mirrors/fdroidserver
1
0
Fork 0
mirror of https://github.com/f-droid/fdroidserver.git synced 2025-11-05 23:10:29 +03:00
Code Issues Projects Releases Packages Wiki Activity Actions

fix all bandit B310 urllib_urlopen

Browse source 
"Audit url open for permitted schemes. Allowing use of ‘file:’’ or custom
schemes is often unexpected."

https://bandit.readthedocs.io/en/latest/blacklists/blacklist_calls.html#b310-urllib-urlopen
This commit is contained in:
Hans-Christoph Steiner 2020-01-31 15:20:24 +01:00
parent d8f3d94997
commit 3df276cc3c
No known key found for this signature in database
GPG key ID: 3E177817BA1B9BFA
4 changed files with 19 additions and 6 deletions
Download patch file Download diff file Expand all files Collapse all files

5
fdroidserver/import.py
View file

@ -40,8 +40,9 @@ SETTINGS_GRADLE = re.compile(r'''include\s+['"]:([^'"]*)['"]''')
# when one of these is found it's assumed that's the information we want.
# Returns repotype, address, or None, reason
def getrepofrompage(url):
req = urllib.request.urlopen(url)
if not url.startswith('http'):
return (None, _('{url} does not start with "http"!'.format(url=url)))
req = urllib.request.urlopen(url) # nosec B310 non-http URLs are filtered out
if req.getcode() != 200:
return (None, 'Unable to get ' + url + ' - return code ' + str(req.getcode()))
page = req.read().decode(req.headers.get_content_charset())