)]}'
{"bandit/core/node_visitor.py":[{"author":{"_account_id":11861,"name":"Travis McPeak","email":"tmcpeak@us.ibm.com","username":"travis-mcpeak"},"change_message_id":"e2185ddcace84bc6950049669ae635b29fe2fef9","unresolved":false,"context_lines":[{"line_number":227,"context_line":"        self.logger.debug(\"%s\\texiting : %s\" % (self.depth, hex(id(node))))"},{"line_number":228,"context_line":"        return self.score"},{"line_number":229,"context_line":""},{"line_number":230,"context_line":"    def linenumber_range(self, node):"},{"line_number":231,"context_line":"        lines \u003d set()"},{"line_number":232,"context_line":"        for n in ast.walk(node):"},{"line_number":233,"context_line":"            if hasattr(n, \u0027lineno\u0027):"}],"source_content_type":"text/x-python","patch_set":1,"id":"ba7be1f8_89e5ee39","line":230,"updated":"2015-02-24 16:56:02.000000000","message":"Cool, I like this","commit_id":"1d099c5368b960dd90e00026966d9e76ecf1f1c6"},{"author":{"_account_id":14692,"name":"Lucas Fisher","email":"lucas.fisher@gmail.com","username":"lucas.fisher"},"change_message_id":"611b2248689298f353cef0ac58531a0f11a688a1","unresolved":false,"context_lines":[{"line_number":83,"context_line":"        :return: -"},{"line_number":84,"context_line":"        \u0027\u0027\u0027"},{"line_number":85,"context_line":""},{"line_number":86,"context_line":"        self.context[\u0027lineno\u0027] \u003d self.linenumber_range(node)"},{"line_number":87,"context_line":"        self.context[\u0027function\u0027] \u003d node"},{"line_number":88,"context_line":""},{"line_number":89,"context_line":"        self.logger.debug(\"visit_FunctionDef called (%s)\" % ast.dump(node))"}],"source_content_type":"text/x-python","patch_set":2,"id":"ba7be1f8_57d27d5c","line":86,"updated":"2015-02-25 15:06:29.000000000","message":"Do we consider a hit on a FunctionDef to be a hit on the whole function or just on the signature. If the later, then we should just get the range for the name, args, and (maybe) decorators.","commit_id":"cb22848a0defa557acc960976a926c73d69ebaaf"},{"author":{"_account_id":15173,"name":"Rob Fletcher","email":"rfletch.vol@gmail.com","username":"fletcher"},"change_message_id":"b9e2532f247c6655a89cbce79fdcdb2a71363e77","unresolved":false,"context_lines":[{"line_number":83,"context_line":"        :return: -"},{"line_number":84,"context_line":"        \u0027\u0027\u0027"},{"line_number":85,"context_line":""},{"line_number":86,"context_line":"        self.context[\u0027lineno\u0027] \u003d self.linenumber_range(node)"},{"line_number":87,"context_line":"        self.context[\u0027function\u0027] \u003d node"},{"line_number":88,"context_line":""},{"line_number":89,"context_line":"        self.logger.debug(\"visit_FunctionDef called (%s)\" % ast.dump(node))"}],"source_content_type":"text/x-python","patch_set":2,"id":"ba7be1f8_75fcd2b8","line":86,"in_reply_to":"ba7be1f8_57d27d5c","updated":"2015-02-25 17:30:28.000000000","message":"I think the former makes more sense. The body of the function is part of the definition, imo.\n\nI could probably be convinced with an example though. :)","commit_id":"cb22848a0defa557acc960976a926c73d69ebaaf"},{"author":{"_account_id":14692,"name":"Lucas Fisher","email":"lucas.fisher@gmail.com","username":"lucas.fisher"},"change_message_id":"611b2248689298f353cef0ac58531a0f11a688a1","unresolved":false,"context_lines":[{"line_number":227,"context_line":"        self.logger.debug(\"%s\\texiting : %s\" % (self.depth, hex(id(node))))"},{"line_number":228,"context_line":"        return self.score"},{"line_number":229,"context_line":""},{"line_number":230,"context_line":"    def linenumber_range(self, node):"},{"line_number":231,"context_line":"        lines \u003d set()"},{"line_number":232,"context_line":"        for n in ast.walk(node):"},{"line_number":233,"context_line":"            if hasattr(n, \u0027lineno\u0027):"}],"source_content_type":"text/x-python","patch_set":2,"id":"ba7be1f8_b70c993c","line":230,"updated":"2015-02-25 15:06:29.000000000","message":"I am a worried about implementing as a set of line numbers. If we have code with large functions we could have some pretty big sets as this will return all lines for a FunctionDef. \n\n1. Do we consider a hit on a FunctionDef to be on the whole function?  See above. \n\n2. Since we currently save lines in test_results this could start to eat up memory, esp if the whole function gets included.\n\nIs there a case where we will have non-sequential line numbers? If not, we could use xrange() to represent lines and I think it would be just as easy. Just get the first and last and make an xrange(first, last+1)","commit_id":"cb22848a0defa557acc960976a926c73d69ebaaf"},{"author":{"_account_id":15173,"name":"Rob Fletcher","email":"rfletch.vol@gmail.com","username":"fletcher"},"change_message_id":"b9e2532f247c6655a89cbce79fdcdb2a71363e77","unresolved":false,"context_lines":[{"line_number":227,"context_line":"        self.logger.debug(\"%s\\texiting : %s\" % (self.depth, hex(id(node))))"},{"line_number":228,"context_line":"        return self.score"},{"line_number":229,"context_line":""},{"line_number":230,"context_line":"    def linenumber_range(self, node):"},{"line_number":231,"context_line":"        lines \u003d set()"},{"line_number":232,"context_line":"        for n in ast.walk(node):"},{"line_number":233,"context_line":"            if hasattr(n, \u0027lineno\u0027):"}],"source_content_type":"text/x-python","patch_set":2,"id":"ba7be1f8_3a124962","line":230,"in_reply_to":"ba7be1f8_6075fa62","updated":"2015-02-25 17:30:28.000000000","message":"Yes, we can have non-sequential line numbers. While files like that won\u0027t pass flake8/pep8 checks, it is valid python and bandit parses and returns errors on those files. In the example below, we can see warnings returned with the line number list of [5, 6, 10].\n\nI think it\u0027s important we capture that behavior and not have line number corresponding to blank lines. (e.g. 7,8,9)\n\nGiven setup.py:\n\n import subprocess\n print \u0027a\u0027\n x \u003d 1\n \n subprocess.Popen([ \u0027ls\u0027,\n \u0027-l\u0027],\n \n \n \n         shell\u003dTrue)\n \n print \u0027a\u0027\n x \u003d 1\n print \u0027a\u0027\n x \u003d 1\n\n\nBandit produces:\n\n Run started:\n \t2015-02-25 17:18:08.641453\n \n Files in scope (1):\n \t/Users/omerta/tmp/setup.py (score: 16)\n \n Files excluded (0):\n \n Files skipped (0):\n \n Test results:\n \n \u003e\u003e Consider possible security implications associated with subprocess  module.\n  - /Users/omerta/tmp/setup.py::[1]\n 1\timport subprocess\n \n \u003e\u003e Popen call with shell\u003dTrue identified, security issue.\n  - /Users/omerta/tmp/setup.py::[5, 6, 10]\n 5\tsubprocess.Popen([ \u0027ls\u0027,\n 6\t\u0027-l\u0027],\n 10\t        shell\u003dTrue)\n \n \u003e\u003e Use of possibly insecure system call function (subprocess.Popen).\n  - /Users/omerta/tmp/setup.py::[5, 6, 10]\n 5\tsubprocess.Popen([ \u0027ls\u0027,\n 6\t\u0027-l\u0027],\n 10\t        shell\u003dTrue)","commit_id":"cb22848a0defa557acc960976a926c73d69ebaaf"},{"author":{"_account_id":11861,"name":"Travis McPeak","email":"tmcpeak@us.ibm.com","username":"travis-mcpeak"},"change_message_id":"9e211567bb821293d7ec4c0561dc725be7f39f9b","unresolved":false,"context_lines":[{"line_number":227,"context_line":"        self.logger.debug(\"%s\\texiting : %s\" % (self.depth, hex(id(node))))"},{"line_number":228,"context_line":"        return self.score"},{"line_number":229,"context_line":""},{"line_number":230,"context_line":"    def linenumber_range(self, node):"},{"line_number":231,"context_line":"        lines \u003d set()"},{"line_number":232,"context_line":"        for n in ast.walk(node):"},{"line_number":233,"context_line":"            if hasattr(n, \u0027lineno\u0027):"}],"source_content_type":"text/x-python","patch_set":2,"id":"ba7be1f8_6075fa62","line":230,"in_reply_to":"ba7be1f8_b70c993c","updated":"2015-02-25 15:28:41.000000000","message":"+1, I can\u0027t think of an example where xrange won\u0027t work.  Good catch Lucas.","commit_id":"cb22848a0defa557acc960976a926c73d69ebaaf"}],"bandit/core/result_store.py":[{"author":{"_account_id":11861,"name":"Travis McPeak","email":"tmcpeak@us.ibm.com","username":"travis-mcpeak"},"change_message_id":"e2185ddcace84bc6950049669ae635b29fe2fef9","unresolved":false,"context_lines":[{"line_number":131,"context_line":"                filename \u003d item[0]"},{"line_number":132,"context_line":"                filelist \u003d item[1]"},{"line_number":133,"context_line":"                for x in filelist:"},{"line_number":134,"context_line":"                    line_nums \u003d x[0]"},{"line_number":135,"context_line":"                    error_label \u003d str(x[1]).strip()"},{"line_number":136,"context_line":"                    error_type \u003d str(x[2]).strip()"},{"line_number":137,"context_line":"                    reason \u003d str(x[3]).strip()"}],"source_content_type":"text/x-python","patch_set":1,"id":"ba7be1f8_e9a82a8f","line":134,"updated":"2015-02-24 16:56:02.000000000","message":"This isn\u0027t related to your check-in, but I\u0027m just wondering if we should be using a dict here... this x[0], x[1]... business feels kind of yucky.","commit_id":"1d099c5368b960dd90e00026966d9e76ecf1f1c6"},{"author":{"_account_id":15173,"name":"Rob Fletcher","email":"rfletch.vol@gmail.com","username":"fletcher"},"change_message_id":"bb2686fa98ef419f784aed057b991da487192d92","unresolved":false,"context_lines":[{"line_number":131,"context_line":"                filename \u003d item[0]"},{"line_number":132,"context_line":"                filelist \u003d item[1]"},{"line_number":133,"context_line":"                for x in filelist:"},{"line_number":134,"context_line":"                    line_nums \u003d x[0]"},{"line_number":135,"context_line":"                    error_label \u003d str(x[1]).strip()"},{"line_number":136,"context_line":"                    error_type \u003d str(x[2]).strip()"},{"line_number":137,"context_line":"                    reason \u003d str(x[3]).strip()"}],"source_content_type":"text/x-python","patch_set":1,"id":"ba7be1f8_c4d50b1d","line":134,"in_reply_to":"ba7be1f8_e9a82a8f","updated":"2015-02-24 17:07:29.000000000","message":"Yah, I most definitely agree. The order of the tuples changes depending on aggregate type. There is an XXX in the file to fix that. :)","commit_id":"1d099c5368b960dd90e00026966d9e76ecf1f1c6"},{"author":{"_account_id":11861,"name":"Travis McPeak","email":"tmcpeak@us.ibm.com","username":"travis-mcpeak"},"change_message_id":"e2185ddcace84bc6950049669ae635b29fe2fef9","unresolved":false,"context_lines":[{"line_number":170,"context_line":"                filelist \u003d item[1]"},{"line_number":171,"context_line":"                for x in filelist:"},{"line_number":172,"context_line":"                    filename \u003d str(x[0])"},{"line_number":173,"context_line":"                    line_num \u003d x[1]"},{"line_number":174,"context_line":"                    error_type \u003d str(x[2]).strip()"},{"line_number":175,"context_line":"                    reason \u003d str(x[3]).strip()"},{"line_number":176,"context_line":"                    code \u003d self.get_code(filename, line_num)"}],"source_content_type":"text/x-python","patch_set":1,"id":"ba7be1f8_a971d245","line":173,"updated":"2015-02-24 16:56:02.000000000","message":"is this not line_nums then?","commit_id":"1d099c5368b960dd90e00026966d9e76ecf1f1c6"},{"author":{"_account_id":15173,"name":"Rob Fletcher","email":"rfletch.vol@gmail.com","username":"fletcher"},"change_message_id":"bb2686fa98ef419f784aed057b991da487192d92","unresolved":false,"context_lines":[{"line_number":170,"context_line":"                filelist \u003d item[1]"},{"line_number":171,"context_line":"                for x in filelist:"},{"line_number":172,"context_line":"                    filename \u003d str(x[0])"},{"line_number":173,"context_line":"                    line_num \u003d x[1]"},{"line_number":174,"context_line":"                    error_type \u003d str(x[2]).strip()"},{"line_number":175,"context_line":"                    reason \u003d str(x[3]).strip()"},{"line_number":176,"context_line":"                    code \u003d self.get_code(filename, line_num)"}],"source_content_type":"text/x-python","patch_set":1,"id":"ba7be1f8_84ef93e8","line":173,"in_reply_to":"ba7be1f8_a971d245","updated":"2015-02-24 17:07:29.000000000","message":"\u0027tis, I just missed it. I\"ll adjust, nice catch","commit_id":"1d099c5368b960dd90e00026966d9e76ecf1f1c6"},{"author":{"_account_id":11861,"name":"Travis McPeak","email":"tmcpeak@us.ibm.com","username":"travis-mcpeak"},"change_message_id":"e2185ddcace84bc6950049669ae635b29fe2fef9","unresolved":false,"context_lines":[{"line_number":341,"context_line":"                        ))"},{"line_number":342,"context_line":""},{"line_number":343,"context_line":"                        tmpstr_list.append(self.get_code(filename,"},{"line_number":344,"context_line":"                                                         utils.lines_with_context(lineno,  # noqa"},{"line_number":345,"context_line":"                                                                                  lines,  # noqa"},{"line_number":346,"context_line":"                                                                                  max_lines),  # noqa"},{"line_number":347,"context_line":"                                                         True))"}],"source_content_type":"text/x-python","patch_set":1,"id":"ba7be1f8_c97b66f3","line":344,"updated":"2015-02-24 16:56:02.000000000","message":"hmmm, can we do something else here instead of noqa\u0027ing these lines?","commit_id":"1d099c5368b960dd90e00026966d9e76ecf1f1c6"},{"author":{"_account_id":15173,"name":"Rob Fletcher","email":"rfletch.vol@gmail.com","username":"fletcher"},"change_message_id":"bb2686fa98ef419f784aed057b991da487192d92","unresolved":false,"context_lines":[{"line_number":341,"context_line":"                        ))"},{"line_number":342,"context_line":""},{"line_number":343,"context_line":"                        tmpstr_list.append(self.get_code(filename,"},{"line_number":344,"context_line":"                                                         utils.lines_with_context(lineno,  # noqa"},{"line_number":345,"context_line":"                                                                                  lines,  # noqa"},{"line_number":346,"context_line":"                                                                                  max_lines),  # noqa"},{"line_number":347,"context_line":"                                                         True))"}],"source_content_type":"text/x-python","patch_set":1,"id":"ba7be1f8_84d95324","line":344,"in_reply_to":"ba7be1f8_c97b66f3","updated":"2015-02-24 17:07:29.000000000","message":"Done","commit_id":"1d099c5368b960dd90e00026966d9e76ecf1f1c6"},{"author":{"_account_id":11861,"name":"Travis McPeak","email":"tmcpeak@us.ibm.com","username":"travis-mcpeak"},"change_message_id":"e2185ddcace84bc6950049669ae635b29fe2fef9","unresolved":false,"context_lines":[{"line_number":415,"context_line":"        :param line_list: A list of integers corresponding to line numbers"},{"line_number":416,"context_line":"        :return: string of code"},{"line_number":417,"context_line":"        \u0027\u0027\u0027"},{"line_number":418,"context_line":"        issue_line \u003d []"},{"line_number":419,"context_line":"        prepend \u003d \"\""},{"line_number":420,"context_line":"        for l in line_list:"},{"line_number":421,"context_line":"            if l:"}],"source_content_type":"text/x-python","patch_set":1,"id":"ba7be1f8_c9c9a627","line":418,"updated":"2015-02-24 16:56:02.000000000","message":"cool","commit_id":"1d099c5368b960dd90e00026966d9e76ecf1f1c6"}],"bandit/core/utils.py":[{"author":{"_account_id":14692,"name":"Lucas Fisher","email":"lucas.fisher@gmail.com","username":"lucas.fisher"},"change_message_id":"611b2248689298f353cef0ac58531a0f11a688a1","unresolved":false,"context_lines":[{"line_number":89,"context_line":""},{"line_number":90,"context_line":""},{"line_number":91,"context_line":"def lines_with_context(line_range_list, context, max_line_no):"},{"line_number":92,"context_line":"    worker \u003d sorted(line_range_list)"},{"line_number":93,"context_line":"    complete \u003d set()"},{"line_number":94,"context_line":"    # add lines list is on"},{"line_number":95,"context_line":"    for l in worker:"}],"source_content_type":"text/x-python","patch_set":2,"id":"ba7be1f8_574c3d9e","line":92,"updated":"2015-02-25 15:06:29.000000000","message":"we could avoid this sorting if we used xrange","commit_id":"cb22848a0defa557acc960976a926c73d69ebaaf"},{"author":{"_account_id":15173,"name":"Rob Fletcher","email":"rfletch.vol@gmail.com","username":"fletcher"},"change_message_id":"b9e2532f247c6655a89cbce79fdcdb2a71363e77","unresolved":false,"context_lines":[{"line_number":89,"context_line":""},{"line_number":90,"context_line":""},{"line_number":91,"context_line":"def lines_with_context(line_range_list, context, max_line_no):"},{"line_number":92,"context_line":"    worker \u003d sorted(line_range_list)"},{"line_number":93,"context_line":"    complete \u003d set()"},{"line_number":94,"context_line":"    # add lines list is on"},{"line_number":95,"context_line":"    for l in worker:"}],"source_content_type":"text/x-python","patch_set":2,"id":"ba7be1f8_f5bd22d9","line":92,"in_reply_to":"ba7be1f8_574c3d9e","updated":"2015-02-25 17:30:28.000000000","message":"We can\u0027t use xrange because of non-sequential line ranges. See my other comment for more details.","commit_id":"cb22848a0defa557acc960976a926c73d69ebaaf"},{"author":{"_account_id":14692,"name":"Lucas Fisher","email":"lucas.fisher@gmail.com","username":"lucas.fisher"},"change_message_id":"611b2248689298f353cef0ac58531a0f11a688a1","unresolved":false,"context_lines":[{"line_number":92,"context_line":"    worker \u003d sorted(line_range_list)"},{"line_number":93,"context_line":"    complete \u003d set()"},{"line_number":94,"context_line":"    # add lines list is on"},{"line_number":95,"context_line":"    for l in worker:"},{"line_number":96,"context_line":"        complete.add(l)"},{"line_number":97,"context_line":""},{"line_number":98,"context_line":"    # add lines before warning"}],"source_content_type":"text/x-python","patch_set":2,"id":"ba7be1f8_378ee9d0","line":95,"updated":"2015-02-25 15:06:29.000000000","message":"complete \u003d set(worker) instead ?","commit_id":"cb22848a0defa557acc960976a926c73d69ebaaf"},{"author":{"_account_id":15173,"name":"Rob Fletcher","email":"rfletch.vol@gmail.com","username":"fletcher"},"change_message_id":"b9e2532f247c6655a89cbce79fdcdb2a71363e77","unresolved":false,"context_lines":[{"line_number":92,"context_line":"    worker \u003d sorted(line_range_list)"},{"line_number":93,"context_line":"    complete \u003d set()"},{"line_number":94,"context_line":"    # add lines list is on"},{"line_number":95,"context_line":"    for l in worker:"},{"line_number":96,"context_line":"        complete.add(l)"},{"line_number":97,"context_line":""},{"line_number":98,"context_line":"    # add lines before warning"}],"source_content_type":"text/x-python","patch_set":2,"id":"ba7be1f8_35ab3a8a","line":95,"in_reply_to":"ba7be1f8_378ee9d0","updated":"2015-02-25 17:30:28.000000000","message":"Sure, that makes sense. Will change.","commit_id":"cb22848a0defa557acc960976a926c73d69ebaaf"}]}