Getting a perfect score of 100 and no flaws for my Python Application. Are we good?

We ran a static scan for our Python application and did not find any flaws, achieving a perfect score of 100.  We are unsure whether our application is being scanned correctly.

How can we ensure that the scan is properly detecting vulnerabilities?

If your Python-based application is showing no flaws and receiving a perfect score of 100, please review the Module Selection (Review Modules) page to check for any pre-scan errors during the upload.

If you see a green-color OK status on the Python Files module and no support issues reported for Python files, your application has been successfully scanned.

If you see some amber-color warnings indicating some support issues, missing files or compilation/parsing issues. It would mean those files are being ignored from the scan but the rest of the files are still being scanned. Please consider fixing those issues for best result. 

Nonetheless, if you believe a flaw should have been flagged, please discuss it with our ASC team. You can consider scheduling a consultation call with ASC team.  They will review the issue and, if necessary, report it as a False Negative to our Engineering team.

To validate the scanning process, you may consider adding a vulnerable code that intentionally raises various CWE flaws. This can help you gain confidence in the scan results.

Here's a Python script that demonstrates various CWE vulnerabilities by incorporating tainted data (T) from user input or external sources. This script is purely for educational and security awareness purposes—never use vulnerable code in production.

Save this file as veracode_demo.py

import os
import io
import flask
import logging
import pickle
import marshal
import hashlib
import random
import MySQLdb
import httplib2

app = flask.Flask(__name__)

# CWE-73: External Control of File Name or Path
def cwe_73():
    T = input("Enter file name: ")  # Tainted data
    open(T, "r")  # Insecure file access
    io.open(T)
    os.open(T, os.O_RDONLY)
    os.mkdir(T)

# CWE-78: OS Command Injection
def cwe_78():
    T = input("Enter command: ")  # Tainted data
    os.popen(T)
    os.system(T)
    os.execl("/bin/sh", "sh", "-c", T)
    os.spawnl(os.P_WAIT, "/bin/sh", "sh", "-c", T)

# CWE-80: XSS via Flask Response Manipulation
@app.route('/xss')
def cwe_80():
    T = input("Enter response data: ")  # Tainted data
    resp = flask.make_response(T)  # XSS vulnerability
    resp.data = T
    return resp

# CWE-89: SQL Injection
def cwe_89():
    db = MySQLdb.connect("localhost", "root", "password", "testdb")
    cursor = db.cursor()
    T = input("Enter SQL query: ")  # Tainted input
    cursor.execute(T)  # Vulnerable SQL execution

# CWE-95: Code Injection
def cwe_95():
    T = input("Enter code to evaluate: ")  # Tainted data
    eval(T)  # Executes arbitrary Python code
    compile(T, "<string>", "exec")

# CWE-117: Log Injection
def cwe_117():
    T = input("Enter log message: ")  # Tainted data
    logging.info(T)  # Log injection
    logging.debug(T)

# CWE-201: Information Exposure
def cwe_201():
    http = httplib2.Http()
    T = input("Enter request body: ")  # Tainted data
    http.request("http://example.com", "POST", body=T, headers={"Custom-Header": T})

# CWE-327: Use of Weak Hashing Algorithm
def cwe_327():
    T = input("Enter data to hash: ")  # Tainted data
    hashlib.sha1(T.encode())  # Weak hash
    hashlib.md5(T.encode())  # MD5 is also weak

# CWE-331: Insufficient Entropy
def cwe_331():
    T = input("Enter data for randomness: ")  # Tainted data
    random.seed(T)
    print(random.random())  # Predictable output
    print(random.choice(["A", "B", "C"]))  # Predictable selection

# CWE-441: Untrusted URL Request
def cwe_441():
    http = httplib2.Http()
    T = input("Enter URL: ")  # Tainted data
    http.request(T, "GET")  # External request without validation

# CWE-502: Deserialization of Untrusted Data
def cwe_502():
    T = input("Enter serialized data: ")  # Tainted data
    obj = pickle.loads(T.encode())  # Unsafe deserialization
    obj2 = marshal.loads(T.encode())  # Unsafe deserialization

# CWE-601: Open Redirect
@app.route('/redirect')
def cwe_601():
    T = input("Enter URL: ")  # Tainted data
    return flask.redirect(T)  # Open redirect vulnerability

# CWE-798: Hardcoded Credentials
def cwe_798():
    h = httplib2.Http()
    h.add_credentials('username', 'oopsie!!!')  # Hardcoded credentials
    resptup = h.request("http://example.com")

if __name__ == "__main__":
    cwe_73()
    cwe_78()
    cwe_89()
    cwe_95()
    cwe_117()
    cwe_201()
    cwe_327()
    cwe_331()
    cwe_441()
    cwe_502()
    cwe_798()
    app.run(debug=True)  # Flask app for XSS and Open Redirect

How This Script Demonstrates CWEs:

• CWE-73: Insecure file operations with user input.
• CWE-78: OS command execution using untrusted input.
• CWE-80: XSS via Flask response manipulation.
• CWE-89: SQL Injection by executing untrusted SQL queries.
• CWE-95: Remote code execution with eval() and compile().
• CWE-117: Log injection by inserting malicious input into logs.
• CWE-201: Exposure of sensitive data in an HTTP request.
• CWE-327: Weak hashing algorithms (SHA-1, MD5).
• CWE-331: Use of predictable random values.
• CWE-441: Untrusted URL request leading to SSRF.
• CWE-502: Deserialization of untrusted input (pickle, marshal).
• CWE-601: Open redirect vulnerability.
• CWE-798: Hardcoded credentials in an HTTP request.