diff options
| author | lhinds <lhinds@redhat.com> | 2017-08-31 14:16:46 +0100 |
|---|---|---|
| committer | Gage Hugo <gagehugo@gmail.com> | 2017-08-31 15:34:13 -0500 |
| commit | b29f478f28c4989156cfe87392cbd308e3f55c1e (patch) | |
| tree | 4eb323f1af0822bb6b9fb7ec9143a6bafd713eb3 | |
| parent | 3593e7d97701ae33cc02ff581ffc90ad1359297a (diff) | |
| download | python-keystoneclient-b29f478f28c4989156cfe87392cbd308e3f55c1e.tar.gz | |
Adds bandit nosec flag to hashlib.sha1
A bandit patch to block sha1 hash is failing CI [1], due to a false
positive on hashlib.sha1 (which actually uses HMAC-SHA1 in keystone
that is considered more secure then standard SHA1)
This change marks a # nosec comment against the line which is
triggering the false positive in Bandit.
[1] https://review.openstack.org/#/c/437563/6
Change-Id: Ib9618119c77f41fba0e612e37c7511676bed47e8
| -rw-r--r-- | keystoneclient/session.py | 4 |
1 files changed, 3 insertions, 1 deletions
diff --git a/keystoneclient/session.py b/keystoneclient/session.py index ae5da94..dfac424 100644 --- a/keystoneclient/session.py +++ b/keystoneclient/session.py @@ -169,7 +169,9 @@ class Session(object): secure_headers = ('authorization', 'x-auth-token', 'x-subject-token', 'x-service-token') if header[0].lower() in secure_headers: - token_hasher = hashlib.sha1() + # hashlib.sha1() bandit nosec, as it is HMAC-SHA1 in + # keystone, which is considered secure (unlike just sha1) + token_hasher = hashlib.sha1() # nosec(lhinds) token_hasher.update(header[1].encode('utf-8')) token_hash = token_hasher.hexdigest() return (header[0], '{SHA1}%s' % token_hash) |