's all for this release!
Source code(tar.gz)
Source code(zip)
pyscan_rs-0.1.1-py3-none-manylinux_2_28_x86_64.whl(26.37 MB)
pyscan_rs-0.1.1-py3-none-win_amd64.whl(3.26 MB)
pyscan_rs-0.1.1.tar.gz(28.17 KB)
pyscan_v0.1.1.exe(17.71 MB)
pyscan_v0.1.1_linux_x86_64(12.24 MB)
v0.1.0(May 16, 2023)

Initial release not any bugs that i know of (do report some so it seems like a busy genius project) there's binaries for windows and linux. enjoy looking at my source code. Thank you.
Source code(tar.gz)
Source code(zip)
pyscan.exe(8.05 MB)
pyscan_linux_amd64(12.21 MB)
pyscan_rs-0.1.0.tar.gz(23.14 KB)

Owner

Aswin.

I like computers and I mess with stuff.

GitHub

Rust Imaging Library's Python binding: A performant and high-level image processing library for Python written in Rust

ril-py Rust Imaging Library for Python: Python bindings for ril, a performant and high-level image processing library written in Rust. What's this? Th

13 Dec 6, 2022

LOKI2 - Simple IOC and YARA Scanner

LOKI2 LOKI - Simple IOC and YARA Scanner Status Work in Progress. This version is not ready for use. There's still some work to do for a first release

34 Dec 20, 2022

High-Speed Memory Scanner & Analyzer with REST API.

memory-server High-Speed Memory Scanner & Analyzer with REST API. Usage iOS Jailbreaking of iphone is required. Place your PC and iphone in the same n

8 Jul 12, 2023

zero-dependency 3d math library in rust

dualquat A lightweight, zero-dependency 3d math library for use in Dual Quaternion based physics simulation. Capable of representing and transforming

4 Nov 11, 2022

Dynamic dependency injection library for rust.

DDI (dynamic dependency injection) This library provides a generic dependency injection container that can be easily integrated into any application a

34 Feb 21, 2023

Rudi - an out-of-the-box dependency injection framework for Rust.

Rudi Rudi - an out-of-the-box dependency injection framework for Rust. use rudi::{Context, Singleton, Transient}; // Register `fn(cx) -> A { A }` as

15 Aug 15, 2023

A zero-dependency crate for writing repetitive code easier and faster.

akin A zero-dependency crate for writing repetitive code easier and faster. Check Syntax for information about how to use it. Why? Example Syntax NONE

36 Dec 29, 2022

A truly zero-dependency crate providing quick, easy, reliable, and scalable access to the name "jordin"

jordin Finally! A truly zero-dependency crate providing quick, easy, reliable, and scalable access to the name "jordin". Additionally, this one-of-a-k

2 Aug 4, 2022

Track and query Cargo dependency graphs.

cargo-guppy: track and query dependency graphs This repository contains the source code for: guppy: a library for performing queries on Cargo dependen

42 Dec 30, 2022

A lightweight, zero-dependency struct diffing library which allows changed fields to be collected and applied

structdiff A lightweight, zero-dependency struct diffing library which allows changed fields to be collected and applied. Derive Difference on a struc

7 Dec 25, 2022

Generate a dependency list to thank them on README.

thanks-dependencies This generates list of dependencies. I think it's better to publish dependencies explicitly on documentation. Of course users can

7 Jan 30, 2023

A high-performance WebSocket integration library for streaming public market data. Used as a key dependency of the `barter-rs` project.

Barter-Data A high-performance WebSocket integration library for streaming public market data from leading cryptocurrency exchanges - batteries includ

23 Feb 3, 2023

python dependency vulnerability scanner, written in Rust.

Related tags

Overview

🐍 Pyscan

A dependency vulnerability scanner for your python projects, straight from the terminal.

🕊️ Install

🐇 Usage

Docker

🦀 Note

🐰 Todo

🐹 Sponsor

Comments

Crashing on my machine

Incorrect version detection of requests package

Exit with zero in case of vulnerability found

Use batch API for OSV

Add support for constraints.txt

prompt/default to when dependency conflict occurs

Releases(v0.1.3)

v0.1.3(May 22, 2023)

v0.1.3

other changes:

v0.1.1(May 17, 2023)

v0.1.1

notes for next release:

v0.1.0(May 16, 2023)