particle-os/debian-koji
1
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

basic security checks with bandit

Browse source 
Fixes: https://pagure.io/koji/issue/3042
This commit is contained in:
Tomas Kopecek 2021-09-22 11:46:45 +02:00
parent 0e2ebb4e25
commit ba2e1e520b
13 changed files with 42 additions and 29 deletions
Download patch file Download diff file Expand all files Collapse all files

6
util/koji-shadow
View file

@ -411,7 +411,7 @@ class TrackedBuild(object):
url = "%s/%s" % (pathinfo.build(self.info), pathinfo.rpm(self.srpm))
log("Downloading %s" % url)
# XXX - this is not really the right place for this
fsrc = urllib2.urlopen(url)
fsrc = urllib2.urlopen(url) # nosec
fn = "%s/%s.src.rpm" % (options.workpath, self.nvr)
koji.ensuredir(os.path.dirname(fn))
fdst = open(fn, 'wb')
@ -856,7 +856,7 @@ class BuildTracker(object):
koji.ensuredir(os.path.dirname(dst))
os.chown(os.path.dirname(dst), 48, 48) # XXX - hack
log("Downloading %s to %s" % (url, dst))
fsrc = urllib2.urlopen(url)
fsrc = urllib2.urlopen(url) # nosec
fdst = open(fn, 'wb')
shutil.copyfileobj(fsrc, fdst)
fsrc.close()
@ -870,7 +870,7 @@ class BuildTracker(object):
koji.ensuredir(options.workpath)
dst = "%s/%s" % (options.workpath, fn)
log("Downloading %s to %s..." % (url, dst))
fsrc = urllib2.urlopen(url)
fsrc = urllib2.urlopen(url) # nosec
fdst = open(dst, 'wb')
shutil.copyfileobj(fsrc, fdst)
fsrc.close()

2
util/kojira
View file

@ -486,7 +486,7 @@ class RepoManager(object):
self.logger.debug('Checking external url: %s' % arch_url)
try:
r = requests.get(arch_url, timeout=5)
root = ElementTree.fromstring(r.text)
root = ElementTree.fromstring(r.text) # nosec
ts_elements = root.iter('{http://linux.duke.edu/metadata/repo}timestamp')
arch_ts = max([round(float(child.text)) for child in ts_elements])
self.external_repo_ts[arch_url] = arch_ts