Integrate Python Bandit #252
Closed
Conversation
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Integrate Bandit for static security scanning of the a3m codebase. Run using tox. e.g. make tox ARG=bandit
Codecov Report
@@ Coverage Diff @@
## main #252 +/- ##
==========================================
+ Coverage 46.59% 46.61% +0.01%
==========================================
Files 107 107
Lines 7774 7775 +1
Branches 1180 1180
==========================================
+ Hits 3622 3624 +2
+ Misses 3973 3972 -1
Partials 179 179
📣 Codecov can now indicate which changes are the most critical in Pull Requests. Learn more |
Remove execution permission when opening files during the check for submission documentation and in the server task class. Refactor executeOrRunSubProcess.py to use the Python tempfile module.
sbreker
force-pushed
the
dev/issue-bandit
branch
5 times, most recently
from
654b313 to
3279992
Compare
Bandit warning B311 is being triggered by the use of random.uniform(). Since this is safe to use for non-security purposes I am flagging with nosec. B311: "Standard pseudo-random generators are not suitable for security/cryptographic purposes."
Update try-catch blocks to react to specific re.error type instead of all exeception types. This change should cause Bandit error B110 "try_except_pass" to not be triggered in models.py.
Added call to shlex.split() to tokenize the command args avoiding the possibily of injecting additional commands with a semicolon. Ignore B404, B603 warnings regarding the use of subprocess. Use of subprocess should be reevaluated.
Add .bandit ini file. Set to skip running Bandit check B410 which recommends the use of the deprecated defusedxml package.
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
Integrate Bandit for static security scanning of the a3m codebase. Run
using tox.
e.g. make tox ARG=bandit
connected to #44