Poc bandit

.github/change_filters.yml

@@ -1,12 +1,14 @@
 backend:
   - 'pyproject.toml'
+  - 'poetry.lock'
   - 'rasa/**/*'
   - 'tests/**/*'
   - 'data/**/*'
   - 'examples/**/*'
 
 docker:
   - 'pyproject.toml'
+  - 'poetry.lock'
   - 'rasa/**/*'
   - 'docker/**/*'
 

.github/workflows/continous-integration.yml

@@ -52,6 +52,7 @@ jobs:
 
     steps:
     - name: Checkout git repository 🕝
+      if: needs.changes.outputs.docs == 'true'
       uses: actions/checkout@v2
 
     - name: Set up Python 3.7 🐍
@@ -118,6 +119,7 @@ jobs:
 
     steps:
     - name: Checkout git repository 🕝
+      if: needs.changes.outputs.backend == 'true'
       uses: actions/checkout@v2
 
     - name: Set up Python 3.7 🐍
@@ -192,6 +194,7 @@ jobs:
 
     steps:
     - name: Checkout git repository 🕝
+      if: needs.changes.outputs.backend == 'true'
       uses: actions/checkout@v2
 
     - name: Set up Python ${{ matrix.python-version }} 🐍
@@ -290,6 +293,7 @@ jobs:
 
     steps:
     - name: Checkout git repository 🕝
+      if: needs.changes.outputs.docker == 'true'
       uses: actions/checkout@v2
 
     - name: Free disk space

.github/workflows/security-scans.yml

@@ -5,6 +5,21 @@ on:
     types: [opened, synchronize, labeled]
 
 jobs:
+  changes:
+    name: Check for file changes
+    runs-on: ubuntu-latest
+    outputs:
+      backend: ${{ steps.filter.outputs.backend }}
+      docker: ${{ steps.filter.outputs.docker }}
+      docs: ${{ steps.filter.outputs.docs }}
+    steps:
+      - uses: actions/checkout@v2
+      - uses: RasaHQ/pr-changed-files-filter@c4f7116a04b8a4596313469429e2ad235f59d9c4
+        id: filter
+        with:
+          token: ${{ secrets.GITHUB_TOKEN }}
+          filters: .github/change_filters.yml
+
   cleanup_runs:
     name: Cancel old branch builds
     runs-on: ubuntu-latest
@@ -27,3 +42,35 @@ jobs:
 
     - name: Gitleaks - detecting hardcoded secrets
       uses: zricethezav/gitleaks-action@v1.1.4
+
+  bandit:
+    name: Detect python security issues
+    runs-on: ubuntu-latest
+    needs: [changes]
+
+    steps:
+    - name: Checkout git repository 🕝
+      if: needs.changes.outputs.backend == 'true'
+      uses: actions/checkout@v2
+
+    - name: Set up Python 3.7 🐍
+      if: needs.changes.outputs.backend == 'true'
+      uses: actions/setup-python@v1
+      with:
+        python-version: 3.7
+
+    - name: Read Poetry Version 🔢
+      if: needs.changes.outputs.backend == 'true'
+      run: |
+        echo "POETRY_VERSION=$(scripts/poetry-version.sh)" >> $GITHUB_ENV
+      shell: bash
+
+    - name: Install poetry 🦄
+      if: needs.changes.outputs.backend == 'true'
+      uses: Gr1N/setup-poetry@v4
+      with:
+        poetry-version: ${{ env.POETRY_VERSION }}
+
+    - name: Run Bandit 🔪
+      if: needs.changes.outputs.backend == 'true'
+      run: make lint-security

Makefile

@@ -18,6 +18,8 @@ help:
 	@echo "        Check docstring conventions in changed files."
 	@echo "    types"
 	@echo "        Check for type errors using mypy."
+	@echo "    static-checks"
+	@echo "        Run all python static checks."
 	@echo "    prepare-tests-ubuntu"
 	@echo "        Install system requirements for running tests on Ubuntu and Debian based systems."
 	@echo "    prepare-tests-macos"
@@ -79,6 +81,10 @@ endif
 	# Diff of uncommitted changes for running locally
 	git diff HEAD -- rasa | poetry run flake8 --select D --diff
 
+lint-security:
+	poetry run pip install bandit\>=1.6.2,\<2.0
+	poetry run bandit -ll -ii -r --config bandit.yml rasa/*
+
 types:
 	# FIXME: working our way towards removing these
 	# see https://github.com/RasaHQ/rasa/pull/6470
@@ -103,6 +109,8 @@ types:
 	--disable-error-code no-redef \
 	--disable-error-code func-returns-value
 
+static-checks: lint lint-security types
+
 prepare-tests-files:
 	poetry install -E spacy
 	poetry run python -m spacy download en_core_web_md

bandit.yml

@@ -0,0 +1 @@
+skips: ['B322', 'B104', 'B301', 'B303']

changelog/7284.improvement.md

@@ -0,0 +1,2 @@
+Run [`bandit`](https://bandit.readthedocs.io/en/latest/) checks on pull requests.
+Introduce `make static-checks` command to run all static checks locally.

rasa/core/tracker_store.py

@@ -935,7 +935,9 @@ def _create_database(engine: "Engine", db: Text):
 
         cursor = conn.connection.cursor()
         cursor.execute("COMMIT")
-        cursor.execute(f"SELECT 1 FROM pg_catalog.pg_database WHERE datname = '{db}'")
+        cursor.execute(
+            "SELECT 1 FROM pg_catalog.pg_database WHERE datname = ?", (db,)  # nosec
+        )
         exists = cursor.fetchone()
         if not exists:
             try: