{"action":"created","issue":{"url":"https://api.github.com/repos/mesonbuild/meson/issues/3866","repository_url":"https://api.github.com/repos/mesonbuild/meson","labels_url":"https://api.github.com/repos/mesonbuild/meson/issues/3866/labels{/name}","comments_url":"https://api.github.com/repos/mesonbuild/meson/issues/3866/comments","events_url":"https://api.github.com/repos/mesonbuild/meson/issues/3866/events","html_url":"https://github.com/mesonbuild/meson/issues/3866","id":339917208,"node_id":"MDU6SXNzdWUzMzk5MTcyMDg=","number":3866,"title":"Do Bandit scans for security","user":{"login":"rossburton","id":32394,"node_id":"MDQ6VXNlcjMyMzk0","avatar_url":"https://avatars3.githubusercontent.com/u/32394?v=4","gravatar_id":"","url":"https://api.github.com/users/rossburton","html_url":"https://github.com/rossburton","followers_url":"https://api.github.com/users/rossburton/followers","following_url":"https://api.github.com/users/rossburton/following{/other_user}","gists_url":"https://api.github.com/users/rossburton/gists{/gist_id}","starred_url":"https://api.github.com/users/rossburton/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/rossburton/subscriptions","organizations_url":"https://api.github.com/users/rossburton/orgs","repos_url":"https://api.github.com/users/rossburton/repos","events_url":"https://api.github.com/users/rossburton/events{/privacy}","received_events_url":"https://api.github.com/users/rossburton/received_events","type":"User","site_admin":false},"labels":[{"id":870588531,"node_id":"MDU6TGFiZWw4NzA1ODg1MzE=","url":"https://api.github.com/repos/mesonbuild/meson/labels/CI","name":"CI","color":"5319e7","default":false},{"id":99546087,"node_id":"MDU6TGFiZWw5OTU0NjA4Nw==","url":"https://api.github.com/repos/mesonbuild/meson/labels/enhancement","name":"enhancement","color":"84b6eb","default":true}],"state":"open","locked":false,"assignee":null,"assignees":[],"milestone":null,"comments":3,"created_at":"2018-07-10T16:26:22Z","updated_at":"2018-07-15T10:16:47Z","closed_at":null,"author_association":"CONTRIBUTOR","body":"Bandit (https://github.com/PyCQA/bandit) is a security scanner for Python.  Maybe Meson should run the code though bandit in the CI system?\r\n\r\nAn example of the scan report:\r\n\r\n```\r\n| Test results:\r\n| >> Issue: [B307:blacklist] Use of possibly insecure function - consider using safer ast.literal_eval.\r\n|    Severity: Medium   Confidence: High\r\n|    Location: /data/poky-tmp/master/work/corei7-64-poky-linux/meson/0.47.0-r0/meson-0.47.0/.pc/0003-Unknown-CPU-family-should-be-fatal.patch/mesonbuild/environment.py:998\r\n| 997\t                try:\r\n| 998\t                    res = eval(value, {'__builtins__': None}, {'true': True, 'false': False})\r\n| 999\t                except Exception:\r\n|\r\n| --------------------------------------------------\r\n| >> Issue: [B310:blacklist] Audit url open for permitted schemes. Allowing use of file:/ or custom schemes is often unexpected.\r\n|    Severity: Medium   Confidence: High\r\n|    Location: /data/poky-tmp/master/work/corei7-64-poky-linux/meson/0.47.0-r0/meson-0.47.0/ghwt.py:48\r\n| 47\t    us_url = config['wrap-file']['source_url']\r\n| 48\t    us = urllib.request.urlopen(us_url).read()\r\n| 49\t    h = hashlib.sha256()\r\n|\r\n| --------------------------------------------------\r\n| >> Issue: [B301:blacklist] Pickle library appears to be in use, possible security issue.\r\n|    Severity: Medium   Confidence: High\r\n|    Location: /data/poky-tmp/master/work/corei7-64-poky-linux/meson/0.47.0-r0/meson-0.47.0/mesonbuild/backend/ninjabackend.py:2819\r\n| 2818\t    with open(filename, 'rb') as f:\r\n| 2819\t        obj = pickle.load(f)\r\n| 2820\t    return obj\r\n|\r\n| --------------------------------------------------\r\n| >> Issue: [B318:blacklist] Using xml.dom.minidom.parse to parse untrusted XML data is known to be vulnerable to XML attacks. Replace xml.dom.minidom.parse with its defusedxml equivalent function or make sure defusedxml.defuse_stdlib() is called\r\n|    Severity: Medium   Confidence: High\r\n|    Location: /data/poky-tmp/master/work/corei7-64-poky-linux/meson/0.47.0-r0/meson-0.47.0/mesonbuild/backend/vs2010backend.py:634\r\n| 633\t        # ElementTree can not do prettyprinting so do it manually\r\n| 634\t        doc = xml.dom.minidom.parse(ofname)\r\n| 635\t        with open(ofname, 'w', encoding='utf-8') as of:\r\n```\r\n\r\nYou can mark specific lines as being fine with a simple #nosec comment, or exclude entire tests.  I guess as Meson's use of XML and Pickle is for interchange and not parsing untrusted data from the network, those tests could be silenced."},"comment":{"url":"https://api.github.com/repos/mesonbuild/meson/issues/comments/405081025","html_url":"https://github.com/mesonbuild/meson/issues/3866#issuecomment-405081025","issue_url":"https://api.github.com/repos/mesonbuild/meson/issues/3866","id":405081025,"node_id":"MDEyOklzc3VlQ29tbWVudDQwNTA4MTAyNQ==","user":{"login":"behlec","id":33778676,"node_id":"MDQ6VXNlcjMzNzc4Njc2","avatar_url":"https://avatars2.githubusercontent.com/u/33778676?v=4","gravatar_id":"","url":"https://api.github.com/users/behlec","html_url":"https://github.com/behlec","followers_url":"https://api.github.com/users/behlec/followers","following_url":"https://api.github.com/users/behlec/following{/other_user}","gists_url":"https://api.github.com/users/behlec/gists{/gist_id}","starred_url":"https://api.github.com/users/behlec/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/behlec/subscriptions","organizations_url":"https://api.github.com/users/behlec/orgs","repos_url":"https://api.github.com/users/behlec/repos","events_url":"https://api.github.com/users/behlec/events{/privacy}","received_events_url":"https://api.github.com/users/behlec/received_events","type":"User","site_admin":false},"created_at":"2018-07-15T10:16:47Z","updated_at":"2018-07-15T10:16:47Z","author_association":"CONTRIBUTOR","body":"While I agree that you always have a trust issue when you download code, compile and run it, it would be nice if Meson had only clearly defined attack vectors. This makes it easier to check sources for security issues.\r\n\r\nFor example a simple `meson.build` file not using `run_command` should at least be safe to configure and even build. Security does not have to be a top priority, in theory one has to download everything and audit it all to ensure security. On the other hand, it would be nice to limit attack vectors or make problematic parts stand out to ease checking."}}
{"actor":{"display_login":"behlec"}}