Facebook yakaunza yakavhurwa sosi static analyzer inonzi "Pysa»(Python Static Analyzer) iri yakagadzirirwa kuona zvingangoita kusagadzikana muPython kodhi.
pysa inopa data kuyerera kuongorora semhedzisiro yekuitwa kwekodhi, iyo inokutendera kuti uone zvakawanda zvingangoita kusagadzikana nematambudziko yehukama inoenderana nekushandiswa kwedatha munzvimbo dzaisingafanire kuoneka.
Semuenzaniso, Pysa inogona kuteedzera kushandiswa kweiri mbichana yekunze data mukufona iyo inoita zvirongwa zvekunze, mukuita kwefaira uye muSQL inogadzira.
Nhasi, tinogovana ruzivo nezvePysa, yakavhurika sosi yekuongorora chishandiso chatakavaka kuti tione uye tidzivirire kuchengetedzeka uye zvakavanzika nyaya muPython kodhi. Gore rakapera, takagovana magadzirirwo atakaitwa Zoncolan, chishandiso chekuongorora icho chinotibatsira kuongorora anopfuura mamirioni zana emitsetse yehodhi kodhi uye zvakabatsira mainjiniya kudzivirira zviuru zvezvinetso zvekuchengetedza. Kubudirira ikoko kwakatikurudzira kuvaka Pysa, chinova chirevo chePython Static Analyzer.
Pysa anoshandisa iwo mamwe algorithms kuita static kuongorora uye nekugovana kodhi ne zoncolan. SaZoncolan, Pysa inoteedzera data kuyerera kuburikidza nechirongwa.
Mushandisi anotsanangura masosi (nzvimbo dzinotangira data rakakosha) pamwe nekunyura (nzvimbo idzo dhatabhesi dzisingafanirwe kupera).
Kune ekushandisa ekuchengetedza, mhando dzakajairika sosi nzvimbo inzvimbo idzo dzinodzorwa nemushandisi dzinopinda mukushandisa, senge duramazwi reDjango.
Vanogamuchira vanowanzo kuve akasiyana siyana, asi vanogona kusanganisira maAPI anomhanya kodhi, senge eval, kana maAPI anowana iyo faira system, sengeos.open.
Pysa anoita iterative kutenderera kwekuongorora kuvaka zvinyorwa kuona kuti ndeapi mabasa anodzosa dhata kubva kune sosi uye ndeapi mabasa ane ma parameter ayo anozopedzisira arova singi. Kana Pysa ikaona kuti sosi inopedzisira yabatana nesingi, inoshuma dambudziko.
Basa rekuongorora inodonha kusvika pakutsvaga anouya masosi edata uye nhare dzine njodzi, umo data rekutanga risingafanirwe kushandiswa.
Pysa inoongorora kupfuurwa kwedata kuburikidza neketani yekufona uye inobatanidza iyo data rekutanga nenzvimbo dzinogona kuve nengozi mukodhi.
Nekuti isu tinoshandisa yakavhurwa sosi Python server masystem senge Django uye Tornado kune edu ega zvigadzirwa, Pysa inogona kutanga kusangana nenyaya dzekuchengetedza mumapurojekiti anoshandisa aya masisitimu kubva pakutanga kwekutanga kumhanya. Tichishandisa Pysa yehurongwa hwatisina kuvharirwa izvozvi zvinowanzo kuve nyore sekuwedzera mashoma ekumisikidza mitsara kuudza Pysa uko data riri kuuya kuseva.
Dambudziko rakajairika rinoonekwa naPysa inyaya yakavhurika redirect nyaya (CVE-2019-19775) muZulip mameseji chikuva, inokonzereswa nekupfuura isina kuchena parameter yekunze paunenge uchiratidza zvigunwe.
Iyo Pysa yekuyerera kwekuyerera kugona kugona inogona kushandiswa kuratidza kushandiswa kwemamwe mafuremu uye kuona kutevedzera nemashandisirwo emashandisirwo ekushandisa data.
Somuenzaniso, Pysa isina mamwe marongero anogona kushandiswa kuongorora mapurojekiti uchishandisa mafomati Django uye Tornado. Pysa inogona zvakare kuona kushomeka kwakajairika mukushandisa kwewebhu, senge kutsiva kweSQL uye kuyambuka -saiti script (XSS)
PaFacebook, muongorori anoshandiswa kuongorora kodhi yeiyo Instagram sevhisi. Pakati pechikamu chekutanga cha2020, Pysa yakabatsira kuona 44% yezvinetso zvese zvakawanikwa neinjiniya vepaFacebook mu Instagram's server-side code base.
Matambudziko ese mazana matatu nemakumi matatu akaonekwa muchiitiko ichi ye automated shanduko ongororo uchishandisa Pysa, 49 (15%) ayo akaongororwa seakakosha uye 131 (40%) anga asiri nengozi. Mune makesi zana nemakumi mashanu (150%) matambudziko akaverengerwa kune ekunyepa.
Iyo nyowani nyowani yakagadzirirwa sekuwedzera kune iyo Pyre mhando yekuongorora toolkit uye inoiswa mune yako repository. Iyo kodhi inosunungurwa pasi peMIT rezinesi.
Finalmente kana iwe uchida kuziva zvakawanda nezvazvo, unogona kutarisa ruzivo rwekutanga kutumira. Iyo yekubatanidza ndeiyi.