Merge "add bandit to pep8 job"

oslo_db/sqlalchemy/enginefacade.py

@@ -843,7 +843,8 @@ class _TransactionContextManager(object):
         new = self._clone()
         new._root = new
         new._root_factory = self._root_factory._create_factory_copy()
-        assert not new._factory._started
+        if new._factory._started:
+            raise AssertionError('TransactionFactory is already started')
         return new
 
     def patch_factory(self, factory_or_manager):
@@ -869,7 +870,8 @@ class _TransactionContextManager(object):
             raise ValueError(
                 "_TransactionContextManager or "
                 "_TransactionFactory expected.")
-        assert self._root is self
+        if self._root is not self:
+            raise AssertionError('patch_factory only works for root factory.')
         existing_factory = self._root_factory
         self._root_factory = factory
 

oslo_db/sqlalchemy/update_match.py

@@ -164,9 +164,9 @@ def update_on_match(
 
     entity = inspect(specimen)
     mapper = entity.mapper
-    assert \
-        [desc['type'] for desc in query.column_descriptions] == \
-        [mapper.class_], "Query does not match given specimen"
+    if [desc['type'] for desc in query.column_descriptions] != \
+        [mapper.class_]:
+        raise AssertionError("Query does not match given specimen")
 
     criteria = manufacture_entity_criteria(
         specimen, include_only=include_only, exclude=[surrogate_key])

oslo_db/sqlalchemy/utils.py

@@ -181,7 +181,9 @@ def paginate_query(query, model, limit, sort_keys, marker=None,
         LOG.warning('Unique keys not in sort_keys. '
                     'The sorting order may be unstable.')
 
-    assert(not (sort_dir and sort_dirs))
+    if sort_dir and sort_dirs:
+        raise AssertionError('Disallow set sort_dir and '
+                             'sort_dirs at the same time.')
 
     # Default the sort direction to ascending
     if sort_dirs is None and sort_dir is None:
@@ -191,7 +193,8 @@ def paginate_query(query, model, limit, sort_keys, marker=None,
     if sort_dirs is None:
         sort_dirs = [sort_dir for _sort_key in sort_keys]
 
-    assert(len(sort_dirs) == len(sort_keys))
+    if len(sort_dirs) != len(sort_keys):
+        raise AssertionError('sort_dirs and sort_keys must have same length.')
 
     # Add sorting
     for current_sort_key, current_sort_dir in zip(sort_keys, sort_dirs):
@@ -1152,7 +1155,8 @@ def suspend_fk_constraints_for_col_alter(
             fks = []
             for ref_table_name in referents:
                 for fk in insp.get_foreign_keys(ref_table_name):
-                    assert fk.get('name')
+                    if not fk.get('name'):
+                        raise AssertionError("foreign key hasn't a name.")
                     if fk['referred_table'] == table_name and \
                             column_name in fk['referred_columns']:
                         fk['source_table'] = ref_table_name

setup.cfg

@@ -38,6 +38,8 @@ test =
   testrepository>=0.0.18 # Apache-2.0/BSD
   testtools>=2.2.0 # MIT
   os-testr>=1.0.0 # Apache-2.0
+# Bandit security code scanner
+  bandit>=1.1.0 # Apache-2.0
 fixtures =
   testresources>=2.0.0 # Apache-2.0/BSD
   testscenarios>=0.4 # Apache-2.0/BSD

tox.ini

@@ -34,7 +34,10 @@ commands =
     env TEST_EVENTLET=1 bash tools/pretty_tox.sh '{posargs}'
 
 [testenv:pep8]
-commands = flake8
+commands =
+  flake8
+  # Run security linter
+  bandit -r oslo_db -x tests -n5 --skip B105,B311
 
 [testenv:venv]
 commands = {posargs}