)]}'
{"bandit/plugins/app_debug.py":[{"author":{"_account_id":8119,"name":"Eric Brown","email":"eric_wade_brown@yahoo.com","username":"ericwb"},"change_message_id":"52cbb689f75b73fe8e916656d7af49e58515d8c5","unresolved":false,"context_lines":[{"line_number":1,"context_line":"# -*- coding:utf-8 -*-"},{"line_number":2,"context_line":"#"},{"line_number":3,"context_line":"# Copyright 2014 Hewlett-Packard Development Company, L.P."},{"line_number":4,"context_line":"#"},{"line_number":5,"context_line":"# Licensed under the Apache License, Version 2.0 (the \"License\"); you may"},{"line_number":6,"context_line":"# not use this file except in compliance with the License. You may obtain"}],"source_content_type":"text/x-python","patch_set":3,"id":"7a2fa921_0b48a62c","line":3,"updated":"2015-10-12 23:20:02.000000000","message":"2015","commit_id":"02d8853c51956a5b4e3da0013828bb9b7a3553fa"},{"author":{"_account_id":11029,"name":"Jamie Finnigan","email":"jamiefinnigan@gmail.com","username":"jamiefinnigan"},"change_message_id":"944998b96b0a0f387f90869be4939fd9ba6f27eb","unresolved":false,"context_lines":[{"line_number":1,"context_line":"# -*- coding:utf-8 -*-"},{"line_number":2,"context_line":"#"},{"line_number":3,"context_line":"# Copyright 2014 Hewlett-Packard Development Company, L.P."},{"line_number":4,"context_line":"#"},{"line_number":5,"context_line":"# Licensed under the Apache License, Version 2.0 (the \"License\"); you may"},{"line_number":6,"context_line":"# not use this file except in compliance with the License. You may obtain"}],"source_content_type":"text/x-python","patch_set":3,"id":"5a2ca52d_66496ed0","line":3,"in_reply_to":"7a2fa921_0b48a62c","updated":"2015-10-13 14:39:14.000000000","message":"Done","commit_id":"02d8853c51956a5b4e3da0013828bb9b7a3553fa"},{"author":{"_account_id":11861,"name":"Travis McPeak","email":"tmcpeak@us.ibm.com","username":"travis-mcpeak"},"change_message_id":"28007bdfcb32b4df1e7b67d24dbfe2020a5bcf5b","unresolved":false,"context_lines":[{"line_number":25,"context_line":"            if context.check_call_arg_value(\u0027debug\u0027, \u0027True\u0027):"},{"line_number":26,"context_line":"                return bandit.Issue("},{"line_number":27,"context_line":"                    severity\u003dbandit.HIGH,"},{"line_number":28,"context_line":"                    confidence\u003dbandit.HIGH,"},{"line_number":29,"context_line":"                    text\u003d\"A Flask app appears to be run with debug\u003dTrue, \""},{"line_number":30,"context_line":"                         \"which exposes the Werkzeug debugger and allows \""},{"line_number":31,"context_line":"                         \"the execution of arbitrary code.\""}],"source_content_type":"text/x-python","patch_set":3,"id":"7a2fa921_ef33ecf4","line":28,"updated":"2015-10-13 06:08:53.000000000","message":"I\u0027m inclined to set confidence MEDIUM, just because we aren\u0027t 100% sure - they could be calling something else with run(debug\u003dTrue)","commit_id":"02d8853c51956a5b4e3da0013828bb9b7a3553fa"},{"author":{"_account_id":11029,"name":"Jamie Finnigan","email":"jamiefinnigan@gmail.com","username":"jamiefinnigan"},"change_message_id":"944998b96b0a0f387f90869be4939fd9ba6f27eb","unresolved":false,"context_lines":[{"line_number":25,"context_line":"            if context.check_call_arg_value(\u0027debug\u0027, \u0027True\u0027):"},{"line_number":26,"context_line":"                return bandit.Issue("},{"line_number":27,"context_line":"                    severity\u003dbandit.HIGH,"},{"line_number":28,"context_line":"                    confidence\u003dbandit.HIGH,"},{"line_number":29,"context_line":"                    text\u003d\"A Flask app appears to be run with debug\u003dTrue, \""},{"line_number":30,"context_line":"                         \"which exposes the Werkzeug debugger and allows \""},{"line_number":31,"context_line":"                         \"the execution of arbitrary code.\""}],"source_content_type":"text/x-python","patch_set":3,"id":"5a2ca52d_261296b5","line":28,"in_reply_to":"7a2fa921_ef33ecf4","updated":"2015-10-13 14:39:14.000000000","message":"Done","commit_id":"02d8853c51956a5b4e3da0013828bb9b7a3553fa"},{"author":{"_account_id":12000,"name":"Ian Cordasco","email":"sigmavirus24@gmail.com","username":"sigmavirus24"},"change_message_id":"efd8ccd89423ae60933576910d71c85b5dfab9c7","unresolved":false,"context_lines":[{"line_number":20,"context_line":""},{"line_number":21,"context_line":"@checks(\u0027Call\u0027)"},{"line_number":22,"context_line":"def flask_debug_true(context):"},{"line_number":23,"context_line":"    if context.is_module_imported_like(\u0027flask\u0027):"},{"line_number":24,"context_line":"        if context.call_function_name_qual.endswith(\u0027.run\u0027):"},{"line_number":25,"context_line":"            if context.check_call_arg_value(\u0027debug\u0027, \u0027True\u0027):"},{"line_number":26,"context_line":"                return bandit.Issue("}],"source_content_type":"text/x-python","patch_set":5,"id":"5a2ca52d_f738853f","line":23,"updated":"2015-10-14 22:00:16.000000000","message":"This could be rewritten as one long and\u0027ed statement, e.g.,\n\n    if (context.is_module_imported_like(\u0027flask\u0027) and\n            context.call_function_name_qual.endswith(\u0027.run\u0027) and\n            context.check_call_arg_value(\u0027debug\u0027, \u0027True\u0027)):\n        return bandit.Issue(...)","commit_id":"517ab2f7abf1f5c17956a38589b235c76aa84323"}],"docs/source/tests/flask_debug_true.rst":[{"author":{"_account_id":8119,"name":"Eric Brown","email":"eric_wade_brown@yahoo.com","username":"ericwb"},"change_message_id":"4ad5a1ea68e34064fe38548a548c6edc3d415762","unresolved":false,"context_lines":[{"line_number":14,"context_line":""},{"line_number":15,"context_line":"Available Since"},{"line_number":16,"context_line":"---------------"},{"line_number":17,"context_line":" - Bandit v0.15.0"},{"line_number":18,"context_line":""},{"line_number":19,"context_line":"Config Options"},{"line_number":20,"context_line":"--------------"}],"source_content_type":"text/x-rst","patch_set":5,"id":"5a2ca52d_1130b69d","line":17,"updated":"2015-10-14 18:26:26.000000000","message":"So does this mean we don\u0027t want to merged until after we cut 0.14?","commit_id":"517ab2f7abf1f5c17956a38589b235c76aa84323"},{"author":{"_account_id":11029,"name":"Jamie Finnigan","email":"jamiefinnigan@gmail.com","username":"jamiefinnigan"},"change_message_id":"b61e223dd077ce7fa7fa921e90b3214c6be9c351","unresolved":false,"context_lines":[{"line_number":14,"context_line":""},{"line_number":15,"context_line":"Available Since"},{"line_number":16,"context_line":"---------------"},{"line_number":17,"context_line":" - Bandit v0.15.0"},{"line_number":18,"context_line":""},{"line_number":19,"context_line":"Config Options"},{"line_number":20,"context_line":"--------------"}],"source_content_type":"text/x-rst","patch_set":5,"id":"5a2ca52d_91cda65f","line":17,"in_reply_to":"5a2ca52d_1130b69d","updated":"2015-10-14 18:34:09.000000000","message":"Heh, I was just guessing at what the next version # might be.  Not sure how we\u0027ve done this for other new docs - better to just use a placeholder/TBD and have updating those on the release checklist?","commit_id":"517ab2f7abf1f5c17956a38589b235c76aa84323"},{"author":{"_account_id":8119,"name":"Eric Brown","email":"eric_wade_brown@yahoo.com","username":"ericwb"},"change_message_id":"7b60ea82a34306ea72e67e4083ea7b8d2850867e","unresolved":false,"context_lines":[{"line_number":14,"context_line":""},{"line_number":15,"context_line":"Available Since"},{"line_number":16,"context_line":"---------------"},{"line_number":17,"context_line":" - Bandit v0.15.0"},{"line_number":18,"context_line":""},{"line_number":19,"context_line":"Config Options"},{"line_number":20,"context_line":"--------------"}],"source_content_type":"text/x-rst","patch_set":5,"id":"3a29b11f_6981438f","line":17,"in_reply_to":"5a2ca52d_5ea82577","updated":"2015-10-18 21:22:37.000000000","message":"Agreed","commit_id":"517ab2f7abf1f5c17956a38589b235c76aa84323"},{"author":{"_account_id":11716,"name":"Tim Kelsey","email":"timothy.kelsey@uk.ibm.com","username":"tkelsey"},"change_message_id":"55352073dcdf4d8b78c29aaf8047c617dc8f8e93","unresolved":false,"context_lines":[{"line_number":14,"context_line":""},{"line_number":15,"context_line":"Available Since"},{"line_number":16,"context_line":"---------------"},{"line_number":17,"context_line":" - Bandit v0.15.0"},{"line_number":18,"context_line":""},{"line_number":19,"context_line":"Config Options"},{"line_number":20,"context_line":"--------------"}],"source_content_type":"text/x-rst","patch_set":5,"id":"5a2ca52d_5ea82577","line":17,"in_reply_to":"5a2ca52d_91cda65f","updated":"2015-10-16 09:46:43.000000000","message":"The next version will be 0.15.0, but it would be better to add in a token that we can grep for pre-release probably.","commit_id":"517ab2f7abf1f5c17956a38589b235c76aa84323"}]}