)]}'
{"/COMMIT_MSG":[{"author":{"_account_id":11861,"name":"Travis McPeak","email":"tmcpeak@us.ibm.com","username":"travis-mcpeak"},"change_message_id":"e9a1b2216798ecf4bfcba4a40ca62e087a8fd333","unresolved":false,"context_lines":[{"line_number":13,"context_line":"This is an initial step for using bandit with Swift"},{"line_number":14,"context_line":"and it should be revisited to improve the testing as more is learned"},{"line_number":15,"context_line":"about the specific needs of the Swift code base."},{"line_number":16,"context_line":"Tox is configured to only show results for high severity"},{"line_number":17,"context_line":"results."},{"line_number":18,"context_line":""},{"line_number":19,"context_line":"https://wiki.openstack.org/wiki/Security/Projects/Bandit"}],"source_content_type":"text/x-gerrit-commit-message","patch_set":5,"id":"9a41bdd9_f5a5ae46","line":16,"updated":"2015-07-14 19:49:26.000000000","message":"this isn\u0027t true anymore, you\u0027re using a profile which only includes certain plugins instead of a severity level, so you can take this part of the commit message out.","commit_id":"3785eed5c4cb36d309c12d44377eb91be57e97f5"},{"author":{"_account_id":8119,"name":"Eric Brown","email":"eric_wade_brown@yahoo.com","username":"ericwb"},"change_message_id":"4bf1d3b0caae9ac9b14bf4d579558e466f86a940","unresolved":false,"context_lines":[],"source_content_type":"","patch_set":6,"id":"9a41bdd9_6a0ef4e6","updated":"2015-07-17 14:12:07.000000000","message":"Could you explain here why some checks are excluded?","commit_id":"59c54d897eddf8fcbf558b15c4df3bbbd8b22ca3"},{"author":{"_account_id":14867,"name":"Jaivish Kothari(janonymous)","email":"janonymous.codevulture@gmail.com","username":"Janonymous"},"change_message_id":"cb7edd39529028b86d4f77e9bdbce5267d391224","unresolved":false,"context_lines":[],"source_content_type":"","patch_set":6,"id":"9a41bdd9_ba8445b1","in_reply_to":"9a41bdd9_6a0ef4e6","updated":"2015-07-17 15:44:25.000000000","message":"Some checks are being excluded  as for now because they needs to be included in swift and they are used as per purpose.","commit_id":"59c54d897eddf8fcbf558b15c4df3bbbd8b22ca3"}],"bandit.yaml":[{"author":{"_account_id":11861,"name":"Travis McPeak","email":"tmcpeak@us.ibm.com","username":"travis-mcpeak"},"change_message_id":"65745e4566dcb79642349925761f3dc37f89d8c9","unresolved":false,"context_lines":[{"line_number":26,"context_line":"# a list of strings, which if found in the path will cause files to be"},{"line_number":27,"context_line":"# excluded"},{"line_number":28,"context_line":"# for example /tests/ - to remove all all files in tests directory"},{"line_number":29,"context_line":"exclude_dirs:"},{"line_number":30,"context_line":""},{"line_number":31,"context_line":"profiles:"},{"line_number":32,"context_line":"    XSS:"}],"source_content_type":"text/x-yaml","patch_set":1,"id":"ba3cc151_39814e4b","line":29,"updated":"2015-06-29 13:56:03.000000000","message":"You might want to exclude your unit test directory, \n\neg. \nexclude_dirs:\n    - \u0027/swift/tests/\u0027","commit_id":"743790e8c9727ace81d2837b5a0ceb07a96a2bc9"},{"author":{"_account_id":14867,"name":"Jaivish Kothari(janonymous)","email":"janonymous.codevulture@gmail.com","username":"Janonymous"},"change_message_id":"bf6d81bfca6d86e7d3ea85b6166bde06a4d679e7","unresolved":false,"context_lines":[{"line_number":26,"context_line":"# a list of strings, which if found in the path will cause files to be"},{"line_number":27,"context_line":"# excluded"},{"line_number":28,"context_line":"# for example /tests/ - to remove all all files in tests directory"},{"line_number":29,"context_line":"exclude_dirs:"},{"line_number":30,"context_line":""},{"line_number":31,"context_line":"profiles:"},{"line_number":32,"context_line":"    XSS:"}],"source_content_type":"text/x-yaml","patch_set":1,"id":"ba3cc151_1e46a823","line":29,"in_reply_to":"ba3cc151_39814e4b","updated":"2015-06-29 16:11:21.000000000","message":"Done","commit_id":"743790e8c9727ace81d2837b5a0ceb07a96a2bc9"},{"author":{"_account_id":8119,"name":"Eric Brown","email":"eric_wade_brown@yahoo.com","username":"ericwb"},"change_message_id":"46c9e750cd71f87d8f6de103d9eccc477dadd152","unresolved":false,"context_lines":[{"line_number":21,"context_line":"# globs of files which should be analyzed"},{"line_number":22,"context_line":"include:"},{"line_number":23,"context_line":"    - \u0027*.py\u0027"},{"line_number":24,"context_line":"    - \u0027*.pyw\u0027"},{"line_number":25,"context_line":""},{"line_number":26,"context_line":"# a list of strings, which if found in the path will cause files to be"},{"line_number":27,"context_line":"# excluded"}],"source_content_type":"text/x-yaml","patch_set":3,"id":"ba3cc151_a39f5d5e","line":24,"updated":"2015-06-29 19:45:53.000000000","message":"You could remove *.pyw since swift has no pyw files.","commit_id":"aabe3e788b36362eb1a78a5dbc4b6f17860d2688"},{"author":{"_account_id":14867,"name":"Jaivish Kothari(janonymous)","email":"janonymous.codevulture@gmail.com","username":"Janonymous"},"change_message_id":"ac077ee94f39c4b20b2fb93085a1bbc4c839b031","unresolved":false,"context_lines":[{"line_number":21,"context_line":"# globs of files which should be analyzed"},{"line_number":22,"context_line":"include:"},{"line_number":23,"context_line":"    - \u0027*.py\u0027"},{"line_number":24,"context_line":"    - \u0027*.pyw\u0027"},{"line_number":25,"context_line":""},{"line_number":26,"context_line":"# a list of strings, which if found in the path will cause files to be"},{"line_number":27,"context_line":"# excluded"}],"source_content_type":"text/x-yaml","patch_set":3,"id":"ba3cc151_d9d02556","line":24,"in_reply_to":"ba3cc151_a39f5d5e","updated":"2015-06-30 16:04:03.000000000","message":"Done","commit_id":"aabe3e788b36362eb1a78a5dbc4b6f17860d2688"},{"author":{"_account_id":8119,"name":"Eric Brown","email":"eric_wade_brown@yahoo.com","username":"ericwb"},"change_message_id":"46c9e750cd71f87d8f6de103d9eccc477dadd152","unresolved":false,"context_lines":[{"line_number":27,"context_line":"# excluded"},{"line_number":28,"context_line":"# for example /tests/ - to remove all all files in tests directory"},{"line_number":29,"context_line":"exclude_dirs:"},{"line_number":30,"context_line":"    - \u0027/swift/tests/\u0027"},{"line_number":31,"context_line":""},{"line_number":32,"context_line":"#configured for swift"},{"line_number":33,"context_line":"profiles:"}],"source_content_type":"text/x-yaml","patch_set":3,"id":"ba3cc151_637955fc","line":30,"updated":"2015-06-29 19:45:53.000000000","message":"Looks like the tests are in the root of swift repo under \"test\".  And since your tox.ini recursively starts in /swift/ path, you don\u0027t need this exclude at all.","commit_id":"aabe3e788b36362eb1a78a5dbc4b6f17860d2688"},{"author":{"_account_id":8119,"name":"Eric Brown","email":"eric_wade_brown@yahoo.com","username":"ericwb"},"change_message_id":"46c9e750cd71f87d8f6de103d9eccc477dadd152","unresolved":false,"context_lines":[{"line_number":31,"context_line":""},{"line_number":32,"context_line":"#configured for swift"},{"line_number":33,"context_line":"profiles:"},{"line_number":34,"context_line":"    swift_conservative:"},{"line_number":35,"context_line":"        include:"},{"line_number":36,"context_line":"            - blacklist_calls"},{"line_number":37,"context_line":"            - blacklist_imports"}],"source_content_type":"text/x-yaml","patch_set":3,"id":"ba3cc151_83e259d4","line":34,"updated":"2015-06-29 19:45:53.000000000","message":"Might want to look at the keystone patch: https://review.openstack.org/#/c/194417/3/bandit.yaml since the conservative vs. verbose was replaced with just a gate (which I feel is better).","commit_id":"aabe3e788b36362eb1a78a5dbc4b6f17860d2688"},{"author":{"_account_id":14867,"name":"Jaivish Kothari(janonymous)","email":"janonymous.codevulture@gmail.com","username":"Janonymous"},"change_message_id":"ac077ee94f39c4b20b2fb93085a1bbc4c839b031","unresolved":false,"context_lines":[{"line_number":31,"context_line":""},{"line_number":32,"context_line":"#configured for swift"},{"line_number":33,"context_line":"profiles:"},{"line_number":34,"context_line":"    swift_conservative:"},{"line_number":35,"context_line":"        include:"},{"line_number":36,"context_line":"            - blacklist_calls"},{"line_number":37,"context_line":"            - blacklist_imports"}],"source_content_type":"text/x-yaml","patch_set":3,"id":"ba3cc151_99ca9da0","line":34,"in_reply_to":"ba3cc151_83e259d4","updated":"2015-06-30 16:04:03.000000000","message":"Done","commit_id":"aabe3e788b36362eb1a78a5dbc4b6f17860d2688"},{"author":{"_account_id":8119,"name":"Eric Brown","email":"eric_wade_brown@yahoo.com","username":"ericwb"},"change_message_id":"46c9e750cd71f87d8f6de103d9eccc477dadd152","unresolved":false,"context_lines":[{"line_number":45,"context_line":""},{"line_number":46,"context_line":"    swift_verbose:"},{"line_number":47,"context_line":"        include:"},{"line_number":48,"context_line":"            - blacklist_calls"},{"line_number":49,"context_line":"            - blacklist_imports"},{"line_number":50,"context_line":"            - request_with_no_cert_validation"},{"line_number":51,"context_line":"            - exec_used"}],"source_content_type":"text/x-yaml","patch_set":3,"id":"ba3cc151_83949937","line":48,"updated":"2015-06-29 19:45:53.000000000","message":"Could you please alpha sort these?  Makes it easier to note the plugins unchecked.","commit_id":"aabe3e788b36362eb1a78a5dbc4b6f17860d2688"},{"author":{"_account_id":14867,"name":"Jaivish Kothari(janonymous)","email":"janonymous.codevulture@gmail.com","username":"Janonymous"},"change_message_id":"ac077ee94f39c4b20b2fb93085a1bbc4c839b031","unresolved":false,"context_lines":[{"line_number":45,"context_line":""},{"line_number":46,"context_line":"    swift_verbose:"},{"line_number":47,"context_line":"        include:"},{"line_number":48,"context_line":"            - blacklist_calls"},{"line_number":49,"context_line":"            - blacklist_imports"},{"line_number":50,"context_line":"            - request_with_no_cert_validation"},{"line_number":51,"context_line":"            - exec_used"}],"source_content_type":"text/x-yaml","patch_set":3,"id":"ba3cc151_59c5f58b","line":48,"in_reply_to":"ba3cc151_83949937","updated":"2015-06-30 16:04:03.000000000","message":"Done","commit_id":"aabe3e788b36362eb1a78a5dbc4b6f17860d2688"},{"author":{"_account_id":8119,"name":"Eric Brown","email":"eric_wade_brown@yahoo.com","username":"ericwb"},"change_message_id":"46c9e750cd71f87d8f6de103d9eccc477dadd152","unresolved":false,"context_lines":[{"line_number":158,"context_line":"        - oslo.config.cfg.StrOpt"},{"line_number":159,"context_line":"        - oslo_config.cfg.StrOpt"},{"line_number":160,"context_line":""},{"line_number":161,"context_line":"execute_with_run_as_root_equals_true:"},{"line_number":162,"context_line":"    function_names:"},{"line_number":163,"context_line":"        - ceilometer.utils.execute"},{"line_number":164,"context_line":"        - cinder.utils.execute"}],"source_content_type":"text/x-yaml","patch_set":3,"id":"ba3cc151_23feed6b","line":161,"updated":"2015-06-29 19:45:53.000000000","message":"If swift doesn\u0027t use rootwrap, you can just remove this line and below.","commit_id":"aabe3e788b36362eb1a78a5dbc4b6f17860d2688"},{"author":{"_account_id":14867,"name":"Jaivish Kothari(janonymous)","email":"janonymous.codevulture@gmail.com","username":"Janonymous"},"change_message_id":"ac077ee94f39c4b20b2fb93085a1bbc4c839b031","unresolved":false,"context_lines":[{"line_number":158,"context_line":"        - oslo.config.cfg.StrOpt"},{"line_number":159,"context_line":"        - oslo_config.cfg.StrOpt"},{"line_number":160,"context_line":""},{"line_number":161,"context_line":"execute_with_run_as_root_equals_true:"},{"line_number":162,"context_line":"    function_names:"},{"line_number":163,"context_line":"        - ceilometer.utils.execute"},{"line_number":164,"context_line":"        - cinder.utils.execute"}],"source_content_type":"text/x-yaml","patch_set":3,"id":"ba3cc151_d937c5ae","line":161,"in_reply_to":"ba3cc151_23feed6b","updated":"2015-06-30 16:04:03.000000000","message":"Done","commit_id":"aabe3e788b36362eb1a78a5dbc4b6f17860d2688"},{"author":{"_account_id":11861,"name":"Travis McPeak","email":"tmcpeak@us.ibm.com","username":"travis-mcpeak"},"change_message_id":"f90d571ac44300998a04d9f353d535b8abbf395a","unresolved":false,"context_lines":[{"line_number":43,"context_line":""},{"line_number":44,"context_line":"#            - any_other_function_with_shell_equals_true"},{"line_number":45,"context_line":"#            - ssl_with_bad_defaults"},{"line_number":46,"context_line":"#            - jinja2_autoescape_false"},{"line_number":47,"context_line":"#            - use_of_mako_templates"},{"line_number":48,"context_line":"#            - subprocess_without_shell_equals_true"},{"line_number":49,"context_line":"#            - any_other_function_with_shell_equals_true"}],"source_content_type":"text/x-yaml","patch_set":5,"id":"9a41bdd9_55c81aa8","line":46,"updated":"2015-07-14 19:41:10.000000000","message":"why is this disabled?","commit_id":"3785eed5c4cb36d309c12d44377eb91be57e97f5"},{"author":{"_account_id":11861,"name":"Travis McPeak","email":"tmcpeak@us.ibm.com","username":"travis-mcpeak"},"change_message_id":"f90d571ac44300998a04d9f353d535b8abbf395a","unresolved":false,"context_lines":[{"line_number":47,"context_line":"#            - use_of_mako_templates"},{"line_number":48,"context_line":"#            - subprocess_without_shell_equals_true"},{"line_number":49,"context_line":"#            - any_other_function_with_shell_equals_true"},{"line_number":50,"context_line":"#            - start_process_with_a_shell"},{"line_number":51,"context_line":"#            - start_process_with_no_shell"},{"line_number":52,"context_line":"#            - hardcoded_sql_expressions"},{"line_number":53,"context_line":"#            - hardcoded_tmp_director"}],"source_content_type":"text/x-yaml","patch_set":5,"id":"9a41bdd9_d553cae0","line":50,"updated":"2015-07-14 19:41:10.000000000","message":"why is this disabled?","commit_id":"3785eed5c4cb36d309c12d44377eb91be57e97f5"},{"author":{"_account_id":8119,"name":"Eric Brown","email":"eric_wade_brown@yahoo.com","username":"ericwb"},"change_message_id":"4bf1d3b0caae9ac9b14bf4d579558e466f86a940","unresolved":false,"context_lines":[{"line_number":26,"context_line":"# excluded"},{"line_number":27,"context_line":"# for example /tests/ - to remove all all files in tests directory"},{"line_number":28,"context_line":"exclude_dirs:"},{"line_number":29,"context_line":"    - \u0027/tests/\u0027"},{"line_number":30,"context_line":""},{"line_number":31,"context_line":"#configured for swift"},{"line_number":32,"context_line":"profiles:"}],"source_content_type":"text/x-yaml","patch_set":6,"id":"9a41bdd9_aacf1cb2","line":29,"updated":"2015-07-17 14:12:07.000000000","message":"This is a no-op because the tests for switft are under the root of /test/.  And since in tox.ini, your starting directory is swift, there are not subdirectories within it called tests.","commit_id":"59c54d897eddf8fcbf558b15c4df3bbbd8b22ca3"},{"author":{"_account_id":14867,"name":"Jaivish Kothari(janonymous)","email":"janonymous.codevulture@gmail.com","username":"Janonymous"},"change_message_id":"cb7edd39529028b86d4f77e9bdbce5267d391224","unresolved":false,"context_lines":[{"line_number":26,"context_line":"# excluded"},{"line_number":27,"context_line":"# for example /tests/ - to remove all all files in tests directory"},{"line_number":28,"context_line":"exclude_dirs:"},{"line_number":29,"context_line":"    - \u0027/tests/\u0027"},{"line_number":30,"context_line":""},{"line_number":31,"context_line":"#configured for swift"},{"line_number":32,"context_line":"profiles:"}],"source_content_type":"text/x-yaml","patch_set":6,"id":"9a41bdd9_5aaad91a","line":29,"in_reply_to":"9a41bdd9_aacf1cb2","updated":"2015-07-17 15:44:25.000000000","message":"Done","commit_id":"59c54d897eddf8fcbf558b15c4df3bbbd8b22ca3"},{"author":{"_account_id":8119,"name":"Eric Brown","email":"eric_wade_brown@yahoo.com","username":"ericwb"},"change_message_id":"4bf1d3b0caae9ac9b14bf4d579558e466f86a940","unresolved":false,"context_lines":[{"line_number":146,"context_line":"    function_names:"},{"line_number":147,"context_line":"        - oslo.config.cfg.StrOpt"},{"line_number":148,"context_line":"        - oslo_config.cfg.StrOpt"},{"line_number":149,"context_line":""}],"source_content_type":"text/x-yaml","patch_set":6,"id":"9a41bdd9_2a4b0c2d","line":149,"updated":"2015-07-17 14:12:07.000000000","message":"remove extra line","commit_id":"59c54d897eddf8fcbf558b15c4df3bbbd8b22ca3"},{"author":{"_account_id":14867,"name":"Jaivish Kothari(janonymous)","email":"janonymous.codevulture@gmail.com","username":"Janonymous"},"change_message_id":"cb7edd39529028b86d4f77e9bdbce5267d391224","unresolved":false,"context_lines":[{"line_number":146,"context_line":"    function_names:"},{"line_number":147,"context_line":"        - oslo.config.cfg.StrOpt"},{"line_number":148,"context_line":"        - oslo_config.cfg.StrOpt"},{"line_number":149,"context_line":""}],"source_content_type":"text/x-yaml","patch_set":6,"id":"9a41bdd9_1a63f11b","line":149,"in_reply_to":"9a41bdd9_2a4b0c2d","updated":"2015-07-17 15:44:25.000000000","message":"Done","commit_id":"59c54d897eddf8fcbf558b15c4df3bbbd8b22ca3"},{"author":{"_account_id":7847,"name":"Alistair Coles","email":"alistairncoles@gmail.com","username":"acoles"},"change_message_id":"1a2f398bbc506722766c48012bfb47c46a5b1e09","unresolved":false,"context_lines":[{"line_number":26,"context_line":"# excluded"},{"line_number":27,"context_line":"# for example /tests/ - to remove all all files in tests directory"},{"line_number":28,"context_line":"#exclude_dirs:"},{"line_number":29,"context_line":"#    - \u0027/tests/\u0027"},{"line_number":30,"context_line":""},{"line_number":31,"context_line":"#configured for swift"},{"line_number":32,"context_line":"profiles:"}],"source_content_type":"text/x-yaml","patch_set":7,"id":"3a50d1a3_3013de66","line":29,"updated":"2015-07-29 09:47:43.000000000","message":"why is this commented?\n\nAlso the swift tests are in dir /test (Note singular)","commit_id":"cc5f376ffdca53168eff4263b4cbbeda651285f8"},{"author":{"_account_id":11861,"name":"Travis McPeak","email":"tmcpeak@us.ibm.com","username":"travis-mcpeak"},"change_message_id":"b53779c2f376ee1d25f0d45a448993b954e78b06","unresolved":false,"context_lines":[{"line_number":26,"context_line":"# excluded"},{"line_number":27,"context_line":"# for example /tests/ - to remove all all files in tests directory"},{"line_number":28,"context_line":"#exclude_dirs:"},{"line_number":29,"context_line":"#    - \u0027/tests/\u0027"},{"line_number":30,"context_line":""},{"line_number":31,"context_line":"#configured for swift"},{"line_number":32,"context_line":"profiles:"}],"source_content_type":"text/x-yaml","patch_set":7,"id":"3a50d1a3_f73ebe89","line":29,"in_reply_to":"3a50d1a3_3013de66","updated":"2015-07-29 14:03:24.000000000","message":"Alistair - this is used by other projects to exclude their test directories.  In this case it isn\u0027t required (as I understand tests are in a different root folder) so it can just be removed.","commit_id":"cc5f376ffdca53168eff4263b4cbbeda651285f8"},{"author":{"_account_id":11861,"name":"Travis McPeak","email":"tmcpeak@us.ibm.com","username":"travis-mcpeak"},"change_message_id":"b53779c2f376ee1d25f0d45a448993b954e78b06","unresolved":false,"context_lines":[{"line_number":54,"context_line":"#            - linux_commands_wildcard_injection"},{"line_number":55,"context_line":"#For now some items are commented which could be included as per use later."},{"line_number":56,"context_line":"blacklist_calls:"},{"line_number":57,"context_line":"#    bad_name_sets:"},{"line_number":58,"context_line":"#        - pickle:"},{"line_number":59,"context_line":"#            qualnames: [pickle.loads, pickle.load, pickle.Unpickler,"},{"line_number":60,"context_line":"#                        cPickle.loads, cPickle.load, cPickle.Unpickler]"}],"source_content_type":"text/x-yaml","patch_set":7,"id":"3a50d1a3_372e6643","line":57,"updated":"2015-07-29 14:03:24.000000000","message":"Uncomment","commit_id":"cc5f376ffdca53168eff4263b4cbbeda651285f8"},{"author":{"_account_id":7847,"name":"Alistair Coles","email":"alistairncoles@gmail.com","username":"acoles"},"change_message_id":"1a2f398bbc506722766c48012bfb47c46a5b1e09","unresolved":false,"context_lines":[{"line_number":65,"context_line":"        - marshal:"},{"line_number":66,"context_line":"            qualnames: [marshal.load, marshal.loads]"},{"line_number":67,"context_line":"            message: \"Deserialization with the marshal module is possibly"},{"line_number":68,"context_line":"dangerous.\""},{"line_number":69,"context_line":"#        - md5:"},{"line_number":70,"context_line":"#            qualnames: [hashlib.md5]"},{"line_number":71,"context_line":"#            level: LOW"}],"source_content_type":"text/x-yaml","patch_set":7,"id":"3a50d1a3_1dad9ae8","line":68,"updated":"2015-07-29 09:47:43.000000000","message":"So more of a general bandit question, but it seems awkward to have to maintain the details of the check message string in swift repo - are there not a set of generic checks defined in bandit lib that can just be referenced in a similar manner to flake8 checks for example?","commit_id":"cc5f376ffdca53168eff4263b4cbbeda651285f8"},{"author":{"_account_id":11861,"name":"Travis McPeak","email":"tmcpeak@us.ibm.com","username":"travis-mcpeak"},"change_message_id":"b53779c2f376ee1d25f0d45a448993b954e78b06","unresolved":false,"context_lines":[{"line_number":65,"context_line":"        - marshal:"},{"line_number":66,"context_line":"            qualnames: [marshal.load, marshal.loads]"},{"line_number":67,"context_line":"            message: \"Deserialization with the marshal module is possibly"},{"line_number":68,"context_line":"dangerous.\""},{"line_number":69,"context_line":"#        - md5:"},{"line_number":70,"context_line":"#            qualnames: [hashlib.md5]"},{"line_number":71,"context_line":"#            level: LOW"}],"source_content_type":"text/x-yaml","patch_set":7,"id":"3a50d1a3_f7b1de01","line":68,"in_reply_to":"3a50d1a3_1dad9ae8","updated":"2015-07-29 14:03:24.000000000","message":"Primarily Bandit test messages are contained in the functions that define them.\n\nThis is actually incorrect, \"marshal\" for example is part of \"bad_name_sets\" which has been commented.\n\nThe idea here is that these tests are all functionally identical - they look for certain qualnames: ie. lib.a, lib.b and then display a message and return a severity.  Since there is so much duplicate code for these checks we define them in config.  In future Bandit changes this config will be moved from main config file into a separate \"blacklist_calls\" config.","commit_id":"cc5f376ffdca53168eff4263b4cbbeda651285f8"},{"author":{"_account_id":7847,"name":"Alistair Coles","email":"alistairncoles@gmail.com","username":"acoles"},"change_message_id":"1a2f398bbc506722766c48012bfb47c46a5b1e09","unresolved":false,"context_lines":[{"line_number":100,"context_line":"            message: \"Paramiko exec_command() and invoke_shell() usage may"},{"line_number":101,"context_line":"expose command injection vulnerabilities and should be reviewed.\""},{"line_number":102,"context_line":""},{"line_number":103,"context_line":"shell_injection:"},{"line_number":104,"context_line":"    # Start a process using the subprocess module, or one of its wrappers."},{"line_number":105,"context_line":"    subprocess: [subprocess.Popen, subprocess.call, subprocess.check_call,"},{"line_number":106,"context_line":"                 subprocess.check_output, utils.execute,"}],"source_content_type":"text/x-yaml","patch_set":7,"id":"3a50d1a3_707e46e5","line":103,"updated":"2015-07-29 09:47:43.000000000","message":"This (and others below) is not referenced in profiles, so does it get run?","commit_id":"cc5f376ffdca53168eff4263b4cbbeda651285f8"},{"author":{"_account_id":11861,"name":"Travis McPeak","email":"tmcpeak@us.ibm.com","username":"travis-mcpeak"},"change_message_id":"b53779c2f376ee1d25f0d45a448993b954e78b06","unresolved":false,"context_lines":[{"line_number":100,"context_line":"            message: \"Paramiko exec_command() and invoke_shell() usage may"},{"line_number":101,"context_line":"expose command injection vulnerabilities and should be reviewed.\""},{"line_number":102,"context_line":""},{"line_number":103,"context_line":"shell_injection:"},{"line_number":104,"context_line":"    # Start a process using the subprocess module, or one of its wrappers."},{"line_number":105,"context_line":"    subprocess: [subprocess.Popen, subprocess.call, subprocess.check_call,"},{"line_number":106,"context_line":"                 subprocess.check_output, utils.execute,"}],"source_content_type":"text/x-yaml","patch_set":7,"id":"3a50d1a3_17832a04","line":103,"in_reply_to":"3a50d1a3_707e46e5","updated":"2015-07-29 14:03:24.000000000","message":"These are configs for modules that are using them.  For example this section is part of shell injection related modules and is used to define which functions it should be looking for.  This should be configurable as some projects define special wrappers.","commit_id":"cc5f376ffdca53168eff4263b4cbbeda651285f8"},{"author":{"_account_id":7847,"name":"Alistair Coles","email":"alistairncoles@gmail.com","username":"acoles"},"change_message_id":"1a2f398bbc506722766c48012bfb47c46a5b1e09","unresolved":false,"context_lines":[{"line_number":129,"context_line":"            message: \"Consider possible security implications associated with"},{"line_number":130,"context_line":"#{module} module.\""},{"line_number":131,"context_line":""},{"line_number":132,"context_line":"hardcoded_password:"},{"line_number":133,"context_line":"    word_list: \"wordlist/default-passwords\""},{"line_number":134,"context_line":""},{"line_number":135,"context_line":"ssl_with_bad_version:"}],"source_content_type":"text/x-yaml","patch_set":7,"id":"3a50d1a3_d06f1a29","line":132,"updated":"2015-07-29 09:47:43.000000000","message":"not referenced in profiles","commit_id":"cc5f376ffdca53168eff4263b4cbbeda651285f8"},{"author":{"_account_id":11861,"name":"Travis McPeak","email":"tmcpeak@us.ibm.com","username":"travis-mcpeak"},"change_message_id":"b53779c2f376ee1d25f0d45a448993b954e78b06","unresolved":false,"context_lines":[{"line_number":129,"context_line":"            message: \"Consider possible security implications associated with"},{"line_number":130,"context_line":"#{module} module.\""},{"line_number":131,"context_line":""},{"line_number":132,"context_line":"hardcoded_password:"},{"line_number":133,"context_line":"    word_list: \"wordlist/default-passwords\""},{"line_number":134,"context_line":""},{"line_number":135,"context_line":"ssl_with_bad_version:"}],"source_content_type":"text/x-yaml","patch_set":7,"id":"3a50d1a3_d7c70243","line":132,"in_reply_to":"3a50d1a3_d06f1a29","updated":"2015-07-29 14:03:24.000000000","message":"This is config for the hardcoded password module.  Since that module isn\u0027t included in the gate profile it won\u0027t be run, but it could be useful to leave in for developers to use for code reviews.\n\nIf you do remove it and decide to run all the plugins at some point the hardcoded password module won\u0027t run properly.","commit_id":"cc5f376ffdca53168eff4263b4cbbeda651285f8"},{"author":{"_account_id":7847,"name":"Alistair Coles","email":"alistairncoles@gmail.com","username":"acoles"},"change_message_id":"1a2f398bbc506722766c48012bfb47c46a5b1e09","unresolved":false,"context_lines":[{"line_number":142,"context_line":"        - \u0027SSLv3_METHOD\u0027    # strict option"},{"line_number":143,"context_line":"        - \u0027TLSv1_METHOD\u0027    # strict option"},{"line_number":144,"context_line":""},{"line_number":145,"context_line":"password_config_option_not_marked_secret:"},{"line_number":146,"context_line":"    function_names:"},{"line_number":147,"context_line":"        - oslo.config.cfg.StrOpt"},{"line_number":148,"context_line":"        - oslo_config.cfg.StrOpt"}],"source_content_type":"text/x-yaml","patch_set":7,"id":"3a50d1a3_907512fb","line":145,"updated":"2015-07-29 09:47:43.000000000","message":"not referenced in profiles","commit_id":"cc5f376ffdca53168eff4263b4cbbeda651285f8"},{"author":{"_account_id":11861,"name":"Travis McPeak","email":"tmcpeak@us.ibm.com","username":"travis-mcpeak"},"change_message_id":"b53779c2f376ee1d25f0d45a448993b954e78b06","unresolved":false,"context_lines":[{"line_number":142,"context_line":"        - \u0027SSLv3_METHOD\u0027    # strict option"},{"line_number":143,"context_line":"        - \u0027TLSv1_METHOD\u0027    # strict option"},{"line_number":144,"context_line":""},{"line_number":145,"context_line":"password_config_option_not_marked_secret:"},{"line_number":146,"context_line":"    function_names:"},{"line_number":147,"context_line":"        - oslo.config.cfg.StrOpt"},{"line_number":148,"context_line":"        - oslo_config.cfg.StrOpt"}],"source_content_type":"text/x-yaml","patch_set":7,"id":"3a50d1a3_d7f5c282","line":145,"in_reply_to":"3a50d1a3_907512fb","updated":"2015-07-29 14:03:24.000000000","message":"This is a really useful test for other projects which catches useful errors.  I\u0027d highly recommend that this test be included in the profile.  I assume it wasn\u0027t because it\u0027s currently finding issues.","commit_id":"cc5f376ffdca53168eff4263b4cbbeda651285f8"}],"tox.ini":[{"author":{"_account_id":11861,"name":"Travis McPeak","email":"tmcpeak@us.ibm.com","username":"travis-mcpeak"},"change_message_id":"65745e4566dcb79642349925761f3dc37f89d8c9","unresolved":false,"context_lines":[{"line_number":51,"context_line":""},{"line_number":52,"context_line":"[testenv:bandit]"},{"line_number":53,"context_line":"deps \u003d -r{toxinidir}/test-requirements.txt"},{"line_number":54,"context_line":"commands \u003d bandit -c bandit.yaml -r swift -n 5 -lll"},{"line_number":55,"context_line":""},{"line_number":56,"context_line":"[flake8]"},{"line_number":57,"context_line":"# it\u0027s not a bug that we aren\u0027t using all of hacking"}],"source_content_type":"text/x-properties","patch_set":1,"id":"ba3cc151_79d59641","line":54,"updated":"2015-06-29 13:56:03.000000000","message":"if at all possible, I\u0027d include medium severity tests too.  Try running with -ll and see if the results are acceptable?","commit_id":"743790e8c9727ace81d2837b5a0ceb07a96a2bc9"},{"author":{"_account_id":14867,"name":"Jaivish Kothari(janonymous)","email":"janonymous.codevulture@gmail.com","username":"Janonymous"},"change_message_id":"67f92897631af1f9dacf3e1dbd5e2af242138e82","unresolved":false,"context_lines":[{"line_number":51,"context_line":""},{"line_number":52,"context_line":"[testenv:bandit]"},{"line_number":53,"context_line":"deps \u003d -r{toxinidir}/test-requirements.txt"},{"line_number":54,"context_line":"commands \u003d bandit -c bandit.yaml -r swift -n 5 -lll"},{"line_number":55,"context_line":""},{"line_number":56,"context_line":"[flake8]"},{"line_number":57,"context_line":"# it\u0027s not a bug that we aren\u0027t using all of hacking"}],"source_content_type":"text/x-properties","patch_set":1,"id":"ba3cc151_457c5c72","line":54,"in_reply_to":"ba3cc151_4331bb0a","updated":"2015-06-29 17:37:29.000000000","message":"Done","commit_id":"743790e8c9727ace81d2837b5a0ceb07a96a2bc9"},{"author":{"_account_id":14867,"name":"Jaivish Kothari(janonymous)","email":"janonymous.codevulture@gmail.com","username":"Janonymous"},"change_message_id":"1ac11d02882588043fe63d31d4c9a98ff0845d77","unresolved":false,"context_lines":[{"line_number":51,"context_line":""},{"line_number":52,"context_line":"[testenv:bandit]"},{"line_number":53,"context_line":"deps \u003d -r{toxinidir}/test-requirements.txt"},{"line_number":54,"context_line":"commands \u003d bandit -c bandit.yaml -r swift -n 5 -lll"},{"line_number":55,"context_line":""},{"line_number":56,"context_line":"[flake8]"},{"line_number":57,"context_line":"# it\u0027s not a bug that we aren\u0027t using all of hacking"}],"source_content_type":"text/x-properties","patch_set":1,"id":"ba3cc151_e8a0ee92","line":54,"in_reply_to":"ba3cc151_79d59641","updated":"2015-06-29 15:56:00.000000000","message":"Yes, I ran with medium severity also but acceptable results would be of high severity only.","commit_id":"743790e8c9727ace81d2837b5a0ceb07a96a2bc9"},{"author":{"_account_id":11861,"name":"Travis McPeak","email":"tmcpeak@us.ibm.com","username":"travis-mcpeak"},"change_message_id":"8d7cbd6e689b36e91cf52c301e06b1b6fb50f598","unresolved":false,"context_lines":[{"line_number":51,"context_line":""},{"line_number":52,"context_line":"[testenv:bandit]"},{"line_number":53,"context_line":"deps \u003d -r{toxinidir}/test-requirements.txt"},{"line_number":54,"context_line":"commands \u003d bandit -c bandit.yaml -r swift -n 5 -lll"},{"line_number":55,"context_line":""},{"line_number":56,"context_line":"[flake8]"},{"line_number":57,"context_line":"# it\u0027s not a bug that we aren\u0027t using all of hacking"}],"source_content_type":"text/x-properties","patch_set":1,"id":"ba3cc151_4331bb0a","line":54,"in_reply_to":"ba3cc151_e8a0ee92","updated":"2015-06-29 16:05:03.000000000","message":"In that case I\u0027d urge you to build a profile with specific tests enabled rather than using the severity filter.  Only running for high issues disables most of Bandit and doesn\u0027t really accomplish much.  You can see the Keystone profile for an example of a respectable set.","commit_id":"743790e8c9727ace81d2837b5a0ceb07a96a2bc9"},{"author":{"_account_id":11861,"name":"Travis McPeak","email":"tmcpeak@us.ibm.com","username":"travis-mcpeak"},"change_message_id":"f90d571ac44300998a04d9f353d535b8abbf395a","unresolved":false,"context_lines":[{"line_number":51,"context_line":""},{"line_number":52,"context_line":"[testenv:bandit]"},{"line_number":53,"context_line":"deps \u003d -r{toxinidir}/test-requirements.txt"},{"line_number":54,"context_line":"commands \u003d bandit -c bandit.yaml -r swift -n 5 -p gate"},{"line_number":55,"context_line":""},{"line_number":56,"context_line":"[flake8]"},{"line_number":57,"context_line":"# it\u0027s not a bug that we aren\u0027t using all of hacking"}],"source_content_type":"text/x-properties","patch_set":5,"id":"9a41bdd9_15237257","line":54,"updated":"2015-07-14 19:41:10.000000000","message":"your commit message says that tox is configured to show only high severity findings, but that doesn\u0027t appear to be the case.  To do that you\u0027d want to use:\n\n-lll","commit_id":"3785eed5c4cb36d309c12d44377eb91be57e97f5"},{"author":{"_account_id":7847,"name":"Alistair Coles","email":"alistairncoles@gmail.com","username":"acoles"},"change_message_id":"1a2f398bbc506722766c48012bfb47c46a5b1e09","unresolved":false,"context_lines":[{"line_number":51,"context_line":""},{"line_number":52,"context_line":"[testenv:bandit]"},{"line_number":53,"context_line":"deps \u003d -r{toxinidir}/test-requirements.txt"},{"line_number":54,"context_line":"commands \u003d bandit -c bandit.yaml -r swift -n 5 -p gate"},{"line_number":55,"context_line":""},{"line_number":56,"context_line":"[flake8]"},{"line_number":57,"context_line":"# it\u0027s not a bug that we aren\u0027t using all of hacking"}],"source_content_type":"text/x-properties","patch_set":7,"id":"3a50d1a3_6b689bf5","line":54,"updated":"2015-07-29 09:47:43.000000000","message":"might want to add the bin dir as well as swift","commit_id":"cc5f376ffdca53168eff4263b4cbbeda651285f8"}]}