Reviewed: https://review.openstack.org/479437 Committed: https://git.openstack.org/cgit/openstack/nova/commit/?id=398d24de68c79f77f0cfc0148f8d914bc09908b9 Submitter: Jenkins Branch: master
commit 398d24de68c79f77f0cfc0148f8d914bc09908b9 Author: Zhen Qin <[email protected]> Date: Fri Jun 30 15:29:10 2017 -0400 Avoid false positives of Jinja2 in Bandit scan When Bandit scans nova/console/xvp.py and nova/virt/netutils.py, the high severity issue ("B701:jinja2_autoescape_false") are triggered. By adding #nosec to above code, this alarm will be surpressed. "When autoescaping is enabled, Jinja2 will filter input strings to escape any HTML content submitted via template variables. Without escaping HTML input the application becomes vulnerable to Cross Site Scripting (XSS) attacks."[1] However, the "injected_network_template" is a template with text format and different rules, and is not intended to be executable. Hence, the security concern is not applicable here. [1] https://docs.openstack.org/developer/bandit/plugins/jinja2_autoescape_false.html Closes-Bug: #1701712 Change-Id: Ie819d90492af1e5c3b3d64403495d7355dc2cd91 ** Changed in: nova Status: In Progress => Fix Released -- You received this bug notification because you are a member of Yahoo! Engineering Team, which is subscribed to OpenStack Compute (nova). https://bugs.launchpad.net/bugs/1701712 Title: Bandit scanning on Nova generates false positives of high severity issue "jinja2_autoescape_false" Status in OpenStack Compute (nova): Fix Released Bug description: In the report generated by Bandit that scans against Nova code, there are two security issues estimated as high severity as shown below. We believe that these two issues are false positives. Therefore, the line of Nova codes that trigger such Bandit issues should be marked with something like # nosec so that any results associated with it will not be reported by Bandit. -------------------------------------------------- >> Issue: [B701:jinja2_autoescape_false] By default, jinja2 sets autoescape to False. Consider using autoescape=True to mitigate XSS vulnerabilities. Severity: High Confidence: High Location: nova/console/xvp.py:113 112 tmpl_path, tmpl_file = os.path.split(CONF.injected_network_template) 113 env = jinja2.Environment(loader=jinja2.FileSystemLoader(tmpl_path)) 114 env.filters['pass_encode'] = self.fix_console_password -------------------------------------------------- >> Issue: [B701:jinja2_autoescape_false] By default, jinja2 sets autoescape to False. Consider using autoescape=True to mitigate XSS vulnerabilities. Severity: High Confidence: High Location: nova/virt/netutils.py:174 173 tmpl_path, tmpl_file = os.path.split(template) 174 env = jinja2.Environment(loader=jinja2.FileSystemLoader(tmpl_path), 175 trim_blocks=True) 176 template = env.get_template(tmpl_file) The reasons that we think the above issue is false positive are: "When autoescaping is enabled, Jinja2 will filter input strings to escape any HTML content submitted via template variables. Without escaping HTML input the application becomes vulnerable to Cross Site Scripting (XSS) attacks."[1] However, the "injected_network_template" configured in nova.conf is a template with text format with different rules, and is not intended to be executable. An example template is https://github.com/openstack/nova/blob/stable/ocata/nova/virt/interfaces.template This bug exists in multiple releases of Nova, including master branch, Ocata, Newton etc. References: [1] https://docs.openstack.org/developer/bandit/plugins/jinja2_autoescape_false.html To manage notifications about this bug go to: https://bugs.launchpad.net/nova/+bug/1701712/+subscriptions -- Mailing list: https://launchpad.net/~yahoo-eng-team Post to : [email protected] Unsubscribe : https://launchpad.net/~yahoo-eng-team More help : https://help.launchpad.net/ListHelp
