ci: add bandit scan workflow
This commit is contained in:
Arina Neshlyaeva
committed by
aneshlya
aneshlya
parent
1925a4ec99
commit
1417347f0e
@@ -0,0 +1,405 @@
|
||||
# Copyright 2024, Intel Corporation
|
||||
# SPDX-License-Identifier: BSD-3-Clause
|
||||
|
||||
### Bandit config file generated from:
|
||||
# './bandit/bandit/cli/config_generator.py --out bandit.config'
|
||||
|
||||
### This config may optionally select a subset of tests to run or skip by
|
||||
### filling out the 'tests' and 'skips' lists given below. If no tests are
|
||||
### specified for inclusion then it is assumed all tests are desired. The skips
|
||||
### set will remove specific tests from the include set. This can be controlled
|
||||
### using the -t/-s CLI options. Note that the same test ID should not appear
|
||||
### in both 'tests' and 'skips', this would be nonsensical and is detected by
|
||||
### Bandit at runtime.
|
||||
|
||||
# Available tests:
|
||||
# B101 : assert_used
|
||||
# B102 : exec_used
|
||||
# B103 : set_bad_file_permissions
|
||||
# B104 : hardcoded_bind_all_interfaces
|
||||
# B105 : hardcoded_password_string
|
||||
# B106 : hardcoded_password_funcarg
|
||||
# B107 : hardcoded_password_default
|
||||
# B108 : hardcoded_tmp_directory
|
||||
# B110 : try_except_pass
|
||||
# B112 : try_except_continue
|
||||
# B201 : flask_debug_true
|
||||
# B301 : pickle
|
||||
# B302 : marshal
|
||||
# B303 : md5
|
||||
# B304 : ciphers
|
||||
# B305 : cipher_modes
|
||||
# B306 : mktemp_q
|
||||
# B307 : eval
|
||||
# B308 : mark_safe
|
||||
# B310 : urllib_urlopen
|
||||
# B311 : random
|
||||
# B312 : telnetlib
|
||||
# B313 : xml_bad_cElementTree
|
||||
# B314 : xml_bad_ElementTree
|
||||
# B315 : xml_bad_expatreader
|
||||
# B316 : xml_bad_expatbuilder
|
||||
# B317 : xml_bad_sax
|
||||
# B318 : xml_bad_minidom
|
||||
# B319 : xml_bad_pulldom
|
||||
# B320 : xml_bad_etree
|
||||
# B321 : ftplib
|
||||
# B323 : unverified_context
|
||||
# B324 : hashlib_new_insecure_functions
|
||||
# B401 : import_telnetlib
|
||||
# B402 : import_ftplib
|
||||
# B403 : import_pickle
|
||||
# B404 : import_subprocess
|
||||
# B405 : import_xml_etree
|
||||
# B406 : import_xml_sax
|
||||
# B407 : import_xml_expat
|
||||
# B408 : import_xml_minidom
|
||||
# B409 : import_xml_pulldom
|
||||
# B410 : import_lxml
|
||||
# B411 : import_xmlrpclib
|
||||
# B412 : import_httpoxy
|
||||
# B413 : import_pycrypto
|
||||
# B501 : request_with_no_cert_validation
|
||||
# B502 : ssl_with_bad_version
|
||||
# B503 : ssl_with_bad_defaults
|
||||
# B504 : ssl_with_no_version
|
||||
# B505 : weak_cryptographic_key
|
||||
# B506 : yaml_load
|
||||
# B507 : ssh_no_host_key_verification
|
||||
# B601 : paramiko_calls
|
||||
# B602 : subprocess_popen_with_shell_equals_true
|
||||
# B603 : subprocess_without_shell_equals_true
|
||||
# B604 : any_other_function_with_shell_equals_true
|
||||
# B605 : start_process_with_a_shell
|
||||
# B606 : start_process_with_no_shell
|
||||
# B607 : start_process_with_partial_path
|
||||
# B608 : hardcoded_sql_expressions
|
||||
# B609 : linux_commands_wildcard_injection
|
||||
# B610 : django_extra_used
|
||||
# B611 : django_rawsql_used
|
||||
# B701 : jinja2_autoescape_false
|
||||
# B702 : use_of_mako_templates
|
||||
# B703 : django_mark_safe
|
||||
|
||||
# (optional) list included test IDs here, eg '[B101, B406]':
|
||||
# Intel Required Checkers. Do not disable these
|
||||
# Additional checkers may be added if desired
|
||||
tests:
|
||||
[ 'B301', 'B302', 'B303', 'B304', 'B305', 'B306', 'B308', 'B310', 'B311', 'B312', 'B313', 'B314', 'B315', 'B316', 'B317', 'B318', 'B319', 'B320', 'B321', 'B323', 'B324', 'B401', 'B402', 'B403', 'B404', 'B405', 'B406', 'B407', 'B408', 'B409', 'B410', 'B411', 'B412', 'B413']
|
||||
|
||||
# (optional) list skipped test IDs here, eg '[B101, B406]':
|
||||
# The following checkers are not required but be added to tests list if desired
|
||||
skips:
|
||||
[ 'B101', 'B102', 'B103', 'B104', 'B105', 'B106', 'B107', 'B108', 'B110', 'B112', 'B201', 'B501', 'B502', 'B503', 'B504', 'B505', 'B506', 'B507', 'B601', 'B602', 'B603', 'B604', 'B605', 'B606', 'B607', 'B608', 'B609', 'B610', 'B611', 'B701', 'B702', 'B703']
|
||||
|
||||
# Exclude 3rd party dirs
|
||||
exclude_dirs: ['benchmarks/vendor', 'ispcrt/tests/vendor']
|
||||
|
||||
### (optional) plugin settings - some test plugins require configuration data
|
||||
### that may be given here, per-plugin. All bandit test plugins have a built in
|
||||
### set of sensible defaults and these will be used if no configuration is
|
||||
### provided. It is not necessary to provide settings for every (or any) plugin
|
||||
### if the defaults are acceptable.
|
||||
|
||||
any_other_function_with_shell_equals_true:
|
||||
no_shell:
|
||||
- os.execl
|
||||
- os.execle
|
||||
- os.execlp
|
||||
- os.execlpe
|
||||
- os.execv
|
||||
- os.execve
|
||||
- os.execvp
|
||||
- os.execvpe
|
||||
- os.spawnl
|
||||
- os.spawnle
|
||||
- os.spawnlp
|
||||
- os.spawnlpe
|
||||
- os.spawnv
|
||||
- os.spawnve
|
||||
- os.spawnvp
|
||||
- os.spawnvpe
|
||||
- os.startfile
|
||||
shell:
|
||||
- os.system
|
||||
- os.popen
|
||||
- os.popen2
|
||||
- os.popen3
|
||||
- os.popen4
|
||||
- popen2.popen2
|
||||
- popen2.popen3
|
||||
- popen2.popen4
|
||||
- popen2.Popen3
|
||||
- popen2.Popen4
|
||||
- commands.getoutput
|
||||
- commands.getstatusoutput
|
||||
subprocess:
|
||||
- subprocess.Popen
|
||||
- subprocess.call
|
||||
- subprocess.check_call
|
||||
- subprocess.check_output
|
||||
- subprocess.run
|
||||
assert_used:
|
||||
skips: []
|
||||
hardcoded_tmp_directory:
|
||||
tmp_dirs:
|
||||
- /tmp
|
||||
- /var/tmp
|
||||
- /dev/shm
|
||||
linux_commands_wildcard_injection:
|
||||
no_shell:
|
||||
- os.execl
|
||||
- os.execle
|
||||
- os.execlp
|
||||
- os.execlpe
|
||||
- os.execv
|
||||
- os.execve
|
||||
- os.execvp
|
||||
- os.execvpe
|
||||
- os.spawnl
|
||||
- os.spawnle
|
||||
- os.spawnlp
|
||||
- os.spawnlpe
|
||||
- os.spawnv
|
||||
- os.spawnve
|
||||
- os.spawnvp
|
||||
- os.spawnvpe
|
||||
- os.startfile
|
||||
shell:
|
||||
- os.system
|
||||
- os.popen
|
||||
- os.popen2
|
||||
- os.popen3
|
||||
- os.popen4
|
||||
- popen2.popen2
|
||||
- popen2.popen3
|
||||
- popen2.popen4
|
||||
- popen2.Popen3
|
||||
- popen2.Popen4
|
||||
- commands.getoutput
|
||||
- commands.getstatusoutput
|
||||
subprocess:
|
||||
- subprocess.Popen
|
||||
- subprocess.call
|
||||
- subprocess.check_call
|
||||
- subprocess.check_output
|
||||
- subprocess.run
|
||||
ssl_with_bad_defaults:
|
||||
bad_protocol_versions:
|
||||
- PROTOCOL_SSLv2
|
||||
- SSLv2_METHOD
|
||||
- SSLv23_METHOD
|
||||
- PROTOCOL_SSLv3
|
||||
- PROTOCOL_TLSv1
|
||||
- SSLv3_METHOD
|
||||
- TLSv1_METHOD
|
||||
ssl_with_bad_version:
|
||||
bad_protocol_versions:
|
||||
- PROTOCOL_SSLv2
|
||||
- SSLv2_METHOD
|
||||
- SSLv23_METHOD
|
||||
- PROTOCOL_SSLv3
|
||||
- PROTOCOL_TLSv1
|
||||
- SSLv3_METHOD
|
||||
- TLSv1_METHOD
|
||||
start_process_with_a_shell:
|
||||
no_shell:
|
||||
- os.execl
|
||||
- os.execle
|
||||
- os.execlp
|
||||
- os.execlpe
|
||||
- os.execv
|
||||
- os.execve
|
||||
- os.execvp
|
||||
- os.execvpe
|
||||
- os.spawnl
|
||||
- os.spawnle
|
||||
- os.spawnlp
|
||||
- os.spawnlpe
|
||||
- os.spawnv
|
||||
- os.spawnve
|
||||
- os.spawnvp
|
||||
- os.spawnvpe
|
||||
- os.startfile
|
||||
shell:
|
||||
- os.system
|
||||
- os.popen
|
||||
- os.popen2
|
||||
- os.popen3
|
||||
- os.popen4
|
||||
- popen2.popen2
|
||||
- popen2.popen3
|
||||
- popen2.popen4
|
||||
- popen2.Popen3
|
||||
- popen2.Popen4
|
||||
- commands.getoutput
|
||||
- commands.getstatusoutput
|
||||
subprocess:
|
||||
- subprocess.Popen
|
||||
- subprocess.call
|
||||
- subprocess.check_call
|
||||
- subprocess.check_output
|
||||
- subprocess.run
|
||||
start_process_with_no_shell:
|
||||
no_shell:
|
||||
- os.execl
|
||||
- os.execle
|
||||
- os.execlp
|
||||
- os.execlpe
|
||||
- os.execv
|
||||
- os.execve
|
||||
- os.execvp
|
||||
- os.execvpe
|
||||
- os.spawnl
|
||||
- os.spawnle
|
||||
- os.spawnlp
|
||||
- os.spawnlpe
|
||||
- os.spawnv
|
||||
- os.spawnve
|
||||
- os.spawnvp
|
||||
- os.spawnvpe
|
||||
- os.startfile
|
||||
shell:
|
||||
- os.system
|
||||
- os.popen
|
||||
- os.popen2
|
||||
- os.popen3
|
||||
- os.popen4
|
||||
- popen2.popen2
|
||||
- popen2.popen3
|
||||
- popen2.popen4
|
||||
- popen2.Popen3
|
||||
- popen2.Popen4
|
||||
- commands.getoutput
|
||||
- commands.getstatusoutput
|
||||
subprocess:
|
||||
- subprocess.Popen
|
||||
- subprocess.call
|
||||
- subprocess.check_call
|
||||
- subprocess.check_output
|
||||
- subprocess.run
|
||||
start_process_with_partial_path:
|
||||
no_shell:
|
||||
- os.execl
|
||||
- os.execle
|
||||
- os.execlp
|
||||
- os.execlpe
|
||||
- os.execv
|
||||
- os.execve
|
||||
- os.execvp
|
||||
- os.execvpe
|
||||
- os.spawnl
|
||||
- os.spawnle
|
||||
- os.spawnlp
|
||||
- os.spawnlpe
|
||||
- os.spawnv
|
||||
- os.spawnve
|
||||
- os.spawnvp
|
||||
- os.spawnvpe
|
||||
- os.startfile
|
||||
shell:
|
||||
- os.system
|
||||
- os.popen
|
||||
- os.popen2
|
||||
- os.popen3
|
||||
- os.popen4
|
||||
- popen2.popen2
|
||||
- popen2.popen3
|
||||
- popen2.popen4
|
||||
- popen2.Popen3
|
||||
- popen2.Popen4
|
||||
- commands.getoutput
|
||||
- commands.getstatusoutput
|
||||
subprocess:
|
||||
- subprocess.Popen
|
||||
- subprocess.call
|
||||
- subprocess.check_call
|
||||
- subprocess.check_output
|
||||
- subprocess.run
|
||||
subprocess_popen_with_shell_equals_true:
|
||||
no_shell:
|
||||
- os.execl
|
||||
- os.execle
|
||||
- os.execlp
|
||||
- os.execlpe
|
||||
- os.execv
|
||||
- os.execve
|
||||
- os.execvp
|
||||
- os.execvpe
|
||||
- os.spawnl
|
||||
- os.spawnle
|
||||
- os.spawnlp
|
||||
- os.spawnlpe
|
||||
- os.spawnv
|
||||
- os.spawnve
|
||||
- os.spawnvp
|
||||
- os.spawnvpe
|
||||
- os.startfile
|
||||
shell:
|
||||
- os.system
|
||||
- os.popen
|
||||
- os.popen2
|
||||
- os.popen3
|
||||
- os.popen4
|
||||
- popen2.popen2
|
||||
- popen2.popen3
|
||||
- popen2.popen4
|
||||
- popen2.Popen3
|
||||
- popen2.Popen4
|
||||
- commands.getoutput
|
||||
- commands.getstatusoutput
|
||||
subprocess:
|
||||
- subprocess.Popen
|
||||
- subprocess.call
|
||||
- subprocess.check_call
|
||||
- subprocess.check_output
|
||||
- subprocess.run
|
||||
subprocess_without_shell_equals_true:
|
||||
no_shell:
|
||||
- os.execl
|
||||
- os.execle
|
||||
- os.execlp
|
||||
- os.execlpe
|
||||
- os.execv
|
||||
- os.execve
|
||||
- os.execvp
|
||||
- os.execvpe
|
||||
- os.spawnl
|
||||
- os.spawnle
|
||||
- os.spawnlp
|
||||
- os.spawnlpe
|
||||
- os.spawnv
|
||||
- os.spawnve
|
||||
- os.spawnvp
|
||||
- os.spawnvpe
|
||||
- os.startfile
|
||||
shell:
|
||||
- os.system
|
||||
- os.popen
|
||||
- os.popen2
|
||||
- os.popen3
|
||||
- os.popen4
|
||||
- popen2.popen2
|
||||
- popen2.popen3
|
||||
- popen2.popen4
|
||||
- popen2.Popen3
|
||||
- popen2.Popen4
|
||||
- commands.getoutput
|
||||
- commands.getstatusoutput
|
||||
subprocess:
|
||||
- subprocess.Popen
|
||||
- subprocess.call
|
||||
- subprocess.check_call
|
||||
- subprocess.check_output
|
||||
- subprocess.run
|
||||
try_except_continue:
|
||||
check_typed_exception: false
|
||||
try_except_pass:
|
||||
check_typed_exception: false
|
||||
weak_cryptographic_key:
|
||||
weak_key_size_dsa_high: 1024
|
||||
weak_key_size_dsa_medium: 2048
|
||||
weak_key_size_ec_high: 160
|
||||
weak_key_size_ec_medium: 224
|
||||
weak_key_size_rsa_high: 1024
|
||||
weak_key_size_rsa_medium: 2048
|
||||
@@ -0,0 +1,37 @@
|
||||
# Copyright 2024, Intel Corporation
|
||||
# SPDX-License-Identifier: BSD-3-Clause
|
||||
|
||||
name: Scan Python code with Bandit
|
||||
|
||||
on:
|
||||
workflow_dispatch:
|
||||
push:
|
||||
pull_request:
|
||||
paths:
|
||||
- '**/*.py'
|
||||
- '.github/workflows/bandit.*'
|
||||
|
||||
permissions:
|
||||
contents: read
|
||||
|
||||
jobs:
|
||||
bandit:
|
||||
name: Bandit
|
||||
runs-on: ubuntu-latest
|
||||
|
||||
steps:
|
||||
- name: Clone the git repo
|
||||
uses: actions/checkout@692973e3d937129bcbf40652eb9f2f61becf3332 # v4.1.7
|
||||
|
||||
- name: Install Bandit
|
||||
run: pip install bandit
|
||||
|
||||
- name: Run Bandit
|
||||
run: |
|
||||
bandit -c .github/workflows/bandit.config -r . -f txt -o bandit_output.txt
|
||||
|
||||
- name: Upload Bandit text report as artifact
|
||||
uses: actions/upload-artifact@0b2256b8c012f0828dc542b3febcab082c67f72b # v4.3.4
|
||||
with:
|
||||
name: bandit-report
|
||||
path: bandit_output.txt
|
||||
@@ -908,7 +908,11 @@ import smtplib
|
||||
import datetime
|
||||
import copy
|
||||
import multiprocessing
|
||||
import subprocess
|
||||
# Subprocess is intentionally used with shell=True, it's required for cross platform support.
|
||||
# The command called from subprocess is constructed inside the script and
|
||||
# it's quoted appropriately to avoid shell injection vulnerabilities
|
||||
# so it's safe to ignore Bandit warning.
|
||||
import subprocess #nosec
|
||||
import re
|
||||
from shutil import copyfile
|
||||
# our drivers
|
||||
|
||||
+3
-1
@@ -6,7 +6,9 @@
|
||||
|
||||
import sys
|
||||
import re
|
||||
import subprocess
|
||||
# Subprocess is used with default shell which is False, it's safe and doesn't allow shell injection
|
||||
# so it's safe to ignore Bandit warning.
|
||||
import subprocess #nosec
|
||||
import platform
|
||||
import argparse
|
||||
from os.path import basename, dirname
|
||||
|
||||
@@ -1,6 +1,6 @@
|
||||
#!/usr/bin/env python3
|
||||
#
|
||||
# Copyright (c) 2013-2023, Intel Corporation
|
||||
# Copyright (c) 2013-2024, Intel Corporation
|
||||
#
|
||||
# SPDX-License-Identifier: BSD-3-Clause
|
||||
|
||||
@@ -15,7 +15,8 @@ class EmptyClass(object): pass
|
||||
|
||||
# load/save almost every object to a file (good for bug reproducing)
|
||||
def dump(fname, obj):
|
||||
import pickle
|
||||
# Pickle is used to dump the file (not to load it), it's safe and doesn't allow shell injection
|
||||
import pickle #nosec
|
||||
with open(fname, 'w') as fp:
|
||||
pickle.dump(obj, fp)
|
||||
|
||||
@@ -442,7 +443,8 @@ class ExecutionStateGatherer(object):
|
||||
print("ESG: loaded from 'TestTable()' with revisions", REVISIONS)
|
||||
|
||||
def dump(self, fname, obj):
|
||||
import pickle
|
||||
# Pickle is used to dump the file (not to load it), it's safe and doesn't allow shell injection
|
||||
import pickle #nosec
|
||||
with open(fname, 'wb') as fp:
|
||||
pickle.dump(obj, fp)
|
||||
|
||||
|
||||
+3
-1
@@ -965,7 +965,9 @@ import re
|
||||
import signal
|
||||
import random
|
||||
import threading
|
||||
import subprocess
|
||||
# Subprocess is used with default shell which is False, it's safe and doesn't allow shell injection
|
||||
# so we can ignore the Bandit warning
|
||||
import subprocess #nosec
|
||||
import shlex
|
||||
import platform
|
||||
import tempfile
|
||||
|
||||
@@ -3,7 +3,9 @@ import errno
|
||||
import io
|
||||
import itertools
|
||||
import getopt
|
||||
import os, signal, subprocess, sys
|
||||
# Subprocess is used with default shell which is False, it's safe and doesn't allow shell injection
|
||||
# so we can ignore the Bandit warning
|
||||
import os, signal, subprocess, sys #nosec
|
||||
import re
|
||||
import stat
|
||||
import platform
|
||||
|
||||
@@ -1,7 +1,9 @@
|
||||
from __future__ import absolute_import
|
||||
import os
|
||||
import shlex
|
||||
import subprocess
|
||||
# Subprocess is used with default shell which is False, it's safe and doesn't allow shell injection
|
||||
# so we can ignore the Bandit warning
|
||||
import subprocess #nosec
|
||||
import sys
|
||||
|
||||
import lit.Test
|
||||
|
||||
@@ -1,7 +1,8 @@
|
||||
import itertools
|
||||
import json
|
||||
|
||||
from xml.sax.saxutils import quoteattr as quo
|
||||
# Seems like a bug in Bandit: https://github.com/PyCQA/bandit/issues/452
|
||||
from xml.sax.saxutils import quoteattr as quo #nosec
|
||||
|
||||
import lit.Test
|
||||
|
||||
|
||||
@@ -7,7 +7,11 @@ import numbers
|
||||
import os
|
||||
import platform
|
||||
import signal
|
||||
import subprocess
|
||||
# Subprocess is used with default shell which is False, it's safe and doesn't allow shell injection.
|
||||
# In one case it's used with Shell=True "subprocess.call('kill -kill $(ps -o pid= -L{})'.format(pid), shell=True)"
|
||||
# The command called from subprocess is constructed inside the script and
|
||||
# it's quoted appropriately to avoid shell injection vulnerabilities
|
||||
import subprocess #nosec
|
||||
import sys
|
||||
import threading
|
||||
|
||||
|
||||
Reference in New Issue
Block a user