src/depends.py

@@ -361,7 +361,7 @@ def check_curses():
         return False
 
     try:
-        subprocess.check_call(['which', 'dialog'])
+        subprocess.check_call(['which', 'dialog'])  # nosec:B603, B607
     except subprocess.CalledProcessError:
         logger.error(
             'Curses requires the `dialog` command to be installed as well as'

src/helper_startup.py

@@ -12,6 +12,7 @@ import sys
 import time
 from distutils.version import StrictVersion
 from struct import pack
+from six.moves import configparser
 
 try:
     import defaults
@@ -218,7 +219,8 @@ def updateConfig():
                 config.set(
                     addressInKeysFile, 'payloadlengthextrabytes',
                     str(int(previousSmallMessageDifficulty * 1000)))
-            except Exception:
+            except (ValueError, TypeError, configparser.NoSectionError,
+                    configparser.NoOptionError):
                 continue
         config.set('bitmessagesettings', 'maxdownloadrate', '0')
         config.set('bitmessagesettings', 'maxuploadrate', '0')

src/network/bmproto.py

@@ -610,7 +610,7 @@ class BMProto(AdvancedDispatcher, ObjectTracker):
                         'Closed connection to %s because we are already'
                         ' connected to that IP.', self.destination)
                     return False
-            except Exception:  # TODO: exception types
+            except Exception:  # nosec:B110 pylint:disable=broad-exception-caught
                 pass
         if not self.isOutbound:
             # incoming from a peer we're connected to as outbound,

src/plugins/sound_playfile.py

@@ -11,14 +11,14 @@ try:
         winsound.PlaySound(sound_file, winsound.SND_FILENAME)
 except ImportError:
     import os
-    import subprocess
+    import subprocess  # nosec:B404
 
     play_cmd = {}
 
     def _subprocess(*args):
         FNULL = open(os.devnull, 'wb')
         subprocess.call(
-            args, stdout=FNULL, stderr=subprocess.STDOUT, close_fds=True)
+            args, stdout=FNULL, stderr=subprocess.STDOUT, close_fds=True)  # nosec:B603
 
     def connect_plugin(sound_file):
         """This function implements the entry point."""

src/proofofwork.py

@@ -10,7 +10,7 @@ import sys
 import tempfile
 import time
 from struct import pack, unpack
-from subprocess import call
+from subprocess import call  # nosec:B404
 
 import openclpow
 import paths
@@ -135,7 +135,7 @@ def _doFastPoW(target, initialHash):
             try:
                 pool.terminate()
                 pool.join()
-            except:  # noqa:E722
+            except:  # nosec:B110 noqa:E722 pylint:disable=bare-except
                 pass
             raise StopIteration("Interrupted")
         for i in range(pool_size):
@@ -272,10 +272,11 @@ def buildCPoW():
     try:
         if "bsd" in sys.platform:
             # BSD make
-            call(["make", "-C", os.path.join(paths.codePath(), "bitmsghash"), '-f', 'Makefile.bsd'])
+            call(["make", "-C", os.path.join(paths.codePath(), "bitmsghash"),
+                  '-f', 'Makefile.bsd'])  # nosec:B607, B603
         else:
             # GNU make
-            call(["make", "-C", os.path.join(paths.codePath(), "bitmsghash")])
+            call(["make", "-C", os.path.join(paths.codePath(), "bitmsghash")])  # nosec:B607, B603
         if os.path.exists(os.path.join(paths.codePath(), "bitmsghash", "bitmsghash.so")):
             init()
             notifyBuild(True)

src/shared.py

@@ -11,7 +11,7 @@ from __future__ import division
 import hashlib
 import os
 import stat
-import subprocess
+import subprocess  # nosec:B404
 import sys
 from binascii import hexlify
 

src/singleinstance.py

@@ -93,7 +93,7 @@ class singleinstance(object):
                         os.close(self.fd)
                 else:
                     fcntl.lockf(self.fp, fcntl.LOCK_UN)
-            except Exception:
+            except (IOError, OSError):
                 pass
 
             return
@@ -107,5 +107,5 @@ class singleinstance(object):
                 fcntl.lockf(self.fp, fcntl.LOCK_UN)
                 if os.path.isfile(self.lockfile):
                     os.unlink(self.lockfile)
-        except Exception:
+        except (IOError, OSError):
             pass

src/upnp.py

@@ -5,12 +5,14 @@ Reference: http://mattscodecave.com/posts/using-python-and-upnp-to-forward-a-por
 """
 
 import httplib
+import re
 import socket
 import time
 import urllib2
 from random import randint
 from urlparse import urlparse
-from xml.dom.minidom import Document, parseString
+from xml.dom.minidom import Document  # nosec:B408
+from defusedxml.minidom import parseString
 
 import queues
 import state
@@ -119,7 +121,7 @@ class Router:  # pylint: disable=old-style-class
             if service.childNodes[0].data.find('WANIPConnection') > 0 or \
                     service.childNodes[0].data.find('WANPPPConnection') > 0:
                 self.path = service.parentNode.getElementsByTagName('controlURL')[0].childNodes[0].data
-                self.upnp_schema = service.childNodes[0].data.split(':')[-2]
+                self.upnp_schema = re.sub(r'[^A-Za-z0-9:-]', '', service.childNodes[0].data.split(':')[-2])
 
     def AddPortMapping(
             self,
@@ -239,7 +241,7 @@ class uPnPThread(StoppableThread):
             if time.time() - lastSent > self.sendSleep and not self.routers:
                 try:
                     self.sendSearchRouter()
-                except:  # noqa:E722
+                except:  # nosec:B110 noqa:E722 pylint:disable=bare-except
                     pass
                 lastSent = time.time()
             try:
@@ -279,11 +281,11 @@ class uPnPThread(StoppableThread):
                     self.createPortMapping(router)
         try:
             self.sock.shutdown(socket.SHUT_RDWR)
-        except:  # noqa:E722
+        except (IOError, OSError):  # noqa:E722
             pass
         try:
             self.sock.close()
-        except:  # noqa:E722
+        except (IOError, OSError):  # noqa:E722
             pass
         deleted = False
         for router in self.routers: