)]}'
{"/COMMIT_MSG":[{"author":{"_account_id":841,"name":"Akihiro Motoki","email":"amotoki@gmail.com","username":"amotoki"},"change_message_id":"5f8b86866e06c927a8ec8deeefa435dea8193069","unresolved":false,"context_lines":[{"line_number":7,"context_line":"Replace insecure function eval"},{"line_number":8,"context_line":""},{"line_number":9,"context_line":"In neutronclient we use a eval function for processing"},{"line_number":10,"context_line":"CLI neutron arguments. This function possible insecure because"},{"line_number":11,"context_line":"eval get argument from client side. Instead of it we can use"},{"line_number":12,"context_line":"a dict with allowed types which is more secure."},{"line_number":13,"context_line":""}],"source_content_type":"text/x-gerrit-commit-message","patch_set":6,"id":"bf659307_16a43ba5","line":10,"range":{"start_line":10,"start_character":37,"end_line":10,"end_character":54},"updated":"2018-03-31 17:53:34.000000000","message":"You potentially break the existing feature in neutron CLI (and your current version obviously breaks it), so we need to evaluate \"possible insecure\" you mention considering the balance of backward compatibility and security risks. It is not enough that some security tool points out potential security risks. We would like to see actual security bug report.","commit_id":"c0fbe1f4f1d2c02bea30e7e774137595d1cf3add"}],"neutronclient/neutron/v2_0/__init__.py":[{"author":{"_account_id":841,"name":"Akihiro Motoki","email":"amotoki@gmail.com","username":"amotoki"},"change_message_id":"33ee5909bd8d7cffefeabaa73aabba028143f3c0","unresolved":false,"context_lines":[{"line_number":220,"context_line":"                    current_arg.update({\u0027type\u0027: utils.str2bool})"},{"line_number":221,"context_line":"                elif current_type_str \u003d\u003d \u0027dict\u0027:"},{"line_number":222,"context_line":"                    current_arg.update({\u0027type\u0027: utils.str2dict})"},{"line_number":223,"context_line":"                continue"},{"line_number":224,"context_line":"        elif _item \u003d\u003d \u0027list\u003dtrue\u0027:"},{"line_number":225,"context_line":"            _list_flag \u003d True"},{"line_number":226,"context_line":"            continue"}],"source_content_type":"text/x-python","patch_set":2,"id":"bf659307_2d551b51","side":"PARENT","line":223,"range":{"start_line":223,"start_character":15,"end_line":223,"end_character":24},"updated":"2018-03-24 18:05:12.000000000","message":"\"continue\" here cannot be dropped.","commit_id":"55ecda7afbc855463be8fb322d5a808721635f47"},{"author":{"_account_id":841,"name":"Akihiro Motoki","email":"amotoki@gmail.com","username":"amotoki"},"change_message_id":"33ee5909bd8d7cffefeabaa73aabba028143f3c0","unresolved":false,"context_lines":[{"line_number":185,"context_line":"    current_item \u003d None"},{"line_number":186,"context_line":"    # the str after \u0027type\u003d\u0027"},{"line_number":187,"context_line":"    current_type_str \u003d None"},{"line_number":188,"context_line":"    # dict of types "},{"line_number":189,"context_line":"    for _item in values_specs_copy:"},{"line_number":190,"context_line":"        if _item.startswith(\u0027--\u0027):"},{"line_number":191,"context_line":"            # Deal with previous argument if any"}],"source_content_type":"text/x-python","patch_set":2,"id":"bf659307_4d696f23","line":188,"range":{"start_line":188,"start_character":4,"end_line":188,"end_character":20},"updated":"2018-03-24 18:05:12.000000000","message":"This line looks unnecessary.","commit_id":"67b2dede6b29934a34d15b0f628ae59a74015d44"},{"author":{"_account_id":841,"name":"Akihiro Motoki","email":"amotoki@gmail.com","username":"amotoki"},"change_message_id":"33ee5909bd8d7cffefeabaa73aabba028143f3c0","unresolved":false,"context_lines":[{"line_number":216,"context_line":"                    _(\"Invalid values_specs %s\") % \u0027 \u0027.join(values_specs))"},{"line_number":217,"context_line":"            if \u0027type\u0027 not in current_arg:"},{"line_number":218,"context_line":"                current_type_str \u003d _item.split(\u0027\u003d\u0027, 2)[1]"},{"line_number":219,"context_line":"                allowed_type_dict \u003d {\u0027bool\u0027: utils.str2bool,"},{"line_number":220,"context_line":"\t\t\t\t\t\t\t\t\t \u0027dict\u0027: utils.str2dict,"},{"line_number":221,"context_line":"                                     \u0027int\u0027: int,"},{"line_number":222,"context_line":"                                     # XXX FIXME add other necessary types here"}],"source_content_type":"text/x-python","patch_set":2,"id":"bf659307_ed4e43c0","line":219,"range":{"start_line":219,"start_character":16,"end_line":219,"end_character":34},"updated":"2018-03-24 18:05:12.000000000","message":"This dict is a constant. Could you define this dict out of the method?","commit_id":"67b2dede6b29934a34d15b0f628ae59a74015d44"},{"author":{"_account_id":841,"name":"Akihiro Motoki","email":"amotoki@gmail.com","username":"amotoki"},"change_message_id":"33ee5909bd8d7cffefeabaa73aabba028143f3c0","unresolved":false,"context_lines":[{"line_number":217,"context_line":"            if \u0027type\u0027 not in current_arg:"},{"line_number":218,"context_line":"                current_type_str \u003d _item.split(\u0027\u003d\u0027, 2)[1]"},{"line_number":219,"context_line":"                allowed_type_dict \u003d {\u0027bool\u0027: utils.str2bool,"},{"line_number":220,"context_line":"\t\t\t\t\t\t\t\t\t \u0027dict\u0027: utils.str2dict,"},{"line_number":221,"context_line":"                                     \u0027int\u0027: int,"},{"line_number":222,"context_line":"                                     # XXX FIXME add other necessary types here"},{"line_number":223,"context_line":"                                    }"}],"source_content_type":"text/x-python","patch_set":2,"id":"bf659307_ed75e3fb","line":220,"updated":"2018-03-24 18:05:12.000000000","message":"Could you use spaces instead of tabs?","commit_id":"67b2dede6b29934a34d15b0f628ae59a74015d44"},{"author":{"_account_id":841,"name":"Akihiro Motoki","email":"amotoki@gmail.com","username":"amotoki"},"change_message_id":"33ee5909bd8d7cffefeabaa73aabba028143f3c0","unresolved":false,"context_lines":[{"line_number":219,"context_line":"                allowed_type_dict \u003d {\u0027bool\u0027: utils.str2bool,"},{"line_number":220,"context_line":"\t\t\t\t\t\t\t\t\t \u0027dict\u0027: utils.str2dict,"},{"line_number":221,"context_line":"                                     \u0027int\u0027: int,"},{"line_number":222,"context_line":"                                     # XXX FIXME add other necessary types here"},{"line_number":223,"context_line":"                                    }"},{"line_number":224,"context_line":"                if current_type_str in allowed_type_dict:"},{"line_number":225,"context_line":"                \tcurrent_arg.update("}],"source_content_type":"text/x-python","patch_set":2,"id":"bf659307_cd66df52","line":222,"range":{"start_line":222,"start_character":37,"end_line":222,"end_character":79},"updated":"2018-03-24 18:05:12.000000000","message":"\u0027str\u0027 is also needed to pass unit tests.\n\nIn addition, could you drop this comment?","commit_id":"67b2dede6b29934a34d15b0f628ae59a74015d44"},{"author":{"_account_id":841,"name":"Akihiro Motoki","email":"amotoki@gmail.com","username":"amotoki"},"change_message_id":"33ee5909bd8d7cffefeabaa73aabba028143f3c0","unresolved":false,"context_lines":[{"line_number":221,"context_line":"                                     \u0027int\u0027: int,"},{"line_number":222,"context_line":"                                     # XXX FIXME add other necessary types here"},{"line_number":223,"context_line":"                                    }"},{"line_number":224,"context_line":"                if current_type_str in allowed_type_dict:"},{"line_number":225,"context_line":"                \tcurrent_arg.update("},{"line_number":226,"context_line":"                \t\t{\u0027type\u0027: allowed_type_dict[current_type_str]})"},{"line_number":227,"context_line":"        elif _item \u003d\u003d \u0027list\u003dtrue\u0027:"}],"source_content_type":"text/x-python","patch_set":2,"id":"bf659307_0d4cd7c5","line":224,"range":{"start_line":224,"start_character":16,"end_line":224,"end_character":57},"updated":"2018-03-24 18:05:12.000000000","message":"If unknown type is found, it is better to raise an error message instead of just ignoring it.","commit_id":"67b2dede6b29934a34d15b0f628ae59a74015d44"},{"author":{"_account_id":841,"name":"Akihiro Motoki","email":"amotoki@gmail.com","username":"amotoki"},"change_message_id":"33ee5909bd8d7cffefeabaa73aabba028143f3c0","unresolved":false,"context_lines":[{"line_number":223,"context_line":"                                    }"},{"line_number":224,"context_line":"                if current_type_str in allowed_type_dict:"},{"line_number":225,"context_line":"                \tcurrent_arg.update("},{"line_number":226,"context_line":"                \t\t{\u0027type\u0027: allowed_type_dict[current_type_str]})"},{"line_number":227,"context_line":"        elif _item \u003d\u003d \u0027list\u003dtrue\u0027:"},{"line_number":228,"context_line":"            _list_flag \u003d True"},{"line_number":229,"context_line":"            continue"}],"source_content_type":"text/x-python","patch_set":2,"id":"bf659307_8d60e734","line":226,"range":{"start_line":226,"start_character":16,"end_line":226,"end_character":17},"updated":"2018-03-24 18:05:12.000000000","message":"Use spaces instead of tab.","commit_id":"67b2dede6b29934a34d15b0f628ae59a74015d44"},{"author":{"_account_id":13717,"name":"Inessa Vasilevskaya","email":"ivasilevskaya@mirantis.com","username":"ivasilevskaya"},"change_message_id":"311d61ce081ad75090c7f17962138417e762f9f4","unresolved":false,"context_lines":[{"line_number":189,"context_line":"    allowed_type_dict \u003d {"},{"line_number":190,"context_line":"        \u0027bool\u0027: utils.str2bool,"},{"line_number":191,"context_line":"        \u0027dict\u0027: utils.str2dict,"},{"line_number":192,"context_line":"        # \u0027int\u0027: int,"},{"line_number":193,"context_line":"        # add other necessary types here"},{"line_number":194,"context_line":"    }"},{"line_number":195,"context_line":""}],"source_content_type":"text/x-python","patch_set":3,"id":"bf659307_54b1dd8e","line":192,"range":{"start_line":192,"start_character":8,"end_line":192,"end_character":21},"updated":"2018-03-26 11:56:17.000000000","message":"that should be removed","commit_id":"3bab86ed6c957e60706cc928d252656de9d1f7d1"},{"author":{"_account_id":13717,"name":"Inessa Vasilevskaya","email":"ivasilevskaya@mirantis.com","username":"ivasilevskaya"},"change_message_id":"c08fa72cbba629c52adf46078bd9190203f15051","unresolved":false,"context_lines":[{"line_number":190,"context_line":"        \u0027bool\u0027: utils.str2bool,"},{"line_number":191,"context_line":"        \u0027dict\u0027: utils.str2dict,"},{"line_number":192,"context_line":"        # \u0027int\u0027: int,"},{"line_number":193,"context_line":"        # add other necessary types here"},{"line_number":194,"context_line":"    }"},{"line_number":195,"context_line":""},{"line_number":196,"context_line":"    for _item in values_specs_copy:"}],"source_content_type":"text/x-python","patch_set":3,"id":"bf659307_efd29e34","line":193,"range":{"start_line":193,"start_character":8,"end_line":193,"end_character":40},"updated":"2018-03-26 12:12:49.000000000","message":"and that if no errors are raised in tests","commit_id":"3bab86ed6c957e60706cc928d252656de9d1f7d1"},{"author":{"_account_id":13717,"name":"Inessa Vasilevskaya","email":"ivasilevskaya@mirantis.com","username":"ivasilevskaya"},"change_message_id":"79f4c7e906462284c72c7df4c054d9308e3220d6","unresolved":false,"context_lines":[{"line_number":228,"context_line":"                        {\u0027type\u0027: allowed_type_dict[current_type_str]})"},{"line_number":229,"context_line":"                    continue"},{"line_number":230,"context_line":"                else:"},{"line_number":231,"context_line":"                    raise exceptions.CommandError("},{"line_number":232,"context_line":"                        _(\"Invalid value_specs %s\") % \u0027 \u0027.join(values_specs))"},{"line_number":233,"context_line":""},{"line_number":234,"context_line":"        elif _item \u003d\u003d \u0027list\u003dtrue\u0027:"},{"line_number":235,"context_line":"            _list_flag \u003d True"}],"source_content_type":"text/x-python","patch_set":3,"id":"bf659307_34bc6904","line":232,"range":{"start_line":231,"start_character":0,"end_line":232,"end_character":77},"updated":"2018-03-26 11:35:16.000000000","message":"Maybe you can be a bit more specific in exception message? Maybe \"Invalid value_specs %(specs)s: type %(type)s is not supported\" or something like that?","commit_id":"3bab86ed6c957e60706cc928d252656de9d1f7d1"},{"author":{"_account_id":13717,"name":"Inessa Vasilevskaya","email":"ivasilevskaya@mirantis.com","username":"ivasilevskaya"},"change_message_id":"f4f89ed050c670cc51d62a533f03d88b0ab3abe9","unresolved":false,"context_lines":[{"line_number":226,"context_line":"                        {\u0027type\u0027: allowed_type_dict[current_type_str]})"},{"line_number":227,"context_line":"                    continue"},{"line_number":228,"context_line":"                else:"},{"line_number":229,"context_line":"                    raise exceptions.CommandError("},{"line_number":230,"context_line":"                        _(\"Invalid value_specs %s: type %s is not supported\")"},{"line_number":231,"context_line":"                        % (\u0027 \u0027.join(values_specs), \u0027\u0027.join(current_type_str)))"},{"line_number":232,"context_line":""},{"line_number":233,"context_line":"        elif _item \u003d\u003d \u0027list\u003dtrue\u0027:"},{"line_number":234,"context_line":"            _list_flag \u003d True"}],"source_content_type":"text/x-python","patch_set":4,"id":"bf659307_b2db69eb","line":231,"range":{"start_line":229,"start_character":20,"end_line":231,"end_character":78},"updated":"2018-03-28 08:27:05.000000000","message":"it\u0027s better to use named args when there is more than 1\n\n\"Invalid value_specs %(specs)s: type %(curr_type)s is not supported\" % {\u0027specs\u0027: \u0027 \u0027.join(values_spec),\n               \u0027curr_type\u0027: current_type_str}\n\n\u0027\u0027.join(current_type_str) is abundant, current_type str can\u0027t be a list under normal conditions","commit_id":"f47c6bdbca79dce78d2d90390a888f6e4cb68a4e"},{"author":{"_account_id":13717,"name":"Inessa Vasilevskaya","email":"ivasilevskaya@mirantis.com","username":"ivasilevskaya"},"change_message_id":"7213c5e1b956818f2991329363956fb9598acce1","unresolved":false,"context_lines":[{"line_number":230,"context_line":"                        _(\"Invalid value_specs {valspec}: type {curtypestr}\""},{"line_number":231,"context_line":"                            \" is not supported\").format("},{"line_number":232,"context_line":"                            valspec\u003d\u0027 \u0027.join(values_specs),"},{"line_number":233,"context_line":"                                curtypestr\u003d\u0027\u0027.join(current_type_str)))"},{"line_number":234,"context_line":""},{"line_number":235,"context_line":"        elif _item \u003d\u003d \u0027list\u003dtrue\u0027:"},{"line_number":236,"context_line":"            _list_flag \u003d True"}],"source_content_type":"text/x-python","patch_set":5,"id":"bf659307_ad746e69","line":233,"range":{"start_line":233,"start_character":32,"end_line":233,"end_character":70},"updated":"2018-03-28 08:47:28.000000000","message":"Why are you using \u0027\u0027.join(current_type_str)? It is never a list","commit_id":"a8856e654f6616f1eaea812e34dba3635e27cd19"},{"author":{"_account_id":13717,"name":"Inessa Vasilevskaya","email":"ivasilevskaya@mirantis.com","username":"ivasilevskaya"},"change_message_id":"7213c5e1b956818f2991329363956fb9598acce1","unresolved":false,"context_lines":[{"line_number":230,"context_line":"                        _(\"Invalid value_specs {valspec}: type {curtypestr}\""},{"line_number":231,"context_line":"                            \" is not supported\").format("},{"line_number":232,"context_line":"                            valspec\u003d\u0027 \u0027.join(values_specs),"},{"line_number":233,"context_line":"                                curtypestr\u003d\u0027\u0027.join(current_type_str)))"},{"line_number":234,"context_line":""},{"line_number":235,"context_line":"        elif _item \u003d\u003d \u0027list\u003dtrue\u0027:"},{"line_number":236,"context_line":"            _list_flag \u003d True"}],"source_content_type":"text/x-python","patch_set":5,"id":"bf659307_cd6f6290","line":233,"range":{"start_line":233,"start_character":28,"end_line":233,"end_character":31},"updated":"2018-03-28 08:47:28.000000000","message":"abundant formatting","commit_id":"a8856e654f6616f1eaea812e34dba3635e27cd19"},{"author":{"_account_id":841,"name":"Akihiro Motoki","email":"amotoki@gmail.com","username":"amotoki"},"change_message_id":"648cd023969f94b5567cd91038f88a4cd0239a02","unresolved":false,"context_lines":[{"line_number":188,"context_line":"    # dict of allowed types"},{"line_number":189,"context_line":"    allowed_type_dict \u003d {"},{"line_number":190,"context_line":"        \u0027bool\u0027: utils.str2bool,"},{"line_number":191,"context_line":"        \u0027dict\u0027: utils.str2dict,"},{"line_number":192,"context_line":"    }"},{"line_number":193,"context_line":""},{"line_number":194,"context_line":"    for _item in values_specs_copy:"}],"source_content_type":"text/x-python","patch_set":6,"id":"bf659307_0085fcce","line":191,"updated":"2018-04-11 12:26:21.000000000","message":"int and str were added in patch set 7.","commit_id":"c0fbe1f4f1d2c02bea30e7e774137595d1cf3add"},{"author":{"_account_id":841,"name":"Akihiro Motoki","email":"amotoki@gmail.com","username":"amotoki"},"change_message_id":"c4e0e8132d3d56d3896b2b13d9884d859b1186a6","unresolved":false,"context_lines":[{"line_number":225,"context_line":"                    current_arg.update("},{"line_number":226,"context_line":"                        {\u0027type\u0027: allowed_type_dict[current_type_str]})"},{"line_number":227,"context_line":"                    continue"},{"line_number":228,"context_line":"                else:"},{"line_number":229,"context_line":"                    raise exceptions.CommandError("},{"line_number":230,"context_line":"                        _(\"Invalid value_specs {valspec}: type {curtypestr}\""},{"line_number":231,"context_line":"                            \" is not supported\").format("}],"source_content_type":"text/x-python","patch_set":6,"id":"bf659307_b6d9cf57","line":228,"updated":"2018-03-31 17:22:33.000000000","message":"Your change blocks type\u003dint and type\u003dstr. You need to honor L.218 in the original code. This accepts python primitives other than bool and dict.\n\nFor example, the following command should work:\n\n neutron net-update net2 --mtu type\u003dint 1430\n\nneutron CLI is now in the freeze phase, so we should not change the existing behavior. All changes which violate this policy are not allowed.","commit_id":"c0fbe1f4f1d2c02bea30e7e774137595d1cf3add"},{"author":{"_account_id":841,"name":"Akihiro Motoki","email":"amotoki@gmail.com","username":"amotoki"},"change_message_id":"20426512c292402d3c999fe2864a824f2ec250af","unresolved":false,"context_lines":[{"line_number":225,"context_line":"                    current_arg.update("},{"line_number":226,"context_line":"                        {\u0027type\u0027: allowed_type_dict[current_type_str]})"},{"line_number":227,"context_line":"                    continue"},{"line_number":228,"context_line":"                else:"},{"line_number":229,"context_line":"                    raise exceptions.CommandError("},{"line_number":230,"context_line":"                        _(\"Invalid value_specs {valspec}: type {curtypestr}\""},{"line_number":231,"context_line":"                            \" is not supported\").format("}],"source_content_type":"text/x-python","patch_set":6,"id":"bf659307_9de73513","line":228,"in_reply_to":"bf659307_568153fa","updated":"2018-04-11 11:37:01.000000000","message":"Looking at the bug report, I now understand possible security risks.\n\nAFAIK, all types we actually use are: int, bool, str, dict, so my vote is to support these four types in this patch. If someone uses other type(s), let\u0027s fix it as a bug.","commit_id":"c0fbe1f4f1d2c02bea30e7e774137595d1cf3add"},{"author":{"_account_id":841,"name":"Akihiro Motoki","email":"amotoki@gmail.com","username":"amotoki"},"change_message_id":"bc02e5afdbb02bbb5447509b3b1af645228b8bf3","unresolved":false,"context_lines":[{"line_number":225,"context_line":"                    current_arg.update("},{"line_number":226,"context_line":"                        {\u0027type\u0027: allowed_type_dict[current_type_str]})"},{"line_number":227,"context_line":"                    continue"},{"line_number":228,"context_line":"                else:"},{"line_number":229,"context_line":"                    raise exceptions.CommandError("},{"line_number":230,"context_line":"                        _(\"Invalid value_specs {valspec}: type {curtypestr}\""},{"line_number":231,"context_line":"                            \" is not supported\").format("}],"source_content_type":"text/x-python","patch_set":6,"id":"bf659307_568153fa","line":228,"in_reply_to":"bf659307_b6d9cf57","updated":"2018-03-31 17:50:05.000000000","message":"One more question: Do you know which types are actually used in released neutron CLI? I guess bool/int/str/dict are at least used, but I don\u0027t know there is other types which actually can be used. At least we must not break the existing behavior.\n\nIf you are not confident to ensure 100% backward incompatibility, I first would like to see the actual \"insecure\" point of eval in **neutron CLI** as a bug. As of now my understanding is JUST refactoring to avoid potential issue.","commit_id":"c0fbe1f4f1d2c02bea30e7e774137595d1cf3add"}],"neutronclient/tests/unit/test_casual_args.py":[{"author":{"_account_id":841,"name":"Akihiro Motoki","email":"amotoki@gmail.com","username":"amotoki"},"change_message_id":"648cd023969f94b5567cd91038f88a4cd0239a02","unresolved":false,"context_lines":[{"line_number":105,"context_line":"    def test_parse_args_to_dict_bad_type(self):"},{"line_number":106,"context_line":"        _specs \u003d [\u0027--badtypearg\u0027, \u0027type\u003dint\u0027]"},{"line_number":107,"context_line":"        self.assertRaises(exceptions.CommandError,"},{"line_number":108,"context_line":"                          neutronV20.parse_args_to_dict, _specs)"},{"line_number":109,"context_line":""},{"line_number":110,"context_line":"    def test_clear_action(self):"},{"line_number":111,"context_line":"        _specs \u003d [\u0027--anyarg\u0027, \u0027action\u003dclear\u0027]"}],"source_content_type":"text/x-python","patch_set":6,"id":"bf659307_c025c40a","line":108,"updated":"2018-04-11 12:26:21.000000000","message":"This raises CommandError, but it should be due to non-existing value. It should not raise an exception due to a bad type. Fixed in patch set 7.","commit_id":"c0fbe1f4f1d2c02bea30e7e774137595d1cf3add"}]}