Validate scheme used in urlopen
An invalid url scheme could be used in urlopen in the python k8s swagger client to violate security. Validate that the URL is either http or https and turn off noise from bandit. Change-Id: I15fe8f9953e526beb25d84895ed3925a758ccda4 Implements: blueprint gate-bandit
This commit is contained in:
parent
c9b7bd6b2c
commit
8adf61ea90
@ -17,6 +17,7 @@ import mimetypes
|
||||
import random
|
||||
import string
|
||||
|
||||
from magnum import utils
|
||||
from models import *
|
||||
|
||||
|
||||
@ -94,11 +95,13 @@ class ApiClient(object):
|
||||
else:
|
||||
raise Exception('Method ' + method + ' is not recognized.')
|
||||
|
||||
utils.raise_exception_invalid_scheme(url)
|
||||
|
||||
request = MethodRequest(method=method, url=url, headers=headers,
|
||||
data=data)
|
||||
|
||||
# Make the request
|
||||
response = urllib2.urlopen(request)
|
||||
response = urllib2.urlopen(request) #nosec
|
||||
if 'Set-Cookie' in response.headers:
|
||||
self.cookie = response.headers['Set-Cookie']
|
||||
string = response.read()
|
||||
|
Loading…
x
Reference in New Issue
Block a user