False positive: random.SystemRandom()

[Gabriel Hurley]

Using random.SystemRandom() is actually a good and valid use. Bandit flags this (lowest severity) but it should in fact be ignored.

Simply importing random probably shouldn't be flagged at all (a linter will catch it if it's unused), and the test should check what functions and/or classes are being used from the random module.

[Travis McPeak (travis-mcpeak)]

Yeah, this test is very noisy. I think in the short term a viable solution is to use profiles which don't include this test.

[Travis McPeak (travis-mcpeak)]

Actually, more to your point - random.SystemRandom() is fine. That's a false positive every time.

[Tim Kelsey (tim-kelsey)]

for some reason the review isn't getting tagged in this bug, its here: https://review.openstack.org/#/c/202058/

[OpenStack Infra (hudson-openstack)]

Reviewed: https://review.openstack.org/202058
Committed: https://git.openstack.org/cgit/openstack/bandit/commit/?id=782ca732716c49f018aacbc7cdc14cbfd10c402b
Submitter: Jenkins
Branch: master

commit 782ca732716c49f018aacbc7cdc14cbfd10c402b
Author: Tim Kelsey <email address hidden>
Date: Wed Jul 15 12:42:18 2015 +0100

    Fixing up random to be less noisy

    This just targets specific functions within random, rather than
    the module itself. We use the blacklist calls stuff for this so
    there is now no need for a special plugin.

    Change-Id: Iecb4cd3d23040f2c4139f468109ddfbb209bbfa4
    Closes-Bug: 1422897

[Eric Brown (ericwb)]

Fix released in 0.13.0