Repository: freedomofpress/securedrop

Issue:
New bandit failures
```
Test results:
>> Issue: [B113:request_without_timeout] Requests call without timeout
   Severity: Medium   Confidence: Low
   CWE: CWE-400 (https://cwe.mitre.org/data/definitions/400.html)
   More Info: https://bandit.readthedocs.io/en/1.7.5/plugins/b113_request_without_timeout.html
   Location: ./admin/tests/test_integration.py:591:21
590	    )
591	    latest_release = requests.get(github_url).json()
592	    latest_tag = str(latest_release["tag_name"])

--------------------------------------------------
>> Issue: [B113:request_without_timeout] Requests call without timeout
   Severity: Medium   Confidence: Low
   CWE: CWE-400 (https://cwe.mitre.org/data/definitions/400.html)
   More Info: https://bandit.readthedocs.io/en/1.7.5/plugins/b113_request_without_timeout.html
   Location: ./admin/tests/test_integration.py:664:21
663	    )
664	    latest_release = requests.get(github_url).json()
665	    latest_tag = str(latest_release["tag_name"])

--------------------------------------------------
>> Issue: [B608:hardcoded_sql_expressions] Possible SQL injection vector through string-based query construction.
   Severity: Medium   Confidence: Medium
   CWE: CWE-89 (https://cwe.mitre.org/data/definitions/89.html)
   More Info: https://bandit.readthedocs.io/en/1.7.5/plugins/b608_hardcoded_sql_expressions.html
   Location: ./securedrop/alembic/versions/2e24fc7536e8_make_journalist_id_non_nullable.py:75:12
74	        result = conn.execute(  # nosec
75	            f"SELECT 1 FROM {table} WHERE journalist_id IS NULL;"
76	        ).first()

--------------------------------------------------
>> Issue: [B608:hardcoded_sql_expressions] Possible SQL injection vector through string-based query construction.
   Severity: Medium   Confidence: Low
   CWE: CWE-89 (https://cwe.mitre.org/data/definitions/89.html)
   More Info: https://bandit.readthedocs.io/en/1.7.5/plugins/b608_hardcoded_sql_expressions.html
   Location: ./securedrop/alembic/versions/2e24fc7536e8_make_journalist_id_non_nullable.py:92:16
91	            sa.text(
92	                f"UPDATE OR IGNORE {table} SET journalist_id=:journalist_id "
93	                "WHERE journalist_id IS NULL;"
94	            ).bindparams(journalist_id=deleted_id)

--------------------------------------------------
```


Discussion:

Resolving patch:
diff --git a/securedrop/alembic/versions/2e24fc7536e8_make_journalist_id_non_nullable.py b/securedrop/alembic/versions/2e24fc7536e8_make_journalist_id_non_nullable.py
--- a/securedrop/alembic/versions/2e24fc7536e8_make_journalist_id_non_nullable.py
+++ b/securedrop/alembic/versions/2e24fc7536e8_make_journalist_id_non_nullable.py
@@ -71,8 +71,8 @@ def migrate_nulls() -> None:
     needs_migration = []
     conn = op.get_bind()
     for table in tables:
-        result = conn.execute(  # nosec
-            f"SELECT 1 FROM {table} WHERE journalist_id IS NULL;"
+        result = conn.execute(
+            f"SELECT 1 FROM {table} WHERE journalist_id IS NULL;"  # nosec
         ).first()
         if result is not None:
             needs_migration.append(table)
@@ -89,7 +89,7 @@ def migrate_nulls() -> None:
         # unique key violations.
         op.execute(
             sa.text(
-                f"UPDATE OR IGNORE {table} SET journalist_id=:journalist_id "
+                f"UPDATE OR IGNORE {table} SET journalist_id=:journalist_id "  # nosec
                 "WHERE journalist_id IS NULL;"
             ).bindparams(journalist_id=deleted_id)
         )


Test patch:
diff --git a/admin/tests/test_integration.py b/admin/tests/test_integration.py
--- a/admin/tests/test_integration.py
+++ b/admin/tests/test_integration.py
@@ -588,7 +588,7 @@ def test_check_for_update_when_updates_not_needed(securedrop_git_repo):
     github_url = (
         "https://api.github.com/repos/freedomofpress/securedrop/releases/latest"  # noqa: E501
     )
-    latest_release = requests.get(github_url).json()
+    latest_release = requests.get(github_url, timeout=60).json()
     latest_tag = str(latest_release["tag_name"])
 
     subprocess.check_call(["git", "checkout", latest_tag])
@@ -661,7 +661,7 @@ def test_update_with_duplicate_branch_and_tag(securedrop_git_repo):
     github_url = (
         "https://api.github.com/repos/freedomofpress/securedrop/releases/latest"  # noqa: E501
     )
-    latest_release = requests.get(github_url).json()
+    latest_release = requests.get(github_url, timeout=60).json()
     latest_tag = str(latest_release["tag_name"])
 
     # Create a branch with the same name as a tag.