summaryrefslogtreecommitdiffstats
path: root/keystonemiddleware-moon/bandit.yaml
diff options
context:
space:
mode:
authorRuan HE <ruan.he@orange.com>2015-09-24 12:58:47 +0000
committerGerrit Code Review <gerrit@172.30.200.206>2015-09-24 12:58:47 +0000
commit49325d99acfadaadfad99c596c4ada6b5ec849de (patch)
tree8aa122c4edb6f9527651e6c3abf65f416c288c85 /keystonemiddleware-moon/bandit.yaml
parent17682330bc068a964bed3ec1c5d43677c09d6d4f (diff)
parent0be7a3d4e0647dc0d94a34e4fc2f8c364de46602 (diff)
Merge "Update code from KeystoneMiddleware Github repository (Master)."
Diffstat (limited to 'keystonemiddleware-moon/bandit.yaml')
-rw-r--r--keystonemiddleware-moon/bandit.yaml134
1 files changed, 134 insertions, 0 deletions
diff --git a/keystonemiddleware-moon/bandit.yaml b/keystonemiddleware-moon/bandit.yaml
new file mode 100644
index 00000000..d4e7dbca
--- /dev/null
+++ b/keystonemiddleware-moon/bandit.yaml
@@ -0,0 +1,134 @@
+# optional: after how many files to update progress
+#show_progress_every: 100
+
+# optional: plugins directory name
+#plugins_dir: 'plugins'
+
+# optional: plugins discovery name pattern
+plugin_name_pattern: '*.py'
+
+# optional: terminal escape sequences to display colors
+#output_colors:
+# DEFAULT: '\033[0m'
+# HEADER: '\033[95m'
+# INFO: '\033[94m'
+# WARN: '\033[93m'
+# ERROR: '\033[91m'
+
+# optional: log format string
+#log_format: "[%(module)s]\t%(levelname)s\t%(message)s"
+
+# globs of files which should be analyzed
+include:
+ - '*.py'
+ - '*.pyw'
+
+# a list of strings, which if found in the path will cause files to be excluded
+# for example /tests/ - to remove all all files in tests directory
+exclude_dirs:
+ - '/tests/'
+
+profiles:
+ keystone_conservative:
+ include:
+ - blacklist_functions
+ - blacklist_imports
+ - request_with_no_cert_validation
+ - exec_used
+ - set_bad_file_permissions
+ - subprocess_popen_with_shell_equals_true
+ - linux_commands_wildcard_injection
+ - ssl_with_bad_version
+
+
+ keystone_verbose:
+ include:
+ - blacklist_functions
+ - blacklist_imports
+ - request_with_no_cert_validation
+ - exec_used
+ - set_bad_file_permissions
+ - hardcoded_tmp_directory
+ - subprocess_popen_with_shell_equals_true
+ - any_other_function_with_shell_equals_true
+ - linux_commands_wildcard_injection
+ - ssl_with_bad_version
+ - ssl_with_bad_defaults
+
+blacklist_functions:
+ bad_name_sets:
+ - pickle:
+ qualnames: [pickle.loads, pickle.load, pickle.Unpickler,
+ cPickle.loads, cPickle.load, cPickle.Unpickler]
+ message: "Pickle library appears to be in use, possible security issue."
+ - marshal:
+ qualnames: [marshal.load, marshal.loads]
+ message: "Deserialization with the marshal module is possibly dangerous."
+ - md5:
+ qualnames: [hashlib.md5]
+ message: "Use of insecure MD5 hash function."
+ - mktemp_q:
+ qualnames: [tempfile.mktemp]
+ message: "Use of insecure and deprecated function (mktemp)."
+ - eval:
+ qualnames: [eval]
+ message: "Use of possibly insecure function - consider using safer ast.literal_eval."
+ - mark_safe:
+ names: [mark_safe]
+ message: "Use of mark_safe() may expose cross-site scripting vulnerabilities and should be reviewed."
+ - httpsconnection:
+ qualnames: [httplib.HTTPSConnection]
+ message: "Use of HTTPSConnection does not provide security, see https://wiki.openstack.org/wiki/OSSN/OSSN-0033"
+ - yaml_load:
+ qualnames: [yaml.load]
+ message: "Use of unsafe yaml load. Allows instantiation of arbitrary objects. Consider yaml.safe_load()."
+ - urllib_urlopen:
+ qualnames: [urllib.urlopen, urllib.urlretrieve, urllib.URLopener, urllib.FancyURLopener, urllib2.urlopen, urllib2.Request]
+ message: "Audit url open for permitted schemes. Allowing use of file:/ or custom schemes is often unexpected."
+
+shell_injection:
+ # Start a process using the subprocess module, or one of its wrappers.
+ subprocess: [subprocess.Popen, subprocess.call, subprocess.check_call,
+ subprocess.check_output, utils.execute, utils.execute_with_timeout]
+ # Start a process with a function vulnerable to shell injection.
+ shell: [os.system, os.popen, os.popen2, os.popen3, os.popen4,
+ popen2.popen2, popen2.popen3, popen2.popen4, popen2.Popen3,
+ popen2.Popen4, commands.getoutput, commands.getstatusoutput]
+ # Start a process with a function that is not vulnerable to shell injection.
+ no_shell: [os.execl, os.execle, os.execlp, os.execlpe, os.execv,os.execve,
+ os.execvp, os.execvpe, os.spawnl, os.spawnle, os.spawnlp,
+ os.spawnlpe, os.spawnv, os.spawnve, os.spawnvp, os.spawnvpe,
+ os.startfile]
+
+blacklist_imports:
+ bad_import_sets:
+ - telnet:
+ imports: [telnetlib]
+ level: ERROR
+ message: "Telnet is considered insecure. Use SSH or some other encrypted protocol."
+
+hardcoded_password:
+ word_list: "wordlist/default-passwords"
+
+ssl_with_bad_version:
+ bad_protocol_versions:
+ - 'PROTOCOL_SSLv2'
+ - 'SSLv2_METHOD'
+ - 'SSLv23_METHOD'
+ - 'PROTOCOL_SSLv3' # strict option
+ - 'PROTOCOL_TLSv1' # strict option
+ - 'SSLv3_METHOD' # strict option
+ - 'TLSv1_METHOD' # strict option
+
+password_config_option_not_marked_secret:
+ function_names:
+ - oslo.config.cfg.StrOpt
+ - oslo_config.cfg.StrOpt
+
+execute_with_run_as_root_equals_true:
+ function_names:
+ - ceilometer.utils.execute
+ - cinder.utils.execute
+ - neutron.agent.linux.utils.execute
+ - nova.utils.execute
+ - nova.utils.trycmd