Repository: PyCQA/bandit
Pull request #470 (2019-04-08 18:27:30)

Remove pycryptodome blacklist
Credits to @ghugo for the actual fix. Opening a new PR since they haven't updated #417 fixing the build.

ghugo: Thanks for picking this back up @mikespallino

Patch:
diff --git a/README.rst b/README.rst
index 7c8af9c..9886620 100644
--- a/README.rst
+++ b/README.rst
@@ -229,7 +229,6 @@ Usage::
       B411  import_xmlrpclib
       B412  import_httpoxy
       B413  import_pycrypto
-      B414  import_pycryptodome
       B501  request_with_no_cert_validation
       B502  ssl_with_bad_version
       B503  ssl_with_bad_defaults
diff --git a/bandit/blacklists/imports.py b/bandit/blacklists/imports.py
index aa4ca3e..cf73761 100644
--- a/bandit/blacklists/imports.py
+++ b/bandit/blacklists/imports.py
@@ -202,6 +202,9 @@ library.
 
 B414: import_pycryptodome
 -------------------------
+This import blacklist has been removed. The information here has been
+left for historical purposes.
+
 pycryptodome is a direct fork of pycrypto that has not fully addressed
 the issues inherent in PyCrypto.  It seems to exist, mainly, as an API
 compatible continuation of pycrypto and should be deprecated in favor
@@ -323,18 +326,4 @@ def gen_blacklist():
         'maintained and have been deprecated. '
         'Consider using pyca/cryptography library.', 'HIGH'))
 
-    sets.append(utils.build_conf_dict(
-        'import_pycryptodome', 'B414',
-        ['Cryptodome.Cipher',
-         'Cryptodome.Hash',
-         'Cryptodome.IO',
-         'Cryptodome.Protocol',
-         'Cryptodome.PublicKey',
-         'Cryptodome.Random',
-         'Cryptodome.Signature',
-         'Cryptodome.Util'],
-        'The pycryptodome library is not considered a secure alternative '
-        'to pycrypto.'
-        'Consider using pyca/cryptography library.', 'HIGH'))
-
     return {'Import': sets, 'ImportFrom': sets, 'Call': sets}


Test patch:
diff --git a/tests/functional/test_functional.py b/tests/functional/test_functional.py
index 2a48ce2..440ccf5 100644
--- a/tests/functional/test_functional.py
+++ b/tests/functional/test_functional.py
@@ -121,16 +121,16 @@ class FunctionalTests(testtools.TestCase):
     def test_crypto_md5(self):
         '''Test the `hashlib.md5` example.'''
         expect = {
-            'SEVERITY': {'UNDEFINED': 0, 'LOW': 0, 'MEDIUM': 15, 'HIGH': 8},
-            'CONFIDENCE': {'UNDEFINED': 0, 'LOW': 0, 'MEDIUM': 0, 'HIGH': 23}
+            'SEVERITY': {'UNDEFINED': 0, 'LOW': 0, 'MEDIUM': 15, 'HIGH': 4},
+            'CONFIDENCE': {'UNDEFINED': 0, 'LOW': 0, 'MEDIUM': 0, 'HIGH': 19}
         }
         self.check_example('crypto-md5.py', expect)
 
     def test_ciphers(self):
         '''Test the `Crypto.Cipher` example.'''
         expect = {
-            'SEVERITY': {'UNDEFINED': 0, 'LOW': 0, 'MEDIUM': 1, 'HIGH': 26},
-            'CONFIDENCE': {'UNDEFINED': 0, 'LOW': 0, 'MEDIUM': 0, 'HIGH': 27}
+            'SEVERITY': {'UNDEFINED': 0, 'LOW': 0, 'MEDIUM': 1, 'HIGH': 21},
+            'CONFIDENCE': {'UNDEFINED': 0, 'LOW': 0, 'MEDIUM': 0, 'HIGH': 22}
         }
         self.check_example('ciphers.py', expect)
 
@@ -678,8 +678,8 @@ class FunctionalTests(testtools.TestCase):
     def test_weak_cryptographic_key(self):
         '''Test for weak key sizes.'''
         expect = {
-            'SEVERITY': {'UNDEFINED': 0, 'LOW': 0, 'MEDIUM': 8, 'HIGH': 10},
-            'CONFIDENCE': {'UNDEFINED': 0, 'LOW': 0, 'MEDIUM': 0, 'HIGH': 18}
+            'SEVERITY': {'UNDEFINED': 0, 'LOW': 0, 'MEDIUM': 8, 'HIGH': 8},
+            'CONFIDENCE': {'UNDEFINED': 0, 'LOW': 0, 'MEDIUM': 0, 'HIGH': 16}
         }
         self.check_example('weak_cryptographic_key_sizes.py', expect)
 
@@ -787,10 +787,13 @@ class FunctionalTests(testtools.TestCase):
         }
         self.check_example('pycrypto.py', expect)
 
-    def test_blacklist_pycryptodome(self):
-        '''Test importing pycryptodome module'''
+    def test_no_blacklist_pycryptodome(self):
+        '''Test importing pycryptodome module
+
+        make sure it's no longer blacklisted
+        '''
         expect = {
-            'SEVERITY': {'UNDEFINED': 0, 'LOW': 0, 'MEDIUM': 0, 'HIGH': 2},
-            'CONFIDENCE': {'UNDEFINED': 0, 'LOW': 0, 'MEDIUM': 0, 'HIGH': 2}
+            'SEVERITY': {'UNDEFINED': 0, 'LOW': 0, 'MEDIUM': 0, 'HIGH': 0},
+            'CONFIDENCE': {'UNDEFINED': 0, 'LOW': 0, 'MEDIUM': 0, 'HIGH': 0}
         }
         self.check_example('pycryptodome.py', expect)