Merge pull request #128 from mekanix/security

Add bandit to CI

.github/workflows/pythonapp.yml

@@ -20,3 +20,6 @@ jobs:
     - name: Test and lint
       run: |
         bin/test.sh
+    - name: Security
+      run: |
+        bin/security.sh

bin/security.sh

@@ -0,0 +1,9 @@
+#!/bin/sh
+
+BIN_DIR=`dirname $0`
+export FREENIT_ENV="test"
+. ${BIN_DIR}/common.sh
+
+
+setup no
+bandit `find freenit -type f -name '*.py'`

freenit/base_config.py

@@ -32,7 +32,7 @@ def __init__(
         self,
         server="mail.example.com",
         user="[email protected]",
-        password="Secrit",
+        password="Secrit", #nosec
         port=587,
         tls=True,
         from_addr="[email protected]",
@@ -69,7 +69,7 @@ class BaseConfig:
     dburl = "sqlite:///db.sqlite"
     database = None
     engine = None
-    secret = "SECRET"
+    secret = "SECRET" #nosec
     user = "freenit.models.ormar.user"
     role = "freenit.models.ormar.role"
     theme = "freenit.models.ormar.theme"
@@ -121,4 +121,4 @@ class TestConfig(BaseConfig):
 
 
 class ProdConfig(BaseConfig):
-    secret = "MORESECURESECRET"
+    secret = "MORESECURESECRET" #nosec

freenit/project/main.py

@@ -10,7 +10,7 @@
 if __name__ == "__main__":
     uvicorn.run(
         "NAME.app:app",
-        host="0.0.0.0",
+        host="0.0.0.0", #nosec
         port=config.port,
         log_level="info",
         reload=True,

freenit/project/project/base_config.py

@@ -20,4 +20,4 @@ class TestConfig(BaseConfig):
 
 
 class ProdConfig(BaseConfig):
-    secret = "MORESECURESECRET"
+    secret = "MORESECURESECRET" #nosec

freenit/project/tests/test_user.py

@@ -12,4 +12,4 @@ async def test_get_user_list(self, client):
         await admin.save()
         client.login(user=admin)
         response = client.get(f"/users")
-        assert response.status_code == 200
+        assert response.status_code == 200 #nosec

setup.py

@@ -31,6 +31,7 @@
     ],
     "test": [
         "aiosqlite",
+        "bandit",
         "black",
         "httpx",
         "isort",