)]}'
{"bandit/plugins/xml.py":[{"author":{"_account_id":11861,"name":"Travis McPeak","email":"tmcpeak@us.ibm.com","username":"travis-mcpeak"},"change_message_id":"7004d010e8cb11fc7afe4606578d21694e2e1732","unresolved":false,"context_lines":[{"line_number":27,"context_line":"    if type(context.call_function_name_qual) \u003d\u003d str:"},{"line_number":28,"context_line":"        qlist \u003d context.call_function_name_qual.split(\u0027.\u0027)"},{"line_number":29,"context_line":"        func \u003d qlist[-1]"},{"line_number":30,"context_line":"        if (\u0027xml\u0027 in qlist and \u0027etree\u0027 in qlist and \u0027cElementTree\u0027 in qlist and"},{"line_number":31,"context_line":"                func in [\u0027parse\u0027, \u0027iterparse\u0027, \u0027fromstring\u0027, \u0027XMLParser\u0027]):"},{"line_number":32,"context_line":"            s \u003d (\"Using xml.etree.cElementTree.%s to parse untrusted XML data\""},{"line_number":33,"context_line":"                 \" is known to be vulnerable to XML attacks. Replace \""}],"source_content_type":"text/x-python","patch_set":1,"id":"bab921fb_1e5fa673","line":30,"updated":"2015-04-23 14:48:15.000000000","message":"is there some reason you did it like this instead of:\n\nif \"xml.etree.cElementTree\" in qlist?","commit_id":"28103dd1e0e00a5e49c823c73ef586063ad90337"},{"author":{"_account_id":15173,"name":"Rob Fletcher","email":"rfletch.vol@gmail.com","username":"fletcher"},"change_message_id":"e58ef0a9949594b5dd4fdddeb093651856ccd7e7","unresolved":false,"context_lines":[{"line_number":27,"context_line":"    if type(context.call_function_name_qual) \u003d\u003d str:"},{"line_number":28,"context_line":"        qlist \u003d context.call_function_name_qual.split(\u0027.\u0027)"},{"line_number":29,"context_line":"        func \u003d qlist[-1]"},{"line_number":30,"context_line":"        if (\u0027xml\u0027 in qlist and \u0027etree\u0027 in qlist and \u0027cElementTree\u0027 in qlist and"},{"line_number":31,"context_line":"                func in [\u0027parse\u0027, \u0027iterparse\u0027, \u0027fromstring\u0027, \u0027XMLParser\u0027]):"},{"line_number":32,"context_line":"            s \u003d (\"Using xml.etree.cElementTree.%s to parse untrusted XML data\""},{"line_number":33,"context_line":"                 \" is known to be vulnerable to XML attacks. Replace \""}],"source_content_type":"text/x-python","patch_set":1,"id":"bab921fb_6594cd36","line":30,"in_reply_to":"bab921fb_1e5fa673","updated":"2015-04-23 16:00:13.000000000","message":"Because we take the qualified name and split on \u0027.\u0027, which returns a list of strings. So \"xml.etree.cElementTree\" becomes [\"xml\", \"etree\", \"cElementTree\"]\n\nIf i do just:\n\n  if \u0027cElementTree\u0027 in qlist:\n\nIt\u0027s possible that its something other than \u0027xml.etree.cElementTree\u0027\n\nHope that makes sense. I agree it doesn\u0027t look the prettiest so I\u0027m definitely open to more elegant solutions. :)","commit_id":"28103dd1e0e00a5e49c823c73ef586063ad90337"},{"author":{"_account_id":15173,"name":"Rob Fletcher","email":"rfletch.vol@gmail.com","username":"fletcher"},"change_message_id":"528add21d0db0c95e647b0c068485fd5100fab31","unresolved":false,"context_lines":[{"line_number":27,"context_line":"    if type(context.call_function_name_qual) \u003d\u003d str:"},{"line_number":28,"context_line":"        qlist \u003d context.call_function_name_qual.split(\u0027.\u0027)"},{"line_number":29,"context_line":"        func \u003d qlist[-1]"},{"line_number":30,"context_line":"        if (\u0027xml\u0027 in qlist and \u0027etree\u0027 in qlist and \u0027cElementTree\u0027 in qlist and"},{"line_number":31,"context_line":"                func in [\u0027parse\u0027, \u0027iterparse\u0027, \u0027fromstring\u0027, \u0027XMLParser\u0027]):"},{"line_number":32,"context_line":"            s \u003d (\"Using xml.etree.cElementTree.%s to parse untrusted XML data\""},{"line_number":33,"context_line":"                 \" is known to be vulnerable to XML attacks. Replace \""}],"source_content_type":"text/x-python","patch_set":1,"id":"bab921fb_a9587ffb","line":30,"in_reply_to":"bab921fb_4009b72b","updated":"2015-04-23 16:42:55.000000000","message":"That makes sense. I was mainly following patterns in previous plug-ins, but I\u0027ll be the first to admit that\u0027s no justification. How does this look?\n\n\n     if type(context.call_function_name_qual) \u003d\u003d str:\n         qlist \u003d context.call_function_name_qual.split(\u0027.\u0027)\n         qual \u003d \u0027.\u0027.join(qlist[:-1])\n         func \u003d qlist[-1]\n         blacklist \u003d [\u0027parse\u0027, \u0027iterparse\u0027, \u0027fromstring\u0027, \u0027XMLParser\u0027]\n         if (\u0027xml.etree.cElementTree\u0027 \u003d\u003d qual and func in blacklist):","commit_id":"28103dd1e0e00a5e49c823c73ef586063ad90337"},{"author":{"_account_id":11861,"name":"Travis McPeak","email":"tmcpeak@us.ibm.com","username":"travis-mcpeak"},"change_message_id":"8fc5809086e439f5ea22c7b613300d76d9dc586c","unresolved":false,"context_lines":[{"line_number":27,"context_line":"    if type(context.call_function_name_qual) \u003d\u003d str:"},{"line_number":28,"context_line":"        qlist \u003d context.call_function_name_qual.split(\u0027.\u0027)"},{"line_number":29,"context_line":"        func \u003d qlist[-1]"},{"line_number":30,"context_line":"        if (\u0027xml\u0027 in qlist and \u0027etree\u0027 in qlist and \u0027cElementTree\u0027 in qlist and"},{"line_number":31,"context_line":"                func in [\u0027parse\u0027, \u0027iterparse\u0027, \u0027fromstring\u0027, \u0027XMLParser\u0027]):"},{"line_number":32,"context_line":"            s \u003d (\"Using xml.etree.cElementTree.%s to parse untrusted XML data\""},{"line_number":33,"context_line":"                 \" is known to be vulnerable to XML attacks. Replace \""}],"source_content_type":"text/x-python","patch_set":1,"id":"bab921fb_4009b72b","line":30,"in_reply_to":"bab921fb_6594cd36","updated":"2015-04-23 16:13:36.000000000","message":"I agree with you, but couldn\u0027t you just check if the qualname is \u0027xml.etree.cElementTree\u0027?","commit_id":"28103dd1e0e00a5e49c823c73ef586063ad90337"},{"author":{"_account_id":11861,"name":"Travis McPeak","email":"tmcpeak@us.ibm.com","username":"travis-mcpeak"},"change_message_id":"7d5e06169fc25fa9f57541575a06960dbf3af67b","unresolved":false,"context_lines":[{"line_number":27,"context_line":"    if type(context.call_function_name_qual) \u003d\u003d str:"},{"line_number":28,"context_line":"        qlist \u003d context.call_function_name_qual.split(\u0027.\u0027)"},{"line_number":29,"context_line":"        func \u003d qlist[-1]"},{"line_number":30,"context_line":"        if (\u0027xml\u0027 in qlist and \u0027etree\u0027 in qlist and \u0027cElementTree\u0027 in qlist and"},{"line_number":31,"context_line":"                func in [\u0027parse\u0027, \u0027iterparse\u0027, \u0027fromstring\u0027, \u0027XMLParser\u0027]):"},{"line_number":32,"context_line":"            s \u003d (\"Using xml.etree.cElementTree.%s to parse untrusted XML data\""},{"line_number":33,"context_line":"                 \" is known to be vulnerable to XML attacks. Replace \""}],"source_content_type":"text/x-python","patch_set":1,"id":"bab921fb_69cf0780","line":30,"in_reply_to":"bab921fb_a9587ffb","updated":"2015-04-23 16:44:40.000000000","message":"Looks good!","commit_id":"28103dd1e0e00a5e49c823c73ef586063ad90337"},{"author":{"_account_id":11861,"name":"Travis McPeak","email":"tmcpeak@us.ibm.com","username":"travis-mcpeak"},"change_message_id":"7004d010e8cb11fc7afe4606578d21694e2e1732","unresolved":false,"context_lines":[{"line_number":33,"context_line":"                 \" is known to be vulnerable to XML attacks. Replace \""},{"line_number":34,"context_line":"                 \" xml.etree.cElementTree.%s with defusedxml.cElementTree.%s\""},{"line_number":35,"context_line":"                 \" function.\")"},{"line_number":36,"context_line":"            return(bandit.ERROR, s % (func, func, func))"},{"line_number":37,"context_line":""},{"line_number":38,"context_line":""},{"line_number":39,"context_line":"@checks(\u0027Call\u0027)"}],"source_content_type":"text/x-python","patch_set":1,"id":"bab921fb_3ee82a7c","line":36,"updated":"2015-04-23 14:48:15.000000000","message":"as you pointed out, this will need to be updated to match new Bandit severity style with Jamie\u0027s commit","commit_id":"28103dd1e0e00a5e49c823c73ef586063ad90337"},{"author":{"_account_id":15173,"name":"Rob Fletcher","email":"rfletch.vol@gmail.com","username":"fletcher"},"change_message_id":"e58ef0a9949594b5dd4fdddeb093651856ccd7e7","unresolved":false,"context_lines":[{"line_number":33,"context_line":"                 \" is known to be vulnerable to XML attacks. Replace \""},{"line_number":34,"context_line":"                 \" xml.etree.cElementTree.%s with defusedxml.cElementTree.%s\""},{"line_number":35,"context_line":"                 \" function.\")"},{"line_number":36,"context_line":"            return(bandit.ERROR, s % (func, func, func))"},{"line_number":37,"context_line":""},{"line_number":38,"context_line":""},{"line_number":39,"context_line":"@checks(\u0027Call\u0027)"}],"source_content_type":"text/x-python","patch_set":1,"id":"bab921fb_e5c7bd43","line":36,"in_reply_to":"bab921fb_3ee82a7c","updated":"2015-04-23 16:00:13.000000000","message":"Yep, just waiting for that to land!","commit_id":"28103dd1e0e00a5e49c823c73ef586063ad90337"},{"author":{"_account_id":11861,"name":"Travis McPeak","email":"tmcpeak@us.ibm.com","username":"travis-mcpeak"},"change_message_id":"7004d010e8cb11fc7afe4606578d21694e2e1732","unresolved":false,"context_lines":[{"line_number":47,"context_line":"                 \" is known to be vulnerable to XML attacks. Replace\""},{"line_number":48,"context_line":"                 \" xml.etree.ElementTree.%s with defusedxml.ElementTree.%s\""},{"line_number":49,"context_line":"                 \" function.\")"},{"line_number":50,"context_line":"            return(bandit.ERROR, s % (func, func, func))"},{"line_number":51,"context_line":""},{"line_number":52,"context_line":""},{"line_number":53,"context_line":"@checks(\u0027Call\u0027)"}],"source_content_type":"text/x-python","patch_set":1,"id":"bab921fb_deadae32","line":50,"updated":"2015-04-23 14:48:15.000000000","message":"I\u0027m thinking medium severity for these, because the XML data might be trusted","commit_id":"28103dd1e0e00a5e49c823c73ef586063ad90337"},{"author":{"_account_id":11861,"name":"Travis McPeak","email":"tmcpeak@us.ibm.com","username":"travis-mcpeak"},"change_message_id":"8fc5809086e439f5ea22c7b613300d76d9dc586c","unresolved":false,"context_lines":[{"line_number":47,"context_line":"                 \" is known to be vulnerable to XML attacks. Replace\""},{"line_number":48,"context_line":"                 \" xml.etree.ElementTree.%s with defusedxml.ElementTree.%s\""},{"line_number":49,"context_line":"                 \" function.\")"},{"line_number":50,"context_line":"            return(bandit.ERROR, s % (func, func, func))"},{"line_number":51,"context_line":""},{"line_number":52,"context_line":""},{"line_number":53,"context_line":"@checks(\u0027Call\u0027)"}],"source_content_type":"text/x-python","patch_set":1,"id":"bab921fb_205da3e9","line":50,"in_reply_to":"bab921fb_25aa55d5","updated":"2015-04-23 16:13:36.000000000","message":"Yeah, you\u0027re right... sev: high, confidence: medium is probably what we want.","commit_id":"28103dd1e0e00a5e49c823c73ef586063ad90337"},{"author":{"_account_id":15173,"name":"Rob Fletcher","email":"rfletch.vol@gmail.com","username":"fletcher"},"change_message_id":"e58ef0a9949594b5dd4fdddeb093651856ccd7e7","unresolved":false,"context_lines":[{"line_number":47,"context_line":"                 \" is known to be vulnerable to XML attacks. Replace\""},{"line_number":48,"context_line":"                 \" xml.etree.ElementTree.%s with defusedxml.ElementTree.%s\""},{"line_number":49,"context_line":"                 \" function.\")"},{"line_number":50,"context_line":"            return(bandit.ERROR, s % (func, func, func))"},{"line_number":51,"context_line":""},{"line_number":52,"context_line":""},{"line_number":53,"context_line":"@checks(\u0027Call\u0027)"}],"source_content_type":"text/x-python","patch_set":1,"id":"bab921fb_25aa55d5","line":50,"in_reply_to":"bab921fb_deadae32","updated":"2015-04-23 16:00:13.000000000","message":"Yah, I had considered that but was thinking that HIGH was appropriate for severity and then I could set confidence to MEDIUM (or LOW if people prefer) since we can\u0027t know if the input is untrusted or not.\n\nWhat do you think?","commit_id":"28103dd1e0e00a5e49c823c73ef586063ad90337"}],"docs/xml.md":[{"author":{"_account_id":11861,"name":"Travis McPeak","email":"tmcpeak@us.ibm.com","username":"travis-mcpeak"},"change_message_id":"7004d010e8cb11fc7afe4606578d21694e2e1732","unresolved":false,"context_lines":[{"line_number":1,"context_line":"XML vulnerabilities"},{"line_number":2,"context_line":"\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d"},{"line_number":3,"context_line":"XML vulnerabilities are known and well studied. The [defusedxml](https://pypi.python.org/pypi/defusedxml/) library provides a great synposis of XML vulnerabilities, how they\u0027re exploited, and which Python libraries are vulnerable to which attacks."},{"line_number":4,"context_line":""}],"source_content_type":"text/x-markdown","patch_set":1,"id":"bab921fb_7e31020b","line":1,"updated":"2015-04-23 14:48:15.000000000","message":"Very awesome that you added the supporting document along with the new test!  To remain consistent with our other docs, this header should be phrased as a best practice, ie \"use a safe XML library to avoid vulnerabilities\" or something","commit_id":"28103dd1e0e00a5e49c823c73ef586063ad90337"},{"author":{"_account_id":15173,"name":"Rob Fletcher","email":"rfletch.vol@gmail.com","username":"fletcher"},"change_message_id":"e58ef0a9949594b5dd4fdddeb093651856ccd7e7","unresolved":false,"context_lines":[{"line_number":1,"context_line":"XML vulnerabilities"},{"line_number":2,"context_line":"\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d"},{"line_number":3,"context_line":"XML vulnerabilities are known and well studied. The [defusedxml](https://pypi.python.org/pypi/defusedxml/) library provides a great synposis of XML vulnerabilities, how they\u0027re exploited, and which Python libraries are vulnerable to which attacks."},{"line_number":4,"context_line":""}],"source_content_type":"text/x-markdown","patch_set":1,"id":"bab921fb_e5f57d83","line":1,"in_reply_to":"bab921fb_7e31020b","updated":"2015-04-23 16:00:13.000000000","message":"Sounds good. I\u0027m hoping to be adding a bunch more docs soon.","commit_id":"28103dd1e0e00a5e49c823c73ef586063ad90337"}],"tests/test_functional.py":[{"author":{"_account_id":11861,"name":"Travis McPeak","email":"tmcpeak@us.ibm.com","username":"travis-mcpeak"},"change_message_id":"7004d010e8cb11fc7afe4606578d21694e2e1732","unresolved":false,"context_lines":[{"line_number":70,"context_line":"        :param warn: The expected number of WARN-level issues to find"},{"line_number":71,"context_line":"        :param error: The expected number of ERROR-level issues to find"},{"line_number":72,"context_line":"        \u0027\u0027\u0027"},{"line_number":73,"context_line":"        # reset scors for subsequent calls to check_example"},{"line_number":74,"context_line":"        self.b_mgr.scores \u003d []"},{"line_number":75,"context_line":"        self.run_example(example_script)"},{"line_number":76,"context_line":"        expected \u003d sum([info * C.SEVERITY_VALUES[\u0027INFO\u0027],"}],"source_content_type":"text/x-python","patch_set":1,"id":"bab921fb_911a876d","line":73,"updated":"2015-04-23 14:48:15.000000000","message":"type: scores","commit_id":"28103dd1e0e00a5e49c823c73ef586063ad90337"},{"author":{"_account_id":15173,"name":"Rob Fletcher","email":"rfletch.vol@gmail.com","username":"fletcher"},"change_message_id":"e58ef0a9949594b5dd4fdddeb093651856ccd7e7","unresolved":false,"context_lines":[{"line_number":70,"context_line":"        :param warn: The expected number of WARN-level issues to find"},{"line_number":71,"context_line":"        :param error: The expected number of ERROR-level issues to find"},{"line_number":72,"context_line":"        \u0027\u0027\u0027"},{"line_number":73,"context_line":"        # reset scors for subsequent calls to check_example"},{"line_number":74,"context_line":"        self.b_mgr.scores \u003d []"},{"line_number":75,"context_line":"        self.run_example(example_script)"},{"line_number":76,"context_line":"        expected \u003d sum([info * C.SEVERITY_VALUES[\u0027INFO\u0027],"}],"source_content_type":"text/x-python","patch_set":1,"id":"bab921fb_a51d45bf","line":73,"in_reply_to":"bab921fb_911a876d","updated":"2015-04-23 16:00:13.000000000","message":"good catch, will fix","commit_id":"28103dd1e0e00a5e49c823c73ef586063ad90337"},{"author":{"_account_id":15304,"name":"Dave Belcher","email":"dave.belcher@hp.com","username":"hpbelch"},"change_message_id":"bc01e54ed1ead12631cabda419aeb7de66f9cae0","unresolved":false,"context_lines":[{"line_number":71,"context_line":"        :param error: The expected number of ERROR-level issues to find"},{"line_number":72,"context_line":"        \u0027\u0027\u0027"},{"line_number":73,"context_line":"        # reset scors for subsequent calls to check_example"},{"line_number":74,"context_line":"        self.b_mgr.scores \u003d []"},{"line_number":75,"context_line":"        self.run_example(example_script)"},{"line_number":76,"context_line":"        expected \u003d sum([info * C.SEVERITY_VALUES[\u0027INFO\u0027],"},{"line_number":77,"context_line":"                        warn * C.SEVERITY_VALUES[\u0027WARN\u0027],"}],"source_content_type":"text/x-python","patch_set":1,"id":"bab921fb_74bc816c","line":74,"updated":"2015-04-23 15:16:43.000000000","message":"Yup, looks good. I hadn\u0027t accounted for multiple calls per test, so this is a valid reset. Nice work.","commit_id":"28103dd1e0e00a5e49c823c73ef586063ad90337"},{"author":{"_account_id":11861,"name":"Travis McPeak","email":"tmcpeak@us.ibm.com","username":"travis-mcpeak"},"change_message_id":"7004d010e8cb11fc7afe4606578d21694e2e1732","unresolved":false,"context_lines":[{"line_number":71,"context_line":"        :param error: The expected number of ERROR-level issues to find"},{"line_number":72,"context_line":"        \u0027\u0027\u0027"},{"line_number":73,"context_line":"        # reset scors for subsequent calls to check_example"},{"line_number":74,"context_line":"        self.b_mgr.scores \u003d []"},{"line_number":75,"context_line":"        self.run_example(example_script)"},{"line_number":76,"context_line":"        expected \u003d sum([info * C.SEVERITY_VALUES[\u0027INFO\u0027],"},{"line_number":77,"context_line":"                        warn * C.SEVERITY_VALUES[\u0027WARN\u0027],"}],"source_content_type":"text/x-python","patch_set":1,"id":"bab921fb_b1346bde","line":74,"updated":"2015-04-23 14:48:15.000000000","message":"good catch","commit_id":"28103dd1e0e00a5e49c823c73ef586063ad90337"},{"author":{"_account_id":11861,"name":"Travis McPeak","email":"tmcpeak@us.ibm.com","username":"travis-mcpeak"},"change_message_id":"8fc5809086e439f5ea22c7b613300d76d9dc586c","unresolved":false,"context_lines":[{"line_number":71,"context_line":"        :param error: The expected number of ERROR-level issues to find"},{"line_number":72,"context_line":"        \u0027\u0027\u0027"},{"line_number":73,"context_line":"        # reset scors for subsequent calls to check_example"},{"line_number":74,"context_line":"        self.b_mgr.scores \u003d []"},{"line_number":75,"context_line":"        self.run_example(example_script)"},{"line_number":76,"context_line":"        expected \u003d sum([info * C.SEVERITY_VALUES[\u0027INFO\u0027],"},{"line_number":77,"context_line":"                        warn * C.SEVERITY_VALUES[\u0027WARN\u0027],"}],"source_content_type":"text/x-python","patch_set":1,"id":"bab921fb_e0f68bd6","line":74,"in_reply_to":"bab921fb_74bc816c","updated":"2015-04-23 16:13:36.000000000","message":"Done","commit_id":"28103dd1e0e00a5e49c823c73ef586063ad90337"},{"author":{"_account_id":15173,"name":"Rob Fletcher","email":"rfletch.vol@gmail.com","username":"fletcher"},"change_message_id":"e58ef0a9949594b5dd4fdddeb093651856ccd7e7","unresolved":false,"context_lines":[{"line_number":71,"context_line":"        :param error: The expected number of ERROR-level issues to find"},{"line_number":72,"context_line":"        \u0027\u0027\u0027"},{"line_number":73,"context_line":"        # reset scors for subsequent calls to check_example"},{"line_number":74,"context_line":"        self.b_mgr.scores \u003d []"},{"line_number":75,"context_line":"        self.run_example(example_script)"},{"line_number":76,"context_line":"        expected \u003d sum([info * C.SEVERITY_VALUES[\u0027INFO\u0027],"},{"line_number":77,"context_line":"                        warn * C.SEVERITY_VALUES[\u0027WARN\u0027],"}],"source_content_type":"text/x-python","patch_set":1,"id":"bab921fb_a54665bd","line":74,"in_reply_to":"bab921fb_74bc816c","updated":"2015-04-23 16:00:13.000000000","message":"Nice!","commit_id":"28103dd1e0e00a5e49c823c73ef586063ad90337"}]}