| 2017-06-30 18:19:19 |
Zhen Qin |
description |
In the report generated by Bandit that scans against Nova code, there are two security issues estimated as high severity as shown below. We believe that these two issues are false positives. Therefore, the line of Nova codes that trigger such Bandit issues should be marked with something like # nosec so that any results associated with it will not be reported by Bandit.
--------------------------------------------------
>> Issue: [B701:jinja2_autoescape_false] By default, jinja2 sets autoescape to False. Consider using autoescape=True to mitigate XSS vulnerabilities.
Severity: High Confidence: High
Location: nova/console/xvp.py:113
112 tmpl_path, tmpl_file = os.path.split(CONF.injected_network_template)
113 env = jinja2.Environment(loader=jinja2.FileSystemLoader(tmpl_path))
114 env.filters['pass_encode'] = self.fix_console_password
--------------------------------------------------
>> Issue: [B701:jinja2_autoescape_false] By default, jinja2 sets autoescape to False. Consider using autoescape=True to mitigate XSS vulnerabilities.
Severity: High Confidence: High
Location: nova/virt/netutils.py:174
173 tmpl_path, tmpl_file = os.path.split(template)
174 env = jinja2.Environment(loader=jinja2.FileSystemLoader(tmpl_path),
175 trim_blocks=True)
176 template = env.get_template(tmpl_file)
The reasons that we think the above issue is false positive are:
"When autoescaping is enabled, Jinja2 will filter input strings to escape any HTML content submitted via template variables. Without escaping HTML input the application becomes vulnerable to Cross Site Scripting (XSS) attacks."[1] However, the "injected_network_template" configured in nova.conf is a template with text format with different rules, and intended to be executable. An example template is https://github.com/openstack/nova/blob/stable/ocata/nova/virt/interfaces.template
This bug exists in multiple releases of Nova, including master branch, Ocata, Newton etc.
References:
[1] https://docs.openstack.org/developer/bandit/plugins/jinja2_autoescape_false.html |
In the report generated by Bandit that scans against Nova code, there are two security issues estimated as high severity as shown below. We believe that these two issues are false positives. Therefore, the line of Nova codes that trigger such Bandit issues should be marked with something like # nosec so that any results associated with it will not be reported by Bandit.
--------------------------------------------------
>> Issue: [B701:jinja2_autoescape_false] By default, jinja2 sets autoescape to False. Consider using autoescape=True to mitigate XSS vulnerabilities.
Severity: High Confidence: High
Location: nova/console/xvp.py:113
112 tmpl_path, tmpl_file = os.path.split(CONF.injected_network_template)
113 env = jinja2.Environment(loader=jinja2.FileSystemLoader(tmpl_path))
114 env.filters['pass_encode'] = self.fix_console_password
--------------------------------------------------
>> Issue: [B701:jinja2_autoescape_false] By default, jinja2 sets autoescape to False. Consider using autoescape=True to mitigate XSS vulnerabilities.
Severity: High Confidence: High
Location: nova/virt/netutils.py:174
173 tmpl_path, tmpl_file = os.path.split(template)
174 env = jinja2.Environment(loader=jinja2.FileSystemLoader(tmpl_path),
175 trim_blocks=True)
176 template = env.get_template(tmpl_file)
The reasons that we think the above issue is false positive are:
"When autoescaping is enabled, Jinja2 will filter input strings to escape any HTML content submitted via template variables. Without escaping HTML input the application becomes vulnerable to Cross Site Scripting (XSS) attacks."[1] However, the "injected_network_template" configured in nova.conf is a template with text format with different rules, and is not intended to be executable. An example template is https://github.com/openstack/nova/blob/stable/ocata/nova/virt/interfaces.template
This bug exists in multiple releases of Nova, including master branch, Ocata, Newton etc.
References:
[1] https://docs.openstack.org/developer/bandit/plugins/jinja2_autoescape_false.html |
|
