Paramiko injection test not testing SSHClient.invoke_shell() properly

[rajathagasthya]

While working on #374, I noticed that the paramiko injection test is not actually testing SSHClient.invoke_shell() because it can't resolve SSHClient and the function call is wrong.

Should be:

import paramiko

ssh_client = paramiko.client.SSHClient()
ssh_client.invoke_shell()

Instead of:

import paramiko

SSHClient.invoke_shell('something; bad; here\n')

Expected behavior
Bandit should flag SSHClient.invoke_shell() correctly.

Bandit version

1.5.0

[ericwb]

Actually, I agree that the paramiko example is wrong. However, Bandit is still able to flag the problems. Here's the result after changing the example:

browne-a01:bandit browne$ .tox/py36/bin/bandit examples/paramiko_injection.py 
[main]	INFO	profile include tests: None
[main]	INFO	profile exclude tests: None
[main]	INFO	cli include tests: None
[main]	INFO	cli exclude tests: None
[main]	INFO	running on Python 3.6.5
Run started:2018-08-27 18:01:15.265128

Test results:
>> Issue: [B601:paramiko_calls] Possible shell injection via Paramiko call, check inputs are properly sanitized.
   Severity: Medium   Confidence: Medium
   Location: examples/paramiko_injection.py:7
   More Info: https://bandit.readthedocs.io/en/latest/plugins/b601_paramiko_calls.html
6	# this is not safe
7	client.exec_command('something; really; unsafe')
8	

--------------------------------------------------
>> Issue: [B601:paramiko_calls] Possible shell injection via Paramiko call, check inputs are properly sanitized.
   Severity: Medium   Confidence: Medium
   Location: examples/paramiko_injection.py:13
   More Info: https://bandit.readthedocs.io/en/latest/plugins/b601_paramiko_calls.html
12	# this is not safe
13	client.invoke_shell('something; bad; here\n')

[ericwb]

Fixed with #377