diff --git a/package_linter.py b/package_linter.py index c7a3244..ee9a7d1 100755 --- a/package_linter.py +++ b/package_linter.py @@ -1565,30 +1565,31 @@ class Configurations(TestSuite): @test() def bind_public_ip(self): app = self.app - for filename in ( - os.listdir(app.path + "/conf") if os.path.exists(app.path + "/conf") else [] + for path, subdirs, files in ( + os.walk(app.path + "/conf") if os.path.exists(app.path + "/conf") else [] ): - try: - content = open(app.path + "/conf/" + filename).read() - except Exception as e: - yield Warning("Can't open/read %s: %s" % (filename, e)) - return + for filename in files: + try: + content = open(os.path.join(path, filename)).read() + except Exception as e: + yield Warning("Can't open/read %s: %s" % (os.path.join(path, filename), e)) + return - for number, line in enumerate(content.split("\n"), 1): - comment = ("#", "//", ";") - if ( - ( "0.0.0.0" in line or "::" in line ) - and not line.strip().startswith(comment) - ): - for ip in re.split("[ \t,='\"(){}\[\]]", line): - if ip == "::" or ip.startswith("0.0.0.0"): - yield Info( - f"{filename}:{number}: Binding to '0.0.0.0' or '::' can result " - "in a security issue as the reverse proxy and the SSO can be " - "bypassed by knowing a public IP (typically an IPv6) and the " - "app port. lease be sure that this behavior is intentional. " - "Maybe use '127.0.0.1' or '::1' instead." - ) + for number, line in enumerate(content.split("\n"), 1): + comment = ("#", "//", ";") + if ( + ( "0.0.0.0" in line or "::" in line ) + and not line.strip().startswith(comment) + ): + for ip in re.split("[ \t,='\"(){}\[\]]", line): + if ip == "::" or ip.startswith("0.0.0.0"): + yield Info( + f"{os.path.join(path, filename)}:{number}: Binding to '0.0.0.0' or '::' can result " + "in a security issue as the reverse proxy and the SSO can be " + "bypassed by knowing a public IP (typically an IPv6) and the " + "app port. lease be sure that this behavior is intentional. " + "Maybe use '127.0.0.1' or '::1' instead." + ) ############################################# # __ __ _ __ _ #