From f431f6f32eacaaa226f392ee022bc8c39f8bd97a Mon Sep 17 00:00:00 2001
From: Eric Brown <browne@vmware.com>
Date: Fri, 1 May 2015 23:52:34 -0700
Subject: [PATCH] Add bandit for security static analysis testing

This change adds a basic bandit config for Nova. It can be invoked
by running the tox environment for bandit;
    tox -e bandit

This is intended as a starting point for using bandit with Nova
and it should be revisited to improve the testing as more is learned
about the specific needs of the Nova code base.

Tox is configured to only show results for high and medium severity
results.

https://wiki.openstack.org/wiki/Security/Projects/Bandit

Change-Id: I3026b81317f0a6322acfc94784899a7453af586f
---
 test-requirements.txt | 1 +
 tox.ini               | 4 ++++
 2 files changed, 5 insertions(+)

diff --git a/test-requirements.txt b/test-requirements.txt
index d088001cc..294ecf205 100644
--- a/test-requirements.txt
+++ b/test-requirements.txt
@@ -21,6 +21,7 @@ oslotest>=1.5.1 # Apache-2.0
 testrepository>=0.0.18
 testtools>=1.4.0
 tempest-lib>=0.6.1
+bandit>=0.10.1
 
 # vmwareapi driver specific dependencies
 oslo.vmware>=0.13.1 # Apache-2.0
diff --git a/tox.ini b/tox.ini
index 5e55830ae..3154344a6 100644
--- a/tox.ini
+++ b/tox.ini
@@ -79,6 +79,10 @@ commands =
   python setup.py build_sphinx
   bash -c '! find doc/ -type f -name *.json | xargs -t -n1 python -m json.tool 2>&1 > /dev/null | grep -B1 -v ^python'
 
+[testenv:bandit]
+deps = -r{toxinidir}/test-requirements.txt
+commands = bandit -c bandit.yaml -r nova -n 5 -ll
+
 [flake8]
 # E125 is deliberately excluded. See https://github.com/jcrocholl/pep8/issues/126
 # The rest of the ignores are TODOs