Facebook yakaunza Pysa, static analyzer yemutauro wePython

Facebook kuunzwa vhura static analyzer pysa (Python Static Analyzer), yakagadzirirwa kuona zvinogona kukanganisa muPython kodhi. Iyo itsva analyzer yakagadzirirwa seyekuwedzera kune yemhando yekutarisa toolkit Pyre ndokuisa mudura rake. Code yakabudiswa pasi peMIT rezinesi.

Pysa inopa ongororo yekuyerera kwedata semhedzisiro yekodhi dhizaini, iyo inokutendera iwe kuti uone zvakawanda zvingangoita kusagadzikana uye zvakavanzika zvine chekuita nekushandisa data munzvimbo dzarisingafanirwe kuoneka.
Semuyenzaniso, Pysa inogona kuronda mashandisirwo e data rekunze rekunze munhare dzinotangisa zvirongwa zvekunze, mukushanda kwemafaira, uye muSQL inovaka.

Basa reanalyzer rinouya pasi pakuona masosi edata uye mafoni ane njodzi umo data rekutanga harifanirwe kushandiswa. Data kubva pawebhu zvikumbiro (semuenzaniso, iro HttpRequest.GET duramazwi riri muDjango) rinoonekwa serinobva, uye mafoni akaita se eval uye os.open anoonekwa sekushandisa kune njodzi. Pysa inoteedzera kuyerera kwedata kuburikidza neketani yebasa rekufona uye inosanganisa iyo sosi data nenzvimbo dzingangove nengozi mukodhi. Kusagadzikana kwakajairika kunoonekwa uchishandisa Pysa inotaura dambudziko rakavhurika redirect (CVE-2019-19775) muZulip messaging platform, inokonzerwa nekupfuura isina kuchena maparamita ekunze pakupa zvigunwe.

Pysa's data flow tracking kugona anogona shandisa kuona mashandisirwo chaiwo emamwe masisitimu uye kuona kutevedza mutemo wekushandisa data remushandisi. Semuenzaniso, Pysa isina mamwe marongero inogona kushandiswa kutarisa mapurojekiti uchishandisa iyo Django uye Tornado masisitimu. Pysa inogona zvakare kuona kusazvibata kwakajairika mumawebhu application, senge SQL jekiseni uye muchinjika-saiti scripting (XSS).

PaFacebook, analyzer inoshandiswa kutarisa kodhi yebasa re Instagram. Muchikamu chekutanga cha2020, Pysa yakabatsira kuona makumi mana nemana muzana ematambudziko ese einjiniya eFacebook akawanikwa mu Instagram's server-side codebase.
Pakazara, Pysa's automated change review process yakaratidza 330 nyaya, idzo makumi mana nepfumbamwe (49%) dzakanzi dzakakura uye 15 (131%) sedzisina kuomarara. Muzviitiko zve40 (150%) matambudziko akarongedzerwa semanyepo.

Source: opennet.ru