Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

bandit identified issue with default directories #30

Open
unquietwiki opened this issue Sep 17, 2019 · 0 comments
Open

bandit identified issue with default directories #30

unquietwiki opened this issue Sep 17, 2019 · 0 comments

Comments

@unquietwiki
Copy link

Used bandit to identify the following issue...

Run started:2019-09-17 07:22:30.845048

Test results:
>> Issue: [B108:hardcoded_tmp_directory] Probable insecure usage of temp file/directory.
   Severity: Medium   Confidence: Medium
   Location: sg-jira-bridge/service.py:145
   More Info: https://bandit.readthedocs.io/en/latest/plugins/b108_hardcoded_tmp_directory.html
144             "--pid_file",
145             default="/tmp/sg_jira.pid",
146             help="Full path to a file where to write the process pid.",

--------------------------------------------------
>> Issue: [B108:hardcoded_tmp_directory] Probable insecure usage of temp file/directory.
   Severity: Medium   Confidence: Medium
   Location: sg-jira-bridge/settings.py:86
   More Info: https://bandit.readthedocs.io/en/latest/plugins/b108_hardcoded_tmp_directory.html
85                  # this location should be updated to where you store logs
86                  "filename": "/tmp/sg_jira.log",
87                  "maxBytes": 1024 * 1024,
88                  "backupCount": 5
89              },
90          },
91      }
92      # Sync settings. Keys are settings name.
93
94      # Add the examples folder to the Python path so the syncers can be loaded.

I'd probably update the defaults to /var/run/ for the PID, and /var/log/ for the log file.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

No branches or pull requests

1 participant