Bandit 1.6.3 does not respect excluded paths from .bandit file #657

budgester · 2020-12-07T12:37:41Z

With a .bandit file with the contents

[bandit]
exclude: ./.tox,./tests

1.6.2 gives

$ bandit -r -ll -ii .
[main]	INFO	Found project level .bandit file: ./.bandit
[main]	INFO	Using ini file for excluded paths
[main]	INFO	Using command line arg for selected targets
[main]	INFO	profile include tests: None
[main]	INFO	profile exclude tests: None
[main]	INFO	cli include tests: None
[main]	INFO	cli exclude tests: None
[main]	INFO	running on Python 3.7.5
114 [0.. 50.. 100.. ]

1.6.3 ignores the exluded paths

$ bandit -r -ll -ii .
[main]	INFO	Found project level .bandit file: ./.bandit
[main]	INFO	Using command line arg for excluded paths
[main]	INFO	Using command line arg for selected targets
[main]	INFO	Using command line arg for recursive scan
[main]	INFO	Using command line arg for aggregate output type
[main]	INFO	Using command line arg for max code lines output for issue
[main]	INFO	Using command line arg for severity level
[main]	INFO	Using command line arg for confidence level
[main]	INFO	Using command line arg for output format
[main]	INFO	Using command line arg for output file
[main]	INFO	profile include tests: None
[main]	INFO	profile exclude tests: None
[main]	INFO	cli include tests: None
[main]	INFO	cli exclude tests: None
[main]	INFO	running on Python 3.7.5
549 [0.. 50.. 100.. 150.. 200.. 250.. 300.. 350.. 400.. 450.. 500.. ]

The text was updated successfully, but these errors were encountered:

Bandit 1.6.3 contains a bug with excluded paths: PyCQA/bandit#657

rjb3977 · 2020-12-07T20:20:11Z

To perhaps save a maintainer a couple minutes of searching, it looks to me like this commit most likely causes the breaking behavior.

Edit:
Also, the documentation for that command line parameter appears to be wrong: it says it should act in addition to the setting in the config file, whereas it actually overrides the setting in the config file.

xuhdev · 2020-12-07T22:53:21Z

I can also reproduce this regression.

Due to PyCQA/bandit#657 Signed-off-by: Kevin Locke <[email protected]>

sirkonst · 2020-12-14T07:56:47Z

Still broken in 1.7.0 :-(

syphar · 2020-12-14T12:17:16Z

We also ran into this issue when upgrading from 1.6.2 to 1.7.0

what could be a proposed fix? I don't know the codebase (yet), but could help

codingjoe · 2020-12-15T10:23:25Z

I believe this commit has broken things:
ca6d283

What's interesting though, skips works just fine, thought it seems implemented the same way.

rjb3977 · 2020-12-15T15:03:32Z

I believe this commit has broken things:
ca6d283

What's interesting though, skips works just fine, thought it seems implemented the same way.

I'm still pretty sure that 5ac8b8b is the culprit. It added a default value for the excluded paths command line argument. That argument overrides the configuration file's excluded paths, rather than merging with it, like the documentation / help message suggests. So now, the excluded paths in the configuration file are always overridden.

codingjoe · 2020-12-15T15:21:33Z

Yes, you are right, the default seems to be the problem. It needs to be added at a later point.

rjb3977 · 2020-12-15T16:24:19Z

Yes, you are right, the default seems to be the problem. It needs to be added at a later point.

Or it could be made so that the command line argument does in fact merge with the config file's exclusions. The help text for that argument says "note that these are in addition to the excluded paths provided in the config file", which is incorrect.

codingjoe · 2020-12-15T19:00:24Z

Yes, you are right, the default seems to be the problem. It needs to be added at a later point.

Or it could be made so that the command line argument does in fact merge with the config file's exclusions. The help text for that argument says "note that these are in addition to the excluded paths provided in the config file", which is incorrect.

No, I wouldn't do that. That would be backwards incompatible, and we won't see a fix released until kingdom come.

Fix PyCQA#657

For the same reason we did it in: uktrade/lite-api#666 because of an upstream bug in 1.6.3: PyCQA/bandit#657

Until PyCQA/bandit#657 is fixed, specify --excludes when invoking bandit. Remove version exclusion for bandit 1.6.3 since 1.7.0 has the same issue. Signed-off-by: Kevin Locke <[email protected]>

xuhdev · 2021-06-16T23:46:46Z

Is there a conclusion to this issue?

iflament · 2022-02-01T03:31:36Z

running into this issue as well - has there been a fix?

shtalinberg · 2022-09-05T09:15:15Z

Release 1.7.4 - not resolved (

…onsidered (relates to PyCQA/bandit#657)

oijkn · 2023-01-02T17:09:43Z

I confirm, last version doesn't fix the problem, it still scans the .venv directory.

bandit -r -x "$(pwd)/.venv/" .

Edit:

With this command that works good :

bandit -r . -x */.venv/*

shtalinberg · 2023-03-15T10:24:18Z

Looks like Release 1.7.5 - resolved it!? works fine for me

kevinoid · 2023-03-17T20:13:11Z

If I run the following script:

echo 'assert 2 > 1' >assert.py
cat >.bandit <<BANDIT
[bandit]
exclude: assert.py
BANDIT
bandit -r .

The test fails with "Issue: [B101:assert_used]..." on 1.7.0 and passes with "No issues identified." in 1.7.1. Bisecting shows that this was fixed by #722.

captaingabi · 2024-07-15T21:49:01Z

Still an issue with 1.7.9

kerin added a commit to uktrade/lite-api that referenced this issue Dec 7, 2020

Pin bandit to v1.6.2

b3ca6a5

Bandit 1.6.3 contains a bug with excluded paths: PyCQA/bandit#657

kerin mentioned this issue Dec 7, 2020

Pin bandit version uktrade/lite-api#666

Merged

ericwb added the bug Something isn't working label Dec 7, 2020

kevinoid added a commit to kevinoid/python-project-template that referenced this issue Dec 8, 2020

Exclude bandit 1.6.3 in requirements

f6cad22

Due to PyCQA/bandit#657 Signed-off-by: Kevin Locke <[email protected]>

ericwb added this to the Release 1.6.4 milestone Dec 9, 2020

xuhdev mentioned this issue Dec 11, 2020

Bump bandit from 1.6.2 to 1.6.3 CODAIT/pardata#58

Closed

ericwb modified the milestones: Release 1.6.4, Release 2.0.0, Release 1.7.1 Dec 13, 2020

xuhdev mentioned this issue Dec 14, 2020

Bump bandit from 1.6.2 to 1.7.0 CODAIT/pardata#71

Closed

codingjoe added a commit to FussyFox/bandit that referenced this issue Dec 15, 2020

Freeze bandit to 1.6.2 because of PyCQA/bandit#657

6675c83

andrey-semakin mentioned this issue Dec 15, 2020

Ini file settings ignored #595

Open

maresmar added a commit to maresmar/bandit that referenced this issue Jan 13, 2021

Fix ini configuration was overriden by default values

2560176

Fix PyCQA#657

maresmar linked a pull request Jan 13, 2021 that will close this issue

Fix settings from INI file are overriden by default values #689

Open

fmigneault added a commit to Ouranosinc/Magpie that referenced this issue Jan 14, 2021

pin bandit==1.6.2, above version exclude paths broken (PyCQA/bandit#657)

3cbbe03

AllenAnthes added a commit to OperationCode/back-end that referenced this issue Feb 1, 2021

lock bandit version - see: PyCQA/bandit#657

40b62bf

r4vi added a commit to uktrade/lite-frontend that referenced this issue Feb 15, 2021

Pin bandit version to 1.6.2

78028c9

For the same reason we did it in: uktrade/lite-api#666 because of an upstream bug in 1.6.3: PyCQA/bandit#657

bsolomon1124 mentioned this issue Mar 1, 2021

ini "exclude" config is ignored #693

Open

devNan0 mentioned this issue Mar 19, 2021

Apply default_values only if not already set in cli or config #699

Closed

ericwb modified the milestones: Release 1.7.3, Near Future Feb 27, 2022

fmigneault added a commit to crim-ca/weaver that referenced this issue Oct 3, 2022

security check workaround to ignore misbehaving bandit excludes not c…

4be442e

…onsidered (relates to PyCQA/bandit#657)

wooch82 mentioned this issue Apr 14, 2023

Excluded Paths in Bandit scanner ignored microsoft/security-devops-azdevops#39

Open

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Bandit 1.6.3 does not respect excluded paths from .bandit file #657

Bandit 1.6.3 does not respect excluded paths from .bandit file #657

budgester commented Dec 7, 2020 •

edited

Loading

rjb3977 commented Dec 7, 2020 •

edited

Loading

xuhdev commented Dec 7, 2020 •

edited

Loading

sirkonst commented Dec 14, 2020

syphar commented Dec 14, 2020

codingjoe commented Dec 15, 2020

rjb3977 commented Dec 15, 2020

codingjoe commented Dec 15, 2020

rjb3977 commented Dec 15, 2020

codingjoe commented Dec 15, 2020

xuhdev commented Jun 16, 2021

iflament commented Feb 1, 2022

shtalinberg commented Sep 5, 2022

oijkn commented Jan 2, 2023 •

edited

Loading

shtalinberg commented Mar 15, 2023

kevinoid commented Mar 17, 2023

captaingabi commented Jul 15, 2024

Bandit 1.6.3 does not respect excluded paths from .bandit file #657

Bandit 1.6.3 does not respect excluded paths from .bandit file #657

Comments

budgester commented Dec 7, 2020 • edited Loading

rjb3977 commented Dec 7, 2020 • edited Loading

xuhdev commented Dec 7, 2020 • edited Loading

sirkonst commented Dec 14, 2020

syphar commented Dec 14, 2020

codingjoe commented Dec 15, 2020

rjb3977 commented Dec 15, 2020

codingjoe commented Dec 15, 2020

rjb3977 commented Dec 15, 2020

codingjoe commented Dec 15, 2020

xuhdev commented Jun 16, 2021

iflament commented Feb 1, 2022

shtalinberg commented Sep 5, 2022

oijkn commented Jan 2, 2023 • edited Loading

Edit:

shtalinberg commented Mar 15, 2023

kevinoid commented Mar 17, 2023

captaingabi commented Jul 15, 2024

budgester commented Dec 7, 2020 •

edited

Loading

rjb3977 commented Dec 7, 2020 •

edited

Loading

xuhdev commented Dec 7, 2020 •

edited

Loading

oijkn commented Jan 2, 2023 •

edited

Loading