| *** tmcpeak has joined #openstack-security | 00:02 | |
| *** voodookid has quit IRC | 00:02 | |
| *** windwhisked_ has joined #openstack-security | 00:02 | |
| *** windwhisked_ has quit IRC | 00:02 | |
| *** markvoelker has quit IRC | 00:11 | |
| *** Krisbelly has joined #openstack-security | 00:22 | |
| *** Krisbelly has left #openstack-security | 00:29 | |
| *** tmcpeak has quit IRC | 00:34 | |
| openstackgerrit | David Wyde proposed stackforge/bandit: Add tests for subprocesses and deserialization https://review.openstack.org/161967 | 00:51 |
|---|---|---|
| *** dwyde has quit IRC | 00:56 | |
| *** dave-mcc_ has joined #openstack-security | 01:11 | |
| *** dave-mccowan has quit IRC | 01:14 | |
| *** markvoelker has joined #openstack-security | 01:15 | |
| *** tmcpeak has joined #openstack-security | 01:20 | |
| *** markvoelker has quit IRC | 01:20 | |
| *** JAHoagie has quit IRC | 01:22 | |
| *** bdpayne has quit IRC | 01:33 | |
| *** dave-mcc_ has quit IRC | 01:45 | |
| *** tmcpeak has quit IRC | 01:51 | |
| *** dave-mcc_ has joined #openstack-security | 01:54 | |
| *** dave-m___ has joined #openstack-security | 01:54 | |
| *** bpokorny_ has quit IRC | 02:04 | |
| *** tmcpeak has joined #openstack-security | 02:08 | |
| *** markvoelker has joined #openstack-security | 02:17 | |
| *** markvoelker has quit IRC | 02:21 | |
| *** tmcpeak has quit IRC | 02:40 | |
| *** fletcher_ has quit IRC | 02:59 | |
| *** browne has quit IRC | 03:04 | |
| *** markvoelker has joined #openstack-security | 03:18 | |
| *** markvoelker has quit IRC | 03:22 | |
| *** browne has joined #openstack-security | 03:42 | |
| *** amrith is now known as _amrith_ | 04:04 | |
| *** _amrith_ is now known as amrith | 04:16 | |
| *** markvoelker has joined #openstack-security | 04:19 | |
| *** markvoelker has quit IRC | 04:25 | |
| *** dave-mcc_ has quit IRC | 05:09 | |
| *** dave-m___ has quit IRC | 05:09 | |
| *** markvoelker has joined #openstack-security | 05:21 | |
| *** markvoelker has quit IRC | 05:26 | |
| *** JAHoagie has joined #openstack-security | 05:38 | |
| openstackgerrit | OpenStack Proposal Bot proposed openstack/security-doc: Imported Translations from Transifex https://review.openstack.org/162024 | 06:01 |
| *** browne has quit IRC | 06:02 | |
| *** browne has joined #openstack-security | 06:02 | |
| openstackgerrit | Merged openstack/security-doc: Imported Translations from Transifex https://review.openstack.org/162024 | 06:18 |
| *** markvoelker has joined #openstack-security | 06:22 | |
| *** markvoelker has quit IRC | 06:27 | |
| *** jamielennox is now known as jamielennox|away | 07:16 | |
| *** markvoelker has joined #openstack-security | 07:24 | |
| *** markvoelker has quit IRC | 07:29 | |
| *** browne has quit IRC | 08:12 | |
| *** markvoelker has joined #openstack-security | 08:25 | |
| *** markvoelker has quit IRC | 08:31 | |
| *** hyakuhei has joined #openstack-security | 08:59 | |
| openstackgerrit | Tim Kelsey proposed stackforge/anchor: Adding functional testing https://review.openstack.org/161821 | 09:10 |
| *** markvoelker has joined #openstack-security | 09:27 | |
| *** markvoelker has quit IRC | 09:33 | |
| *** rkgudboy has joined #openstack-security | 09:55 | |
| *** hyakuhei has quit IRC | 10:03 | |
| *** hyakuhei has joined #openstack-security | 10:06 | |
| *** rohitkashyap has joined #openstack-security | 10:19 | |
| *** rkgudboy has quit IRC | 10:22 | |
| *** markvoelker has joined #openstack-security | 10:29 | |
| *** markvoelker has quit IRC | 10:35 | |
| *** hyakuhei has quit IRC | 10:42 | |
| *** rohitkashyap has quit IRC | 10:50 | |
| *** markvoelker has joined #openstack-security | 11:31 | |
| *** tmcpeak has joined #openstack-security | 11:32 | |
| *** markvoelker has quit IRC | 11:36 | |
| openstackgerrit | Tim Kelsey proposed stackforge/anchor: Adding functional testing https://review.openstack.org/161821 | 11:48 |
| *** markvoelker has joined #openstack-security | 12:32 | |
| *** markvoelker has quit IRC | 12:36 | |
| *** hyakuhei has joined #openstack-security | 12:41 | |
| *** markvoelker has joined #openstack-security | 13:06 | |
| *** amrith is now known as _amrith_ | 13:25 | |
| *** hyakuhei has quit IRC | 13:49 | |
| *** hyakuhei has joined #openstack-security | 14:06 | |
| *** salv-orl_ has joined #openstack-security | 14:09 | |
| *** salv-orlando has quit IRC | 14:09 | |
| *** hyakuhei has quit IRC | 14:20 | |
| *** hyakuhei has joined #openstack-security | 14:21 | |
| *** _amrith_ is now known as amrith | 14:23 | |
| *** dave-mccowan has joined #openstack-security | 14:32 | |
| *** hyakuhei has quit IRC | 15:24 | |
| *** sicarie has joined #openstack-security | 15:25 | |
| *** voodookid has joined #openstack-security | 15:32 | |
| *** hyakuhei has joined #openstack-security | 15:38 | |
| *** dwyde has joined #openstack-security | 15:43 | |
| *** JAHoagie has quit IRC | 15:43 | |
| *** hyakuhei has quit IRC | 16:02 | |
| *** bpokorny has joined #openstack-security | 16:05 | |
| *** fletcher has joined #openstack-security | 16:20 | |
| *** browne has joined #openstack-security | 16:30 | |
| *** hyakuhei has joined #openstack-security | 16:50 | |
| *** hyakuhei has quit IRC | 16:52 | |
| openstackgerrit | OpenStack Proposal Bot proposed openstack/security-doc: Updated from global requirements https://review.openstack.org/162225 | 16:54 |
| *** hyakuhei has joined #openstack-security | 16:57 | |
| tmcpeak | dwyde: you around? | 16:57 |
| dwyde | yep | 16:58 |
| tmcpeak | so for this change you have | 16:58 |
| tmcpeak | when you're moving os.exec with params l, le, etc out of blacklist calls | 16:59 |
| tmcpeak | it looks like you're replacing them with os.execl, os.execle etc | 16:59 |
| tmcpeak | are those the same? | 16:59 |
| tmcpeak | I'd assume that first case is a parameter 'l' to a function os.exec | 17:00 |
| tmcpeak | whereas in new case os.execl is a function called… os.execl | 17:00 |
| tmcpeak | what am I missing? :D | 17:00 |
| dwyde | none of the exec* blacklist_functions were found in the example | 17:01 |
| dwyde | maybe it’s looking for exec(‘l’)? | 17:01 |
| dwyde | i’m in the process of just putting everything back in the config file, including an explicit list of all the exec* and spawn* functions | 17:02 |
| tmcpeak | well actually where are those blacklist functions even checked? | 17:02 |
| tmcpeak | oh got it | 17:03 |
| tmcpeak | examples/os-exec.py | 17:03 |
| dwyde | os.exec(‘l’) is a syntax error, but os.spawn(‘l’) matches on master :-) | 17:03 |
| tmcpeak | syntax error? | 17:04 |
| dwyde | must have to do with the way Python parses for the exec statement | 17:04 |
| tmcpeak | wow | 17:05 |
| tmcpeak | you're right, syntax error | 17:05 |
| tmcpeak | sick | 17:05 |
| tmcpeak | ok cool, carry on :) | 17:06 |
| tmcpeak | this is obviously moderately broken at least | 17:06 |
| dwyde | cool | 17:07 |
| dwyde | i actually did just run into a problem | 17:07 |
| dwyde | which is that the bad_name_sets are a list | 17:08 |
| tmcpeak | which file? | 17:08 |
| tmcpeak | oh, bandit.yaml | 17:08 |
| dwyde | yep | 17:08 |
| dwyde | so it’s hard to find the one I want with @takes_config in a plugin | 17:08 |
| tmcpeak | yeah, shouldn't they be? | 17:08 |
| tmcpeak | if xxx in config: ? | 17:08 |
| dwyde | it could be a dict, keyed by the names like “pickle” | 17:09 |
| dwyde | right now it’s a list of dicts | 17:09 |
| tmcpeak | hmm | 17:10 |
| tmcpeak | yeah | 17:10 |
| tmcpeak | see what you mean | 17:10 |
| tmcpeak | original idea was just that we would iterate through, not try to find | 17:10 |
| tmcpeak | it's a pain in the ass to find the right dict in the list | 17:10 |
| tmcpeak | is that the general idea of what you're saying? :) | 17:10 |
| dwyde | yes :-) | 17:10 |
| tmcpeak | well, I think it's safe to say you're giving blacklist_functions the most love it's had in at least 6 months, so fix away | 17:11 |
| dwyde | haha | 17:11 |
| dwyde | okay, I’ll see what the reviewers say | 17:12 |
| tmcpeak | I'm really curious why that exec statement is a syntax error though | 17:13 |
| *** hyakuhei has quit IRC | 17:13 | |
| dwyde | it’s got to be in the grammar, since os.print(‘l’) is the same: SyntaxError | 17:14 |
| tmcpeak | is os.print a thing? | 17:18 |
| tmcpeak | yeah, it's just invalid python | 17:19 |
| dwyde | no, but you’d expect it to be an AttributeError | 17:19 |
| tmcpeak | just flat out no existe os.exec | 17:21 |
| tmcpeak | I'm not sure why those are listed as params in that blacklist check | 17:21 |
| tmcpeak | fletcher: around? | 17:26 |
| fletcher | hi | 17:26 |
| fletcher | reading | 17:26 |
| tmcpeak | hey, was it you that was really interested in getting docs into pinned version? | 17:26 |
| tmcpeak | not docs but better test explanations? | 17:26 |
| fletcher | Yah, i was interesting in having comprehensives docs/ to explain why we are flagging things | 17:27 |
| fletcher | I haven't made much progress though, so maybe now isn't the time | 17:27 |
| tmcpeak | cool, you get anywhere with that? | 17:27 |
| tmcpeak | yeah | 17:27 |
| fletcher | im thinking I'll just hijack a bunch of the OSSG stuff | 17:27 |
| tmcpeak | I'm itching to pull the trigger on the version pin :) | 17:27 |
| tmcpeak | +1 | 17:27 |
| tmcpeak | that's what it's there for | 17:27 |
| fletcher | I agree, i want to pip install so I can depend on behavior | 17:27 |
| tmcpeak | ok cool | 17:28 |
| fletcher | when we shooting for? | 17:28 |
| tmcpeak | I'll shoot a follow up version pin email today | 17:28 |
| tmcpeak | unless I hear any objections maybe Tuesday? | 17:28 |
| fletcher | So does that mean I have until EOD Monday to get a docs review out if I want them included in the pinned version? | 17:28 |
| tmcpeak | no, if you're planning to get a review out for that and you really want them in pinned version we'll wait :) | 17:29 |
| tmcpeak | I don't want to cut off before anybody's prized feature, but at the same time I'd like to get *some* reasonable version of bandit in PyPI | 17:30 |
| fletcher | No no, I don't want to hold off pinning based on this | 17:31 |
| fletcher | :) | 17:31 |
| tmcpeak | cool | 17:31 |
| fletcher | But if I can get some things done (merged over from OSSG) before the deadline, that'd be good, imo | 17:31 |
| *** browne has quit IRC | 17:34 | |
| tmcpeak | fletcher: ok, after decide to draw our line, I'm going to spend a half day or so testing the crap out of it | 17:34 |
| tmcpeak | making sure nothing seems broken | 17:34 |
| tmcpeak | then we'll push to PyPI | 17:34 |
| fletcher | that'd be awesome | 17:35 |
| fletcher | just trying abusing syntax and see what bandit blows up on | 17:35 |
| tmcpeak | yeah, and also run it on *all the code* | 17:35 |
| fletcher | If you end up running big batches of it, it would be interesting to wrap thte calls in a benchmark function | 17:36 |
| fletcher | so we can verify performance changes on pinned versions | 17:36 |
| fletcher | might be heavy haneded, idk | 17:36 |
| tmcpeak | yeah, good point | 17:37 |
| tmcpeak | although to be fair, performance is lower down on my list of things I care about for Bandit | 17:38 |
| tmcpeak | I'd rather have, for example, code readability than performance. Would definitely rather have accuracy, etc | 17:38 |
| fletcher | I agree; probably only a concern if we ever get to real DFD/taint analysis | 17:38 |
| *** hyakuhei has joined #openstack-security | 17:44 | |
| *** hyakuhei has quit IRC | 17:46 | |
| dwyde | huh, the qualname field in the config’s blacklist_functions gets parsed as a string with commas in it | 17:49 |
| dwyde | then the plugin splits on comma | 17:50 |
| dwyde | because YAML needs square brackets to be a list | 17:50 |
| *** sicarie has quit IRC | 18:03 | |
| *** browne has joined #openstack-security | 18:07 | |
| *** dwyde has quit IRC | 18:11 | |
| *** bdpayne has joined #openstack-security | 18:13 | |
| *** salv-orl_ has quit IRC | 18:28 | |
| *** voodookid has quit IRC | 18:32 | |
| *** hyakuhei has joined #openstack-security | 18:36 | |
| *** markvoelker has quit IRC | 18:39 | |
| *** markvoelker has joined #openstack-security | 18:40 | |
| *** hyakuhei has quit IRC | 18:41 | |
| *** markvoelker has quit IRC | 18:44 | |
| openstackgerrit | Merged openstack/security-doc: Updated from global requirements https://review.openstack.org/162225 | 18:53 |
| tmcpeak | dwyde: any idea what the timeframe would be for your changes? | 18:54 |
| tmcpeak | dwyde: yeah, I initially intended for it to be a comma separated string, I guess list would have been a better choice | 18:58 |
| tmcpeak | really I intended for each blacklist function to be one, then the need presented itself for more than one in some cases but not most, hence the string with comma separators if necessary | 18:59 |
| *** bpokorny_ has joined #openstack-security | 19:01 | |
| *** markvoelker has joined #openstack-security | 19:03 | |
| *** bpokorny has quit IRC | 19:04 | |
| *** bpokorny has joined #openstack-security | 19:35 | |
| *** dwyde has joined #openstack-security | 19:37 | |
| *** bpokorny_ has quit IRC | 19:38 | |
| dwyde | tmcpeak: I can have a change request of just adding entries blacklist_functions today | 19:43 |
| dwyde | the deeper changes (plugins) would probably be Monday or Tuesday | 19:43 |
| *** salv-orlando has joined #openstack-security | 19:52 | |
| *** _et has joined #openstack-security | 19:58 | |
| *** bpokorny_ has joined #openstack-security | 20:00 | |
| *** bpokorn__ has joined #openstack-security | 20:01 | |
| *** bpokorny has quit IRC | 20:03 | |
| *** amrith is now known as _amrith_ | 20:04 | |
| *** dwyde has left #openstack-security | 20:04 | |
| *** dwyde has joined #openstack-security | 20:05 | |
| *** bpokorny_ has quit IRC | 20:05 | |
| *** salv-orlando has quit IRC | 20:11 | |
| tmcpeak | dwyde: sounds good | 20:15 |
| *** sicarie has joined #openstack-security | 20:24 | |
| openstackgerrit | David Wyde proposed stackforge/bandit: Add tests for subprocesses and deserialization https://review.openstack.org/161967 | 20:49 |
| *** dwyde has quit IRC | 21:03 | |
| *** dwyde has joined #openstack-security | 21:18 | |
| *** salv-orlando has joined #openstack-security | 21:36 | |
| *** sicarie has quit IRC | 21:59 | |
| *** AlejandroOMG has joined #openstack-security | 22:03 | |
| *** AlejandroOMG has quit IRC | 22:04 | |
| *** bpokorny has joined #openstack-security | 22:21 | |
| *** bpokorn__ has quit IRC | 22:25 | |
| *** dave-mccowan has quit IRC | 22:28 | |
| *** hyakuhei has joined #openstack-security | 22:48 | |
| *** salv-orlando has quit IRC | 22:53 | |
| *** hyakuhei has quit IRC | 22:54 | |
| *** dave-mccowan has joined #openstack-security | 23:38 | |
| openstackgerrit | David Wyde proposed stackforge/bandit: Add tests for subprocesses and deserialization https://review.openstack.org/161967 | 23:46 |
| *** dwyde has left #openstack-security | 23:49 | |
Generated by irclog2html.py 2.14.0 by Marius Gedminas - find it at mg.pov.lt!