Merge pull request #97 from RIPE-NCC/fix_sec_issues

Fix sec issues

Author: iannuzzelli

.github/workflows/python-package.yml

@@ -62,7 +62,7 @@ jobs:
           path: dist/
       - name: Push to pypi
         # if: github.event_name == 'push' && startsWith(github.ref, 'refs/tags')
-        uses: pypa/gh-action-pypi-publish@release/v1.13
+        uses: pypa/gh-action-pypi-publish@ed0c53931b1dc9bd32cbe73a98c7f6766f8a527e # release/v1.13
         with:
           user: __token__
           password: ${{ secrets.PYPI_API_TOKEN }}

docs/conf.py

@@ -12,11 +12,12 @@
 # All configuration values have a default; values that are commented out
 # serve to show the default.
 
+import re
 import sys
 import os
 
-__version__ = None
-exec(open("../ripe/atlas/sagan/version.py").read())
+with open("../ripe/atlas/sagan/version.py") as f:
+    __version__ = re.search(r'^__version__\s*=\s*["\']([^"\']+)["\']', f.read(), re.M).group(1)
 
 # If extensions (or modules to document with autodoc) are in another directory,
 # add these directories to sys.path here. If the directory is relative to the

ripe/atlas/sagan/ssl.py

@@ -65,8 +65,8 @@ def __init__(self, data, **kwargs):
         cert = x509.load_pem_x509_certificate(data.encode("ascii"), openssl.backend)
 
         if cert:
-            self.checksum_md5 = self._colonify(cert.fingerprint(hashes.MD5()))
-            self.checksum_sha1 = self._colonify(cert.fingerprint(hashes.SHA1()))
+            self.checksum_md5 = self._colonify(cert.fingerprint(hashes.MD5()))  # nosec B303 - reporting cert fingerprint only, not used for security
+            self.checksum_sha1 = self._colonify(cert.fingerprint(hashes.SHA1()))  # nosec B303 - reporting cert fingerprint only, not used for security
             self.checksum_sha256 = self._colonify(cert.fingerprint(hashes.SHA256()))
 
             self.valid_from = pytz.utc.localize(cert.not_valid_before)

ripe/atlas/sagan/traceroute.py

@@ -217,10 +217,8 @@ def ip_path(self):
 
     def _parse_hops(self, parse_all_hops=True, **kwargs):
 
-        try:
-            hops = self.raw_data["result"]
-            assert(isinstance(hops, list))
-        except (KeyError, AssertionError):
+        hops = self.raw_data.get("result")
+        if not isinstance(hops, list):
             self._handle_malformation("Legacy formats not supported")
             return
 

ripe/atlas/sagan/version.py

@@ -13,4 +13,4 @@
 # You should have received a copy of the GNU General Public License
 # along with this program.  If not, see <http://www.gnu.org/licenses/>.
 
-__version__ = "2.0.0"
+__version__ = "2.0.1"

setup.py

@@ -1,9 +1,10 @@
 import os
+import re
 from os.path import abspath, dirname, join
 from setuptools import setup
 
-__version__ = None
-exec(open("ripe/atlas/sagan/version.py").read())
+with open("ripe/atlas/sagan/version.py") as f:
+    __version__ = re.search(r'^__version__\s*=\s*["\']([^"\']+)["\']', f.read(), re.M).group(1)
 
 name = "ripe.atlas.sagan"
 install_requires = [