| *** dave-mccowan has joined #openstack-security | 00:15 | |
| *** markvoelker has joined #openstack-security | 00:16 | |
| *** markvoelker has quit IRC | 00:20 | |
| *** tmcpeak has joined #openstack-security | 00:49 | |
| *** markvoelker has joined #openstack-security | 00:50 | |
| *** tmcpeak has quit IRC | 00:53 | |
| *** markvoelker has quit IRC | 00:55 | |
| *** salv-orlando has quit IRC | 01:22 | |
| *** tmcpeak has joined #openstack-security | 01:32 | |
| *** markvoelker has joined #openstack-security | 01:51 | |
| *** markvoelker has quit IRC | 01:57 | |
| *** markvoelker has joined #openstack-security | 02:00 | |
| *** tmcpeak has quit IRC | 02:13 | |
| *** markvoelker has quit IRC | 02:26 | |
| *** markvoelker has joined #openstack-security | 02:27 | |
| *** markvoelker has quit IRC | 02:31 | |
| *** amrith is now known as _amrith_ | 03:01 | |
| *** bpokorny has quit IRC | 04:01 | |
| *** _amrith_ is now known as amrith | 04:04 | |
| *** dave-mccowan has quit IRC | 05:17 | |
| *** pcaruana has quit IRC | 05:45 | |
| *** lionelz has joined #openstack-security | 09:24 | |
| *** salv-orlando has joined #openstack-security | 09:33 | |
| *** salv-orlando has quit IRC | 10:04 | |
| *** salv-orlando has joined #openstack-security | 10:14 | |
| *** lionelz has quit IRC | 10:21 | |
| *** salv-orlando has quit IRC | 11:19 | |
| *** salv-orlando has joined #openstack-security | 11:25 | |
| *** salv-orlando has quit IRC | 11:29 | |
| *** salv-orl_ has joined #openstack-security | 11:29 | |
| *** salv-orl_ has quit IRC | 12:38 | |
| *** salv-orlando has joined #openstack-security | 12:39 | |
| *** salv-orlando has quit IRC | 12:42 | |
| *** salv-orlando has joined #openstack-security | 12:43 | |
| *** salv-orlando has quit IRC | 13:04 | |
| *** salv-orlando has joined #openstack-security | 13:23 | |
| *** salv-orlando has quit IRC | 13:28 | |
| *** salv-orlando has joined #openstack-security | 13:33 | |
| *** amrith is now known as _amrith_ | 13:40 | |
| *** salv-orlando has quit IRC | 13:41 | |
| *** bknudson has quit IRC | 13:41 | |
| *** lorenz_esz has joined #openstack-security | 13:41 | |
| *** lorenz_esz has left #openstack-security | 13:43 | |
| *** salv-orlando has joined #openstack-security | 13:46 | |
| *** salv-orlando has quit IRC | 13:53 | |
| *** ljfisher has joined #openstack-security | 13:55 | |
| *** bknudson has joined #openstack-security | 14:05 | |
| *** Guest28285 is now known as mgagne | 14:13 | |
| *** mgagne has joined #openstack-security | 14:13 | |
| *** nkinder has quit IRC | 14:26 | |
| *** singlethink has joined #openstack-security | 14:35 | |
| *** dave-mccowan has joined #openstack-security | 14:54 | |
| *** tmcpeak has joined #openstack-security | 14:59 | |
| *** _amrith_ is now known as amrith | 15:02 | |
| *** JAHoagie has joined #openstack-security | 15:14 | |
| *** Guest-Pirc has joined #openstack-security | 15:16 | |
| *** nkinder has joined #openstack-security | 15:17 | |
| *** Guest-Pirc has quit IRC | 15:18 | |
| *** JAHoagie has quit IRC | 15:18 | |
| *** voodookid has joined #openstack-security | 15:39 | |
| *** amrith is now known as _amrith_ | 15:39 | |
| *** voodookid has quit IRC | 15:43 | |
| *** _amrith_ is now known as amrith | 15:54 | |
| *** bpokorny has joined #openstack-security | 15:54 | |
| *** voodookid has joined #openstack-security | 16:00 | |
| *** tmcpeak has quit IRC | 16:06 | |
| *** tmcpeak has joined #openstack-security | 16:16 | |
| *** tmcpeak has quit IRC | 16:19 | |
| openstackgerrit | Shellee Arnold proposed openstack/security-doc: Sentence revision https://review.openstack.org/158354 | 16:45 |
|---|---|---|
| *** tmcpeak has joined #openstack-security | 16:49 | |
| openstackgerrit | Merged stackforge/bandit: Adds jinja2 autocomplete=false test https://review.openstack.org/158006 | 17:20 |
| *** tkelsey has joined #openstack-security | 17:20 | |
| openstackgerrit | Shellee Arnold proposed openstack/security-doc: Sentence revision https://review.openstack.org/158354 | 17:34 |
| openstackgerrit | Shellee Arnold proposed openstack/security-doc: Sentence revision https://review.openstack.org/158354 | 17:44 |
| *** salv-orlando has joined #openstack-security | 17:46 | |
| *** optik_ has joined #openstack-security | 17:50 | |
| *** optik_ has quit IRC | 17:50 | |
| *** pdesai has joined #openstack-security | 17:56 | |
| *** tkelsey has quit IRC | 18:41 | |
| *** pdesai1 has joined #openstack-security | 18:49 | |
| *** pdesai has quit IRC | 18:52 | |
| *** pdesai has joined #openstack-security | 18:59 | |
| *** pdesai1 has quit IRC | 19:03 | |
| *** raok has joined #openstack-security | 19:05 | |
| *** raok has left #openstack-security | 19:06 | |
| openstackgerrit | Travis McPeak proposed stackforge/bandit: Adding file discovery and directory exclusion https://review.openstack.org/158405 | 19:09 |
| *** tmcpeak has quit IRC | 19:12 | |
| *** tmcpeak has joined #openstack-security | 19:15 | |
| openstackgerrit | Travis McPeak proposed stackforge/bandit: Adding file discovery and directory exclusion https://review.openstack.org/158405 | 19:21 |
| tmcpeak | ljfisher chair6 bknudson: come and get it ^ | 19:23 |
| *** tmcpeak has quit IRC | 19:26 | |
| *** dave-mccowan has quit IRC | 19:30 | |
| *** tmcpeak has joined #openstack-security | 19:32 | |
| openstackgerrit | Priti Desai proposed openstack/security-doc: Enhancement - Additional ways to configure SSL https://review.openstack.org/157550 | 19:33 |
| *** salv-orlando has quit IRC | 19:40 | |
| *** amrith is now known as _amrith_ | 19:49 | |
| *** openstackgerrit has quit IRC | 19:51 | |
| *** openstackgerrit has joined #openstack-security | 19:52 | |
| *** bdpayne has joined #openstack-security | 19:56 | |
| *** dave-mccowan has joined #openstack-security | 19:58 | |
| *** bpokorny_ has joined #openstack-security | 20:00 | |
| *** tmcpeak has quit IRC | 20:01 | |
| *** pdesai1 has joined #openstack-security | 20:01 | |
| *** tmcpeak has joined #openstack-security | 20:01 | |
| *** bpokorny has quit IRC | 20:02 | |
| *** pdesai has quit IRC | 20:03 | |
| *** tkelsey has joined #openstack-security | 20:05 | |
| *** markvoelker has joined #openstack-security | 20:07 | |
| *** tmcpeak has quit IRC | 20:15 | |
| *** singlethink has quit IRC | 20:26 | |
| *** singlethink has joined #openstack-security | 20:33 | |
| openstackgerrit | Merged openstack/security-doc: Fixed grammatical error https://review.openstack.org/158081 | 20:36 |
| *** salv-orlando has joined #openstack-security | 20:41 | |
| *** markvoelker has quit IRC | 20:51 | |
| *** tkelsey has quit IRC | 21:00 | |
| *** browne has joined #openstack-security | 21:01 | |
| *** bknudson has quit IRC | 21:05 | |
| *** salv-orlando has quit IRC | 21:12 | |
| *** markvoelker has joined #openstack-security | 21:15 | |
| *** markvoelker has quit IRC | 21:15 | |
| *** markvoelker has joined #openstack-security | 21:16 | |
| *** salv-orlando has joined #openstack-security | 21:17 | |
| *** pdesai1 has quit IRC | 21:22 | |
| *** _amrith_ is now known as amrith | 21:26 | |
| *** pdesai has joined #openstack-security | 21:31 | |
| *** tmcpeak has joined #openstack-security | 21:35 | |
| dave-mccowan | I have a bandit question. I opened bug https://bugs.launchpad.net/bandit/+bug/1422907 because bandit is reporting sql injection possibilities in strings that are docstrings. | 21:40 |
| openstack | Launchpad bug 1422907 in Bandit "False Positive: SqlInjection warnings found in docstrings" [Undecided,New] | 21:40 |
| dave-mccowan | i'm willing to submit a patch for this bug. looking at the code now, it does not look like there is enough info in the node to determine if a string is a docstring. (the code needs to know the parent of the current node). are there any plans to add this sort of AST Meta Data to Bandit processing? | 21:42 |
| *** fletcher has joined #openstack-security | 21:45 | |
| fletcher | When is the weekly openstack security meeting? I want to add it to my calendar | 21:45 |
| tmcpeak | fletcher: Thurs at 9am PST | 21:50 |
| tmcpeak | dave-mccowan: yeah, better docstring handling is definitely on our radar, but it isn't a simple change (as you mentioned). I've seen the same problem with our hardcoded password test The same issue you mentioned has made that test useless and we currently have it disabled | 21:52 |
| tmcpeak | dave-mccowan: how would you patch it? | 21:52 |
| fletcher | tmcpeak: boom, thanks! | 21:53 |
| tmcpeak | dave-mccowan: in regards to your question about adding parent-node awareness, yeah.. that's pretty much next on our list | 21:53 |
| tmcpeak | fletcher: cool, see you there | 21:53 |
| dave-mccowan | tmcpeak astmonkey has an is_docstring() method. it uses info from the parent node to make the determination. | 21:55 |
| tmcpeak | dave-mccowan: oh interesting, so in that case we could actually use that to add a is_docstring attribute to context of each string node. A good place to do that would be in string node visitor | 21:57 |
| tmcpeak | that would be a great enhancement | 21:57 |
| tmcpeak | I'd love to revive the hardcoded password test… | 21:58 |
| dave-mccowan | tmcpeak I agree. what is the plan for adding parent node awareness? using a library (like astmonkey) or roll our own? | 21:59 |
| tmcpeak | dave-mccowan: I think we'll shy away from third party libraries - mostly because we have to be careful not to introduce additional dependancies in upstream projects which use Bandit | 22:01 |
| tmcpeak | dave-mccowan: I think some of the folks were working on this at mid-cycle, I don't know how far they got | 22:01 |
| *** pdesai has quit IRC | 22:02 | |
| tmcpeak | chair6, fletcher, ljfisher: ? | 22:02 |
| tmcpeak | ^ | 22:02 |
| ljfisher | just posted my comments | 22:02 |
| *** bpokorny has joined #openstack-security | 22:02 | |
| *** bpokorny_ has quit IRC | 22:05 | |
| *** tkelsey has joined #openstack-security | 22:06 | |
| ljfisher | We had discussed a different way of getting additional context in that we could provide the node of the statement and the node of the function. You coudl traverse down from there. | 22:06 |
| ljfisher | But astmonkey looks like it is monkey patching the nodes to add parent links which would be nice. I haven’t been around long enough to understand how much a problem another dependency would be. It woudl sure save us time. | 22:10 |
| dave-mccowan | for identifying docstrings, i think the function's node and the and string's node would be sufficient. is that enhancement in progress? | 22:11 |
| ljfisher | not sure, ukbelch was looking at it | 22:13 |
| *** pdesai has joined #openstack-security | 22:15 | |
| openstackgerrit | Travis McPeak proposed stackforge/bandit: Adding file discovery and directory exclusion https://review.openstack.org/158405 | 22:22 |
| *** bpokorny_ has joined #openstack-security | 22:23 | |
| *** tmcpeak has quit IRC | 22:26 | |
| *** bpokorny has quit IRC | 22:26 | |
| *** tmcpeak has joined #openstack-security | 22:27 | |
| tmcpeak | dave-mccowan ljfisher: another dependency which isn't in Openstack global requirements already is not possible for us | 22:29 |
| tmcpeak | astmonkey is not in there | 22:29 |
| tmcpeak | so we'll have to do something that doesn't rely on that | 22:29 |
| ljfisher | or just end up reimplementing it | 22:29 |
| tmcpeak | yeah, that's probably what we'll have to do | 22:29 |
| tmcpeak | ljfisher: re-submitted that change with your feedback | 22:30 |
| ljfisher | coo | 22:30 |
| ljfisher | cool | 22:30 |
| tmcpeak | I want to get it merged before fletcher does more work and forces me to rebase in a significant way | 22:30 |
| ljfisher | are you going to write tests separately then? | 22:31 |
| *** pdesai has quit IRC | 22:32 | |
| tmcpeak | ljfisher: which tests? | 22:34 |
| tmcpeak | functional tests? | 22:34 |
| tmcpeak | ljfisher: like unit tests I mean? | 22:35 |
| tmcpeak | in the past we haven't really done them, I noticed you have with your recent one, but I've just done testing by hand | 22:35 |
| tmcpeak | we should do something more sustainable long term | 22:35 |
| ljfisher | yeah, I think fletcher had suggested to be sure exclude was working ?? | 22:35 |
| tmcpeak | yeah I have tested myself by hand, but haven't added unit tests | 22:36 |
| tmcpeak | I guess I'd see overall code coverage as a future enhancement | 22:36 |
| tmcpeak | there are tons of things we don't have coverage for already though | 22:37 |
| tmcpeak | I'd really have to spin up a bandit instance and a dummy directory with dummy tests in it | 22:38 |
| fletcher | I've got line range fix almost done, once I'm finished with that. I plan on hitting tests hard | 22:38 |
| fletcher | tmcpeak, ljfisher ^ | 22:38 |
| tmcpeak | fletcher: awesome, that would be great | 22:38 |
| tmcpeak | I'll pitch in on that too | 22:38 |
| tmcpeak | pain in the ass to test by hand all the time | 22:38 |
| fletcher | I think first step is getting one small test that uses subprocess.Popen() to call bandit from CLI and then check things | 22:39 |
| fletcher | so we can all agree on approach | 22:39 |
| fletcher | then start cranking them out | 22:39 |
| fletcher | yah, i'm in the same boat | 22:39 |
| fletcher | tmcpeak: nice catch on report_json, I'll need to add in the ignore functionality | 22:39 |
| tmcpeak | fletcher: yeah, that sounds good. We can have a few test config files to use in testing too | 22:40 |
| tmcpeak | fletcher: you mean skipped and excluded tests? I thought you just intentionally didn't include it | 22:40 |
| tmcpeak | if the goal is to have everything in json that is available on command line, we should include it. If the goal is to compare two test runs results, we can probably get by without it | 22:40 |
| fletcher | Cool, so being completely honest, it wasn't intentional | 22:42 |
| fletcher | if we want to leave it the way it is, i'm fine with that | 22:42 |
| fletcher | but it does seem a bit inconsistent | 22:42 |
| fletcher | what does everyone think? | 22:42 |
| tmcpeak | fletcher: yeah, I think we should probably add it | 22:43 |
| tmcpeak | fletcher: care to do it in a separate change? :) | 22:44 |
| tmcpeak | I'm very keen to get this current change merged | 22:44 |
| tmcpeak | once we do that I'm going to try to add a tag for Bandit 0.9.1 and then push to PyPI and then add Bandit in global requirements with a pinned version, and then get it in Keystone's gate | 22:45 |
| *** pdesai has joined #openstack-security | 22:46 | |
| fletcher | yep, I can add that, nbd | 22:46 |
| tmcpeak | fletcher: cool | 22:46 |
| *** tkelsey has quit IRC | 22:46 | |
| *** pdesai has quit IRC | 22:47 | |
| fletcher | So this is what i'm working on, and I'd love to get it in before the 0.9.1 freeze: line range fix, json add ability to ignore ranges based on type (e.g. -lll flag), adjust Jinja2 test to flag if autocomplete isn't directly set to true (since default is False), tests tests tests | 22:47 |
| fletcher | tmcpeak ^ | 22:47 |
| tmcpeak | fletcher: ok cool, we'll release after those are complete | 22:48 |
| fletcher | I'll be pushing things out as I go, but expect to be done by Weds | 22:48 |
| fletcher | swaheet, thanks | 22:48 |
| tmcpeak | I think those are great changes and we should have them in the pinned release | 22:48 |
| tmcpeak | fletcher: thanks for all the work | 22:48 |
| tmcpeak | you're making some awesome progress on Bandit | 22:49 |
| fletcher | oh yah, no sweat. It's been fun :) | 22:49 |
| *** tkelsey has joined #openstack-security | 22:50 | |
| *** tkelsey has quit IRC | 22:58 | |
| *** tmcpeak has quit IRC | 22:59 | |
| *** pdesai has joined #openstack-security | 23:00 | |
| *** tmcpeak has joined #openstack-security | 23:02 | |
| ljfisher | tmcpeak fletcher Should json include the skipped and excluded files? It seems if they are important enough to show in txt output the info would be valuable in json too? | 23:09 |
| tmcpeak | ljfisher: yeah, we decided that fletcher will add them in another change | 23:10 |
| ljfisher | ok | 23:11 |
| fletcher | Uh oh, ok, I think I misunderstood | 23:13 |
| tmcpeak | fletcher: ? | 23:13 |
| fletcher | I don't mind to add either functionality, but I was thinking of enabling the -lll functionality for report_json() since its not in there right now | 23:13 |
| fletcher | once tmcpeak's code lands, I can also add that functionality into report_json if desired | 23:14 |
| tmcpeak | yeah, that's fine - ljfisher is just saying to include the excluded and skipped files in json reporting | 23:14 |
| tmcpeak | what we said earlier - it is inconsistent with what other reporting does | 23:14 |
| tmcpeak | I didn't add excluded since you weren't already reporting "skipped" and they are pretty much the same | 23:14 |
| fletcher | Cool deal, I'll sync up with you when I start working on that just to ensure I'm not crossing my wires | 23:15 |
| tmcpeak | fletcher: ok cool, it should be a pretty simple change | 23:17 |
| tmcpeak | just a matter of deciding what section we want to put them in | 23:17 |
| ljfisher | tmcpeak more review posted, feel free to tell if you think I’m being too anal. I want to get the semantic right so we don’t have to change it later. | 23:21 |
| tmcpeak | ljfisher: cool, yeah looks like good points. Thanks for quick review | 23:21 |
| tmcpeak | let me check it out | 23:22 |
| ljfisher | got other stuff so won’t be able to look again til tomorrow | 23:22 |
| tmcpeak | ljfisher: so about the excluded paths, excluded dirs thing | 23:25 |
| tmcpeak | got a sec to answer a q about that? | 23:25 |
| tmcpeak | I'm not sure exactly what you mean | 23:25 |
| openstackgerrit | Travis McPeak proposed stackforge/bandit: Adding file discovery and directory exclusion https://review.openstack.org/158405 | 23:45 |
| *** salv-orlando has quit IRC | 23:45 | |
| *** singlethink has quit IRC | 23:50 | |
| openstackgerrit | Tim Kelsey proposed stackforge/anchor: Adding more X509 name tests, now at 100% coverage https://review.openstack.org/158494 | 23:54 |
| openstackgerrit | Travis McPeak proposed stackforge/bandit: Adding file discovery and directory exclusion https://review.openstack.org/158405 | 23:54 |
| *** pdesai has quit IRC | 23:58 | |
Generated by irclog2html.py 2.14.0 by Marius Gedminas - find it at mg.pov.lt!