sentry/bin/scan

#!/bin/bash

ignored=(
    # djangorestframework, installed 2.4.8, affected <3.1.1, id 25804
    # Description: Escape tab switching cookie name in browsable API.
    # Reason: We do not use the browsable API
    25804
    # django, installed 1.6.11, affected <1.7.11, id 25714
    # Description: The get_format function in utils/formats.py in Django before 1.7.x before 1.7.11, 1.8.x before 1.8.7, and 1.9.x before 1.9rc2 might allow remote attackers to obtain sensitive application secrets via a settings key in place of a date/time format setting, as demonstrated by SECRET_KEY.
    # Reason: We don't leverage this feature.
    25714
    # django, installed 1.6.11, affected <1.7.6, id 25715
    # Description: Cross-site scripting (XSS) vulnerability in the contents function in admin/helpers.py in Django before 1.7.6 and 1.8 before 1.8b2 allows remote attackers to inject arbitrary web script or HTML via a model attribute in ModelAdmin.readonly_fields, as demonstrated by a @property.
    # Reason: We don't leverage this feature.
    25715
    # django, installed 1.6.11, affected <1.8.10, id 33073
    # Description: The utils.http.is_safe_url function in Django before 1.8.10 and 1.9.x before 1.9.3 allows remote attackers to redirect users to arbitrary web sites and conduct phishing attacks or possibly conduct cross-site scripting (XSS) attacks via a URL containing basic authentication, as demonstrated by http://mysite.example.com\@attacker.com.
    # Reason: We have already patched around this and use our own `is_safe_url` function pulled from Django 1.10.
    33073
    # django, installed 1.6.11, affected <1.8.10, id 33074
    # Description: The password hasher in contrib/auth/hashers.py in Django before 1.8.10 and 1.9.x before 1.9.3 allows remote attackers to enumerate users via a timing attack involving login requests
    # Reason: We don't leverage this feature, nor would a timing attack be viable due to rate limiting.
    33074
    # django, installed 1.6.11, affected <1.8.15, id 25718
    # Description: The cookie parsing code in Django before 1.8.15 and 1.9.x before 1.9.10, when used on a site with Google Analytics, allows remote attackers to bypass an intended CSRF protection mechanism by setting arbitrary cookies.
    # Reason: We have backported the patch.
    25718
    # django, installed 1.6.11, affected >=1.5,<1.7, id 25725
    # Description: The session backends in Django before 1.4.21, 1.5.x through 1.6.x, 1.7.x before 1.7.9, and 1.8.x before 1.8.3 allows remote attackers to cause a denial of service (session store consumption) via multiple requests with unique session keys.
    # Reason: This does not apply to us with the cookie based session backend.
    25725
)

args="--full-report"
for i in ${ignored[@]}; do
  args="$args --ignore=${i}"
done

exec safety check ${args}