feat: add ASH, Bandit and CDK Nag

[jaidisido]

Feature or Bugfix

• Feature

Detail

Add ASH, Bandit and CDK Nag security checks.

By submitting this pull request, I confirm that my contribution is made under the terms of the Apache 2.0 license.

[jaidisido]

Some initial comments, still WIP

[dbalintx]

The new Bandit job fails due to 2 occurences of Popen calls with the argument "shell=True" which basically makes the process to be executed via shell.
We have a couple of other occurences in the repo where this finding is suppressed with the "# nosec" tag, eg. in the cdk_cli_wrapper

The bandit guideline suggests that the input which is executed in the shell should be properly sanitized / checked to mitigate the risk.

@dlpzx How do you want to proceed? Should we simply suppress this warning to get this PR merged, or do you want to have first some input sanitization steps to be implemented, everywhere where this "shell=True" option is used?

[jaidisido]

The new Bandit job fails due to 2 occurences of Popen calls with the argument "shell=True" which basically makes the process to be executed via shell. We have a couple of other occurences in the repo where this finding is suppressed with the "# nosec" tag, eg. in the cdk_cli_wrapper

The bandit guideline suggests that the input which is executed in the shell should be properly sanitized / checked to mitigate the risk.

@dlpzx How do you want to proceed? Should we simply suppress this warning to get this PR merged, or do you want to have first some input sanitization steps to be implemented, everywhere where this "shell=True" option is used?

@dbalintx thanks for the input. Agreed - the # nosec comments should be removed and some time should be spent by the team implementing input sanitization for all subprocess calls. semgrep has a guide with mitigation suggestions for example

[dlpzx]

I agree @dbalintx , we should fix and not ignore the issues. In this other PR #536 I added semgrep and it points out to the same issue

[dlpzx]

@noah-paige @jaidisido, I added some #nosec comments for the shell-true findings. There is a separate issue to track the fix, which has been added to milestone 2.1.0

[noah-paige]

Looks good - approving this PR