)]}'
{"/COMMIT_MSG":[{"author":{"_account_id":5707,"name":"Henry Nash","email":"henryn@linux.vnet.ibm.com","username":"henry-nash"},"change_message_id":"e60197c2d8b2497367f10158df25f297fc1b207d","unresolved":false,"context_lines":[{"line_number":10,"context_line":"requirements.txt. This version updated the standard"},{"line_number":11,"context_line":"configuration for the blacklist_imports test."},{"line_number":12,"context_line":""},{"line_number":13,"context_line":"The new config flags use of subprocess to indicate that"},{"line_number":14,"context_line":"developers need to verify that this isn\u0027t used in secure context."},{"line_number":15,"context_line":"The use in keystone is safe, so it\u0027s marked in the code as not an"},{"line_number":16,"context_line":"issue."}],"source_content_type":"text/x-gerrit-commit-message","patch_set":1,"id":"ba15a1d1_189fbab5","line":13,"updated":"2015-09-19 09:12:10.000000000","message":"nit: similar comment to early patch as to whether the sentence parses correctly....","commit_id":"e1df7a1ce4cf3fdfc08d75f2ef3b151413b12c02"},{"author":{"_account_id":6486,"name":"Brant Knudson","email":"blk@acm.org","username":"blk-u"},"change_message_id":"9a67a2bd4e53bb5604abe55df47329b7f08373a3","unresolved":false,"context_lines":[{"line_number":10,"context_line":"requirements.txt. This version updated the standard"},{"line_number":11,"context_line":"configuration for the blacklist_imports test."},{"line_number":12,"context_line":""},{"line_number":13,"context_line":"The new config flags use of subprocess to indicate that"},{"line_number":14,"context_line":"developers need to verify that this isn\u0027t used in secure context."},{"line_number":15,"context_line":"The use in keystone is safe, so it\u0027s marked in the code as not an"},{"line_number":16,"context_line":"issue."}],"source_content_type":"text/x-gerrit-commit-message","patch_set":1,"id":"ba15a1d1_ea768cd7","line":13,"in_reply_to":"ba15a1d1_189fbab5","updated":"2015-09-21 14:50:38.000000000","message":"reworded.","commit_id":"e1df7a1ce4cf3fdfc08d75f2ef3b151413b12c02"},{"author":{"_account_id":5707,"name":"Henry Nash","email":"henryn@linux.vnet.ibm.com","username":"henry-nash"},"change_message_id":"2b8d236b3903a1710ebba3f3a1aa1288604d8139","unresolved":false,"context_lines":[{"line_number":13,"context_line":"With the new config, use of subprocess is flagged to indicate"},{"line_number":14,"context_line":"that developers need to verify that this isn\u0027t used in secure"},{"line_number":15,"context_line":"context. The use in keystone is safe, so it\u0027s marked in the"},{"line_number":16,"context_line":"code as secure use."},{"line_number":17,"context_line":""},{"line_number":18,"context_line":"Change-Id: I020d3fa4fac4086b3264114a661326644e045df7"}],"source_content_type":"text/x-gerrit-commit-message","patch_set":3,"id":"ba15a1d1_5244eab5","line":16,"updated":"2015-09-22 07:03:08.000000000","message":"nit: I guess we are really marking it as \"not used in secure context\" (or something like that), given that the tag is #nosec ?","commit_id":"dec28f856da5742653b16467ae0d8f18372312b4"}],"bandit.yaml":[{"author":{"_account_id":17123,"name":"Tom Cocozzello (tjcocozz)","email":"tjcocozz@us.ibm.com","username":"tcocozzello"},"change_message_id":"9bd6bafac56fadcdf27ccc6062167d897ade9039","unresolved":false,"context_lines":[{"line_number":217,"context_line":"                      xml.dom.pulldom,"},{"line_number":218,"context_line":"                      lxml.etree,"},{"line_number":219,"context_line":"                      lxml]"},{"line_number":220,"context_line":"            message: \"Using {module} to parse untrusted XML data is known to be vulnerable to XML attacks. Replace {module} with the equivilent defusedxml package.\""},{"line_number":221,"context_line":"            level: LOW"},{"line_number":222,"context_line":"        - xml_libs_high:"},{"line_number":223,"context_line":"            imports: [xmlrpclib]"}],"source_content_type":"text/x-yaml","patch_set":4,"id":"ba15a1d1_82578201","line":220,"updated":"2015-09-22 13:25:54.000000000","message":"s/equivilent/equivalent/","commit_id":"7b1e1cb90d6ad86e6f681c529cf25578cb046784"},{"author":{"_account_id":6486,"name":"Brant Knudson","email":"blk@acm.org","username":"blk-u"},"change_message_id":"4fb75e9870d228ddebfe2a3b56530e2083426c40","unresolved":false,"context_lines":[{"line_number":217,"context_line":"                      xml.dom.pulldom,"},{"line_number":218,"context_line":"                      lxml.etree,"},{"line_number":219,"context_line":"                      lxml]"},{"line_number":220,"context_line":"            message: \"Using {module} to parse untrusted XML data is known to be vulnerable to XML attacks. Replace {module} with the equivilent defusedxml package.\""},{"line_number":221,"context_line":"            level: LOW"},{"line_number":222,"context_line":"        - xml_libs_high:"},{"line_number":223,"context_line":"            imports: [xmlrpclib]"}],"source_content_type":"text/x-yaml","patch_set":4,"id":"ba15a1d1_85ca2ca0","line":220,"in_reply_to":"ba15a1d1_82578201","updated":"2015-09-22 13:45:36.000000000","message":"this is copied from bandit.yaml, so make the fix in the bandit project and we\u0027ll pick it up next time we sync.","commit_id":"7b1e1cb90d6ad86e6f681c529cf25578cb046784"},{"author":{"_account_id":17123,"name":"Tom Cocozzello (tjcocozz)","email":"tjcocozz@us.ibm.com","username":"tcocozzello"},"change_message_id":"3e3eb8aed848c25dda4ac8cd7c7e27c372eb3166","unresolved":false,"context_lines":[{"line_number":217,"context_line":"                      xml.dom.pulldom,"},{"line_number":218,"context_line":"                      lxml.etree,"},{"line_number":219,"context_line":"                      lxml]"},{"line_number":220,"context_line":"            message: \"Using {module} to parse untrusted XML data is known to be vulnerable to XML attacks. Replace {module} with the equivilent defusedxml package.\""},{"line_number":221,"context_line":"            level: LOW"},{"line_number":222,"context_line":"        - xml_libs_high:"},{"line_number":223,"context_line":"            imports: [xmlrpclib]"}],"source_content_type":"text/x-yaml","patch_set":4,"id":"ba15a1d1_92aee596","line":220,"in_reply_to":"ba15a1d1_85ca2ca0","updated":"2015-09-22 16:38:56.000000000","message":"It\u0027s already done in the bandit project, so you will be good to go next time you sync.","commit_id":"7b1e1cb90d6ad86e6f681c529cf25578cb046784"}],"keystone/common/environment/__init__.py":[{"author":{"_account_id":4,"name":"Dolph Mathews","email":"dolph.mathews@gmail.com","username":"dolph"},"change_message_id":"e4ad975ccb85242e06532cc845cecb9ff0e18bbf","unresolved":false,"context_lines":[{"line_number":95,"context_line":"    global httplib, subprocess"},{"line_number":96,"context_line":""},{"line_number":97,"context_line":"    import six.moves.http_client as _httplib"},{"line_number":98,"context_line":"    import subprocess as _subprocess  # nosec"},{"line_number":99,"context_line":""},{"line_number":100,"context_line":"    httplib \u003d _httplib"},{"line_number":101,"context_line":"    subprocess \u003d _subprocess"}],"source_content_type":"text/x-python","patch_set":5,"id":"9a1a9d01_ec732fb3","line":98,"updated":"2015-09-24 15:34:57.000000000","message":"unjustified","commit_id":"0f516f612130081f43a3ac6c0494c9a629641c35"},{"author":{"_account_id":6486,"name":"Brant Knudson","email":"blk@acm.org","username":"blk-u"},"change_message_id":"15a16d560b0811186940eca75ee5c4299ff7f11d","unresolved":false,"context_lines":[{"line_number":95,"context_line":"    global httplib, subprocess"},{"line_number":96,"context_line":""},{"line_number":97,"context_line":"    import six.moves.http_client as _httplib"},{"line_number":98,"context_line":"    import subprocess as _subprocess  # nosec"},{"line_number":99,"context_line":""},{"line_number":100,"context_line":"    httplib \u003d _httplib"},{"line_number":101,"context_line":"    subprocess \u003d _subprocess"}],"source_content_type":"text/x-python","patch_set":5,"id":"9a1a9d01_8fba32bf","line":98,"in_reply_to":"9a1a9d01_ec732fb3","updated":"2015-09-28 18:57:40.000000000","message":"Done","commit_id":"0f516f612130081f43a3ac6c0494c9a629641c35"},{"author":{"_account_id":5046,"name":"Lance Bragstad","email":"lbragstad@redhat.com","username":"ldbragst"},"change_message_id":"7e5067233b9d50d582234a1839d0d8276c64296d","unresolved":false,"context_lines":[{"line_number":96,"context_line":""},{"line_number":97,"context_line":"    import six.moves.http_client as _httplib"},{"line_number":98,"context_line":"    import subprocess as _subprocess  # nosec : We can\u0027t validate here whether"},{"line_number":99,"context_line":"    # users of the subprocess in this module are safe or not."},{"line_number":100,"context_line":""},{"line_number":101,"context_line":"    httplib \u003d _httplib"},{"line_number":102,"context_line":"    subprocess \u003d _subprocess"}],"source_content_type":"text/x-python","patch_set":6,"id":"9a1a9d01_b5c28e51","line":99,"updated":"2015-09-30 14:19:53.000000000","message":"this seems to go against the assumption made in the commit message, saying keystone uses this in a safe context.","commit_id":"b4f57ea1161425b73c2800848297ee3366758582"},{"author":{"_account_id":6486,"name":"Brant Knudson","email":"blk@acm.org","username":"blk-u"},"change_message_id":"b73643dcfae595756e4293ad59d0e4be99aba0d4","unresolved":false,"context_lines":[{"line_number":96,"context_line":""},{"line_number":97,"context_line":"    import six.moves.http_client as _httplib"},{"line_number":98,"context_line":"    import subprocess as _subprocess  # nosec : We can\u0027t validate here whether"},{"line_number":99,"context_line":"    # users of the subprocess in this module are safe or not."},{"line_number":100,"context_line":""},{"line_number":101,"context_line":"    httplib \u003d _httplib"},{"line_number":102,"context_line":"    subprocess \u003d _subprocess"}],"source_content_type":"text/x-python","patch_set":6,"id":"9a1a9d01_2350710a","line":99,"in_reply_to":"9a1a9d01_b5c28e51","updated":"2015-09-30 22:59:39.000000000","message":"I\u0027ll change this so that we don\u0027t check that subprocess is used correctly since we can\u0027t really prove it anyways.","commit_id":"b4f57ea1161425b73c2800848297ee3366758582"}]}