Merge pull request #57 from sentinel-hub/chore/satisfy-qgis-scanner

Chore/satisfy qgis scanner

Author: lovenjak

README.md

@@ -55,6 +55,13 @@ pylint SentinelHub
 
 ### Release
 
+- Verify the plugin passes the checks that the [QGIS plugin repository runs on upload](https://plugins.qgis.org/docs/security-scanning). Bandit and detect-secrets findings are blocking; flake8 is informational but worth resolving:
+```bash
+pip install bandit detect-secrets flake8
+bandit -r SentinelHub/ -x SentinelHub/tests
+detect-secrets scan SentinelHub/
+flake8 SentinelHub/
+```
 - Package code into a zip file using `pb_tool`
 ```bash
 cd ./SentinelHub

SentinelHub/sentinelhub/configuration.py

@@ -108,9 +108,10 @@ def get_layer(self, instance_id, layer_id, load_url=False):
         if load_url and data_source.service_url is None:
             # Copernicus Dataspace uses different API endpoint
             if self.settings.base_url == "https://sh.dataspace.copernicus.eu":
-                url = f"{self.settings.base_url}/api/v2/configuration/datasets/{data_source.type}/sources/{data_source.id}"
+                base = f"{self.settings.base_url}/api/v2/configuration"
             else:
-                url = f"{self.configuration_url}/datasets/{data_source.type}/sources/{data_source.id}"
+                base = self.configuration_url
+            url = f"{base}/datasets/{data_source.type}/sources/{data_source.id}"
             result = self.client.download(url, session_settings=self.settings).json()
 
             data_source.name = result["description"]

SentinelHub/settings.py

@@ -15,7 +15,8 @@ class Settings:
 
     base_url = ""
     client_id = ""
-    client_secret = ""
+    # Placeholder default, populated from QSettings at runtime
+    client_secret = ""  # nosec B105
 
     instance_id = ""
     service_type = ServiceType.WMS