)]}'
{"bandit.yaml":[{"author":{"_account_id":12000,"name":"Ian Cordasco","email":"sigmavirus24@gmail.com","username":"sigmavirus24"},"change_message_id":"0995f7434149bd08f10233423e620f05ada44f49","unresolved":false,"context_lines":[{"line_number":59,"context_line":"            qualname: tempfile.mktemp"},{"line_number":60,"context_line":"            message: \"Use of insecure and deprecated function (mktemp).\""},{"line_number":61,"context_line":"        - eval:"},{"line_number":62,"context_line":"            name: eval, input"},{"line_number":63,"context_line":"            message: \"Use of possibly insecure function - consider using safer ast.literal_eval.\""},{"line_number":64,"context_line":"        - mark_safe:"},{"line_number":65,"context_line":"            name: mark_safe"}],"source_content_type":"text/x-yaml","patch_set":1,"id":"9a80dd14_32f1bf02","line":62,"updated":"2015-03-06 18:16:41.000000000","message":"Frankly, I\u0027m uncertain if any project is using raw_input, but if it\u0027s a py3 project, there is no raw_input and the evaluation part of input (on py2) has been removed. So the following on py3\n\n    input(\u0027Enter your favorite color: \u0027)\n\nIs equivalent to\n\n    raw_input(\"What is the southern migration path of the long necked swallow? \")\n\nIf that makes sense. Also you can use six.moves.input to write 2/3 compatible code if I remember correctly.\n\nThoughts?","commit_id":"d41227de7ed9c84d1418fda1df937af3753af79d"},{"author":{"_account_id":11861,"name":"Travis McPeak","email":"tmcpeak@us.ibm.com","username":"travis-mcpeak"},"change_message_id":"c8860049a50f3595447c291229b98d46432325a3","unresolved":false,"context_lines":[{"line_number":67,"context_line":"                      os.execvp, os.execvpe, os.spawnl, os.spawnle, os.spawnlp,"},{"line_number":68,"context_line":"                      os.spawnlpe, os.spawnv, os.spawnve, os.spawnvp, os.spawnvpe,"},{"line_number":69,"context_line":"                      os.startfile"},{"line_number":70,"context_line":"            message: \"Starting a new process.\""},{"line_number":71,"context_line":"        - md5:"},{"line_number":72,"context_line":"            qualname: hashlib.md5"},{"line_number":73,"context_line":"            message: \"Use of insecure MD5 hash function.\""}],"source_content_type":"text/x-yaml","patch_set":2,"id":"9a80dd14_1c520a3b","line":70,"updated":"2015-03-06 21:02:07.000000000","message":"what\u0027s our default? WARN?  I\u0027d probably be in favor of marking process starting by itself as INFO.","commit_id":"fe3705f44392fe0ebc88c970550ccba0a90302db"},{"author":{"_account_id":15338,"name":"David Wyde","username":"dwyde","inactive":true},"change_message_id":"4f8130464f1f6f125f2570aea123655b472da7c3","unresolved":false,"context_lines":[{"line_number":67,"context_line":"                      os.execvp, os.execvpe, os.spawnl, os.spawnle, os.spawnlp,"},{"line_number":68,"context_line":"                      os.spawnlpe, os.spawnv, os.spawnve, os.spawnvp, os.spawnvpe,"},{"line_number":69,"context_line":"                      os.startfile"},{"line_number":70,"context_line":"            message: \"Starting a new process.\""},{"line_number":71,"context_line":"        - md5:"},{"line_number":72,"context_line":"            qualname: hashlib.md5"},{"line_number":73,"context_line":"            message: \"Use of insecure MD5 hash function.\""}],"source_content_type":"text/x-yaml","patch_set":2,"id":"9a80dd14_53dab04c","line":70,"in_reply_to":"9a80dd14_1c520a3b","updated":"2015-03-06 22:09:01.000000000","message":"Yep, default is WARN. Will fix.","commit_id":"fe3705f44392fe0ebc88c970550ccba0a90302db"},{"author":{"_account_id":11861,"name":"Travis McPeak","email":"tmcpeak@us.ibm.com","username":"travis-mcpeak"},"change_message_id":"e1767297e2ebe21c42a2387f645d96714cb28416","unresolved":false,"context_lines":[{"line_number":74,"context_line":"            qualname: urllib.urlopen, urllib.urlretrieve, urllib.URLopener, urllib.FancyURLopener, urllib2.urlopen, urllib2.Request"},{"line_number":75,"context_line":"            message: \"Audit url open for permitted schemes. Allowing use of file:/ or custom schemes is often unexpected.\""},{"line_number":76,"context_line":""},{"line_number":77,"context_line":"    process_name_sets:"},{"line_number":78,"context_line":"        # Start a process using the subprocess module, or one of its wrappers."},{"line_number":79,"context_line":"        subprocess: [subprocess.Popen, subprocess.call, subprocess.check_call,"},{"line_number":80,"context_line":"                     subprocess.check_output, utils.execute, utils.execute_with_timeout]"}],"source_content_type":"text/x-yaml","patch_set":3,"id":"9a80dd14_a15f0940","line":77,"updated":"2015-03-07 22:21:17.000000000","message":"David - you can just add whatever you want to define as config for its own function.  Please see blacklist_functions for an example of how to do it.","commit_id":"7e657a03d96673f57cda71d83204b6811e8db563"}],"bandit/plugins/injection_shell.py":[{"author":{"_account_id":11861,"name":"Travis McPeak","email":"tmcpeak@us.ibm.com","username":"travis-mcpeak"},"change_message_id":"c8860049a50f3595447c291229b98d46432325a3","unresolved":false,"context_lines":[{"line_number":22,"context_line":"# FIXME: this should be read from the config."},{"line_number":23,"context_line":"_SUBPROCESS_NAMES \u003d set([\u0027subprocess.Popen\u0027, \u0027subprocess.call\u0027,"},{"line_number":24,"context_line":"                         \u0027subprocess.check_call\u0027, \u0027subprocess.check_output\u0027,"},{"line_number":25,"context_line":"                         \u0027utils.execute\u0027, \u0027utils.execute_with_timeout\u0027])"},{"line_number":26,"context_line":""},{"line_number":27,"context_line":""},{"line_number":28,"context_line":"@checks(\u0027Call\u0027)"}],"source_content_type":"text/x-python","patch_set":2,"id":"9a80dd14_9c243ac6","line":25,"updated":"2015-03-06 21:02:07.000000000","message":"yep, definitely put this in config... can you do it in this patchset?","commit_id":"fe3705f44392fe0ebc88c970550ccba0a90302db"},{"author":{"_account_id":15338,"name":"David Wyde","username":"dwyde","inactive":true},"change_message_id":"4f8130464f1f6f125f2570aea123655b472da7c3","unresolved":false,"context_lines":[{"line_number":22,"context_line":"# FIXME: this should be read from the config."},{"line_number":23,"context_line":"_SUBPROCESS_NAMES \u003d set([\u0027subprocess.Popen\u0027, \u0027subprocess.call\u0027,"},{"line_number":24,"context_line":"                         \u0027subprocess.check_call\u0027, \u0027subprocess.check_output\u0027,"},{"line_number":25,"context_line":"                         \u0027utils.execute\u0027, \u0027utils.execute_with_timeout\u0027])"},{"line_number":26,"context_line":""},{"line_number":27,"context_line":""},{"line_number":28,"context_line":"@checks(\u0027Call\u0027)"}],"source_content_type":"text/x-python","patch_set":2,"id":"9a80dd14_b35f6c40","line":25,"in_reply_to":"9a80dd14_9c243ac6","updated":"2015-03-06 22:09:01.000000000","message":"This one seems a little tricky to me. If I put these in bad_name_sets, they will get double-counted by this plugin and the blacklist_calls plugin. Maybe I create a separate \"shell_name_sets\" under blacklist_functions, and have this plugin handle that section?","commit_id":"fe3705f44392fe0ebc88c970550ccba0a90302db"},{"author":{"_account_id":11861,"name":"Travis McPeak","email":"tmcpeak@us.ibm.com","username":"travis-mcpeak"},"change_message_id":"2db8364bd02623e31e59c0d49fc94ed1fac0bb48","unresolved":false,"context_lines":[{"line_number":22,"context_line":"# FIXME: this should be read from the config."},{"line_number":23,"context_line":"_SUBPROCESS_NAMES \u003d set([\u0027subprocess.Popen\u0027, \u0027subprocess.call\u0027,"},{"line_number":24,"context_line":"                         \u0027subprocess.check_call\u0027, \u0027subprocess.check_output\u0027,"},{"line_number":25,"context_line":"                         \u0027utils.execute\u0027, \u0027utils.execute_with_timeout\u0027])"},{"line_number":26,"context_line":""},{"line_number":27,"context_line":""},{"line_number":28,"context_line":"@checks(\u0027Call\u0027)"}],"source_content_type":"text/x-python","patch_set":2,"id":"9a80dd14_416acdee","line":25,"in_reply_to":"9a80dd14_b35f6c40","updated":"2015-03-07 22:18:37.000000000","message":"How about we just move them out of blacklist_functions?  I\u0027d favor a complete plugin to handle all of these shell injection tests.  We can separate them logically by function, and each function can implement a config.","commit_id":"fe3705f44392fe0ebc88c970550ccba0a90302db"},{"author":{"_account_id":11861,"name":"Travis McPeak","email":"tmcpeak@us.ibm.com","username":"travis-mcpeak"},"change_message_id":"fa5a332e694c1fd99f8bd1d3db28008cd48ae676","unresolved":false,"context_lines":[{"line_number":19,"context_line":"from bandit.core.test_properties import takes_config"},{"line_number":20,"context_line":""},{"line_number":21,"context_line":""},{"line_number":22,"context_line":"@takes_config(\u0027blacklist_functions.process_name_sets.subprocess\u0027)"},{"line_number":23,"context_line":"@checks(\u0027Call\u0027)"},{"line_number":24,"context_line":"def subprocess_popen_with_shell_equals_true(context, config):"},{"line_number":25,"context_line":"    if config and context.call_function_name_qual in config:"}],"source_content_type":"text/x-python","patch_set":3,"id":"9a80dd14_14f55a56","line":22,"updated":"2015-03-09 12:39:41.000000000","message":"Let\u0027s just put this in its own config section, rather than adding onto blacklist_functions","commit_id":"7e657a03d96673f57cda71d83204b6811e8db563"},{"author":{"_account_id":11861,"name":"Travis McPeak","email":"tmcpeak@us.ibm.com","username":"travis-mcpeak"},"change_message_id":"fa5a332e694c1fd99f8bd1d3db28008cd48ae676","unresolved":false,"context_lines":[{"line_number":31,"context_line":"            return (bandit.INFO, \u0027subprocess call without a subshell.\u0027)"},{"line_number":32,"context_line":""},{"line_number":33,"context_line":""},{"line_number":34,"context_line":"@takes_config(\u0027blacklist_functions.process_name_sets.subprocess\u0027)"},{"line_number":35,"context_line":"@checks(\u0027Call\u0027)"},{"line_number":36,"context_line":"def any_other_function_with_shell_equals_true(context, config):"},{"line_number":37,"context_line":"    \u0027\u0027\u0027Alerts on any function call that includes a shell\u003dTrue parameter."}],"source_content_type":"text/x-python","patch_set":3,"id":"9a80dd14_7405b644","line":34,"updated":"2015-03-09 12:39:41.000000000","message":"same here... these should be in a separate section for the shell injection module","commit_id":"7e657a03d96673f57cda71d83204b6811e8db563"},{"author":{"_account_id":11861,"name":"Travis McPeak","email":"tmcpeak@us.ibm.com","username":"travis-mcpeak"},"change_message_id":"fa5a332e694c1fd99f8bd1d3db28008cd48ae676","unresolved":false,"context_lines":[{"line_number":46,"context_line":"                   context.call_args_string)"},{"line_number":47,"context_line":""},{"line_number":48,"context_line":""},{"line_number":49,"context_line":"@takes_config(\u0027blacklist_functions.process_name_sets.shell\u0027)"},{"line_number":50,"context_line":"@checks(\u0027Call\u0027)"},{"line_number":51,"context_line":"def start_process_with_a_shell(context, config):"},{"line_number":52,"context_line":"    if config and context.call_function_name_qual in config:"}],"source_content_type":"text/x-python","patch_set":3,"id":"9a80dd14_d4f6625c","line":49,"updated":"2015-03-09 12:39:41.000000000","message":"same","commit_id":"7e657a03d96673f57cda71d83204b6811e8db563"},{"author":{"_account_id":11861,"name":"Travis McPeak","email":"tmcpeak@us.ibm.com","username":"travis-mcpeak"},"change_message_id":"fa5a332e694c1fd99f8bd1d3db28008cd48ae676","unresolved":false,"context_lines":[{"line_number":54,"context_line":"                \u0027check for injection.\u0027)"},{"line_number":55,"context_line":""},{"line_number":56,"context_line":""},{"line_number":57,"context_line":"@takes_config(\u0027blacklist_functions.process_name_sets.no_shell\u0027)"},{"line_number":58,"context_line":"@checks(\u0027Call\u0027)"},{"line_number":59,"context_line":"def start_process_with_no_shell(context, config):"},{"line_number":60,"context_line":"    if config and context.call_function_name_qual in config:"}],"source_content_type":"text/x-python","patch_set":3,"id":"9a80dd14_149c7a0e","line":57,"updated":"2015-03-09 12:39:41.000000000","message":"same","commit_id":"7e657a03d96673f57cda71d83204b6811e8db563"}],"bandit/plugins/injection_wildcard.py":[{"author":{"_account_id":11861,"name":"Travis McPeak","email":"tmcpeak@us.ibm.com","username":"travis-mcpeak"},"change_message_id":"c8860049a50f3595447c291229b98d46432325a3","unresolved":false,"context_lines":[{"line_number":20,"context_line":""},{"line_number":21,"context_line":"@checks(\u0027Call\u0027)"},{"line_number":22,"context_line":"def linux_commands_wildcard_injection(context):"},{"line_number":23,"context_line":"    # FIXME: this list of system calls should be read from the config."},{"line_number":24,"context_line":"    system_calls \u003d [\u0027os.system\u0027, \u0027subprocess.Popen\u0027, \u0027os.popen\u0027]"},{"line_number":25,"context_line":"    vulnerable_funcs \u003d [\u0027chown\u0027, \u0027chmod\u0027, \u0027tar\u0027, \u0027rsync\u0027]"},{"line_number":26,"context_line":""}],"source_content_type":"text/x-python","patch_set":2,"id":"9a80dd14_bc049e18","line":23,"updated":"2015-03-06 21:02:07.000000000","message":"if you\u0027re calling it out, would you please add it?  should be fairly easy","commit_id":"fe3705f44392fe0ebc88c970550ccba0a90302db"},{"author":{"_account_id":11861,"name":"Travis McPeak","email":"tmcpeak@us.ibm.com","username":"travis-mcpeak"},"change_message_id":"2db8364bd02623e31e59c0d49fc94ed1fac0bb48","unresolved":false,"context_lines":[{"line_number":20,"context_line":""},{"line_number":21,"context_line":"@checks(\u0027Call\u0027)"},{"line_number":22,"context_line":"def linux_commands_wildcard_injection(context):"},{"line_number":23,"context_line":"    # FIXME: this list of system calls should be read from the config."},{"line_number":24,"context_line":"    system_calls \u003d [\u0027os.system\u0027, \u0027subprocess.Popen\u0027, \u0027os.popen\u0027]"},{"line_number":25,"context_line":"    vulnerable_funcs \u003d [\u0027chown\u0027, \u0027chmod\u0027, \u0027tar\u0027, \u0027rsync\u0027]"},{"line_number":26,"context_line":""}],"source_content_type":"text/x-python","patch_set":2,"id":"9a80dd14_214cf99d","line":23,"in_reply_to":"9a80dd14_b6691ac0","updated":"2015-03-07 22:18:37.000000000","message":"Cool, as with shell injection, how about if we just move these into a config for this function?  Then you don\u0027t need to re-architect blacklist_function to get this fix in.","commit_id":"fe3705f44392fe0ebc88c970550ccba0a90302db"},{"author":{"_account_id":15338,"name":"David Wyde","username":"dwyde","inactive":true},"change_message_id":"4f8130464f1f6f125f2570aea123655b472da7c3","unresolved":false,"context_lines":[{"line_number":20,"context_line":""},{"line_number":21,"context_line":"@checks(\u0027Call\u0027)"},{"line_number":22,"context_line":"def linux_commands_wildcard_injection(context):"},{"line_number":23,"context_line":"    # FIXME: this list of system calls should be read from the config."},{"line_number":24,"context_line":"    system_calls \u003d [\u0027os.system\u0027, \u0027subprocess.Popen\u0027, \u0027os.popen\u0027]"},{"line_number":25,"context_line":"    vulnerable_funcs \u003d [\u0027chown\u0027, \u0027chmod\u0027, \u0027tar\u0027, \u0027rsync\u0027]"},{"line_number":26,"context_line":""}],"source_content_type":"text/x-python","patch_set":2,"id":"9a80dd14_b6691ac0","line":23,"in_reply_to":"9a80dd14_bc049e18","updated":"2015-03-06 22:09:01.000000000","message":"This will be straightforward if I do the shell_name_sets I mentioned in my injection_shell.py comment response. Otherwise, I think I\u0027d need to make the bad_name_sets into a dict instead of a list, to pull out all the names.","commit_id":"fe3705f44392fe0ebc88c970550ccba0a90302db"},{"author":{"_account_id":11861,"name":"Travis McPeak","email":"tmcpeak@us.ibm.com","username":"travis-mcpeak"},"change_message_id":"fa5a332e694c1fd99f8bd1d3db28008cd48ae676","unresolved":false,"context_lines":[{"line_number":18,"context_line":"from bandit.core.test_properties import *"},{"line_number":19,"context_line":""},{"line_number":20,"context_line":""},{"line_number":21,"context_line":"@takes_config(\u0027blacklist_functions.process_name_sets\u0027)"},{"line_number":22,"context_line":"@checks(\u0027Call\u0027)"},{"line_number":23,"context_line":"def linux_commands_wildcard_injection(context, config):"},{"line_number":24,"context_line":"    vulnerable_funcs \u003d [\u0027chown\u0027, \u0027chmod\u0027, \u0027tar\u0027, \u0027rsync\u0027]"}],"source_content_type":"text/x-python","patch_set":3,"id":"9a80dd14_94878ab4","line":21,"updated":"2015-03-09 12:39:41.000000000","message":"move to own config section","commit_id":"7e657a03d96673f57cda71d83204b6811e8db563"},{"author":{"_account_id":11861,"name":"Travis McPeak","email":"tmcpeak@us.ibm.com","username":"travis-mcpeak"},"change_message_id":"6420d41273f938967ec6b3f9118fa4c6d86842d6","unresolved":false,"context_lines":[{"line_number":21,"context_line":"@takes_config(\u0027shell_injection\u0027)"},{"line_number":22,"context_line":"@checks(\u0027Call\u0027)"},{"line_number":23,"context_line":"def linux_commands_wildcard_injection(context, config):"},{"line_number":24,"context_line":"    vulnerable_funcs \u003d [\u0027chown\u0027, \u0027chmod\u0027, \u0027tar\u0027, \u0027rsync\u0027]"},{"line_number":25,"context_line":"    system_calls \u003d config[\u0027subprocess\u0027] + config[\u0027shell\u0027] + config[\u0027no_shell\u0027]"},{"line_number":26,"context_line":"    if context.call_function_name_qual in system_calls:"},{"line_number":27,"context_line":"        if context.call_args_count \u003d\u003d 1:"}],"source_content_type":"text/x-python","patch_set":4,"id":"9a80dd14_10571303","line":24,"updated":"2015-03-09 20:22:11.000000000","message":"In my mind wildcard injection and shell injection are slightly separate vuln types, which is why they are different plugins.  Let\u0027s have separate configs for them too.","commit_id":"34144381d06d88f8b2f26b6f15654870214d9a08"}],"examples/marshal_deserialize.py":[{"author":{"_account_id":11861,"name":"Travis McPeak","email":"tmcpeak@us.ibm.com","username":"travis-mcpeak"},"change_message_id":"fa5a332e694c1fd99f8bd1d3db28008cd48ae676","unresolved":false,"context_lines":[{"line_number":7,"context_line":""},{"line_number":8,"context_line":"file_obj \u003d tempfile.TemporaryFile()"},{"line_number":9,"context_line":"marshal.dump(range(5), file_obj)"},{"line_number":10,"context_line":"file_obj.seek(0)"},{"line_number":11,"context_line":"print marshal.load(file_obj)"},{"line_number":12,"context_line":"file_obj.close()"}],"source_content_type":"text/x-python","patch_set":3,"id":"9a80dd14_9475cacc","line":10,"updated":"2015-03-09 12:39:41.000000000","message":"anything benign from the marshal class we want to put here to make sure we don\u0027t trigger false positives?","commit_id":"7e657a03d96673f57cda71d83204b6811e8db563"}],"examples/os_system.py":[{"author":{"_account_id":11861,"name":"Travis McPeak","email":"tmcpeak@us.ibm.com","username":"travis-mcpeak"},"change_message_id":"c8860049a50f3595447c291229b98d46432325a3","unresolved":false,"context_lines":[{"line_number":1,"context_line":"import os"},{"line_number":2,"context_line":""},{"line_number":3,"context_line":"os.system(\u0027echo hi\u0027)"}],"source_content_type":"text/x-python","patch_set":2,"id":"9a80dd14_1707451a","line":3,"updated":"2015-03-06 21:02:07.000000000","message":"what are we testing here?","commit_id":"fe3705f44392fe0ebc88c970550ccba0a90302db"},{"author":{"_account_id":15338,"name":"David Wyde","username":"dwyde","inactive":true},"change_message_id":"4f8130464f1f6f125f2570aea123655b472da7c3","unresolved":false,"context_lines":[{"line_number":1,"context_line":"import os"},{"line_number":2,"context_line":""},{"line_number":3,"context_line":"os.system(\u0027echo hi\u0027)"}],"source_content_type":"text/x-python","patch_set":2,"id":"9a80dd14_33bc5cdc","line":3,"in_reply_to":"9a80dd14_1707451a","updated":"2015-03-06 22:09:01.000000000","message":"os.system was previously overlooked entirely. Should I combine this with another test, maybe os-startfile.py?","commit_id":"fe3705f44392fe0ebc88c970550ccba0a90302db"}],"examples/utils-shell.py":[{"author":{"_account_id":11861,"name":"Travis McPeak","email":"tmcpeak@us.ibm.com","username":"travis-mcpeak"},"change_message_id":"c8860049a50f3595447c291229b98d46432325a3","unresolved":false,"context_lines":[{"line_number":5,"context_line":"utils.execute(\u0027gcc --version\u0027, shell\u003dTrue)"},{"line_number":6,"context_line":"u.execute_with_timeout(\u0027gcc --version\u0027, shell\u003dTrue)"},{"line_number":7,"context_line":"utils.execute_with_timeout(\u0027gcc --version\u0027, shell\u003dTrue)"},{"line_number":8,"context_line":"utils.execute_with_timeout([\u0027gcc\u0027, \u0027--version\u0027], shell\u003dFalse)"},{"line_number":9,"context_line":""},{"line_number":10,"context_line":""}],"source_content_type":"text/x-python","patch_set":2,"id":"9a80dd14_d7468d4e","line":8,"updated":"2015-03-06 21:02:07.000000000","message":"good catch","commit_id":"fe3705f44392fe0ebc88c970550ccba0a90302db"}],"tests/test_functional.py":[{"author":{"_account_id":11861,"name":"Travis McPeak","email":"tmcpeak@us.ibm.com","username":"travis-mcpeak"},"change_message_id":"c8860049a50f3595447c291229b98d46432325a3","unresolved":false,"context_lines":[{"line_number":204,"context_line":""},{"line_number":205,"context_line":"    def test_utils_shell(self):"},{"line_number":206,"context_line":"        \u0027\u0027\u0027Test for `utils.execute*` with `shell\u003dTrue`.\u0027\u0027\u0027"},{"line_number":207,"context_line":"        # FIXME: subprocess calls with shell\u003dTrue are double-counted."},{"line_number":208,"context_line":"        self.check_example(\u0027utils-shell.py\u0027, warn\u003d5, error\u003d4)"},{"line_number":209,"context_line":""},{"line_number":210,"context_line":"    def test_wildcard_injection(self):"}],"source_content_type":"text/x-python","patch_set":2,"id":"9a80dd14_9767b5e8","line":207,"updated":"2015-03-06 21:02:07.000000000","message":"why?","commit_id":"fe3705f44392fe0ebc88c970550ccba0a90302db"},{"author":{"_account_id":15338,"name":"David Wyde","username":"dwyde","inactive":true},"change_message_id":"4f8130464f1f6f125f2570aea123655b472da7c3","unresolved":false,"context_lines":[{"line_number":204,"context_line":""},{"line_number":205,"context_line":"    def test_utils_shell(self):"},{"line_number":206,"context_line":"        \u0027\u0027\u0027Test for `utils.execute*` with `shell\u003dTrue`.\u0027\u0027\u0027"},{"line_number":207,"context_line":"        # FIXME: subprocess calls with shell\u003dTrue are double-counted."},{"line_number":208,"context_line":"        self.check_example(\u0027utils-shell.py\u0027, warn\u003d5, error\u003d4)"},{"line_number":209,"context_line":""},{"line_number":210,"context_line":"    def test_wildcard_injection(self):"}],"source_content_type":"text/x-python","patch_set":2,"id":"9a80dd14_b3968c4a","line":207,"in_reply_to":"9a80dd14_9767b5e8","updated":"2015-03-06 22:09:01.000000000","message":"Currently flagged once in blacklist_functions and once in the injection_shell.py plugin, even on master.","commit_id":"fe3705f44392fe0ebc88c970550ccba0a90302db"}]}