From 62ac2012f178d67cce36926d69f6442bc9a3ec97 Mon Sep 17 00:00:00 2001 From: Gareth Jones Date: Fri, 21 Aug 2026 12:36:28 +1200 Subject: [PATCH 1/4] chore: enable `flake8-bandit` rules --- ruff.toml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/ruff.toml b/ruff.toml index deb7b13f..da2a0893 100644 --- a/ruff.toml +++ b/ruff.toml @@ -24,7 +24,7 @@ extend-select = [ 'PLE', # pylint errors 'PLR', # pylint refactors 'PLW', # pylint warnings -# 'S', # flake8-bandit + 'S', # flake8-bandit 'SIM', # flake8-simplify 'UP', # pyupgrade 'W' # pycodestyle From 226891b3cb0a0082d66068f45040401e252b3762 Mon Sep 17 00:00:00 2001 From: Gareth Jones Date: Fri, 21 Aug 2026 12:36:56 +1200 Subject: [PATCH 2/4] fix: ensure all `requests` have a timeout --- scripts/download_sa_advisories.py | 2 +- scripts/generate_osv_advisories.py | 5 ++++- scripts/precache_nodes.py | 2 +- scripts/validate_advisories.py | 3 ++- 4 files changed, 8 insertions(+), 4 deletions(-) diff --git a/scripts/download_sa_advisories.py b/scripts/download_sa_advisories.py index 19f520a3..a90c9f45 100755 --- a/scripts/download_sa_advisories.py +++ b/scripts/download_sa_advisories.py @@ -53,7 +53,7 @@ def download_sa_advisories_from_rest_api(last_modified_timestamp: int) -> None: retry = True while url != '': print(f'fetching {url}') - response = requests.get(url, headers={'user-agent': user_agent}) + response = requests.get(url, headers={'user-agent': user_agent}, timeout=60) # if we're making too many requests and have not already retried the current # url, wait the requested number of seconds before doing a retry diff --git a/scripts/generate_osv_advisories.py b/scripts/generate_osv_advisories.py index 9ed7fefa..b214d598 100755 --- a/scripts/generate_osv_advisories.py +++ b/scripts/generate_osv_advisories.py @@ -39,6 +39,7 @@ def fetch_drupal_node(nid: str) -> drupal.Node: resp = requests.get( f'https://www.drupal.org/api-d7/node/{nid}.json', headers={'user-agent': user_agent}, + timeout=60, ) if resp.status_code == 200: @@ -365,7 +366,9 @@ def fetch_drupal_packages_available_on_packagist() -> list[str]: """ Fetches a list of all Drupal packages that are available on packagist.org """ - resp = requests.get('https://packagist.org/packages/list.json?vendor=drupal') + resp = requests.get( + 'https://packagist.org/packages/list.json?vendor=drupal', timeout=60 + ) if resp.status_code != 200: raise RuntimeError( diff --git a/scripts/precache_nodes.py b/scripts/precache_nodes.py index d91aa3b4..503a900f 100755 --- a/scripts/precache_nodes.py +++ b/scripts/precache_nodes.py @@ -26,7 +26,7 @@ def fetch_drupal_nodes(nids: list[str], retry: bool = True) -> list[drupal.Node] for nid in nids: url += f'nid[]={nid}&' - resp = requests.get(url, headers={'user-agent': user_agent}) + resp = requests.get(url, headers={'user-agent': user_agent}, timeout=60) if retry and resp.status_code == 429: seconds = int(resp.headers.get('Retry-After', 0)) diff --git a/scripts/validate_advisories.py b/scripts/validate_advisories.py index 935990d5..47f9e810 100755 --- a/scripts/validate_advisories.py +++ b/scripts/validate_advisories.py @@ -14,7 +14,8 @@ report_valid = False resp = requests.get( - 'https://raw.githubusercontent.com/ossf/osv-schema/refs/heads/main/validation/schema.json' + 'https://raw.githubusercontent.com/ossf/osv-schema/refs/heads/main/validation/schema.json', + timeout=60, ) if resp.status_code != 200: From bdda71adbd14a5179173e90458bdc663f527f543 Mon Sep 17 00:00:00 2001 From: Gareth Jones Date: Fri, 21 Aug 2026 12:39:36 +1200 Subject: [PATCH 3/4] chore: ignore S607 inline --- scripts/list_changed_advisories.py | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) diff --git a/scripts/list_changed_advisories.py b/scripts/list_changed_advisories.py index c13e90c6..da82d36f 100755 --- a/scripts/list_changed_advisories.py +++ b/scripts/list_changed_advisories.py @@ -8,7 +8,8 @@ import subprocess output = subprocess.check_output( - ['git', 'status', '--untracked-files', '--porcelain'], text=True + ['git', 'status', '--untracked-files', '--porcelain'], # noqa: S607 + text=True, ) for line in output.split('\n'): From 375f7d243980bc9e5fdcd86762b1b29afa7308c2 Mon Sep 17 00:00:00 2001 From: Gareth Jones Date: Fri, 21 Aug 2026 12:43:09 +1200 Subject: [PATCH 4/4] chore: allow `assert` to be used in tests --- ruff.toml | 5 +++++ 1 file changed, 5 insertions(+) diff --git a/ruff.toml b/ruff.toml index da2a0893..c2f44986 100644 --- a/ruff.toml +++ b/ruff.toml @@ -36,3 +36,8 @@ known-first-party = [ 'user_agent', 'typings' ] + +[lint.per-file-ignores] +"**/test_*.py" = [ + "S101" # allow using assert in tests +]