4 ms·

I looked at Bandit earlier this year, but had to put it down when I discovered it didn't have a way to fill in default config -- the instant I specified anythin

I looked at Bandit earlier this year, but had to put it down when I discovered it didn't have a way to fill in default config -- the instant I specified anything in the config file, I had to supply a complete config, including literally every single check it's capable of doing, because Bandit would discard all its defaults on encountering that single line of custom config. Don't suppose you know if that's gotten better?

viraptor 10y ago
It's not ideal - the config file is still a complete list, but there are a few things you can do. - `bandit-config-generator` will give you a file filled with the current/default configuration, so it's a simple way to start with the defaults and modify just what you need - if you just need to enable/disable tests rather than reconfigure, you can do that in command line options - if you want to get rid of specific warning, you can mark the line with "# nosec" in the source Merging various configs is possible, but rather complex to implement considering we aim for the config to be a complete description that won't ever need to change between versions. If none of the above workarounds solve your use case, feel free to report an issue. (https://bugs.launchpad.net/bandit https://bugs.launchpad.net/bandit) I can't guarantee how/whether we'll fix this, but we'd definitely like to know what the problem is and how you're trying to use Bandit.
- wyldfire 10y ago
  FYI when using pypy bandit fails to discover tests for some reason (could be a pypy bug?). In this case, the default output generated by bandit-config-generator is mostly empty and bandit fails to parse it. It doesn't indicate what the nature of the parse failure is (what line, what rule(s) were violated), even with verbose mode. The readme doesn't cover the format of the config file. Is it YAML/TOML/JSON/other?
  - viraptor 10y ago
    Which version of pypy are you using? I can't reproduce the issue with 5.1.2 (ubuntu packaged one). The config uses YAML format. Regardless, config errors should be more verbose. I raised https://bugs.launchpad.net/bandit/+bug/1621552 https://bugs.launchpad.net/bandit/+bug/1621552
    - wyldfire 10y ago
      EDIT: nevermind, couldn't reproduce it with a new virtualenv. Whatever problem occurred in that virtualenv likely wasn't that interesting (wild guess is a package name collision). pypy2-v5.3.1-linux64 / [PyPy 5.3.1 with GCC 4.8.2] If you can't reproduce it with that tarball I'll dig deeper to see the mechanism of failure, maybe it's not pypy and it's just something local to my config or venv.
      - viraptor 10y ago
        Checked the same tarball (downloaded from bitbucket) and still can't repro. Just in case, what I'm doing is: cd path/to/bandit virtualenv -p path/to/pypy venv venv/bin/pip install -r./requirements.txt -e . venv/bin/bandit-config-generator -o tmp_file venv/bin/bandit -c tmp_file -r path/to/some/project
        wyldfire 10y ago
        I did something similar, yes. I cannot reproduce this with a new virtualenv anymore. It may have been due to odd bits in my environment (likely not worth further investigation). virtualenv -p `which pypy` ~/pypy_env source ~/pypy_env/bin/activate # indeterminate <but probably critical> changes to this venv pip install bandit bandit-config-generator -o tmp_file bandit --help # "The following sets..." is empty bandit -c tmp_file -r path/to/some/project # gives the error regarding config file parse failure I can reproduce the parse error given the nearly empty config file, but it's not clear to me whether the parse error is expected in this case or not. $ echo -e 'tests:\nskips:\n{}' > parse_err.cfg $ bandit -c parse_err.cfg . [main] ERROR parse_err.cfg : Error parsing file.

viraptor 10y ago

It's not ideal - the config file is still a complete list, but there are a few things you can do. - `bandit-config-generator` will give you a file filled with the current/default configuration, so it's a simple way to start with the defaults and modify just what you need - if you just need to enable/disable tests rather than reconfigure, you can do that in command line options - if you want to get rid of specific warning, you can mark the line with "# nosec" in the source Merging various configs is possible, but rather complex to implement considering we aim for the config to be a complete description that won't ever need to change between versions. If none of the above workarounds solve your use case, feel free to report an issue. (https://bugs.launchpad.net/bandit https://bugs.launchpad.net/bandit) I can't guarantee how/whether we'll fix this, but we'd definitely like to know what the problem is and how you're trying to use Bandit.

wyldfire 10y ago
FYI when using pypy bandit fails to discover tests for some reason (could be a pypy bug?). In this case, the default output generated by bandit-config-generator is mostly empty and bandit fails to parse it. It doesn't indicate what the nature of the parse failure is (what line, what rule(s) were violated), even with verbose mode. The readme doesn't cover the format of the config file. Is it YAML/TOML/JSON/other?
- viraptor 10y ago
  Which version of pypy are you using? I can't reproduce the issue with 5.1.2 (ubuntu packaged one). The config uses YAML format. Regardless, config errors should be more verbose. I raised https://bugs.launchpad.net/bandit/+bug/1621552 https://bugs.launchpad.net/bandit/+bug/1621552
  - wyldfire 10y ago
    EDIT: nevermind, couldn't reproduce it with a new virtualenv. Whatever problem occurred in that virtualenv likely wasn't that interesting (wild guess is a package name collision). pypy2-v5.3.1-linux64 / [PyPy 5.3.1 with GCC 4.8.2] If you can't reproduce it with that tarball I'll dig deeper to see the mechanism of failure, maybe it's not pypy and it's just something local to my config or venv.
    - viraptor 10y ago
      Checked the same tarball (downloaded from bitbucket) and still can't repro. Just in case, what I'm doing is: cd path/to/bandit virtualenv -p path/to/pypy venv venv/bin/pip install -r./requirements.txt -e . venv/bin/bandit-config-generator -o tmp_file venv/bin/bandit -c tmp_file -r path/to/some/project
      - wyldfire 10y ago
        I did something similar, yes. I cannot reproduce this with a new virtualenv anymore. It may have been due to odd bits in my environment (likely not worth further investigation). virtualenv -p `which pypy` ~/pypy_env source ~/pypy_env/bin/activate # indeterminate <but probably critical> changes to this venv pip install bandit bandit-config-generator -o tmp_file bandit --help # "The following sets..." is empty bandit -c tmp_file -r path/to/some/project # gives the error regarding config file parse failure I can reproduce the parse error given the nearly empty config file, but it's not clear to me whether the parse error is expected in this case or not. $ echo -e 'tests:\nskips:\n{}' > parse_err.cfg $ bandit -c parse_err.cfg . [main] ERROR parse_err.cfg : Error parsing file.