)]}'
{"oslo_vmware/image_util.py":[{"author":{"_account_id":8119,"name":"Eric Brown","email":"eric_wade_brown@yahoo.com","username":"ericwb"},"change_message_id":"2c67b7228eb48c1244c6c5d24135f12c051ba0af","unresolved":false,"context_lines":[{"line_number":13,"context_line":"#    License for the specific language governing permissions and limitations"},{"line_number":14,"context_line":"#    under the License."},{"line_number":15,"context_line":""},{"line_number":16,"context_line":"from lxml import etree  # nosec"},{"line_number":17,"context_line":""},{"line_number":18,"context_line":""},{"line_number":19,"context_line":"def _get_vmdk_name_from_ovf(root):"}],"source_content_type":"text/x-python","patch_set":5,"id":"1a122d0e_c8a94492","line":16,"range":{"start_line":16,"start_character":26,"end_line":16,"end_character":31},"updated":"2016-04-19 20:51:30.000000000","message":"Please put a reason you want this bandit issue ignored.","commit_id":"3910bdf12bc6aa30af65657f36cc7a00c1529141"},{"author":{"_account_id":9171,"name":"Vipin Balachandran","email":"vipin.bl@gmail.com","username":"vbala"},"change_message_id":"037a9c6f9e11e3e1ceade1f07cbdc6b4b9652ef1","unresolved":false,"context_lines":[{"line_number":13,"context_line":"#    License for the specific language governing permissions and limitations"},{"line_number":14,"context_line":"#    under the License."},{"line_number":15,"context_line":""},{"line_number":16,"context_line":"from lxml import etree  # nosec"},{"line_number":17,"context_line":""},{"line_number":18,"context_line":""},{"line_number":19,"context_line":"def _get_vmdk_name_from_ovf(root):"}],"source_content_type":"text/x-python","patch_set":5,"id":"1a122d0e_988e5ece","line":16,"range":{"start_line":16,"start_character":26,"end_line":16,"end_character":31},"in_reply_to":"1a122d0e_c8a94492","updated":"2016-04-20 10:21:03.000000000","message":"Done\n\nBtw, this is not mentioned here:\nhttps://github.com/openstack/bandit#exclusions","commit_id":"3910bdf12bc6aa30af65657f36cc7a00c1529141"},{"author":{"_account_id":8119,"name":"Eric Brown","email":"eric_wade_brown@yahoo.com","username":"ericwb"},"change_message_id":"2c67b7228eb48c1244c6c5d24135f12c051ba0af","unresolved":false,"context_lines":[{"line_number":27,"context_line":""},{"line_number":28,"context_line":"def get_vmdk_name_from_ovf(ovf_handle):"},{"line_number":29,"context_line":"    \"\"\"Get the vmdk name from the given ovf descriptor.\"\"\""},{"line_number":30,"context_line":"    return _get_vmdk_name_from_ovf(etree.parse(ovf_handle).getroot())"}],"source_content_type":"text/x-python","patch_set":5,"id":"1a122d0e_489ed463","line":30,"range":{"start_line":30,"start_character":35,"end_line":30,"end_character":46},"updated":"2016-04-19 20:51:30.000000000","message":"This is worrisome since the OVF comes from a user, and etree.parse has potential security issues.","commit_id":"3910bdf12bc6aa30af65657f36cc7a00c1529141"},{"author":{"_account_id":9171,"name":"Vipin Balachandran","email":"vipin.bl@gmail.com","username":"vbala"},"change_message_id":"037a9c6f9e11e3e1ceade1f07cbdc6b4b9652ef1","unresolved":false,"context_lines":[{"line_number":27,"context_line":""},{"line_number":28,"context_line":"def get_vmdk_name_from_ovf(ovf_handle):"},{"line_number":29,"context_line":"    \"\"\"Get the vmdk name from the given ovf descriptor.\"\"\""},{"line_number":30,"context_line":"    return _get_vmdk_name_from_ovf(etree.parse(ovf_handle).getroot())"}],"source_content_type":"text/x-python","patch_set":5,"id":"1a122d0e_3810ea58","line":30,"range":{"start_line":30,"start_character":35,"end_line":30,"end_character":46},"in_reply_to":"1a122d0e_489ed463","updated":"2016-04-20 10:21:03.000000000","message":"What other options we have?\n\nSee https://github.com/openstack/nova/blob/master/nova/virt/vmwareapi/images.py#L392\n\nAlso see http://lists.openstack.org/pipermail/openstack-dev/2014-September/047463.html","commit_id":"3910bdf12bc6aa30af65657f36cc7a00c1529141"},{"author":{"_account_id":8119,"name":"Eric Brown","email":"eric_wade_brown@yahoo.com","username":"ericwb"},"change_message_id":"4f367cf3ccb9e0cb491a4f56ee4d48bb0c076a1e","unresolved":false,"context_lines":[{"line_number":13,"context_line":"#    License for the specific language governing permissions and limitations"},{"line_number":14,"context_line":"#    under the License."},{"line_number":15,"context_line":""},{"line_number":16,"context_line":"from lxml import etree  # nosec (defusedxml not in global-requirements)"},{"line_number":17,"context_line":""},{"line_number":18,"context_line":""},{"line_number":19,"context_line":"def _get_vmdk_name_from_ovf(root):"}],"source_content_type":"text/x-python","patch_set":7,"id":"1a122d0e_e047c6a0","line":16,"updated":"2016-04-28 15:07:53.000000000","message":"Please see https://docs.python.org/2/library/xml.html#xml-vulnerabilities\n\nIts still recommended to use defusedxml. If its not part of g-r, then it should be added.  This patch makes use of external input which is very vulnerable to various exploits.","commit_id":"1289d859d5bf848a45ae23c19ea3dd80e23e6f29"},{"author":{"_account_id":8119,"name":"Eric Brown","email":"eric_wade_brown@yahoo.com","username":"ericwb"},"change_message_id":"636f2f4275b30f2a5da1b27f7dc7be91c742af73","unresolved":false,"context_lines":[{"line_number":13,"context_line":"#    License for the specific language governing permissions and limitations"},{"line_number":14,"context_line":"#    under the License."},{"line_number":15,"context_line":""},{"line_number":16,"context_line":"from lxml import etree  # nosec (defusedxml not in global-requirements)"},{"line_number":17,"context_line":""},{"line_number":18,"context_line":""},{"line_number":19,"context_line":"def _get_vmdk_name_from_ovf(root):"}],"source_content_type":"text/x-python","patch_set":7,"id":"1a122d0e_e0518631","line":16,"in_reply_to":"1a122d0e_e047c6a0","updated":"2016-04-28 15:12:31.000000000","message":"Same with lxml\n\nhttp://lxml.de/FAQ.html#is-lxml-vulnerable-to-xml-bombs","commit_id":"1289d859d5bf848a45ae23c19ea3dd80e23e6f29"},{"author":{"_account_id":9171,"name":"Vipin Balachandran","email":"vipin.bl@gmail.com","username":"vbala"},"change_message_id":"83e40e6cbe03608573de919c011e7ed68ab267f6","unresolved":false,"context_lines":[{"line_number":13,"context_line":"#    License for the specific language governing permissions and limitations"},{"line_number":14,"context_line":"#    under the License."},{"line_number":15,"context_line":""},{"line_number":16,"context_line":"from lxml import etree  # nosec (defusedxml not in global-requirements)"},{"line_number":17,"context_line":""},{"line_number":18,"context_line":""},{"line_number":19,"context_line":"def _get_vmdk_name_from_ovf(root):"}],"source_content_type":"text/x-python","patch_set":7,"id":"1a122d0e_ee170c43","line":16,"in_reply_to":"1a122d0e_e0518631","updated":"2016-05-04 17:38:17.000000000","message":"See https://review.openstack.org/#/c/311857/\n\nIt looks like using lxml is safe.","commit_id":"1289d859d5bf848a45ae23c19ea3dd80e23e6f29"}]}