)]}'
{"keystone/contrib/federation/idp.py":[{"author":{"_account_id":4,"name":"Dolph Mathews","email":"dolph.mathews@gmail.com","username":"dolph"},"change_message_id":"8ec06f6648cf37e603075ab9ee40c6d8fa29c858","unresolved":false,"context_lines":[{"line_number":425,"context_line":"            nspair\u003d{\u0027saml\u0027: saml2.NAMESPACE,"},{"line_number":426,"context_line":"                    \u0027xmldsig\u0027: xmldsig.NAMESPACE}))"},{"line_number":427,"context_line":"        command_list.append(file_path)"},{"line_number":428,"context_line":"        stdout \u003d subprocess.check_output(command_list,  # nosec"},{"line_number":429,"context_line":"                                         stderr\u003dsubprocess.STDOUT)"},{"line_number":430,"context_line":"    except Exception as e:"},{"line_number":431,"context_line":"        msg \u003d _LE(\u0027Error when signing assertion, reason: %(reason)s%(output)s\u0027)"}],"source_content_type":"text/x-python","patch_set":5,"id":"9a1a9d01_b143506c","line":428,"updated":"2015-09-24 15:31:56.000000000","message":"why should bandit be ignored here?","commit_id":"be0a827a48f15bdc1c303d200a3eb00879f542b4"},{"author":{"_account_id":6486,"name":"Brant Knudson","email":"blk@acm.org","username":"blk-u"},"change_message_id":"36b9ecacce1f670f130466037a4fcf6cf234002f","unresolved":false,"context_lines":[{"line_number":425,"context_line":"            nspair\u003d{\u0027saml\u0027: saml2.NAMESPACE,"},{"line_number":426,"context_line":"                    \u0027xmldsig\u0027: xmldsig.NAMESPACE}))"},{"line_number":427,"context_line":"        command_list.append(file_path)"},{"line_number":428,"context_line":"        stdout \u003d subprocess.check_output(command_list,  # nosec"},{"line_number":429,"context_line":"                                         stderr\u003dsubprocess.STDOUT)"},{"line_number":430,"context_line":"    except Exception as e:"},{"line_number":431,"context_line":"        msg \u003d _LE(\u0027Error when signing assertion, reason: %(reason)s%(output)s\u0027)"}],"source_content_type":"text/x-python","patch_set":5,"id":"9a1a9d01_af4a96c3","line":428,"in_reply_to":"9a1a9d01_b143506c","updated":"2015-09-28 19:01:48.000000000","message":"Done","commit_id":"be0a827a48f15bdc1c303d200a3eb00879f542b4"},{"author":{"_account_id":5046,"name":"Lance Bragstad","email":"lbragstad@redhat.com","username":"ldbragst"},"change_message_id":"eb165828b74aafc64b91951c7702669a10537aab","unresolved":false,"context_lines":[{"line_number":428,"context_line":"        stdout \u003d subprocess.check_output(command_list,  # nosec : The command"},{"line_number":429,"context_line":"                                         # is passed as a list rather than a"},{"line_number":430,"context_line":"                                         # string so we are protected from"},{"line_number":431,"context_line":"                                         # injection due to command parsing."},{"line_number":432,"context_line":"                                         stderr\u003dsubprocess.STDOUT)"},{"line_number":433,"context_line":"    except Exception as e:"},{"line_number":434,"context_line":"        msg \u003d _LE(\u0027Error when signing assertion, reason: %(reason)s%(output)s\u0027)"}],"source_content_type":"text/x-python","patch_set":6,"id":"9a1a9d01_10082827","line":431,"updated":"2015-09-30 14:27:23.000000000","message":"where is this list constructed?","commit_id":"47238765793fe81d06a9eb77188fd44b097bce5f"},{"author":{"_account_id":6486,"name":"Brant Knudson","email":"blk@acm.org","username":"blk-u"},"change_message_id":"4fd28382b860d73c8b0a3114f617a84496cec12d","unresolved":false,"context_lines":[{"line_number":428,"context_line":"        stdout \u003d subprocess.check_output(command_list,  # nosec : The command"},{"line_number":429,"context_line":"                                         # is passed as a list rather than a"},{"line_number":430,"context_line":"                                         # string so we are protected from"},{"line_number":431,"context_line":"                                         # injection due to command parsing."},{"line_number":432,"context_line":"                                         stderr\u003dsubprocess.STDOUT)"},{"line_number":433,"context_line":"    except Exception as e:"},{"line_number":434,"context_line":"        msg \u003d _LE(\u0027Error when signing assertion, reason: %(reason)s%(output)s\u0027)"}],"source_content_type":"text/x-python","patch_set":6,"id":"9a1a9d01_83437dae","line":431,"in_reply_to":"9a1a9d01_10082827","updated":"2015-09-30 23:25:57.000000000","message":"Done","commit_id":"47238765793fe81d06a9eb77188fd44b097bce5f"},{"author":{"_account_id":7725,"name":"David Stanek","email":"dstanek@dstanek.com","username":"dstanek"},"change_message_id":"0ccbecc23a18c1ad130232b26d68a0d1726e5fed","unresolved":false,"context_lines":[{"line_number":425,"context_line":"            nspair\u003d{\u0027saml\u0027: saml2.NAMESPACE,"},{"line_number":426,"context_line":"                    \u0027xmldsig\u0027: xmldsig.NAMESPACE}))"},{"line_number":427,"context_line":"        command_list.append(file_path)"},{"line_number":428,"context_line":"        stdout \u003d subprocess.check_output(command_list,  # nosec : The command"},{"line_number":429,"context_line":"                                         # is a list rather than a string so we"},{"line_number":430,"context_line":"                                         # are protected from attackers"},{"line_number":431,"context_line":"                                         # attempting command injection due to"}],"source_content_type":"text/x-python","patch_set":7,"id":"9a1a9d01_19ac87ec","line":428,"updated":"2015-10-02 01:24:44.000000000","message":"It\u0027s not really the fact that this is a list that makes this safe, it\u0027s that the list consists of all trusted input.","commit_id":"84fd6f8bfa031d08160fe8723c2f3b2453f652d0"},{"author":{"_account_id":6486,"name":"Brant Knudson","email":"blk@acm.org","username":"blk-u"},"change_message_id":"3a25db160bb7f34cb758acd1f91e1ef81c732258","unresolved":false,"context_lines":[{"line_number":425,"context_line":"            nspair\u003d{\u0027saml\u0027: saml2.NAMESPACE,"},{"line_number":426,"context_line":"                    \u0027xmldsig\u0027: xmldsig.NAMESPACE}))"},{"line_number":427,"context_line":"        command_list.append(file_path)"},{"line_number":428,"context_line":"        stdout \u003d subprocess.check_output(command_list,  # nosec : The command"},{"line_number":429,"context_line":"                                         # is a list rather than a string so we"},{"line_number":430,"context_line":"                                         # are protected from attackers"},{"line_number":431,"context_line":"                                         # attempting command injection due to"}],"source_content_type":"text/x-python","patch_set":7,"id":"7a2fa921_ab872f0e","line":428,"in_reply_to":"9a1a9d01_19ac87ec","updated":"2015-10-06 13:41:01.000000000","message":"Done","commit_id":"84fd6f8bfa031d08160fe8723c2f3b2453f652d0"},{"author":{"_account_id":4,"name":"Dolph Mathews","email":"dolph.mathews@gmail.com","username":"dolph"},"change_message_id":"ca293ee44404c2c311eee84678910937631d21b1","unresolved":false,"context_lines":[{"line_number":429,"context_line":"                                         # is a list rather than a string so we"},{"line_number":430,"context_line":"                                         # are protected from attackers"},{"line_number":431,"context_line":"                                         # attempting command injection due to"},{"line_number":432,"context_line":"                                         # command string parsing. command_list"},{"line_number":433,"context_line":"                                         # is initialized earlier in this"},{"line_number":434,"context_line":"                                         # function to a list and it\u0027s still a"},{"line_number":435,"context_line":"                                         # list at this point in the function."}],"source_content_type":"text/x-python","patch_set":8,"id":"7a2fa921_190e7d3b","line":432,"updated":"2015-10-07 17:33:47.000000000","message":"The period could be a \"because\". The first statement alone isn\u0027t true (a list itself provides no real protection).","commit_id":"b4b6c699d822b2f0c47ca34ee5c95118780c59a3"},{"author":{"_account_id":4,"name":"Dolph Mathews","email":"dolph.mathews@gmail.com","username":"dolph"},"change_message_id":"ca293ee44404c2c311eee84678910937631d21b1","unresolved":false,"context_lines":[{"line_number":433,"context_line":"                                         # is initialized earlier in this"},{"line_number":434,"context_line":"                                         # function to a list and it\u0027s still a"},{"line_number":435,"context_line":"                                         # list at this point in the function."},{"line_number":436,"context_line":"                                         # The executable and arguments all"},{"line_number":437,"context_line":"                                         # either come from the config file or"},{"line_number":438,"context_line":"                                         # are hardcoded, so the inputs are"},{"line_number":439,"context_line":"                                         # coming from a trusted source."}],"source_content_type":"text/x-python","patch_set":8,"id":"7a2fa921_a4515c10","line":436,"updated":"2015-10-07 17:33:47.000000000","message":"I would either prefix this sentence with \"Critically, \" because it\u0027s really all that matters here, or move it to the beginning and restructure the paragraph accordingly.","commit_id":"b4b6c699d822b2f0c47ca34ee5c95118780c59a3"},{"author":{"_account_id":6486,"name":"Brant Knudson","email":"blk@acm.org","username":"blk-u"},"change_message_id":"8c170c528af084674b3edcb59a56196ff30dd80c","unresolved":false,"context_lines":[{"line_number":430,"context_line":"                                         # a trusted source because the"},{"line_number":431,"context_line":"                                         # executable and arguments all either"},{"line_number":432,"context_line":"                                         # come from the config file or are"},{"line_number":433,"context_line":"                                         # hardcoded. The command list is is"},{"line_number":434,"context_line":"                                         # initialized earlier in this function"},{"line_number":435,"context_line":"                                         # to a list and it\u0027s still a list at"},{"line_number":436,"context_line":"                                         # this point in the function. Further,"}],"source_content_type":"text/x-python","patch_set":9,"id":"7a2fa921_e41c34c3","line":433,"updated":"2015-10-07 17:48:19.000000000","message":"remove duplicate \"is\"","commit_id":"c5a2a5f283a247512e10dd9467297d80234a16bc"},{"author":{"_account_id":6486,"name":"Brant Knudson","email":"blk@acm.org","username":"blk-u"},"change_message_id":"8c170c528af084674b3edcb59a56196ff30dd80c","unresolved":false,"context_lines":[{"line_number":433,"context_line":"                                         # hardcoded. The command list is is"},{"line_number":434,"context_line":"                                         # initialized earlier in this function"},{"line_number":435,"context_line":"                                         # to a list and it\u0027s still a list at"},{"line_number":436,"context_line":"                                         # this point in the function. Further,"},{"line_number":437,"context_line":"                                         # there is no opportunity for an"},{"line_number":438,"context_line":"                                         # attacker to attempt command"},{"line_number":439,"context_line":"                                         # injection via string parsing."}],"source_content_type":"text/x-python","patch_set":9,"id":"7a2fa921_e48f54ca","line":436,"updated":"2015-10-07 17:48:19.000000000","message":"This isn\u0027t \"Further\" the previous sentence -- the reason you can\u0027t mess keystone up with string parsing is because the command is passed as a list of strings rather than a string. E.g., you can\u0027t make keystone delete everything by setting CONF.saml.keyfile to \"; rm -rf / #\":\n\n xmlsec1 --sign --privkey-pem ; rm -rf / # ,cert2 --id-attr:ID Assertion\n\nbecause `certificates` isn\u0027t going to be split on spaces due to passing the command as a list.","commit_id":"c5a2a5f283a247512e10dd9467297d80234a16bc"},{"author":{"_account_id":4,"name":"Dolph Mathews","email":"dolph.mathews@gmail.com","username":"dolph"},"change_message_id":"3e658b8b3e0f717b79f98338815e52938d26eb2f","unresolved":false,"context_lines":[{"line_number":433,"context_line":"                                         # hardcoded. The command list is is"},{"line_number":434,"context_line":"                                         # initialized earlier in this function"},{"line_number":435,"context_line":"                                         # to a list and it\u0027s still a list at"},{"line_number":436,"context_line":"                                         # this point in the function. Further,"},{"line_number":437,"context_line":"                                         # there is no opportunity for an"},{"line_number":438,"context_line":"                                         # attacker to attempt command"},{"line_number":439,"context_line":"                                         # injection via string parsing."}],"source_content_type":"text/x-python","patch_set":9,"id":"7a2fa921_7f2c3102","line":436,"in_reply_to":"7a2fa921_e48f54ca","updated":"2015-10-07 18:07:17.000000000","message":"I intended \"Further\" to be an \"In addition to the justification expressed in the rest of the paragraph\" but I\u0027ll remove it.","commit_id":"c5a2a5f283a247512e10dd9467297d80234a16bc"}]}