janitoring: add bandit to pre-commit checks (#940)

.pre-commit-config.yaml

@@ -40,6 +40,13 @@ repos:
   - id: flake8
     additional_dependencies: [flake8-docstrings, flake8-bugbear, flake8-builtins, flake8-print, flake8-pytest-style, flake8-return, flake8-simplify, flake8-annotations]
 
+- repo: https://github.com/PyCQA/bandit
+  rev: 1.7.0
+  hooks:
+  - id: bandit
+    args: [-x, 'tests']
+
+
 #- repo: https://github.com/pre-commit/mirrors-mypy
 #  rev: v0.740
 #  hooks:

azure-pipelines.yml

@@ -45,10 +45,15 @@ stages:
         poetry run pre-commit run docformatter --all-files
       displayName: 'Docstring formating (docformatter)'
 
+    - script: |
+        poetry run pre-commit run bandit --all-files
+      displayName: 'Potential security issues (bandit)'
+
     - script: |
         poetry run sphinx-build docs/ generated_docs
       displayName: 'Documentation build (sphinx)'
 
+
 - stage: "Tests"
   jobs:
   - job: "Tests"

miio/airconditioningcompanionMCN.py

@@ -132,7 +132,7 @@ def __init__(
         model: str = MODEL_ACPARTNER_MCN02,
     ) -> None:
         if start_id is None:
-            start_id = random.randint(0, 999)
+            start_id = random.randint(0, 999)  # nosec
         super().__init__(ip, token, start_id, debug, lazy_discover)
 
         if model != MODEL_ACPARTNER_MCN02:

miio/extract_tokens.py

@@ -2,12 +2,12 @@
 import logging
 import sqlite3
 import tempfile
-import xml.etree.ElementTree as ET
 from pprint import pformat as pf
 from typing import Iterator
 
 import attr
 import click
+import defusedxml.ElementTree as ET
 from cryptography.hazmat.backends import default_backend
 from cryptography.hazmat.primitives.ciphers import Cipher, algorithms, modes
 
@@ -80,7 +80,9 @@ def decrypt_ztoken(ztoken):
 
         keystring = "00000000000000000000000000000000"
         key = bytes.fromhex(keystring)
-        cipher = Cipher(algorithms.AES(key), modes.ECB(), backend=default_backend())
+        cipher = Cipher(  # nosec
+            algorithms.AES(key), modes.ECB(), backend=default_backend()
+        )
         decryptor = cipher.decryptor()
         token = decryptor.update(bytes.fromhex(ztoken[:64])) + decryptor.finalize()
 

miio/protocol.py

@@ -57,7 +57,7 @@ def verify_token(token: bytes):
     @staticmethod
     def md5(data: bytes) -> bytes:
         """Calculates a md5 hashsum for the given bytes object."""
-        checksum = hashlib.md5()
+        checksum = hashlib.md5()  # nosec
         checksum.update(data)
         return checksum.digest()
 

miio/updater.py

@@ -55,7 +55,7 @@ def __init__(self, file, interface=None):
         with open(file, "rb") as f:
             self.payload = f.read()
             self.server.payload = self.payload
-            self.md5 = hashlib.md5(self.payload).hexdigest()
+            self.md5 = hashlib.md5(self.payload).hexdigest()  # nosec
             _LOGGER.info("Using local %s (md5: %s)" % (file, self.md5))
 
     @staticmethod
@@ -93,5 +93,5 @@ def serve_once(self):
 
 if __name__ == "__main__":
     logging.basicConfig(level=logging.DEBUG)
-    upd = OneShotServer("/tmp/test")
+    upd = OneShotServer("/tmp/test")  # nosec
     upd.serve_once()

miio/vacuum_cli.py

@@ -627,7 +627,8 @@ def update_firmware(vac: miio.Vacuum, url: str, md5: str, ip: str):
             try:
                 state = vac.update_state()
                 progress = vac.update_progress()
-            except:  # we may not get our messages through during upload # noqa
+            except:  # noqa # nosec
+                # we may not get our messages through during uploads
                 continue
 
             if state == UpdateState.Installing:

pyproject.toml

@@ -34,6 +34,7 @@ netifaces = "^0"
 android_backup = { version = "^0", optional = true }
 importlib_metadata = { version = "^1", markers = "python_version <= '3.7'" }
 croniter = "^0"
+defusedxml = "^0.6"
 
 sphinx = { version = "^3", optional = true }
 sphinx_click = { version = "^2", optional = true }