Pyramid/Python security scanner?

Question

Is there an automated security scanner of any sort for Pyramid?

I've seen these for other frameworks, like Brakeman for Rails. It would be really great if there was one for Pyramid (or even Python in general).

Then again, it wouldn't surprise me if there wasn't, because it's not quite as popular as Rails.

Answer 1

I am not sure if Pyramid or any Python application is very good target for a security scanner. I am reading this list and I am not sure if any of these issues are very applicable to Python web applications. It is interesting idea though.

Frameworks, like Pyramid, should have safe defaults so that OWASP top 10 most common vulnerabilities should not be happening in the first place.

• Usage of SQLALchemy or Django ORM prevents SQL injections

• Template engines do safe HTML escape by default

• Unsafe serialization (Python pickling) is non-existent as most code uses JSON

• I have not seen anybody doing eval() in Python, though this doesn't mean some poor soul somewhere would not be doing it

• etc.

However novice programmers surely can shoot themselves to foot with these kind of issues and it would make sense to catch handcoded SQL strings or eval() usage by an automatic scanner. But my gut feeling as being working with various Python web projects and security for over a decade is that in Python world the state of the matters is more robust and gains using a security scanner would be very small or non-existent.