From 1c7e0d5f3db8c405d956a892a5a22509302f2af8 Mon Sep 17 00:00:00 2001 From: Ondřej Nosek Date: Sep 06 2022 12:02:18 +0000 Subject: Fix medium level bandit findings Fix the rest of the medium level bandit findings. This allows enabling more strict policy - when a new medium/high level warning appears, tests will fail. Signed-off-by: Ondřej Nosek --- diff --git a/pyrpkg/__init__.py b/pyrpkg/__init__.py index 4d2a13b..aa8b09f 100644 --- a/pyrpkg/__init__.py +++ b/pyrpkg/__init__.py @@ -805,7 +805,7 @@ class Commands(object): tmp_resultdir = tempfile.mkdtemp(prefix="mock_resultdir") cmd += ['-r', root, '--chroot', '--resultdir', tmp_resultdir] - tmp_root = '/var/tmp' # temporary directory inside the mock root + tmp_root = '/var/tmp' # temporary directory inside the mock root # nosec copyin_cmd = cmd + ['--copyin', specfile_path, tmp_root] # We make sure there is a space at the end of our query so that diff --git a/tests/test_commands.py b/tests/test_commands.py index 1c0fdc8..9aa5637 100644 --- a/tests/test_commands.py +++ b/tests/test_commands.py @@ -1111,15 +1111,18 @@ class TestRunCommand(CommandTestCase): super(TestRunCommand, self).setUp() self.cmd = self.make_commands(path='/path/to/repo') + # NOTE: this method will be removed once 'shell' parameter is removed from + # _run_command method. Currently it is marked as deprecated. + # Until then, shell=True is excluded from bandit scan. @patch('subprocess.Popen') def test_run_command_within_shell(self, Popen): Popen.return_value.wait.return_value = 0 - result = self.cmd._run_command(['rpmbuild'], shell=True) + result = self.cmd._run_command(['rpmbuild'], shell=True) # nosec self.assertEqual((0, None, None), result) Popen.assert_called_once_with( - 'rpmbuild', env=os.environ, shell=True, cwd=None, + 'rpmbuild', env=os.environ, shell=True, cwd=None, # nosec stdout=None, stderr=None, universal_newlines=False) @patch('subprocess.Popen')