Alexander Hughes
498d5c078f
The three lines of code in pegleg.engine.errorcodes, and
pegleg.engine.util.pegleg_secret_management are giving false positive
bandit errors. This patchset address these by adding # nosec label
to each line, instructing Bandit to ignore that line of code.
The three errors detected are all B105, details below from Bandit:
>> Issue: [B105:hardcoded_password_string] Possible hardcoded password:
'P009'
Severity: Low Confidence: Medium
Location: pegleg/engine/errorcodes.py:22
20 FILE_CONTAINS_INVALID_YAML = 'P007'
21 DOCUMENT_LAYER_MISMATCH = 'P008'
22 SECRET_NOT_ENCRYPTED_POLICY = 'P009'
23
24 ALL_CODES = (
25 SCHEMA_STORAGE_POLICY_MISMATCH_FLAG,
# nosec reasoning: The variable 'SECRET_NOT_ENCRYPTED_POLICY' does not
map to a hardcoded password.
--------------------------------------------------
>> Issue: [B105:hardcoded_password_string] Possible hardcoded password:
'^.{24,}$'
Severity: Low Confidence: Medium
Location: pegleg/engine/util/pegleg_secret_management.py:30
28
29 LOG = logging.getLogger(__name__)
30 PASSPHRASE_PATTERN = '^.{24,}$'
31 ENV_PASSPHRASE = 'PEGLEG_PASSPHRASE'
32 ENV_SALT = 'PEGLEG_SALT'
# nosec reasoning: The variable 'PASSPHRASE_PATTERN' does not map to a
hardcoded password
--------------------------------------------------
>> Issue: [B105:hardcoded_password_string] Possible hardcoded password:
'PEGLEG_PASSPHRASE'
Severity: Low Confidence: Medium
Location: pegleg/engine/util/pegleg_secret_management.py:31
29 LOG = logging.getLogger(__name__)
30 PASSPHRASE_PATTERN = '^.{24,}$'
31 ENV_PASSPHRASE = 'PEGLEG_PASSPHRASE'
32 ENV_SALT = 'PEGLEG_SALT'
33
# nosec reasoning: The variable 'ENV_PASSPHRASE' does not map to a
hardcoded password. This is setting the environment variable name that
passwords are stored in as 'PEGLEG_PASSPHRASE'. The passphrases are not
hardcoded on disk, but retrieved from environment variables later via
os.environ.get(ENV_PASSPHRASE)
Change-Id: I4508b30b763f25e4466c2e2159fbaf3c7df68b5b
34 lines
1.2 KiB
Python
34 lines
1.2 KiB
Python
# Copyright 2018 AT&T Intellectual Property. All other rights reserved.
|
|
#
|
|
# Licensed under the Apache License, Version 2.0 (the "License");
|
|
# you may not use this file except in compliance with the License.
|
|
# You may obtain a copy of the License at
|
|
#
|
|
# http://www.apache.org/licenses/LICENSE-2.0
|
|
#
|
|
# Unless required by applicable law or agreed to in writing, software
|
|
# distributed under the License is distributed on an "AS IS" BASIS,
|
|
# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
|
|
# See the License for the specific language governing permissions and
|
|
# limitations under the License.
|
|
|
|
SCHEMA_STORAGE_POLICY_MISMATCH_FLAG = 'P001'
|
|
REPOS_MISSING_DIRECTORIES_FLAG = 'P003'
|
|
DECKHAND_DUPLICATE_SCHEMA = 'P004'
|
|
DECKHAND_RENDER_EXCEPTION = 'P005'
|
|
FILE_MISSING_YAML_DOCUMENT_HEADER = 'P006'
|
|
FILE_CONTAINS_INVALID_YAML = 'P007'
|
|
DOCUMENT_LAYER_MISMATCH = 'P008'
|
|
SECRET_NOT_ENCRYPTED_POLICY = 'P009' # nosec (alexanderhughes)
|
|
|
|
ALL_CODES = (
|
|
SCHEMA_STORAGE_POLICY_MISMATCH_FLAG,
|
|
REPOS_MISSING_DIRECTORIES_FLAG,
|
|
DECKHAND_DUPLICATE_SCHEMA,
|
|
DECKHAND_RENDER_EXCEPTION,
|
|
FILE_MISSING_YAML_DOCUMENT_HEADER,
|
|
FILE_CONTAINS_INVALID_YAML,
|
|
DOCUMENT_LAYER_MISMATCH,
|
|
SECRET_NOT_ENCRYPTED_POLICY,
|
|
)
|