)]}'
{"/COMMIT_MSG":[{"author":{"_account_id":9107,"name":"Victor Stinner","email":"vstinner@redhat.com","username":"haypo"},"change_message_id":"507e9249c1047d89ffb2c3e1a0b9ec4f055d6a31","unresolved":false,"context_lines":[{"line_number":7,"context_line":"Add a bandit target to tox.ini"},{"line_number":8,"context_line":""},{"line_number":9,"context_line":"The \"assert_used\" and \"try_except_pass\" checkers have been disabled"},{"line_number":10,"context_line":"because they were only throwing false positives."},{"line_number":11,"context_line":""},{"line_number":12,"context_line":"Change-Id: I9d8a8ab79e8b5de98e7d291ac132f8971a44216d"}],"source_content_type":"text/x-gerrit-commit-message","patch_set":3,"id":"1a26ad4f_472c674a","line":10,"updated":"2015-10-28 01:21:51.000000000","message":"Instead of disabling them globally, would it make sense to modify the code to put \"# nosec\"?","commit_id":"d6f406cd4e2699cae962d1a999b2f2ab37418af3"},{"author":{"_account_id":8122,"name":"Cyril Roelandt","email":"cyril@redhat.com","username":"cyril.roelandt.enovance"},"change_message_id":"548a88608edb83f970d099e26c255f641f2079db","unresolved":false,"context_lines":[{"line_number":7,"context_line":"Add a bandit target to tox.ini"},{"line_number":8,"context_line":""},{"line_number":9,"context_line":"The \"assert_used\" and \"try_except_pass\" checkers have been disabled"},{"line_number":10,"context_line":"because they were only throwing false positives."},{"line_number":11,"context_line":""},{"line_number":12,"context_line":"Change-Id: I9d8a8ab79e8b5de98e7d291ac132f8971a44216d"}],"source_content_type":"text/x-gerrit-commit-message","patch_set":3,"id":"1a26ad4f_b8d3ff37","line":10,"in_reply_to":"1a26ad4f_472c674a","updated":"2015-10-28 17:22:46.000000000","message":"I did that for strutils.py, for instance (in this very patchset). There are so many occurrences of \"assert\" and \"try except pass\" that it felt better to just disable them. I do not think there is much we can do about the asserts (to be honest, I\u0027m not exactly sure what the warning is about). As for the \"try except pass\", we might need to rewrite a bunch of code, and since it is not critical, I did not feel like doing that now.\n\nYou also do not want to start writing \"#nosec\" everywhere, otherwise people will just silence valid warnings.","commit_id":"d6f406cd4e2699cae962d1a999b2f2ab37418af3"}],"bandit.yaml":[{"author":{"_account_id":9107,"name":"Victor Stinner","email":"vstinner@redhat.com","username":"haypo"},"change_message_id":"507e9249c1047d89ffb2c3e1a0b9ec4f055d6a31","unresolved":false,"context_lines":[{"line_number":1,"context_line":"# optional: after how many files to update progress"},{"line_number":2,"context_line":"#show_progress_every: 100"},{"line_number":3,"context_line":""},{"line_number":4,"context_line":"# optional: plugins directory name"},{"line_number":5,"context_line":"#plugins_dir: plugins"}],"source_content_type":"text/x-yaml","patch_set":3,"id":"1a26ad4f_a7177bec","line":2,"updated":"2015-10-28 01:21:51.000000000","message":"Do we need these commented options?","commit_id":"d6f406cd4e2699cae962d1a999b2f2ab37418af3"},{"author":{"_account_id":9107,"name":"Victor Stinner","email":"vstinner@redhat.com","username":"haypo"},"change_message_id":"507e9249c1047d89ffb2c3e1a0b9ec4f055d6a31","unresolved":false,"context_lines":[{"line_number":20,"context_line":""},{"line_number":21,"context_line":"# globs of files which should be analyzed"},{"line_number":22,"context_line":"include:"},{"line_number":23,"context_line":"    - \u0027*.py\u0027"},{"line_number":24,"context_line":"    - \u0027*.pyw\u0027"},{"line_number":25,"context_line":""},{"line_number":26,"context_line":"# a list of strings, which if found in the path will cause files to be excluded"}],"source_content_type":"text/x-yaml","patch_set":3,"id":"1a26ad4f_4788e722","line":23,"updated":"2015-10-28 01:21:51.000000000","message":"Hum, do we really have to repeat this in each bandit project? Bandit is not able to know that we want to scan .py files? :-(\n\nWould it be possible to mutualize the configuration between OpenStack projects? Maybe be putting better default values in Bandit default configuration?","commit_id":"d6f406cd4e2699cae962d1a999b2f2ab37418af3"},{"author":{"_account_id":8122,"name":"Cyril Roelandt","email":"cyril@redhat.com","username":"cyril.roelandt.enovance"},"change_message_id":"548a88608edb83f970d099e26c255f641f2079db","unresolved":false,"context_lines":[{"line_number":20,"context_line":""},{"line_number":21,"context_line":"# globs of files which should be analyzed"},{"line_number":22,"context_line":"include:"},{"line_number":23,"context_line":"    - \u0027*.py\u0027"},{"line_number":24,"context_line":"    - \u0027*.pyw\u0027"},{"line_number":25,"context_line":""},{"line_number":26,"context_line":"# a list of strings, which if found in the path will cause files to be excluded"}],"source_content_type":"text/x-yaml","patch_set":3,"id":"1a26ad4f_a32bd42f","line":23,"in_reply_to":"1a26ad4f_4788e722","updated":"2015-10-28 17:22:46.000000000","message":"Out of the 589 (!) projects listed on github.com/openstack/, I believe only 14 use bandit. Most of them seem to use a bandit.yaml file copied from the bandit repo and more or less customized.\n\nMaybe we could start by writing a script that, given the example config file from the bandit repo, would 1) write a \"generic\" config file suited for oslo (removing the \"pyw\" stuff etc. 2) make project-specific adjustments (disabling some checkers for instance).\n\nThis way, we could easily generate config files for every single oslo project, and it would be easy to update them when a new version of bandit comes out.\n\nWDYT?","commit_id":"d6f406cd4e2699cae962d1a999b2f2ab37418af3"},{"author":{"_account_id":9107,"name":"Victor Stinner","email":"vstinner@redhat.com","username":"haypo"},"change_message_id":"3ff54d67708e304bf121e4a0b9b5d79af4d6b502","unresolved":false,"context_lines":[{"line_number":20,"context_line":""},{"line_number":21,"context_line":"# globs of files which should be analyzed"},{"line_number":22,"context_line":"include:"},{"line_number":23,"context_line":"    - \u0027*.py\u0027"},{"line_number":24,"context_line":"    - \u0027*.pyw\u0027"},{"line_number":25,"context_line":""},{"line_number":26,"context_line":"# a list of strings, which if found in the path will cause files to be excluded"}],"source_content_type":"text/x-yaml","patch_set":3,"id":"1a26ad4f_5e1e4964","line":23,"in_reply_to":"1a26ad4f_a32bd42f","updated":"2015-10-29 02:50:17.000000000","message":"\u003e Maybe we could start by writing a script that, given the example config file from the bandit repo, would 1) write a \"generic\" config file suited for oslo (removing the \"pyw\" stuff etc. 2) make project-specific adjustments (disabling some checkers for instance).\n\nYeah, we already have such scripts to update requirements.txt, test-requirements.txt, setup.py and project/openstack/common/.\n\nIt would be nice to compare the bandit.yaml of these 14 OpenStack projects. Maybe we can write a single configuration file and copy it everywhere. Maybe the template can be put in oslo.utils, oslo-incubator, requirements or project-config?","commit_id":"d6f406cd4e2699cae962d1a999b2f2ab37418af3"},{"author":{"_account_id":9107,"name":"Victor Stinner","email":"vstinner@redhat.com","username":"haypo"},"change_message_id":"507e9249c1047d89ffb2c3e1a0b9ec4f055d6a31","unresolved":false,"context_lines":[{"line_number":21,"context_line":"# globs of files which should be analyzed"},{"line_number":22,"context_line":"include:"},{"line_number":23,"context_line":"    - \u0027*.py\u0027"},{"line_number":24,"context_line":"    - \u0027*.pyw\u0027"},{"line_number":25,"context_line":""},{"line_number":26,"context_line":"# a list of strings, which if found in the path will cause files to be excluded"},{"line_number":27,"context_line":"# for example /tests/ - to remove all files in tests directory"}],"source_content_type":"text/x-yaml","patch_set":3,"id":"1a26ad4f_e7e4930e","line":24,"updated":"2015-10-28 01:21:51.000000000","message":"oslo.utils has no .pyw files. There are only used on Windows, and we have no code specific to Windows.","commit_id":"d6f406cd4e2699cae962d1a999b2f2ab37418af3"},{"author":{"_account_id":8122,"name":"Cyril Roelandt","email":"cyril@redhat.com","username":"cyril.roelandt.enovance"},"change_message_id":"548a88608edb83f970d099e26c255f641f2079db","unresolved":false,"context_lines":[{"line_number":21,"context_line":"# globs of files which should be analyzed"},{"line_number":22,"context_line":"include:"},{"line_number":23,"context_line":"    - \u0027*.py\u0027"},{"line_number":24,"context_line":"    - \u0027*.pyw\u0027"},{"line_number":25,"context_line":""},{"line_number":26,"context_line":"# a list of strings, which if found in the path will cause files to be excluded"},{"line_number":27,"context_line":"# for example /tests/ - to remove all files in tests directory"}],"source_content_type":"text/x-yaml","patch_set":3,"id":"1a26ad4f_18ef93e9","line":24,"in_reply_to":"1a26ad4f_e7e4930e","updated":"2015-10-28 17:22:46.000000000","message":"It would make sense to remove \"pyw\" then :)","commit_id":"d6f406cd4e2699cae962d1a999b2f2ab37418af3"},{"author":{"_account_id":9107,"name":"Victor Stinner","email":"vstinner@redhat.com","username":"haypo"},"change_message_id":"507e9249c1047d89ffb2c3e1a0b9ec4f055d6a31","unresolved":false,"context_lines":[{"line_number":30,"context_line":""},{"line_number":31,"context_line":"profiles:"},{"line_number":32,"context_line":"    oslo.utils:"},{"line_number":33,"context_line":"        include:"},{"line_number":34,"context_line":"            - any_other_function_with_shell_equals_true"},{"line_number":35,"context_line":"            # - assert_used"},{"line_number":36,"context_line":"            - blacklist_calls"}],"source_content_type":"text/x-yaml","patch_set":3,"id":"1a26ad4f_07998f6e","line":33,"updated":"2015-10-28 01:21:51.000000000","message":"I\u0027m unable to find \"exec_used\" on http://git.openstack.org/cgit/openstack/bandit/tree/README.rst or https://wiki.openstack.org/wiki/Security/Projects/Bandit\n\nI guess that Bandit doesn\u0027t have a better documentation yet.","commit_id":"d6f406cd4e2699cae962d1a999b2f2ab37418af3"},{"author":{"_account_id":9107,"name":"Victor Stinner","email":"vstinner@redhat.com","username":"haypo"},"change_message_id":"507e9249c1047d89ffb2c3e1a0b9ec4f055d6a31","unresolved":false,"context_lines":[{"line_number":65,"context_line":"    XSS:"},{"line_number":66,"context_line":"        include:"},{"line_number":67,"context_line":"            - jinja2_autoescape_false"},{"line_number":68,"context_line":"            - use_of_mako_templates"},{"line_number":69,"context_line":""},{"line_number":70,"context_line":"    ShellInjection:"},{"line_number":71,"context_line":"        include:"}],"source_content_type":"text/x-yaml","patch_set":3,"id":"1a26ad4f_e7c7b343","line":68,"updated":"2015-10-28 01:21:51.000000000","message":"Would it be possible to always enable \"all\" checks, but disable a few of them? I guess that new warnings are only added when bandit is updated, and we control the version of bandit, no?","commit_id":"d6f406cd4e2699cae962d1a999b2f2ab37418af3"},{"author":{"_account_id":8122,"name":"Cyril Roelandt","email":"cyril@redhat.com","username":"cyril.roelandt.enovance"},"change_message_id":"548a88608edb83f970d099e26c255f641f2079db","unresolved":false,"context_lines":[{"line_number":65,"context_line":"    XSS:"},{"line_number":66,"context_line":"        include:"},{"line_number":67,"context_line":"            - jinja2_autoescape_false"},{"line_number":68,"context_line":"            - use_of_mako_templates"},{"line_number":69,"context_line":""},{"line_number":70,"context_line":"    ShellInjection:"},{"line_number":71,"context_line":"        include:"}],"source_content_type":"text/x-yaml","patch_set":3,"id":"1a26ad4f_98ec03c9","line":68,"in_reply_to":"1a26ad4f_e7c7b343","updated":"2015-10-28 17:22:46.000000000","message":"I should remove the \u0027XSS\u0027, \u0027ShellInjection\u0027 and \u0027SqlInjection\u0027 profiles, as they are included in the \u0027oslo_utils\u0027 profile.","commit_id":"d6f406cd4e2699cae962d1a999b2f2ab37418af3"},{"author":{"_account_id":9107,"name":"Victor Stinner","email":"vstinner@redhat.com","username":"haypo"},"change_message_id":"507e9249c1047d89ffb2c3e1a0b9ec4f055d6a31","unresolved":false,"context_lines":[{"line_number":114,"context_line":"                - Crypto.Cipher.XOR.new"},{"line_number":115,"context_line":"                - cryptography.hazmat.primitives.ciphers.algorithms.ARC4"},{"line_number":116,"context_line":"                - cryptography.hazmat.primitives.ciphers.algorithms.Blowfish"},{"line_number":117,"context_line":"                - cryptography.hazmat.primitives.ciphers.algorithms.IDEA"},{"line_number":118,"context_line":"            message: \u003e"},{"line_number":119,"context_line":"                Use of insecure cipher {func}. Replace with a known secure"},{"line_number":120,"context_line":"                cipher such as AES."}],"source_content_type":"text/x-yaml","patch_set":3,"id":"1a26ad4f_a7d8db1e","line":117,"updated":"2015-10-28 01:21:51.000000000","message":"Hum, I don\u0027t like the idea of maintaining this long list in each Oslo project. We have 20 Common Libraries or more :-( Again, I would prefer to have a template or something else to have a common config.","commit_id":"d6f406cd4e2699cae962d1a999b2f2ab37418af3"}],"oslo_utils/timeutils.py":[{"author":{"_account_id":8122,"name":"Cyril Roelandt","email":"cyril@redhat.com","username":"cyril.roelandt.enovance"},"change_message_id":"7fdaabed2d500c357831b55f142855724f865287","unresolved":false,"context_lines":[{"line_number":217,"context_line":"    See :py:class:`oslo_utils.fixture.TimeFixture`."},{"line_number":218,"context_line":""},{"line_number":219,"context_line":"    \"\"\""},{"line_number":220,"context_line":"    assert utcnow.override_time is not None  # nosec"},{"line_number":221,"context_line":"    try:"},{"line_number":222,"context_line":"        for dt in utcnow.override_time:"},{"line_number":223,"context_line":"            dt +\u003d timedelta"}],"source_content_type":"text/x-python","patch_set":4,"id":"ba8a016a_0280ac45","line":220,"updated":"2015-11-20 15:00:17.000000000","message":"Not so sure about \"nosec\" here. We might want to raise a ValueError here, rather than using \"assert\". If this assertion is removed in optimized bytecode, we\u0027ll get an error at the next line.","commit_id":"92661e47babe172eef30c7a3a546db4f9ea5b54c"},{"author":{"_account_id":9107,"name":"Victor Stinner","email":"vstinner@redhat.com","username":"haypo"},"change_message_id":"e95863fe647ec52090de2f41ccb90ea95ac568d8","unresolved":false,"context_lines":[{"line_number":217,"context_line":"    See :py:class:`oslo_utils.fixture.TimeFixture`."},{"line_number":218,"context_line":""},{"line_number":219,"context_line":"    \"\"\""},{"line_number":220,"context_line":"    assert utcnow.override_time is not None  # nosec"},{"line_number":221,"context_line":"    try:"},{"line_number":222,"context_line":"        for dt in utcnow.override_time:"},{"line_number":223,"context_line":"            dt +\u003d timedelta"}],"source_content_type":"text/x-python","patch_set":4,"id":"ba8a016a_9db0478d","line":220,"in_reply_to":"ba8a016a_0280ac45","updated":"2015-11-23 10:08:57.000000000","message":"I prefer to keep \"# nosec\".\n\nThis feature (.override_time) is only used in tests, I prefer to remove the assertion in production code.\n\nIn practice, the -O command line option (removing assertions) is rarely used.","commit_id":"92661e47babe172eef30c7a3a546db4f9ea5b54c"}]}