)]}'
{"/COMMIT_MSG":[{"author":{"_account_id":7488,"name":"Jeffrey Zhang","email":"zhang.lei.fly@gmail.com","username":"Jeffrey4l"},"change_message_id":"f7f6610beb2bcd33df027d761d9fc49701ec9bf2","unresolved":false,"context_lines":[{"line_number":8,"context_line":""},{"line_number":9,"context_line":"* Inspected each error and fixed / added nosec where appropriate."},{"line_number":10,"context_line":"* build-swift-ring.py which was throwing sec errors is no longer used so"},{"line_number":11,"context_line":"  removed it."},{"line_number":12,"context_line":"* Removed the dev/ directory from being checked."},{"line_number":13,"context_line":""},{"line_number":14,"context_line":"TrivialFix"}],"source_content_type":"text/x-gerrit-commit-message","patch_set":4,"id":"3ac371cc_e1802149","line":11,"updated":"2016-08-14 15:03:11.000000000","message":"do u have any idea why this is no needed?","commit_id":"fe29f5c439e98eb04adb7ed8ea61515c80a55123"},{"author":{"_account_id":2834,"name":"Steven Dake","email":"steven.dake@gmail.com","username":"sdake"},"change_message_id":"a8aba2cedcae384bb0ce929c6a96a17c86c3bd46","unresolved":false,"context_lines":[{"line_number":7,"context_line":"Fix bandit gate jobs"},{"line_number":8,"context_line":""},{"line_number":9,"context_line":"* Inspected each error and fixed / added nosec where appropriate."},{"line_number":10,"context_line":"* build-swift-ring.py which was throwing sec errors is no longer used so"},{"line_number":11,"context_line":"  removed it."},{"line_number":12,"context_line":"* Removed the dev/ directory from being checked."},{"line_number":13,"context_line":""},{"line_number":14,"context_line":"TrivialFix"}],"source_content_type":"text/x-gerrit-commit-message","patch_set":5,"id":"3ac371cc_3d5b6e30","line":11,"range":{"start_line":10,"start_character":2,"end_line":11,"end_character":13},"updated":"2016-08-19 01:54:29.000000000","message":"didn\u0027t we decide we needed this?","commit_id":"14ae73a2e910cea8a076ef5eaffe91d70fbdf59b"},{"author":{"_account_id":979,"name":"Dave Walker","email":"email@daviey.com","username":"davewalker"},"change_message_id":"cf79250d91c0afd1c6644d08971c3faaa9e33301","unresolved":false,"context_lines":[{"line_number":12,"context_line":"* Removed the dev/ directory from being checked."},{"line_number":13,"context_line":""},{"line_number":14,"context_line":"TrivialFix"},{"line_number":15,"context_line":""},{"line_number":16,"context_line":"Change-Id: I25664cabca4137e5c9f499c1af3f5ce78b86fb56"}],"source_content_type":"text/x-gerrit-commit-message","patch_set":5,"id":"1ac06dbe_f1727d7b","line":15,"updated":"2016-08-20 16:34:13.000000000","message":"Please add SecurityImpact tag","commit_id":"14ae73a2e910cea8a076ef5eaffe91d70fbdf59b"}],"docker/rabbitmq/rabbitmq_get_gospel_node.py":[{"author":{"_account_id":2834,"name":"Steven Dake","email":"steven.dake@gmail.com","username":"sdake"},"change_message_id":"7af21e07b6644114d017b5085d5cc2d37c6ffc7e","unresolved":false,"context_lines":[{"line_number":25,"context_line":"    try:"},{"line_number":26,"context_line":"        raw_status \u003d subprocess.check_output("},{"line_number":27,"context_line":"            \"/usr/sbin/rabbitmqctl eval \u0027rabbit_clusterer:status().\u0027\","},{"line_number":28,"context_line":"            shell\u003dTrue, stderr\u003dsubprocess.STDOUT  # nosec"},{"line_number":29,"context_line":"        )"},{"line_number":30,"context_line":"        if \"Rabbit is running in cluster configuration\" not in raw_status:"},{"line_number":31,"context_line":"            raise AttributeError"}],"source_content_type":"text/x-python","patch_set":1,"id":"9ad45d7e_73cc556a","line":28,"updated":"2016-08-11 10:00:50.000000000","message":"not so sure on this one - can you provide a rationale (concern over shell\u003dTrue)","commit_id":"a2bb80341b57f4b43472b8647a2e312935a7bf21"},{"author":{"_account_id":1390,"name":"Paul Bourke","email":"pauldbourke@proton.me","username":"pauldbourke"},"change_message_id":"4970ea94cd1415a1759e197a9bc28f5002f3b1bc","unresolved":false,"context_lines":[{"line_number":25,"context_line":"    try:"},{"line_number":26,"context_line":"        raw_status \u003d subprocess.check_output("},{"line_number":27,"context_line":"            \"/usr/sbin/rabbitmqctl eval \u0027rabbit_clusterer:status().\u0027\","},{"line_number":28,"context_line":"            shell\u003dTrue, stderr\u003dsubprocess.STDOUT  # nosec"},{"line_number":29,"context_line":"        )"},{"line_number":30,"context_line":"        if \"Rabbit is running in cluster configuration\" not in raw_status:"},{"line_number":31,"context_line":"            raise AttributeError"}],"source_content_type":"text/x-python","patch_set":1,"id":"9ad45d7e_02fca46e","line":28,"in_reply_to":"9ad45d7e_73cc556a","updated":"2016-08-11 10:37:30.000000000","message":"Tried this out and can\u0027t find a form of this command that works without shell... Will add some notes and a TODO to revisit","commit_id":"a2bb80341b57f4b43472b8647a2e312935a7bf21"},{"author":{"_account_id":11561,"name":"Dave McCowan","email":"dmccowan@cisco.com","username":"dave-mccowan"},"change_message_id":"b2f2de7527b54d87ad55dcbbf90e1f38391f914e","unresolved":false,"context_lines":[{"line_number":27,"context_line":"        raw_status \u003d subprocess.check_output("},{"line_number":28,"context_line":"            \"/usr/sbin/rabbitmqctl eval \u0027rabbit_clusterer:status().\u0027\","},{"line_number":29,"context_line":"            shell\u003dTrue, stderr\u003dsubprocess.STDOUT  # nosec: this command appears"},{"line_number":30,"context_line":"                                                  # to require a shell to work"},{"line_number":31,"context_line":"        )"},{"line_number":32,"context_line":"        if \"Rabbit is running in cluster configuration\" not in raw_status:"},{"line_number":33,"context_line":"            raise AttributeError"}],"source_content_type":"text/x-python","patch_set":4,"id":"9ad45d7e_373d968f","line":30,"range":{"start_line":30,"start_character":0,"end_line":30,"end_character":50},"updated":"2016-08-11 14:47:41.000000000","message":"I\u0027d rather leave this finding open, until we find a fix, instead of masking it with #nosec.  In addition to shell\u003dTrue being evil, \"eval\" is also evil.  I think the fix will be to break this into two calls and remove eval.  We can open a bug and address this in a second commit.","commit_id":"fe29f5c439e98eb04adb7ed8ea61515c80a55123"},{"author":{"_account_id":1390,"name":"Paul Bourke","email":"pauldbourke@proton.me","username":"pauldbourke"},"change_message_id":"e2a0c37075efa887214f3d5407042fe96e0a703f","unresolved":false,"context_lines":[{"line_number":27,"context_line":"        raw_status \u003d subprocess.check_output("},{"line_number":28,"context_line":"            \"/usr/sbin/rabbitmqctl eval \u0027rabbit_clusterer:status().\u0027\","},{"line_number":29,"context_line":"            shell\u003dTrue, stderr\u003dsubprocess.STDOUT  # nosec: this command appears"},{"line_number":30,"context_line":"                                                  # to require a shell to work"},{"line_number":31,"context_line":"        )"},{"line_number":32,"context_line":"        if \"Rabbit is running in cluster configuration\" not in raw_status:"},{"line_number":33,"context_line":"            raise AttributeError"}],"source_content_type":"text/x-python","patch_set":4,"id":"9ad45d7e_1a6cf79a","line":30,"range":{"start_line":30,"start_character":0,"end_line":30,"end_character":50},"in_reply_to":"9ad45d7e_373d968f","updated":"2016-08-11 15:05:25.000000000","message":"Unless we know of an alternative it will stay broken and the gate will degenerate again as everyone will ignore the red.","commit_id":"fe29f5c439e98eb04adb7ed8ea61515c80a55123"},{"author":{"_account_id":2834,"name":"Steven Dake","email":"steven.dake@gmail.com","username":"sdake"},"change_message_id":"a8aba2cedcae384bb0ce929c6a96a17c86c3bd46","unresolved":false,"context_lines":[{"line_number":23,"context_line":""},{"line_number":24,"context_line":"def main():"},{"line_number":25,"context_line":"    try:"},{"line_number":26,"context_line":"        # TODO(pbourke): see if can get gospel node without requiring shell"},{"line_number":27,"context_line":"        raw_status \u003d subprocess.check_output("},{"line_number":28,"context_line":"            \"/usr/sbin/rabbitmqctl eval \u0027rabbit_clusterer:status().\u0027\","},{"line_number":29,"context_line":"            shell\u003dTrue, stderr\u003dsubprocess.STDOUT  # nosec: this command appears"}],"source_content_type":"text/x-python","patch_set":5,"id":"3ac371cc_9d95428a","line":26,"updated":"2016-08-19 01:54:29.000000000","message":"I still think this is dangerous and deserves a special tag such as WARNING(pbourke)","commit_id":"14ae73a2e910cea8a076ef5eaffe91d70fbdf59b"},{"author":{"_account_id":979,"name":"Dave Walker","email":"email@daviey.com","username":"davewalker"},"change_message_id":"cf79250d91c0afd1c6644d08971c3faaa9e33301","unresolved":false,"context_lines":[{"line_number":23,"context_line":""},{"line_number":24,"context_line":"def main():"},{"line_number":25,"context_line":"    try:"},{"line_number":26,"context_line":"        # TODO(pbourke): see if can get gospel node without requiring shell"},{"line_number":27,"context_line":"        raw_status \u003d subprocess.check_output("},{"line_number":28,"context_line":"            \"/usr/sbin/rabbitmqctl eval \u0027rabbit_clusterer:status().\u0027\","},{"line_number":29,"context_line":"            shell\u003dTrue, stderr\u003dsubprocess.STDOUT  # nosec: this command appears"}],"source_content_type":"text/x-python","patch_set":5,"id":"1ac06dbe_1153d9e2","line":26,"in_reply_to":"3ac371cc_9d95428a","updated":"2016-08-20 16:34:13.000000000","message":"I\u0027m not convinced this needs a WARNING.  We are not executing on a shell with any user controlled variables, so there is no need for the command to be sanitized.\n\nWe are executing RabbitMQ from the full path, without wildcarded paths, which reduces the risk.\n\nRabbitMQ is a reasonably trusted binary installed from a reliable source, so the risk of it abusing environment variables is low.","commit_id":"14ae73a2e910cea8a076ef5eaffe91d70fbdf59b"}],"docker/swift/swift-base/Dockerfile.j2":[{"author":{"_account_id":2834,"name":"Steven Dake","email":"steven.dake@gmail.com","username":"sdake"},"change_message_id":"a8aba2cedcae384bb0ce929c6a96a17c86c3bd46","unresolved":false,"context_lines":[{"line_number":52,"context_line":"RUN chmod 750 /etc/sudoers.d \\"},{"line_number":53,"context_line":"    \u0026\u0026 chmod 440 /etc/sudoers.d/kolla_swift_sudoers"},{"line_number":54,"context_line":""},{"line_number":55,"context_line":"COPY build-swift-ring.py /usr/local/bin/kolla_build_swift_ring"},{"line_number":56,"context_line":"RUN mkdir -p /opt/swift"},{"line_number":57,"context_line":""},{"line_number":58,"context_line":"RUN usermod -a -G kolla swift"}],"source_content_type":"text/x-jinja2","patch_set":5,"id":"3ac371cc_fdec362b","side":"PARENT","line":55,"updated":"2016-08-19 01:54:29.000000000","message":"I am pretty sure swift requires this as per our documentation on swift.","commit_id":"cc4150292c66b99aaf63a63e7438fa1cee3be129"}],"docker/swift/swift-base/build-swift-ring.py":[{"author":{"_account_id":2834,"name":"Steven Dake","email":"steven.dake@gmail.com","username":"sdake"},"change_message_id":"a8aba2cedcae384bb0ce929c6a96a17c86c3bd46","unresolved":false,"context_lines":[{"line_number":1,"context_line":"#!/usr/bin/env python"},{"line_number":2,"context_line":""},{"line_number":3,"context_line":"# Copyright 2015 Paul Bourke"},{"line_number":4,"context_line":"#"},{"line_number":5,"context_line":"# Licensed under the Apache License, Version 2.0 (the \"License\");"},{"line_number":6,"context_line":"# you may not use this file except in compliance with the License."}],"source_content_type":"text/x-python","patch_set":5,"id":"3ac371cc_7dd96683","side":"PARENT","line":3,"updated":"2016-08-19 01:54:29.000000000","message":"think this is needed","commit_id":"cc4150292c66b99aaf63a63e7438fa1cee3be129"}],"kolla/cmd/genpwd.py":[{"author":{"_account_id":7488,"name":"Jeffrey Zhang","email":"zhang.lei.fly@gmail.com","username":"Jeffrey4l"},"change_message_id":"b0f29e6aa1cf1dd6c850dae5c8593e6972c57c9e","unresolved":false,"context_lines":[{"line_number":24,"context_line":""},{"line_number":25,"context_line":"def generate_RSA(bits\u003d2048):"},{"line_number":26,"context_line":"    # NOTE(pbourke): default is recommended 2048 (false positive) [0]"},{"line_number":27,"context_line":"    new_key \u003d RSA.generate(bits, os.urandom)  # nosec: [0]"},{"line_number":28,"context_line":"    private_key \u003d new_key.exportKey(\"PEM\")"},{"line_number":29,"context_line":"    public_key \u003d new_key.publickey().exportKey(\"OpenSSH\")"},{"line_number":30,"context_line":"    return private_key, public_key"}],"source_content_type":"text/x-python","patch_set":5,"id":"3ac371cc_41251c07","line":27,"updated":"2016-08-17 13:45:08.000000000","message":"what\u0027s the [0] meaning here?","commit_id":"14ae73a2e910cea8a076ef5eaffe91d70fbdf59b"},{"author":{"_account_id":1390,"name":"Paul Bourke","email":"pauldbourke@proton.me","username":"pauldbourke"},"change_message_id":"71ff51c53d02453076b82036457f9c9e43bee230","unresolved":false,"context_lines":[{"line_number":24,"context_line":""},{"line_number":25,"context_line":"def generate_RSA(bits\u003d2048):"},{"line_number":26,"context_line":"    # NOTE(pbourke): default is recommended 2048 (false positive) [0]"},{"line_number":27,"context_line":"    new_key \u003d RSA.generate(bits, os.urandom)  # nosec: [0]"},{"line_number":28,"context_line":"    private_key \u003d new_key.exportKey(\"PEM\")"},{"line_number":29,"context_line":"    public_key \u003d new_key.publickey().exportKey(\"OpenSSH\")"},{"line_number":30,"context_line":"    return private_key, public_key"}],"source_content_type":"text/x-python","patch_set":5,"id":"3ac371cc_5f15f0e2","line":27,"in_reply_to":"3ac371cc_41251c07","updated":"2016-08-17 14:46:01.000000000","message":"It\u0027s a reference to the NOTE on line 26. The nosec seems to have to go on the end of the line so it\u0027s messy to fit any kind of long description in as well and still be within the line length restrictions","commit_id":"14ae73a2e910cea8a076ef5eaffe91d70fbdf59b"},{"author":{"_account_id":979,"name":"Dave Walker","email":"email@daviey.com","username":"davewalker"},"change_message_id":"39c4dbb8afcbcfd5ab0031ff3548bacf98b4c174","unresolved":false,"context_lines":[{"line_number":24,"context_line":""},{"line_number":25,"context_line":"def generate_RSA(bits\u003d2048):"},{"line_number":26,"context_line":"    # NOTE(pbourke): default is recommended 2048 (false positive) [0]"},{"line_number":27,"context_line":"    new_key \u003d RSA.generate(bits, os.urandom)  # nosec: [0]"},{"line_number":28,"context_line":"    private_key \u003d new_key.exportKey(\"PEM\")"},{"line_number":29,"context_line":"    public_key \u003d new_key.publickey().exportKey(\"OpenSSH\")"},{"line_number":30,"context_line":"    return private_key, public_key"}],"source_content_type":"text/x-python","patch_set":5,"id":"3ac371cc_8a7dfdb3","line":27,"in_reply_to":"3ac371cc_5f15f0e2","updated":"2016-08-19 00:17:21.000000000","message":"It is the _minimum_ that both the OSSP and US NIST recommends (see SP 800-131A), but does currently consider it safe until at least 2030.  For GPG Debian recommends 4096, but at least Ubuntu and CentOS/RH 7 does default to 2048 with ssh-keygen.\n\nThe OSSP via bandit raises this as Medium issue, rather than a High issue (that 1024 would have)\n\nWho recommends 2048?  I timed the creation locally, and we are talking 0.5s vs 0.005s.. which doesn\u0027t seem like a noticeable difference.\n\nWhy not just jump to 4096 and make this issue go away?","commit_id":"14ae73a2e910cea8a076ef5eaffe91d70fbdf59b"},{"author":{"_account_id":2834,"name":"Steven Dake","email":"steven.dake@gmail.com","username":"sdake"},"change_message_id":"a8aba2cedcae384bb0ce929c6a96a17c86c3bd46","unresolved":false,"context_lines":[{"line_number":24,"context_line":""},{"line_number":25,"context_line":"def generate_RSA(bits\u003d2048):"},{"line_number":26,"context_line":"    # NOTE(pbourke): default is recommended 2048 (false positive) [0]"},{"line_number":27,"context_line":"    new_key \u003d RSA.generate(bits, os.urandom)  # nosec: [0]"},{"line_number":28,"context_line":"    private_key \u003d new_key.exportKey(\"PEM\")"},{"line_number":29,"context_line":"    public_key \u003d new_key.publickey().exportKey(\"OpenSSH\")"},{"line_number":30,"context_line":"    return private_key, public_key"}],"source_content_type":"text/x-python","patch_set":5,"id":"3ac371cc_bd30fee9","line":27,"in_reply_to":"3ac371cc_8a7dfdb3","updated":"2016-08-19 01:54:29.000000000","message":"agree with Dave here.","commit_id":"14ae73a2e910cea8a076ef5eaffe91d70fbdf59b"}],"tools/validate-yaml.py":[{"author":{"_account_id":11561,"name":"Dave McCowan","email":"dmccowan@cisco.com","username":"dave-mccowan"},"change_message_id":"b2f2de7527b54d87ad55dcbbf90e1f38391f914e","unresolved":false,"context_lines":[{"line_number":32,"context_line":"    for filename in args.input:"},{"line_number":33,"context_line":"        with open(filename) as fd:"},{"line_number":34,"context_line":"            try:"},{"line_number":35,"context_line":"                yaml.load(fd)  # nosec"},{"line_number":36,"context_line":"            except yaml.error.YAMLError as error:"},{"line_number":37,"context_line":"                res \u003d 1"},{"line_number":38,"context_line":"                logging.error(\u0027%s failed validation: %s\u0027,"}],"source_content_type":"text/x-python","patch_set":4,"id":"9ad45d7e_170332b9","line":35,"range":{"start_line":35,"start_character":21,"end_line":35,"end_character":25},"updated":"2016-08-11 14:47:41.000000000","message":"Will safe_load() work here?","commit_id":"fe29f5c439e98eb04adb7ed8ea61515c80a55123"},{"author":{"_account_id":7488,"name":"Jeffrey Zhang","email":"zhang.lei.fly@gmail.com","username":"Jeffrey4l"},"change_message_id":"f7f6610beb2bcd33df027d761d9fc49701ec9bf2","unresolved":false,"context_lines":[{"line_number":32,"context_line":"    for filename in args.input:"},{"line_number":33,"context_line":"        with open(filename) as fd:"},{"line_number":34,"context_line":"            try:"},{"line_number":35,"context_line":"                yaml.load(fd)  # nosec"},{"line_number":36,"context_line":"            except yaml.error.YAMLError as error:"},{"line_number":37,"context_line":"                res \u003d 1"},{"line_number":38,"context_line":"                logging.error(\u0027%s failed validation: %s\u0027,"}],"source_content_type":"text/x-python","patch_set":4,"id":"3ac371cc_41965595","line":35,"updated":"2016-08-14 15:03:11.000000000","message":"why not change to safe_load here? even though this is run in CI, why do not better/safer code in CI?","commit_id":"fe29f5c439e98eb04adb7ed8ea61515c80a55123"},{"author":{"_account_id":1390,"name":"Paul Bourke","email":"pauldbourke@proton.me","username":"pauldbourke"},"change_message_id":"e2a0c37075efa887214f3d5407042fe96e0a703f","unresolved":false,"context_lines":[{"line_number":32,"context_line":"    for filename in args.input:"},{"line_number":33,"context_line":"        with open(filename) as fd:"},{"line_number":34,"context_line":"            try:"},{"line_number":35,"context_line":"                yaml.load(fd)  # nosec"},{"line_number":36,"context_line":"            except yaml.error.YAMLError as error:"},{"line_number":37,"context_line":"                res \u003d 1"},{"line_number":38,"context_line":"                logging.error(\u0027%s failed validation: %s\u0027,"}],"source_content_type":"text/x-python","patch_set":4,"id":"9ad45d7e_3ad9fb57","line":35,"range":{"start_line":35,"start_character":21,"end_line":35,"end_character":25},"in_reply_to":"9ad45d7e_170332b9","updated":"2016-08-11 15:05:25.000000000","message":"It may but given the nature of the script I think it will be limiting. This script runs as part of the gate rather than on users machines so I don\u0027t think it needs to comply.","commit_id":"fe29f5c439e98eb04adb7ed8ea61515c80a55123"},{"author":{"_account_id":167,"name":"Christian Berendt","email":"berendt@osism.tech","username":"berendt"},"change_message_id":"b87cf849e694a76002b56ff1cb6a91a21f05d534","unresolved":false,"context_lines":[{"line_number":32,"context_line":"    for filename in args.input:"},{"line_number":33,"context_line":"        with open(filename) as fd:"},{"line_number":34,"context_line":"            try:"},{"line_number":35,"context_line":"                yaml.load(fd)  # nosec"},{"line_number":36,"context_line":"            except yaml.error.YAMLError as error:"},{"line_number":37,"context_line":"                res \u003d 1"},{"line_number":38,"context_line":"                logging.error(\u0027%s failed validation: %s\u0027,"}],"source_content_type":"text/x-python","patch_set":4,"id":"3ac371cc_aa73abb3","line":35,"range":{"start_line":35,"start_character":21,"end_line":35,"end_character":25},"in_reply_to":"9ad45d7e_3ad9fb57","updated":"2016-08-13 23:00:22.000000000","message":"Does it not work on the gates when we not use safe_load? I would prefer to fix the issue identified by Bandit rather then disabling the warning.","commit_id":"fe29f5c439e98eb04adb7ed8ea61515c80a55123"}]}