)]}'
{"security-notes/OSSN-0070":[{"author":{"_account_id":17893,"name":"Luke Hinds","email":"lhinds@redhat.com","username":"lhinds"},"change_message_id":"ebdeb19c00d37ebb8e19035d427a9176edf694d7","unresolved":false,"context_lines":[{"line_number":3,"context_line":""},{"line_number":4,"context_line":"### Summary ###"},{"line_number":5,"context_line":"Bandit versions lower than 1.1.0 had a bug in the HTML report formatter that"},{"line_number":6,"context_line":"did not escape HTML in issue context snippets. This could lead to an XXS if"},{"line_number":7,"context_line":"HTML reports were hosted as part of a CI pipeline."},{"line_number":8,"context_line":""},{"line_number":9,"context_line":"### Affected Services / Software ###"}],"source_content_type":"application/octet-stream","patch_set":2,"id":"3ac371cc_d29035ef","line":6,"range":{"start_line":6,"start_character":69,"end_line":6,"end_character":72},"updated":"2016-08-15 14:47:50.000000000","message":"XSS","commit_id":"add5b6ece91f7cbd7eabf3e1f79cf32c6c04daba"},{"author":{"_account_id":17893,"name":"Luke Hinds","email":"lhinds@redhat.com","username":"lhinds"},"change_message_id":"ebdeb19c00d37ebb8e19035d427a9176edf694d7","unresolved":false,"context_lines":[{"line_number":11,"context_line":""},{"line_number":12,"context_line":"### Discussion ###"},{"line_number":13,"context_line":"Bandit versions lower than 1.1.0 had a bug in the HTML report formatter that"},{"line_number":14,"context_line":"did not escape HTML in issue context snippets. This could lead to an XXS attack"},{"line_number":15,"context_line":"if HTML reports were hosted as part of a CI pipeline because HTML in the source"},{"line_number":16,"context_line":"code would be copied verbatim into the report. For example:"},{"line_number":17,"context_line":""}],"source_content_type":"application/octet-stream","patch_set":2,"id":"3ac371cc_527285e6","line":14,"range":{"start_line":14,"start_character":69,"end_line":14,"end_character":72},"updated":"2016-08-15 14:47:50.000000000","message":"XSS","commit_id":"add5b6ece91f7cbd7eabf3e1f79cf32c6c04daba"},{"author":{"_account_id":10705,"name":"Darren Chan","email":"dazzachan@yahoo.com.au","username":"daz"},"change_message_id":"86889f6525f8e65ea24a9fc759fc359c5aaee459","unresolved":false,"context_lines":[{"line_number":2,"context_line":"---"},{"line_number":3,"context_line":""},{"line_number":4,"context_line":"### Summary ###"},{"line_number":5,"context_line":"Bandit versions lower than 1.1.0 had a bug in the HTML report formatter that"},{"line_number":6,"context_line":"did not escape HTML in issue context snippets. This could lead to an XSS if"},{"line_number":7,"context_line":"HTML reports were hosted as part of a CI pipeline."},{"line_number":8,"context_line":""}],"source_content_type":"application/octet-stream","patch_set":3,"id":"3ac371cc_434f006b","line":5,"range":{"start_line":5,"start_character":33,"end_line":5,"end_character":36},"updated":"2016-08-17 02:06:13.000000000","message":"has","commit_id":"08d3e2e33ceddc44add5144db897bc8f915c8165"},{"author":{"_account_id":7063,"name":"Robert Clark","email":"hyakuhei@gmail.com","username":"hyakuhei"},"change_message_id":"d2c1f89b2acd6379c7861b07018f648b8b60ed77","unresolved":false,"context_lines":[{"line_number":2,"context_line":"---"},{"line_number":3,"context_line":""},{"line_number":4,"context_line":"### Summary ###"},{"line_number":5,"context_line":"Bandit versions lower than 1.1.0 had a bug in the HTML report formatter that"},{"line_number":6,"context_line":"did not escape HTML in issue context snippets. This could lead to an XSS if"},{"line_number":7,"context_line":"HTML reports were hosted as part of a CI pipeline."},{"line_number":8,"context_line":""}],"source_content_type":"application/octet-stream","patch_set":3,"id":"1ac06dbe_17312d0c","line":5,"range":{"start_line":5,"start_character":33,"end_line":5,"end_character":36},"in_reply_to":"3ac371cc_434f006b","updated":"2016-08-19 16:33:26.000000000","message":"\u0027have\u0027 makes more sense.","commit_id":"08d3e2e33ceddc44add5144db897bc8f915c8165"},{"author":{"_account_id":10705,"name":"Darren Chan","email":"dazzachan@yahoo.com.au","username":"daz"},"change_message_id":"86889f6525f8e65ea24a9fc759fc359c5aaee459","unresolved":false,"context_lines":[{"line_number":3,"context_line":""},{"line_number":4,"context_line":"### Summary ###"},{"line_number":5,"context_line":"Bandit versions lower than 1.1.0 had a bug in the HTML report formatter that"},{"line_number":6,"context_line":"did not escape HTML in issue context snippets. This could lead to an XSS if"},{"line_number":7,"context_line":"HTML reports were hosted as part of a CI pipeline."},{"line_number":8,"context_line":""},{"line_number":9,"context_line":"### Affected Services / Software ###"}],"source_content_type":"application/octet-stream","patch_set":3,"id":"3ac371cc_835578fb","line":6,"range":{"start_line":6,"start_character":0,"end_line":6,"end_character":3},"updated":"2016-08-17 02:06:13.000000000","message":"does","commit_id":"08d3e2e33ceddc44add5144db897bc8f915c8165"},{"author":{"_account_id":10705,"name":"Darren Chan","email":"dazzachan@yahoo.com.au","username":"daz"},"change_message_id":"86889f6525f8e65ea24a9fc759fc359c5aaee459","unresolved":false,"context_lines":[{"line_number":4,"context_line":"### Summary ###"},{"line_number":5,"context_line":"Bandit versions lower than 1.1.0 had a bug in the HTML report formatter that"},{"line_number":6,"context_line":"did not escape HTML in issue context snippets. This could lead to an XSS if"},{"line_number":7,"context_line":"HTML reports were hosted as part of a CI pipeline."},{"line_number":8,"context_line":""},{"line_number":9,"context_line":"### Affected Services / Software ###"},{"line_number":10,"context_line":"Bandit: \u003c 1.1.0"}],"source_content_type":"application/octet-stream","patch_set":3,"id":"3ac371cc_034a2855","line":7,"range":{"start_line":7,"start_character":13,"end_line":7,"end_character":17},"updated":"2016-08-17 02:06:13.000000000","message":"are","commit_id":"08d3e2e33ceddc44add5144db897bc8f915c8165"},{"author":{"_account_id":10705,"name":"Darren Chan","email":"dazzachan@yahoo.com.au","username":"daz"},"change_message_id":"86889f6525f8e65ea24a9fc759fc359c5aaee459","unresolved":false,"context_lines":[{"line_number":10,"context_line":"Bandit: \u003c 1.1.0"},{"line_number":11,"context_line":""},{"line_number":12,"context_line":"### Discussion ###"},{"line_number":13,"context_line":"Bandit versions lower than 1.1.0 had a bug in the HTML report formatter that"},{"line_number":14,"context_line":"did not escape HTML in issue context snippets. This could lead to an XSS attack"},{"line_number":15,"context_line":"if HTML reports were hosted as part of a CI pipeline because HTML in the source"},{"line_number":16,"context_line":"code would be copied verbatim into the report. For example:"}],"source_content_type":"application/octet-stream","patch_set":3,"id":"3ac371cc_63715ca8","line":13,"range":{"start_line":13,"start_character":33,"end_line":13,"end_character":36},"updated":"2016-08-17 02:06:13.000000000","message":"has","commit_id":"08d3e2e33ceddc44add5144db897bc8f915c8165"},{"author":{"_account_id":10705,"name":"Darren Chan","email":"dazzachan@yahoo.com.au","username":"daz"},"change_message_id":"86889f6525f8e65ea24a9fc759fc359c5aaee459","unresolved":false,"context_lines":[{"line_number":11,"context_line":""},{"line_number":12,"context_line":"### Discussion ###"},{"line_number":13,"context_line":"Bandit versions lower than 1.1.0 had a bug in the HTML report formatter that"},{"line_number":14,"context_line":"did not escape HTML in issue context snippets. This could lead to an XSS attack"},{"line_number":15,"context_line":"if HTML reports were hosted as part of a CI pipeline because HTML in the source"},{"line_number":16,"context_line":"code would be copied verbatim into the report. For example:"},{"line_number":17,"context_line":""}],"source_content_type":"application/octet-stream","patch_set":3,"id":"3ac371cc_e35d4c16","line":14,"range":{"start_line":14,"start_character":0,"end_line":14,"end_character":3},"updated":"2016-08-17 02:06:13.000000000","message":"does","commit_id":"08d3e2e33ceddc44add5144db897bc8f915c8165"},{"author":{"_account_id":10705,"name":"Darren Chan","email":"dazzachan@yahoo.com.au","username":"daz"},"change_message_id":"86889f6525f8e65ea24a9fc759fc359c5aaee459","unresolved":false,"context_lines":[{"line_number":12,"context_line":"### Discussion ###"},{"line_number":13,"context_line":"Bandit versions lower than 1.1.0 had a bug in the HTML report formatter that"},{"line_number":14,"context_line":"did not escape HTML in issue context snippets. This could lead to an XSS attack"},{"line_number":15,"context_line":"if HTML reports were hosted as part of a CI pipeline because HTML in the source"},{"line_number":16,"context_line":"code would be copied verbatim into the report. For example:"},{"line_number":17,"context_line":""},{"line_number":18,"context_line":"  import subprocess"}],"source_content_type":"application/octet-stream","patch_set":3,"id":"3ac371cc_63a83cdc","line":15,"range":{"start_line":15,"start_character":16,"end_line":15,"end_character":20},"updated":"2016-08-17 02:06:13.000000000","message":"are","commit_id":"08d3e2e33ceddc44add5144db897bc8f915c8165"},{"author":{"_account_id":10705,"name":"Darren Chan","email":"dazzachan@yahoo.com.au","username":"daz"},"change_message_id":"86889f6525f8e65ea24a9fc759fc359c5aaee459","unresolved":false,"context_lines":[{"line_number":18,"context_line":"  import subprocess"},{"line_number":19,"context_line":"  subprocess.Popen(\"\u003cscript\u003ealert(1)\u003c/script\u003e\", shell\u003dTrue)"},{"line_number":20,"context_line":""},{"line_number":21,"context_line":"Would result in the \"\u003cscript\u003ealert(1)\u003c/script\u003e\" being inserted into the report"},{"line_number":22,"context_line":"HTML. This issue could allow for arbitrary code injection into CI/CD pipelines"},{"line_number":23,"context_line":"that feature accessible HTML reports generated from Bandit runs."},{"line_number":24,"context_line":""}],"source_content_type":"application/octet-stream","patch_set":3,"id":"3ac371cc_03da2817","line":21,"range":{"start_line":21,"start_character":0,"end_line":21,"end_character":19},"updated":"2016-08-17 02:06:13.000000000","message":"This causes \"\u003cscript\u003ealert(1)\u003c/script\u003e\" to be","commit_id":"08d3e2e33ceddc44add5144db897bc8f915c8165"},{"author":{"_account_id":7063,"name":"Robert Clark","email":"hyakuhei@gmail.com","username":"hyakuhei"},"change_message_id":"0ea59d4076e127acdff488b284ecdbb637c9d11f","unresolved":false,"context_lines":[{"line_number":10,"context_line":"Bandit: \u003c 1.1.0"},{"line_number":11,"context_line":""},{"line_number":12,"context_line":"### Discussion ###"},{"line_number":13,"context_line":"Bandit versions lower than 1.1.0 has a bug in the HTML report formatter that"},{"line_number":14,"context_line":"does not escape HTML in issue context snippets. This could lead to an XSS attack"},{"line_number":15,"context_line":"if HTML reports are hosted as part of a CI pipeline because HTML in the source"},{"line_number":16,"context_line":"code would be copied verbatim into the report. For example:"}],"source_content_type":"application/octet-stream","patch_set":4,"id":"1ac06dbe_3e3159ed","line":13,"range":{"start_line":13,"start_character":33,"end_line":13,"end_character":36},"updated":"2016-08-22 11:31:14.000000000","message":"nit: have","commit_id":"ff76d2ce717a5f09f7ff8a60cf58a9cb096cb8ad"},{"author":{"_account_id":20508,"name":"Mohit Motiani","email":"mohit.motiani@intel.com","username":"mohit.motiani"},"change_message_id":"14f7c9d2951c0886ffca3c0afbab7bea5ec86585","unresolved":false,"context_lines":[{"line_number":18,"context_line":"  import subprocess"},{"line_number":19,"context_line":"  subprocess.Popen(\"\u003cscript\u003ealert(1)\u003c/script\u003e\", shell\u003dTrue)"},{"line_number":20,"context_line":""},{"line_number":21,"context_line":"Will cause \"\u003cscript\u003ealert(1)\u003c/script\u003e\" to be inserted into the report HTML."},{"line_number":22,"context_line":"This issue could allow for arbitrary code injection into CI/CD pipelines that"},{"line_number":23,"context_line":"feature accessible HTML reports generated from Bandit runs."},{"line_number":24,"context_line":""}],"source_content_type":"application/octet-stream","patch_set":6,"id":"1ac06dbe_1e72efad","line":21,"updated":"2016-08-24 16:01:45.000000000","message":"Nit: s/report HTML/HTML report","commit_id":"c02cf583dc488de410b864b78a49eed05ae14fdb"}]}