From 482dbcac29129483bc2124c76e124fbfe45be275 Mon Sep 17 00:00:00 2001 From: Gage Hugo Date: Wed, 3 Oct 2018 16:30:29 -0500 Subject: [PATCH] Scan templated python files with bandit This change adds a zuul check job to export any templated python contained in the helm charts and scan it with bandit for any potential security flaws. This also adds two nosec comments on the instances of subprocess used as they currently do not appear to be malicious, as well as changing the endpoint_update python code to prevent sql injection, which satisfies bandit code B608. Change-Id: I2212d26514c3510353d16a4592893dd2e85cb369 --- .../templates/bin/_endpoint-update.py.tpl | 15 ++++------ keystone/templates/bin/_fernet-manage.py.tpl | 4 +-- tools/gate/files/template-python.sh | 16 +++++++++++ tools/gate/playbooks/osh-bandit.yaml | 28 +++++++++++++++++++ zuul.d/jobs-openstack-helm.yaml | 14 ++++++++++ zuul.d/project.yaml | 1 + 6 files changed, 67 insertions(+), 11 deletions(-) create mode 100755 tools/gate/files/template-python.sh create mode 100644 tools/gate/playbooks/osh-bandit.yaml diff --git a/keystone/templates/bin/_endpoint-update.py.tpl b/keystone/templates/bin/_endpoint-update.py.tpl index 88930f56..f523c626 100644 --- a/keystone/templates/bin/_endpoint-update.py.tpl +++ b/keystone/templates/bin/_endpoint-update.py.tpl @@ -73,9 +73,8 @@ except: # Set Internal Endpoint try: endpoint_url = os.environ['OS_BOOTSTRAP_INTERNAL_URL'] - user_engine.execute( - "update endpoint set url = '{0}' where interface ='internal' and service_id = (select id from service where service.type = 'identity')". - format(endpoint_url)) + cmd = "update endpoint set url = %s where interface ='internal' and service_id = (select id from service where service.type = 'identity')" + user_engine.execute(cmd, (endpoint_url,)) except: logger.critical("Could not update internal endpoint") raise @@ -83,9 +82,8 @@ except: # Set Admin Endpoint try: endpoint_url = os.environ['OS_BOOTSTRAP_ADMIN_URL'] - user_engine.execute( - "update endpoint set url = '{0}' where interface ='admin' and service_id = (select id from service where service.type = 'identity')". - format(endpoint_url)) + cmd = "update endpoint set url = %s where interface ='admin' and service_id = (select id from service where service.type = 'identity')" + user_engine.execute(cmd, (endpoint_url,)) except: logger.critical("Could not update admin endpoint") raise @@ -93,9 +91,8 @@ except: # Set Public Endpoint try: endpoint_url = os.environ['OS_BOOTSTRAP_PUBLIC_URL'] - user_engine.execute( - "update endpoint set url = '{0}' where interface ='public' and service_id = (select id from service where service.type = 'identity')". - format(endpoint_url)) + cmd = "update endpoint set url = %s where interface ='public' and service_id = (select id from service where service.type = 'identity')" + user_engine.execute(cmd, (endpoint_url,)) except: logger.critical("Could not update public endpoint") raise diff --git a/keystone/templates/bin/_fernet-manage.py.tpl b/keystone/templates/bin/_fernet-manage.py.tpl index 5d122c78..a5ea3d6f 100644 --- a/keystone/templates/bin/_fernet-manage.py.tpl +++ b/keystone/templates/bin/_fernet-manage.py.tpl @@ -25,7 +25,7 @@ import os import pwd import re import six -import subprocess +import subprocess #nosec import sys import time @@ -127,7 +127,7 @@ def execute_command(cmd): LOG.info("Executing 'keystone-manage %s --keystone-user=%s " "--keystone-group=%s' command.", cmd, KEYSTONE_USER, KEYSTONE_GROUP) - subprocess.call(['keystone-manage', cmd, + subprocess.call(['keystone-manage', cmd, #nosec '--keystone-user=%s' % KEYSTONE_USER, '--keystone-group=%s' % KEYSTONE_GROUP]) diff --git a/tools/gate/files/template-python.sh b/tools/gate/files/template-python.sh new file mode 100755 index 00000000..19ef3a93 --- /dev/null +++ b/tools/gate/files/template-python.sh @@ -0,0 +1,16 @@ +#!/bin/bash + +EXCLUDES="helm-toolkit doc tests tools logs tmp roles playbooks releasenotes zuul.d python-files" +DIRS=`ls -d */ | cut -f1 -d'/'` + +for EX in $EXCLUDES; do + DIRS=`echo $DIRS | sed "s/\b$EX\b//g"` +done + +for DIR in $DIRS; do + PYFILES=$(helm template $DIR | yq 'select(.data != null) | .data | to_entries | map(select(.key | test(".*\\.py"))) | select(length > 0) | values[] | {(.key) : (.value)}' | jq -s add) + PYKEYS=$(echo "$PYFILES" | jq -r 'select(. != null) | keys[]') + for KEY in $PYKEYS; do + echo "$PYFILES" | jq -r --arg KEY "$KEY" '.[$KEY]' > ./python-files/"$DIR-$KEY" + done +done diff --git a/tools/gate/playbooks/osh-bandit.yaml b/tools/gate/playbooks/osh-bandit.yaml new file mode 100644 index 00000000..99174a8e --- /dev/null +++ b/tools/gate/playbooks/osh-bandit.yaml @@ -0,0 +1,28 @@ +- hosts: all + name: openstack-helm-bandit + tasks: + + - name: Install Required Packages and Setup Host + shell: | + set -xe; + ./tools/deployment/common/install-packages.sh + ./tools/deployment/common/deploy-k8s.sh + sudo -H pip install yq bandit + environment: + zuul_site_mirror_fqdn: "{{ zuul_site_mirror_fqdn }}" + args: + chdir: "{{ zuul.project.src_dir }}" + + - name: Template out python files + shell: | + set -xe; + make all + mkdir -p python-files + ./tools/gate/files/template-python.sh + args: + chdir: "{{ zuul.project.src_dir }}" + + - name: Run bandit against python files + shell: bandit -r ./python-files + args: + chdir: "{{ zuul.project.src_dir }}" diff --git a/zuul.d/jobs-openstack-helm.yaml b/zuul.d/jobs-openstack-helm.yaml index ce25bdb4..b5dd6f38 100644 --- a/zuul.d/jobs-openstack-helm.yaml +++ b/zuul.d/jobs-openstack-helm.yaml @@ -24,6 +24,20 @@ - ^doc/.*$ - ^releasenotes/.*$ +- job: + name: openstack-helm-bandit + timeout: 3600 + run: tools/gate/playbooks/osh-bandit.yaml + required-projects: + - openstack/openstack-helm-infra + # NOTE(gagehugo): Look into only running this for py.tpl file changes + # files: + # - ^.*\.py\.tpl$ + irrelevant-files: + - ^.*\.rst$ + - ^doc/.*$ + - ^releasenotes/.*$ + - job: name: openstack-helm-chart-deploy parent: openstack-helm-functional-temp diff --git a/zuul.d/project.yaml b/zuul.d/project.yaml index 2770a677..c90bf095 100644 --- a/zuul.d/project.yaml +++ b/zuul.d/project.yaml @@ -24,6 +24,7 @@ check: jobs: - openstack-helm-lint + - openstack-helm-bandit - openstack-helm-keystone - openstack-helm-keystone-ldap - openstack-helm-glance