Docs: B605 Severity Inaccurate

Bug #1742493 reported by Gage Hugo
6
This bug affects 1 person
Affects Status Importance Assigned to Milestone
Bandit
Fix Released
Undecided
Unassigned

Bug Description

According to the docs for B605[0], this should report back with a MEDIUM severity if this condition is met. However the code[1] has this condition returning a LOW severity. It appears that in a previous patch[2] that a case for special characters was removed, and the docs[3] were never updated to match.

[0] https://docs.openstack.org/bandit/latest/plugins/start_process_with_a_shell.html
[1] https://github.com/openstack/bandit/blob/master/bandit/plugins/injection_shell.py#L31
[2] https://github.com/openstack/bandit/commit/8f74c51935058cacd77ee2a2a40dc6e6efbde4a2#diff-5abc40c6b98a9c677ed95d1ffec0ad66L41
[3] https://docs.openstack.org/bandit/latest/plugins/start_process_with_a_shell.html

Tags: bandit
Gage Hugo (gagehugo)
summary: - B605 Severity Inaccurate
+ Docs: B605 Severity Inaccurate
description: updated
Revision history for this message
OpenStack Infra (hudson-openstack) wrote : Fix merged to bandit (master)

Reviewed: https://review.openstack.org/532942
Committed: https://git.openstack.org/cgit/openstack/bandit/commit/?id=32c27bdcdf220ff24c4c29fa000ef0dffdc47d59
Submitter: Zuul
Branch: master

commit 32c27bdcdf220ff24c4c29fa000ef0dffdc47d59
Author: Tin Lam <email address hidden>
Date: Thu Jan 11 12:43:27 2018 -0600

    Update documentation

    In patch [0], B605 no longer will return a MEDIUM severity, instead
    it will return a LOW severity. However, the documentation was never
    updated to match the change [1]. This patch set updates the
    documentation to match the update.

    [0] https://github.com/openstack/bandit/commit/8f74c51935058cacd77ee2a2a40dc6e6efbde4a2#diff-5abc40c6b98a9c677ed95d1ffec0ad66L41
    [1] https://docs.openstack.org/bandit/latest/plugins/start_process_with_a_shell.html

    Closes-Bug: #1742493

    Change-Id: I201c259313aef09b3d68cca54380dc47033a5b26
    Signed-off-by: Tin Lam <email address hidden>

Changed in bandit:
status: New → Fix Released
To post a comment you must log in.
This report contains Public information  
Everyone can see this information.

Other bug subscribers

Remote bug watches

Bug watches keep track of this bug in other bug trackers.