From 757586251c31de76db0324f8efee937bc7b1fd4f Mon Sep 17 00:00:00 2001
From: Chenxiong Qi <cqi@redhat.com>
Date: Dec 04 2018 10:00:43 +0000
Subject: [PATCH 1/2] Fix flake8 errors


Signed-off-by: Chenxiong Qi <cqi@redhat.com>

---

diff --git a/tests/helpers.py b/tests/helpers.py
index c2ca17a..1a620cd 100644
--- a/tests/helpers.py
+++ b/tests/helpers.py
@@ -101,7 +101,7 @@ class FreshmakerTestCase(unittest.TestCase):
         hub.config = {}
         hub.config['freshmakerconsumer'] = True
         hub.config['validate_signatures'] = False
-        consumer =  freshmaker.consumer.FreshmakerConsumer(hub)
+        consumer = freshmaker.consumer.FreshmakerConsumer(hub)
         consumer.incoming = queue.Queue()
         return consumer
 
diff --git a/tests/test_consumer.py b/tests/test_consumer.py
index 3a7a9bb..d66d76b 100644
--- a/tests/test_consumer.py
+++ b/tests/test_consumer.py
@@ -18,7 +18,6 @@
 # OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
 # SOFTWARE.
 
-import fedmsg.config
 import mock
 import unittest
 
diff --git a/tests/test_git_dockerfile_change_handler.py b/tests/test_git_dockerfile_change_handler.py
index 7094113..a277a5a 100644
--- a/tests/test_git_dockerfile_change_handler.py
+++ b/tests/test_git_dockerfile_change_handler.py
@@ -20,15 +20,12 @@
 #
 # Written by Chenxiong Qi <cqi@redhat.com>
 
-import fedmsg.config
-
 from mock import patch
-from mock import MagicMock, PropertyMock
+from mock import PropertyMock
 
 import freshmaker
 
 from freshmaker import models
-from freshmaker.consumer import FreshmakerConsumer
 from freshmaker.types import ArtifactType
 from freshmaker.config import any_
 from tests import get_fedmsg, helpers
diff --git a/tests/test_monitor.py b/tests/test_monitor.py
index 8996801..1ef7b35 100644
--- a/tests/test_monitor.py
+++ b/tests/test_monitor.py
@@ -19,10 +19,8 @@
 # OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
 # SOFTWARE.
 
-import fedmsg.config
 import mock
 import freshmaker
-from six.moves import queue
 
 from freshmaker import app, db, events, models, login_manager
 from tests import helpers
diff --git a/tests/test_odcsclient.py b/tests/test_odcsclient.py
index e702481..12c5416 100644
--- a/tests/test_odcsclient.py
+++ b/tests/test_odcsclient.py
@@ -22,11 +22,9 @@
 # Written by Chenxiong Qi <cqi@redhat.com>
 #            Jan kaluza <jkaluza@redhat.com>
 
-import fedmsg
 import six
-from six.moves import queue
 
-from mock import patch, Mock, MagicMock
+from mock import patch, Mock
 from odcs.client.odcs import AuthMech
 
 from freshmaker import conf, db
@@ -34,7 +32,6 @@ from freshmaker.models import Event, ArtifactBuild, Compose
 from freshmaker.odcsclient import create_odcs_client
 from freshmaker.types import ArtifactBuildState, EventState, ArtifactType
 from freshmaker.handlers import ContainerBuildHandler
-from freshmaker.consumer import FreshmakerConsumer
 from tests import helpers
 
 
diff --git a/tests/test_producer.py b/tests/test_producer.py
index 5dca1f2..70fe56c 100644
--- a/tests/test_producer.py
+++ b/tests/test_producer.py
@@ -23,12 +23,10 @@
 # Written by Jan Kaluza <jkaluza@redhat.com>
 
 import koji
-import fedmsg.config
 
 from mock import patch, MagicMock
 from six.moves import queue
 
-import freshmaker
 from freshmaker import db
 from freshmaker.events import ErrataAdvisoryRPMsSignedEvent
 from freshmaker.models import ArtifactBuild, Event

From 2cb599ff6568fd0ae1e7bfc3ad3155add434082e Mon Sep 17 00:00:00 2001
From: Chenxiong Qi <cqi@redhat.com>
Date: Dec 04 2018 10:11:24 +0000
Subject: [PATCH 2/2] Fix issues reported by bandit


This patch fixes these issues:

* B104:hardcoded_bind_all_interfaces: ignore this issue from bandit
  command line.
* B320:blacklist: use defusedxml.ElementTree.fromstring instead of
  lxml.etree.fromstring.
* B506:yaml_load: use yaml.safe_load instead.
* B608:hardcoded_sql_expressions: fixed in a migration.

Signed-off-by: Chenxiong Qi <cqi@redhat.com>

---

diff --git a/freshmaker/bugzilla.py b/freshmaker/bugzilla.py
index c21ef2f..fab282f 100644
--- a/freshmaker/bugzilla.py
+++ b/freshmaker/bugzilla.py
@@ -24,7 +24,7 @@
 
 import requests
 
-import lxml.etree
+from defusedxml import ElementTree
 from freshmaker import log, conf
 
 
@@ -65,10 +65,10 @@ class BugzillaAPI(object):
         r.raise_for_status()
 
         # Parse
-        root = lxml.etree.fromstring(r.text.encode('utf-8'))
+        root = ElementTree.fromstring(r.text.encode('utf-8'))
 
         # List the major xml elements
-        elements = root.getchildren()[0].getchildren()
+        elements = list(list(root)[0])
 
         # Extract the whiteboard string
         whiteboard = [e.text for e in elements if e.tag == 'status_whiteboard']
diff --git a/freshmaker/lightblue.py b/freshmaker/lightblue.py
index 3f900b3..0547dc6 100644
--- a/freshmaker/lightblue.py
+++ b/freshmaker/lightblue.py
@@ -378,7 +378,7 @@ class ContainerImage(dict):
             return data
 
         try:
-            content_sets_yaml = yaml.load(content_sets_data)
+            content_sets_yaml = yaml.safe_load(content_sets_data)
         except Exception as err:
             log.exception(err)
             data["generate_pulp_repos"] = True
@@ -393,7 +393,7 @@ class ContainerImage(dict):
             data["generate_pulp_repos"] = True
             return data
 
-        container_yaml = yaml.load(container_data)
+        container_yaml = yaml.safe_load(container_data)
 
         if ("compose" not in container_yaml or
                 "pulp_repos" not in container_yaml["compose"] or
diff --git a/freshmaker/migrations/versions/b17231ee8220_remove_event_compose_id.py b/freshmaker/migrations/versions/b17231ee8220_remove_event_compose_id.py
index 3318cca..1469cc4 100644
--- a/freshmaker/migrations/versions/b17231ee8220_remove_event_compose_id.py
+++ b/freshmaker/migrations/versions/b17231ee8220_remove_event_compose_id.py
@@ -97,8 +97,10 @@ def downgrade():
                 'Restore odcs compose id %s from Compose %s back to Event %s',
                 compose.odcs_compose_id, compose.id, event.id)
             connection.execute(
-                'UPDATE events SET compose_id = {} WHERE id = {}'.format(
-                    compose.odcs_compose_id, event.id))
+                'UPDATE events SET compose_id = :compose_id WHERE id = :event_id'
+                .bindparams(
+                    compose_id=compose.odcs_compose_id,
+                    event_id=event.id))
 
         logger.info('Clear data from ArtifactBuildCompose')
         connection.execute('DELETE FROM artifact_build_composes')
diff --git a/requirements.txt b/requirements.txt
index adefad0..d88d9a0 100644
--- a/requirements.txt
+++ b/requirements.txt
@@ -26,3 +26,4 @@ koji
 tabulate
 lxml
 prometheus_client
+defusedxml
diff --git a/tox.ini b/tox.ini
index 87735bf..91b90ff 100644
--- a/tox.ini
+++ b/tox.ini
@@ -28,7 +28,10 @@ basepython = python3
 skip_install = true
 deps = bandit
 commands =
-    /bin/bash -c "bandit -r -ll $(find . -mindepth 1 -maxdepth 1 ! -name tests ! -name \.\* -type d -o -name \*.py)"
+    ; 0.0.0.0 is set in BaseConfiguration, which is ok for local dev and it
+    ; will be replace with a specific host IP when deploy to a server. So, it
+    ; works to ignore B104.
+    /bin/bash -c "bandit -r -s B104 -ll $(find . -mindepth 1 -maxdepth 1 ! -name tests ! -name \.\* -type d -o -name \*.py)"
 ignore_outcome = True
 
 [flake8]
@@ -46,4 +49,4 @@ omit =
      .tox
      .env
      tests/*
-     /usr/*
\ No newline at end of file
+     /usr/*

