Some security bugs to check out and review

.deepsource.toml

@@ -0,0 +1,22 @@
+version = 1
+
+[[analyzers]]
+name = "python"
+
+  [analyzers.meta]
+  runtime_version = "3.x.x"
+
+[[transformers]]
+name = "ruff"
+
+[[transformers]]
+name = "yapf"
+
+[[transformers]]
+name = "autopep8"
+
+[[transformers]]
+name = "isort"
+
+[[transformers]]
+name = "black"

setup.py

@@ -6,8 +6,8 @@
 
 setup(
     name="staking_deposit",
-    version='2.7.0',
+    version="2.7.0",
     py_modules=["staking_deposit"],
-    packages=find_packages(exclude=('tests', 'docs')),
+    packages=find_packages(exclude=("tests", "docs")),
     python_requires=">=3.8,<4",
 )

staking_deposit/cli/existing_mnemonic.py

@@ -1,53 +1,54 @@
+from typing import Any, Callable
+
 import click
-from typing import (
-    Any,
-    Callable,
-)
 
 from staking_deposit.exceptions import ValidationError
-from staking_deposit.key_handling.key_derivation.mnemonic import (
-    reconstruct_mnemonic,
-)
-from staking_deposit.utils.constants import (
-    WORD_LISTS_PATH,
-)
-from staking_deposit.utils.click import (
-    captive_prompt_callback,
-    jit_option,
-)
+from staking_deposit.key_handling.key_derivation.mnemonic import reconstruct_mnemonic
+from staking_deposit.utils.click import captive_prompt_callback, jit_option
+from staking_deposit.utils.constants import WORD_LISTS_PATH
 from staking_deposit.utils.intl import load_text
 from staking_deposit.utils.validation import validate_int_range
-from .generate_keys import (
-    generate_keys,
-    generate_keys_arguments_decorator,
-)
+
+from .generate_keys import generate_keys, generate_keys_arguments_decorator
 
 
-def load_mnemonic_arguments_decorator(function: Callable[..., Any]) -> Callable[..., Any]:
-    '''
+def load_mnemonic_arguments_decorator(
+    function: Callable[..., Any],
+) -> Callable[..., Any]:
+    """
     This is a decorator that, when applied to a parent-command, implements the
     to obtain the necessary arguments for the generate_keys() subcommand.
-    '''
+    """
     decorators = [
         jit_option(
             callback=validate_mnemonic,
-            help=lambda: load_text(['arg_mnemonic', 'help'], func='existing_mnemonic'),
-            param_decls='--mnemonic',
-            prompt=lambda: load_text(['arg_mnemonic', 'prompt'], func='existing_mnemonic'),
+            help=lambda: load_text(["arg_mnemonic", "help"], func="existing_mnemonic"),
+            param_decls="--mnemonic",
+            prompt=lambda: load_text(
+                ["arg_mnemonic", "prompt"], func="existing_mnemonic"
+            ),
             type=str,
         ),
         jit_option(
             callback=captive_prompt_callback(
                 lambda x: x,
-                lambda: load_text(['arg_mnemonic_password', 'prompt'], func='existing_mnemonic'),
-                lambda: load_text(['arg_mnemonic_password', 'confirm'], func='existing_mnemonic'),
-                lambda: load_text(['arg_mnemonic_password', 'mismatch'], func='existing_mnemonic'),
+                lambda: load_text(
+                    ["arg_mnemonic_password", "prompt"], func="existing_mnemonic"
+                ),
+                lambda: load_text(
+                    ["arg_mnemonic_password", "confirm"], func="existing_mnemonic"
+                ),
+                lambda: load_text(
+                    ["arg_mnemonic_password", "mismatch"], func="existing_mnemonic"
+                ),
                 True,
             ),
-            default='',
-            help=lambda: load_text(['arg_mnemonic_password', 'help'], func='existing_mnemonic'),
+            default="",
+            help=lambda: load_text(
+                ["arg_mnemonic_password", "help"], func="existing_mnemonic"
+            ),
             hidden=True,
-            param_decls='--mnemonic-password',
+            param_decls="--mnemonic-password",
             prompt=False,
         ),
     ]
@@ -61,27 +62,38 @@ def validate_mnemonic(ctx: click.Context, param: Any, mnemonic: str) -> str:
     if mnemonic is not None:
         return mnemonic
     else:
-        raise ValidationError(load_text(['err_invalid_mnemonic']))
+        raise ValidationError(load_text(["err_invalid_mnemonic"]))
 
 
 @click.command(
-    help=load_text(['arg_existing_mnemonic', 'help'], func='existing_mnemonic'),
+    help=load_text(["arg_existing_mnemonic", "help"], func="existing_mnemonic"),
 )
 @load_mnemonic_arguments_decorator
 @jit_option(
     callback=captive_prompt_callback(
         lambda num: validate_int_range(num, 0, 2**32),
-        lambda: load_text(['arg_validator_start_index', 'prompt'], func='existing_mnemonic'),
-        lambda: load_text(['arg_validator_start_index', 'confirm'], func='existing_mnemonic'),
+        lambda: load_text(
+            ["arg_validator_start_index", "prompt"], func="existing_mnemonic"
+        ),
+        lambda: load_text(
+            ["arg_validator_start_index", "confirm"], func="existing_mnemonic"
+        ),
     ),
     default=0,
-    help=lambda: load_text(['arg_validator_start_index', 'help'], func='existing_mnemonic'),
+    help=lambda: load_text(
+        ["arg_validator_start_index", "help"], func="existing_mnemonic"
+    ),
     param_decls="--validator_start_index",
-    prompt=lambda: load_text(['arg_validator_start_index', 'prompt'], func='existing_mnemonic'),
+    prompt=lambda: load_text(
+        ["arg_validator_start_index", "prompt"], func="existing_mnemonic"
+    ),
 )
 @generate_keys_arguments_decorator
 @click.pass_context
-def existing_mnemonic(ctx: click.Context, mnemonic: str, mnemonic_password: str, **kwargs: Any) -> None:
-    ctx.obj = {} if ctx.obj is None else ctx.obj  # Create a new ctx.obj if it doesn't exist
-    ctx.obj.update({'mnemonic': mnemonic, 'mnemonic_password': mnemonic_password})
+def existing_mnemonic(
+    ctx: click.Context, mnemonic: str, mnemonic_password: str, **kwargs: Any
+) -> None:
+    # Create a new ctx.obj if it doesn't exist
+    ctx.obj = {} if ctx.obj is None else ctx.obj
+    ctx.obj.update({"mnemonic": mnemonic, "mnemonic_password": mnemonic_password})
     ctx.forward(generate_keys)