From 2142860353f12aea1dc4bc7e8e7a503602913c85 Mon Sep 17 00:00:00 2001 From: Erno Kuvaja Date: Thu, 16 Aug 2018 19:53:58 +0100 Subject: [PATCH] Remove broken bandit from testing Change-Id: I415eed3096698c805d1f3ed3e23eeb87337471de --- bandit.yaml | 245 ------------------------------------------ lower-constraints.txt | 1 - test-requirements.txt | 1 - tox.ini | 5 - 4 files changed, 252 deletions(-) delete mode 100644 bandit.yaml diff --git a/bandit.yaml b/bandit.yaml deleted file mode 100644 index 2394d71590..0000000000 --- a/bandit.yaml +++ /dev/null @@ -1,245 +0,0 @@ -# optional: after how many files to update progress -#show_progress_every: 100 - -# optional: plugins directory name -#plugins_dir: 'plugins' - -# optional: plugins discovery name pattern -plugin_name_pattern: '*.py' - -# optional: terminal escape sequences to display colors -#output_colors: -# DEFAULT: '\033[0m' -# HEADER: '\033[95m' -# LOW: '\033[94m' -# MEDIUM: '\033[93m' -# HIGH: '\033[91m' - -# optional: log format string -#log_format: "[%(module)s]\t%(levelname)s\t%(message)s" - -# globs of files which should be analyzed -include: - - '*.py' - - '*.pyw' - -# a list of strings, which if found in the path will cause files to be excluded -# for example /tests/ - to remove all all files in tests directory -exclude_dirs: - - '/tests/' - -profiles: - gate: - include: - - - any_other_function_with_shell_equals_true - - assert_used - - blacklist_calls - - blacklist_import_func - - # One of the blacklisted imports is the subprocess module. Keystone - # has to import the subprocess module in a single module for - # eventlet support so in most cases bandit won't be able to detect - # that subprocess is even being imported. Also, Bandit's - # recommendation is just to check that the use is safe without any - # documentation on what safe or unsafe usage is. So this test is - # skipped. - # - blacklist_imports - - - exec_used - - - execute_with_run_as_root_equals_true - - # - hardcoded_bind_all_interfaces # TODO: enable this test - - # Not working because wordlist/default-passwords file not bundled, - # see https://bugs.launchpad.net/bandit/+bug/1451575 : - # - hardcoded_password - - # Not used because it's prone to false positives: - # - hardcoded_sql_expressions - - # - hardcoded_tmp_directory # TODO: enable this test - - - jinja2_autoescape_false - - - linux_commands_wildcard_injection - - - paramiko_calls - - - password_config_option_not_marked_secret - - request_with_no_cert_validation - - set_bad_file_permissions - - subprocess_popen_with_shell_equals_true - # - subprocess_without_shell_equals_true # TODO: enable this test - - start_process_with_a_shell - # - start_process_with_no_shell # TODO: enable this test - - start_process_with_partial_path - - ssl_with_bad_defaults - - ssl_with_bad_version - - ssl_with_no_version - # - try_except_pass # TODO: enable this test - - - use_of_mako_templates - -blacklist_calls: - bad_name_sets: - # - pickle: - # qualnames: [pickle.loads, pickle.load, pickle.Unpickler, - # cPickle.loads, cPickle.load, cPickle.Unpickler] - # message: "Pickle library appears to be in use, possible security issue." - # TODO: enable this test - - marshal: - qualnames: [marshal.load, marshal.loads] - message: "Deserialization with the marshal module is possibly dangerous." - # - md5: - # qualnames: [hashlib.md5, Crypto.Hash.MD2.new, Crypto.Hash.MD4.new, Crypto.Hash.MD5.new, cryptography.hazmat.primitives.hashes.MD5] - # message: "Use of insecure MD2, MD4, or MD5 hash function." - # TODO: enable this test - - mktemp_q: - qualnames: [tempfile.mktemp] - message: "Use of insecure and deprecated function (mktemp)." - - eval: - qualnames: [eval] - message: "Use of possibly insecure function - consider using safer ast.literal_eval." - - mark_safe: - names: [mark_safe] - message: "Use of mark_safe() may expose cross-site scripting vulnerabilities and should be reviewed." - - httpsconnection: - qualnames: [httplib.HTTPSConnection] - message: "Use of HTTPSConnection does not provide security, see https://wiki.openstack.org/wiki/OSSN/OSSN-0033" - - yaml_load: - qualnames: [yaml.load] - message: "Use of unsafe yaml load. Allows instantiation of arbitrary objects. Consider yaml.safe_load()." - - urllib_urlopen: - qualnames: [urllib.urlopen, urllib.urlretrieve, urllib.URLopener, urllib.FancyURLopener, urllib2.urlopen, urllib2.Request] - message: "Audit url open for permitted schemes. Allowing use of file:/ or custom schemes is often unexpected." - - random: - qualnames: [random.random, random.randrange, random.randint, random.choice, random.uniform, random.triangular] - message: "Standard pseudo-random generators are not suitable for security/cryptographic purposes." - level: "LOW" - - # Most of this is based off of Christian Heimes' work on defusedxml: - # https://pypi.org/project/defusedxml/#defusedxml-sax - - # TODO(jaegerandi): Enable once defusedxml is in global requirements. - #- xml_bad_cElementTree: - # qualnames: [xml.etree.cElementTree.parse, - # xml.etree.cElementTree.iterparse, - # xml.etree.cElementTree.fromstring, - # xml.etree.cElementTree.XMLParser] - # message: "Using {func} to parse untrusted XML data is known to be vulnerable to XML attacks. Replace {func} with it's defusedxml equivilent function." - #- xml_bad_ElementTree: - # qualnames: [xml.etree.ElementTree.parse, - # xml.etree.ElementTree.iterparse, - # xml.etree.ElementTree.fromstring, - # xml.etree.ElementTree.XMLParser] - # message: "Using {func} to parse untrusted XML data is known to be vulnerable to XML attacks. Replace {func} with it's defusedxml equivilent function." - - xml_bad_expatreader: - qualnames: [xml.sax.expatreader.create_parser] - message: "Using {func} to parse untrusted XML data is known to be vulnerable to XML attacks. Replace {func} with it's defusedxml equivilent function." - - xml_bad_expatbuilder: - qualnames: [xml.dom.expatbuilder.parse, - xml.dom.expatbuilder.parseString] - message: "Using {func} to parse untrusted XML data is known to be vulnerable to XML attacks. Replace {func} with it's defusedxml equivilent function." - - xml_bad_sax: - qualnames: [xml.sax.parse, - xml.sax.parseString, - xml.sax.make_parser] - message: "Using {func} to parse untrusted XML data is known to be vulnerable to XML attacks. Replace {func} with it's defusedxml equivilent function." - - xml_bad_minidom: - qualnames: [xml.dom.minidom.parse, - xml.dom.minidom.parseString] - message: "Using {func} to parse untrusted XML data is known to be vulnerable to XML attacks. Replace {func} with it's defusedxml equivilent function." - - xml_bad_pulldom: - qualnames: [xml.dom.pulldom.parse, - xml.dom.pulldom.parseString] - message: "Using {func} to parse untrusted XML data is known to be vulnerable to XML attacks. Replace {func} with it's defusedxml equivilent function." - - xml_bad_etree: - qualnames: [lxml.etree.parse, - lxml.etree.fromstring, - lxml.etree.RestrictedElement, - lxml.etree.GlobalParserTLS, - lxml.etree.getDefaultParser, - lxml.etree.check_docinfo] - message: "Using {func} to parse untrusted XML data is known to be vulnerable to XML attacks. Replace {func} with it's defusedxml equivilent function." - - -shell_injection: - # Start a process using the subprocess module, or one of its wrappers. - subprocess: [subprocess.Popen, subprocess.call, subprocess.check_call, - subprocess.check_output, utils.execute, utils.execute_with_timeout] - # Start a process with a function vulnerable to shell injection. - shell: [os.system, os.popen, os.popen2, os.popen3, os.popen4, - popen2.popen2, popen2.popen3, popen2.popen4, popen2.Popen3, - popen2.Popen4, commands.getoutput, commands.getstatusoutput] - # Start a process with a function that is not vulnerable to shell injection. - no_shell: [os.execl, os.execle, os.execlp, os.execlpe, os.execv,os.execve, - os.execvp, os.execvpe, os.spawnl, os.spawnle, os.spawnlp, - os.spawnlpe, os.spawnv, os.spawnve, os.spawnvp, os.spawnvpe, - os.startfile] - -blacklist_imports: - bad_import_sets: - - telnet: - imports: [telnetlib] - level: HIGH - message: "Telnet is considered insecure. Use SSH or some other encrypted protocol." - - info_libs: - imports: [pickle, cPickle, subprocess, Crypto] - level: LOW - message: "Consider possible security implications associated with {module} module." - - # Most of this is based off of Christian Heimes' work on defusedxml: - # https://pypi.org/project/defusedxml/#defusedxml-sax - - - xml_libs: - imports: [xml.etree.cElementTree, - xml.etree.ElementTree, - xml.sax.expatreader, - xml.sax, - xml.dom.expatbuilder, - xml.dom.minidom, - xml.dom.pulldom, - lxml.etree, - lxml] - message: "Using {module} to parse untrusted XML data is known to be vulnerable to XML attacks. Replace {module} with the equivilent defusedxml package." - level: LOW - - xml_libs_high: - imports: [xmlrpclib] - message: "Using {module} to parse untrusted XML data is known to be vulnerable to XML attacks. Use defused.xmlrpc.monkey_patch() function to monkey-patch xmlrpclib and mitigate XML vulnerabilities." - level: HIGH - -hardcoded_tmp_directory: - tmp_dirs: ['/tmp', '/var/tmp', '/dev/shm'] - -hardcoded_password: - # Support for full path, relative path and special "%(site_data_dir)s" - # substitution (/usr/{local}/share) - word_list: "%(site_data_dir)s/wordlist/default-passwords" - -ssl_with_bad_version: - bad_protocol_versions: - - 'PROTOCOL_SSLv2' - - 'SSLv2_METHOD' - - 'SSLv23_METHOD' - - 'PROTOCOL_SSLv3' # strict option - - 'PROTOCOL_TLSv1' # strict option - - 'SSLv3_METHOD' # strict option - - 'TLSv1_METHOD' # strict option - -password_config_option_not_marked_secret: - function_names: - - oslo.config.cfg.StrOpt - - oslo_config.cfg.StrOpt - -execute_with_run_as_root_equals_true: - function_names: - - ceilometer.utils.execute - - cinder.utils.execute - - neutron.agent.linux.utils.execute - - nova.utils.execute - - nova.utils.trycmd - -try_except_pass: - check_typed_exception: True diff --git a/lower-constraints.txt b/lower-constraints.txt index d032306b20..beac1f1604 100644 --- a/lower-constraints.txt +++ b/lower-constraints.txt @@ -5,7 +5,6 @@ appdirs==1.4.3 asn1crypto==0.24.0 automaton==1.14.0 Babel==2.3.4 -bandit==1.1.0 cachetools==2.0.1 castellan==0.17.0 certifi==2018.1.18 diff --git a/test-requirements.txt b/test-requirements.txt index 8c2ec24300..01a708b56f 100644 --- a/test-requirements.txt +++ b/test-requirements.txt @@ -9,7 +9,6 @@ hacking!=0.13.0,<0.14,>=0.12.0 # Apache-2.0 Babel!=2.4.0,>=2.3.4 # BSD # Needed for testing -bandit>=1.1.0 # Apache-2.0 coverage!=4.4,>=4.0 # Apache-2.0 ddt>=1.0.1 # MIT fixtures>=3.0.0 # Apache-2.0/BSD diff --git a/tox.ini b/tox.ini index 01683d85ec..0f88bc383e 100644 --- a/tox.ini +++ b/tox.ini @@ -67,7 +67,6 @@ basepython = python3 commands = flake8 {posargs} # Run security linter - bandit -c bandit.yaml -r glance -n5 -p gate # Check that .po and .pot files are valid: bash -c "find glance -type f -regex '.*\.pot?' -print0|xargs -0 -n 1 msgfmt --check-format -o /dev/null" doc8 {posargs} @@ -135,10 +134,6 @@ commands = basepython = python3 commands = {posargs} -[testenv:bandit] -basepython = python3 -commands = bandit -c bandit.yaml -r glance -n5 -p gate - [testenv:releasenotes] basepython = python3 deps =