Skip to content

Commit 2cbb1d0

Browse files
gooishingooishin
committed
Add bandit
1 parent f17d972 commit 2cbb1d0

File tree

1 file changed

+398
-0
lines changed

1 file changed

+398
-0
lines changed

‎.github/bandit/ipas_default.config‎

Lines changed: 398 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,398 @@
1+
2+
### Bandit config file generated from:
3+
# './bandit/bandit/cli/config_generator.py --out ipas_default.config'
4+
5+
### This config may optionally select a subset of tests to run or skip by
6+
### filling out the 'tests' and 'skips' lists given below. If no tests are
7+
### specified for inclusion then it is assumed all tests are desired. The skips
8+
### set will remove specific tests from the include set. This can be controlled
9+
### using the -t/-s CLI options. Note that the same test ID should not appear
10+
### in both 'tests' and 'skips', this would be nonsensical and is detected by
11+
### Bandit at runtime.
12+
13+
# Available tests:
14+
# B101 : assert_used
15+
# B102 : exec_used
16+
# B103 : set_bad_file_permissions
17+
# B104 : hardcoded_bind_all_interfaces
18+
# B105 : hardcoded_password_string
19+
# B106 : hardcoded_password_funcarg
20+
# B107 : hardcoded_password_default
21+
# B108 : hardcoded_tmp_directory
22+
# B110 : try_except_pass
23+
# B112 : try_except_continue
24+
# B201 : flask_debug_true
25+
# B301 : pickle
26+
# B302 : marshal
27+
# B303 : md5
28+
# B304 : ciphers
29+
# B305 : cipher_modes
30+
# B306 : mktemp_q
31+
# B307 : eval
32+
# B308 : mark_safe
33+
# B310 : urllib_urlopen
34+
# B311 : random
35+
# B312 : telnetlib
36+
# B313 : xml_bad_cElementTree
37+
# B314 : xml_bad_ElementTree
38+
# B315 : xml_bad_expatreader
39+
# B316 : xml_bad_expatbuilder
40+
# B317 : xml_bad_sax
41+
# B318 : xml_bad_minidom
42+
# B319 : xml_bad_pulldom
43+
# B321 : ftplib
44+
# B323 : unverified_context
45+
# B324 : hashlib_new_insecure_functions
46+
# B401 : import_telnetlib
47+
# B402 : import_ftplib
48+
# B403 : import_pickle
49+
# B404 : import_subprocess
50+
# B405 : import_xml_etree
51+
# B406 : import_xml_sax
52+
# B407 : import_xml_expat
53+
# B408 : import_xml_minidom
54+
# B409 : import_xml_pulldom
55+
# B411 : import_xmlrpclib
56+
# B412 : import_httpoxy
57+
# B413 : import_pycrypto
58+
# B501 : request_with_no_cert_validation
59+
# B502 : ssl_with_bad_version
60+
# B503 : ssl_with_bad_defaults
61+
# B504 : ssl_with_no_version
62+
# B505 : weak_cryptographic_key
63+
# B506 : yaml_load
64+
# B507 : ssh_no_host_key_verification
65+
# B601 : paramiko_calls
66+
# B602 : subprocess_popen_with_shell_equals_true
67+
# B603 : subprocess_without_shell_equals_true
68+
# B604 : any_other_function_with_shell_equals_true
69+
# B605 : start_process_with_a_shell
70+
# B606 : start_process_with_no_shell
71+
# B607 : start_process_with_partial_path
72+
# B608 : hardcoded_sql_expressions
73+
# B609 : linux_commands_wildcard_injection
74+
# B610 : django_extra_used
75+
# B611 : django_rawsql_used
76+
# B701 : jinja2_autoescape_false
77+
# B702 : use_of_mako_templates
78+
# B703 : django_mark_safe
79+
80+
# (optional) list included test IDs here, eg '[B101, B406]':
81+
# IPAS Required Checkers. Do not disable these
82+
# Additional checkers may be added if desired
83+
tests:
84+
[ 'B301', 'B302', 'B303', 'B304', 'B305', 'B306', 'B308', 'B310', 'B311', 'B312', 'B313', 'B314', 'B315', 'B316', 'B317', 'B318', 'B319', 'B321', 'B323', 'B324', 'B401', 'B402', 'B403', 'B404', 'B405', 'B406', 'B407', 'B408', 'B409', 'B411', 'B412', 'B413']
85+
86+
# (optional) list skipped test IDs here, eg '[B101, B406]':
87+
# The following checkers are not required but be added to tests list if desired
88+
skips:
89+
[ 'B101', 'B102', 'B103', 'B104', 'B105', 'B106', 'B107', 'B108', 'B110', 'B112', 'B201', 'B501', 'B502', 'B503', 'B504', 'B505', 'B506', 'B507', 'B601', 'B602', 'B603', 'B604', 'B605', 'B606', 'B607', 'B608', 'B609', 'B610', 'B611', 'B701', 'B702', 'B703']
90+
91+
### (optional) plugin settings - some test plugins require configuration data
92+
### that may be given here, per-plugin. All bandit test plugins have a built in
93+
### set of sensible defaults and these will be used if no configuration is
94+
### provided. It is not necessary to provide settings for every (or any) plugin
95+
### if the defaults are acceptable.
96+
97+
any_other_function_with_shell_equals_true:
98+
no_shell:
99+
- os.execl
100+
- os.execle
101+
- os.execlp
102+
- os.execlpe
103+
- os.execv
104+
- os.execve
105+
- os.execvp
106+
- os.execvpe
107+
- os.spawnl
108+
- os.spawnle
109+
- os.spawnlp
110+
- os.spawnlpe
111+
- os.spawnv
112+
- os.spawnve
113+
- os.spawnvp
114+
- os.spawnvpe
115+
- os.startfile
116+
shell:
117+
- os.system
118+
- os.popen
119+
- os.popen2
120+
- os.popen3
121+
- os.popen4
122+
- popen2.popen2
123+
- popen2.popen3
124+
- popen2.popen4
125+
- popen2.Popen3
126+
- popen2.Popen4
127+
- commands.getoutput
128+
- commands.getstatusoutput
129+
subprocess:
130+
- subprocess.Popen
131+
- subprocess.call
132+
- subprocess.check_call
133+
- subprocess.check_output
134+
- subprocess.run
135+
assert_used:
136+
skips: []
137+
hardcoded_tmp_directory:
138+
tmp_dirs:
139+
- /tmp
140+
- /var/tmp
141+
- /dev/shm
142+
linux_commands_wildcard_injection:
143+
no_shell:
144+
- os.execl
145+
- os.execle
146+
- os.execlp
147+
- os.execlpe
148+
- os.execv
149+
- os.execve
150+
- os.execvp
151+
- os.execvpe
152+
- os.spawnl
153+
- os.spawnle
154+
- os.spawnlp
155+
- os.spawnlpe
156+
- os.spawnv
157+
- os.spawnve
158+
- os.spawnvp
159+
- os.spawnvpe
160+
- os.startfile
161+
shell:
162+
- os.system
163+
- os.popen
164+
- os.popen2
165+
- os.popen3
166+
- os.popen4
167+
- popen2.popen2
168+
- popen2.popen3
169+
- popen2.popen4
170+
- popen2.Popen3
171+
- popen2.Popen4
172+
- commands.getoutput
173+
- commands.getstatusoutput
174+
subprocess:
175+
- subprocess.Popen
176+
- subprocess.call
177+
- subprocess.check_call
178+
- subprocess.check_output
179+
- subprocess.run
180+
ssl_with_bad_defaults:
181+
bad_protocol_versions:
182+
- PROTOCOL_SSLv2
183+
- SSLv2_METHOD
184+
- SSLv23_METHOD
185+
- PROTOCOL_SSLv3
186+
- PROTOCOL_TLSv1
187+
- SSLv3_METHOD
188+
- TLSv1_METHOD
189+
ssl_with_bad_version:
190+
bad_protocol_versions:
191+
- PROTOCOL_SSLv2
192+
- SSLv2_METHOD
193+
- SSLv23_METHOD
194+
- PROTOCOL_SSLv3
195+
- PROTOCOL_TLSv1
196+
- SSLv3_METHOD
197+
- TLSv1_METHOD
198+
start_process_with_a_shell:
199+
no_shell:
200+
- os.execl
201+
- os.execle
202+
- os.execlp
203+
- os.execlpe
204+
- os.execv
205+
- os.execve
206+
- os.execvp
207+
- os.execvpe
208+
- os.spawnl
209+
- os.spawnle
210+
- os.spawnlp
211+
- os.spawnlpe
212+
- os.spawnv
213+
- os.spawnve
214+
- os.spawnvp
215+
- os.spawnvpe
216+
- os.startfile
217+
shell:
218+
- os.system
219+
- os.popen
220+
- os.popen2
221+
- os.popen3
222+
- os.popen4
223+
- popen2.popen2
224+
- popen2.popen3
225+
- popen2.popen4
226+
- popen2.Popen3
227+
- popen2.Popen4
228+
- commands.getoutput
229+
- commands.getstatusoutput
230+
subprocess:
231+
- subprocess.Popen
232+
- subprocess.call
233+
- subprocess.check_call
234+
- subprocess.check_output
235+
- subprocess.run
236+
start_process_with_no_shell:
237+
no_shell:
238+
- os.execl
239+
- os.execle
240+
- os.execlp
241+
- os.execlpe
242+
- os.execv
243+
- os.execve
244+
- os.execvp
245+
- os.execvpe
246+
- os.spawnl
247+
- os.spawnle
248+
- os.spawnlp
249+
- os.spawnlpe
250+
- os.spawnv
251+
- os.spawnve
252+
- os.spawnvp
253+
- os.spawnvpe
254+
- os.startfile
255+
shell:
256+
- os.system
257+
- os.popen
258+
- os.popen2
259+
- os.popen3
260+
- os.popen4
261+
- popen2.popen2
262+
- popen2.popen3
263+
- popen2.popen4
264+
- popen2.Popen3
265+
- popen2.Popen4
266+
- commands.getoutput
267+
- commands.getstatusoutput
268+
subprocess:
269+
- subprocess.Popen
270+
- subprocess.call
271+
- subprocess.check_call
272+
- subprocess.check_output
273+
- subprocess.run
274+
start_process_with_partial_path:
275+
no_shell:
276+
- os.execl
277+
- os.execle
278+
- os.execlp
279+
- os.execlpe
280+
- os.execv
281+
- os.execve
282+
- os.execvp
283+
- os.execvpe
284+
- os.spawnl
285+
- os.spawnle
286+
- os.spawnlp
287+
- os.spawnlpe
288+
- os.spawnv
289+
- os.spawnve
290+
- os.spawnvp
291+
- os.spawnvpe
292+
- os.startfile
293+
shell:
294+
- os.system
295+
- os.popen
296+
- os.popen2
297+
- os.popen3
298+
- os.popen4
299+
- popen2.popen2
300+
- popen2.popen3
301+
- popen2.popen4
302+
- popen2.Popen3
303+
- popen2.Popen4
304+
- commands.getoutput
305+
- commands.getstatusoutput
306+
subprocess:
307+
- subprocess.Popen
308+
- subprocess.call
309+
- subprocess.check_call
310+
- subprocess.check_output
311+
- subprocess.run
312+
subprocess_popen_with_shell_equals_true:
313+
no_shell:
314+
- os.execl
315+
- os.execle
316+
- os.execlp
317+
- os.execlpe
318+
- os.execv
319+
- os.execve
320+
- os.execvp
321+
- os.execvpe
322+
- os.spawnl
323+
- os.spawnle
324+
- os.spawnlp
325+
- os.spawnlpe
326+
- os.spawnv
327+
- os.spawnve
328+
- os.spawnvp
329+
- os.spawnvpe
330+
- os.startfile
331+
shell:
332+
- os.system
333+
- os.popen
334+
- os.popen2
335+
- os.popen3
336+
- os.popen4
337+
- popen2.popen2
338+
- popen2.popen3
339+
- popen2.popen4
340+
- popen2.Popen3
341+
- popen2.Popen4
342+
- commands.getoutput
343+
- commands.getstatusoutput
344+
subprocess:
345+
- subprocess.Popen
346+
- subprocess.call
347+
- subprocess.check_call
348+
- subprocess.check_output
349+
- subprocess.run
350+
subprocess_without_shell_equals_true:
351+
no_shell:
352+
- os.execl
353+
- os.execle
354+
- os.execlp
355+
- os.execlpe
356+
- os.execv
357+
- os.execve
358+
- os.execvp
359+
- os.execvpe
360+
- os.spawnl
361+
- os.spawnle
362+
- os.spawnlp
363+
- os.spawnlpe
364+
- os.spawnv
365+
- os.spawnve
366+
- os.spawnvp
367+
- os.spawnvpe
368+
- os.startfile
369+
shell:
370+
- os.system
371+
- os.popen
372+
- os.popen2
373+
- os.popen3
374+
- os.popen4
375+
- popen2.popen2
376+
- popen2.popen3
377+
- popen2.popen4
378+
- popen2.Popen3
379+
- popen2.Popen4
380+
- commands.getoutput
381+
- commands.getstatusoutput
382+
subprocess:
383+
- subprocess.Popen
384+
- subprocess.call
385+
- subprocess.check_call
386+
- subprocess.check_output
387+
- subprocess.run
388+
try_except_continue:
389+
check_typed_exception: false
390+
try_except_pass:
391+
check_typed_exception: false
392+
weak_cryptographic_key:
393+
weak_key_size_dsa_high: 1024
394+
weak_key_size_dsa_medium: 2048
395+
weak_key_size_ec_high: 160
396+
weak_key_size_ec_medium: 224
397+
weak_key_size_rsa_high: 1024
398+
weak_key_size_rsa_medium: 2048

0 commit comments

Comments
 (0)