Enable some more bandit checks (#30857)

* Enable B108 (hardcoded tmp dir), address findings

* Enable B602 (subprocess popen with shell), address findings

* Enable B604 (start process with shell), address findings

* Enable B306 (mktemp), B307 (eval), and B325 (tempnam), no issues to address

tests/components/automation/test_litejet.py

@@ -54,7 +54,7 @@ def mock_lj(hass):
         mock_lj.on_switch_pressed.side_effect = on_switch_pressed
         mock_lj.on_switch_released.side_effect = on_switch_released
 
-        config = {"litejet": {"port": "/tmp/this_will_be_mocked"}}
+        config = {"litejet": {"port": "/dev/serial/by-id/mock-litejet"}}
         assert hass.loop.run_until_complete(
             setup.async_setup_component(hass, litejet.DOMAIN, config)
         )

tests/components/camera/test_init.py

@@ -102,7 +102,7 @@ async def test_snapshot_service(hass, mock_camera):
     with patch(
         "homeassistant.components.camera.open", mopen, create=True
     ), patch.object(hass.config, "is_allowed_path", return_value=True):
-        common.async_snapshot(hass, "/tmp/bla")
+        common.async_snapshot(hass, "/test/snapshot.jpg")
         await hass.async_block_till_done()
 
         mock_write = mopen().write

tests/components/command_line/test_cover.py

@@ -44,7 +44,9 @@ def test_query_state_value(rs):
         result = rs._query_state_value("runme")
         assert "foo bar" == result
         assert mock_run.call_count == 1
-        assert mock_run.call_args == mock.call("runme", shell=True)
+        assert mock_run.call_args == mock.call(
+            "runme", shell=True,  # nosec # shell by design
+        )
 
 
 async def test_state_value(hass):

tests/components/fail2ban/test_sensor.py

@@ -97,7 +97,7 @@ class TestBanSensor(unittest.TestCase):
 
     def test_single_ban(self):
         """Test that log is parsed correctly for single ban."""
-        log_parser = BanLogParser("/tmp")
+        log_parser = BanLogParser("/test/fail2ban.log")
         sensor = BanSensor("fail2ban", "jail_one", log_parser)
         assert sensor.name == "fail2ban jail_one"
         mock_fh = MockOpen(read_data=fake_log("single_ban"))
@@ -112,7 +112,7 @@ class TestBanSensor(unittest.TestCase):
 
     def test_ipv6_ban(self):
         """Test that log is parsed correctly for IPV6 bans."""
-        log_parser = BanLogParser("/tmp")
+        log_parser = BanLogParser("/test/fail2ban.log")
         sensor = BanSensor("fail2ban", "jail_one", log_parser)
         assert sensor.name == "fail2ban jail_one"
         mock_fh = MockOpen(read_data=fake_log("ipv6_ban"))
@@ -127,7 +127,7 @@ class TestBanSensor(unittest.TestCase):
 
     def test_multiple_ban(self):
         """Test that log is parsed correctly for multiple ban."""
-        log_parser = BanLogParser("/tmp")
+        log_parser = BanLogParser("/test/fail2ban.log")
         sensor = BanSensor("fail2ban", "jail_one", log_parser)
         assert sensor.name == "fail2ban jail_one"
         mock_fh = MockOpen(read_data=fake_log("multi_ban"))
@@ -148,7 +148,7 @@ class TestBanSensor(unittest.TestCase):
 
     def test_unban_all(self):
         """Test that log is parsed correctly when unbanning."""
-        log_parser = BanLogParser("/tmp")
+        log_parser = BanLogParser("/test/fail2ban.log")
         sensor = BanSensor("fail2ban", "jail_one", log_parser)
         assert sensor.name == "fail2ban jail_one"
         mock_fh = MockOpen(read_data=fake_log("unban_all"))
@@ -166,7 +166,7 @@ class TestBanSensor(unittest.TestCase):
 
     def test_unban_one(self):
         """Test that log is parsed correctly when unbanning one ip."""
-        log_parser = BanLogParser("/tmp")
+        log_parser = BanLogParser("/test/fail2ban.log")
         sensor = BanSensor("fail2ban", "jail_one", log_parser)
         assert sensor.name == "fail2ban jail_one"
         mock_fh = MockOpen(read_data=fake_log("unban_one"))
@@ -184,7 +184,7 @@ class TestBanSensor(unittest.TestCase):
 
     def test_multi_jail(self):
         """Test that log is parsed correctly when using multiple jails."""
-        log_parser = BanLogParser("/tmp")
+        log_parser = BanLogParser("/test/fail2ban.log")
         sensor1 = BanSensor("fail2ban", "jail_one", log_parser)
         sensor2 = BanSensor("fail2ban", "jail_two", log_parser)
         assert sensor1.name == "fail2ban jail_one"
@@ -205,7 +205,7 @@ class TestBanSensor(unittest.TestCase):
 
     def test_ban_active_after_update(self):
         """Test that ban persists after subsequent update."""
-        log_parser = BanLogParser("/tmp")
+        log_parser = BanLogParser("/test/fail2ban.log")
         sensor = BanSensor("fail2ban", "jail_one", log_parser)
         assert sensor.name == "fail2ban jail_one"
         mock_fh = MockOpen(read_data=fake_log("single_ban"))

tests/components/litejet/test_light.py

@@ -50,7 +50,9 @@ class TestLiteJetLight(unittest.TestCase):
         self.mock_lj.on_load_deactivated.side_effect = on_load_deactivated
 
         assert setup.setup_component(
-            self.hass, litejet.DOMAIN, {"litejet": {"port": "/tmp/this_will_be_mocked"}}
+            self.hass,
+            litejet.DOMAIN,
+            {"litejet": {"port": "/dev/serial/by-id/mock-litejet"}},
         )
         self.hass.block_till_done()
 

tests/components/litejet/test_scene.py

@@ -37,7 +37,9 @@ class TestLiteJetScene(unittest.TestCase):
         self.mock_lj.get_scene_name.side_effect = get_scene_name
 
         assert setup.setup_component(
-            self.hass, litejet.DOMAIN, {"litejet": {"port": "/tmp/this_will_be_mocked"}}
+            self.hass,
+            litejet.DOMAIN,
+            {"litejet": {"port": "/dev/serial/by-id/mock-litejet"}},
         )
         self.hass.block_till_done()
 

tests/components/litejet/test_switch.py

@@ -48,7 +48,7 @@ class TestLiteJetSwitch(unittest.TestCase):
         self.mock_lj.on_switch_pressed.side_effect = on_switch_pressed
         self.mock_lj.on_switch_released.side_effect = on_switch_released
 
-        config = {"litejet": {"port": "/tmp/this_will_be_mocked"}}
+        config = {"litejet": {"port": "/dev/serial/by-id/mock-litejet"}}
         if method == self.test_include_switches_False:
             config["litejet"]["include_switches"] = False
         elif method != self.test_include_switches_unspecified:

tests/components/minio/test_minio.py

@@ -55,7 +55,7 @@ def minio_client_event_fixture():
 
 async def test_minio_services(hass, caplog, minio_client):
     """Test Minio services."""
-    hass.config.whitelist_external_dirs = set("/tmp")
+    hass.config.whitelist_external_dirs = set("/test")
 
     await async_setup_component(
         hass,
@@ -80,22 +80,22 @@ async def test_minio_services(hass, caplog, minio_client):
     await hass.services.async_call(
         DOMAIN,
         "put",
-        {"file_path": "/tmp/some_file", "key": "some_key", "bucket": "some_bucket"},
+        {"file_path": "/test/some_file", "key": "some_key", "bucket": "some_bucket"},
         blocking=True,
     )
     assert minio_client.fput_object.call_args == call(
-        "some_bucket", "some_key", "/tmp/some_file"
+        "some_bucket", "some_key", "/test/some_file"
     )
     minio_client.reset_mock()
 
     await hass.services.async_call(
         DOMAIN,
         "get",
-        {"file_path": "/tmp/some_file", "key": "some_key", "bucket": "some_bucket"},
+        {"file_path": "/test/some_file", "key": "some_key", "bucket": "some_bucket"},
         blocking=True,
     )
     assert minio_client.fget_object.call_args == call(
-        "some_bucket", "some_key", "/tmp/some_file"
+        "some_bucket", "some_key", "/test/some_file"
     )
     minio_client.reset_mock()
 

tests/components/tomato/test_device_tracker.py

@@ -137,7 +137,7 @@ def test_config_verify_ssl_but_no_ssl_enabled(hass, mock_session_send):
                 CONF_HOST: "tomato-router",
                 CONF_PORT: 1234,
                 CONF_SSL: False,
-                CONF_VERIFY_SSL: "/tmp/tomato.crt",
+                CONF_VERIFY_SSL: "/test/tomato.crt",
                 CONF_USERNAME: "foo",
                 CONF_PASSWORD: "password",
                 tomato.CONF_HTTP_ID: "1234567890",
@@ -171,7 +171,7 @@ def test_config_valid_verify_ssl_path(hass, mock_session_send):
                 CONF_HOST: "tomato-router",
                 CONF_PORT: 1234,
                 CONF_SSL: True,
-                CONF_VERIFY_SSL: "/tmp/tomato.crt",
+                CONF_VERIFY_SSL: "/test/tomato.crt",
                 CONF_USERNAME: "bar",
                 CONF_PASSWORD: "foo",
                 tomato.CONF_HTTP_ID: "0987654321",
@@ -189,7 +189,7 @@ def test_config_valid_verify_ssl_path(hass, mock_session_send):
     assert "exec=devlist" in result.req.body
     assert mock_session_send.call_count == 1
     assert mock_session_send.mock_calls[0] == mock.call(
-        result.req, timeout=3, verify="/tmp/tomato.crt"
+        result.req, timeout=3, verify="/test/tomato.crt"
     )