PyCQA / PyCQA/bandit

Extra results printed, when running bandit on file that doesnt exist

Open
#1,008 0 comments 0 reactions 0 assignees View on GitHub

Nobody has claimed this yet.

bug
Dominant language
Python
Stars
8.3k
Forks
836
Avg merge
5d 3h
Merged PRs (30d)
1

Description

When running bandit on a file that doesn't exist, it still gives the results as if it found the file and ran the project, saying 0 issues found. Then when you go the bottom of the results it then says one file skipped and says (example.py (No such file or directory)).

There should be an added functionality that is added where it just says no such file found, instead of acting like it "ran the file"

example below:

(Desktop) Omars-MacBook-Air:bandit omar$ bandit example.py
[main]  INFO    profile include tests: None
[main]  INFO    profile exclude tests: None
[main]  INFO    cli include tests: None
[main]  INFO    cli exclude tests: None
[main]  INFO    running on Python 3.7.4
Run started:2023-03-28 01:16:36.366190
Test results:
        No issues identified.
Code scanned:
        Total lines of code: 0
        Total lines skipped (#nosec): 0
Run metrics:
        Total issues (by severity):
                Undefined: 0
                Low: 0
                Medium: 0
                High: 0
        Total issues (by confidence):
                Undefined: 0
                Low: 0
                Medium: 0
                High: 0
Files skipped (1):
        example.py (No such file or directory)
(Desktop) Omars-MacBook-Air:bandit omar$

Contributor guide

Open the contributing guide

First steps

  1. Read the whole issue, then the project's contributing guide.
  2. Comment on the issue to say you are picking it up — it saves two people doing the same work.
  3. Fork the repository and make your change on a branch.
  4. Open a pull request that references the issue number.

Research direction

Start by reproducing the issue with bandit example.py, then trace the CLI handling for nonexistent input files and the reporting of skipped files. Done means a missing file reports that it was not found without presenting a normal successful scan with zero issues; verify the existing command output after the change.

Written by the indexing model from the issue text.

Assessment

Tech stack
python
Domain
cli, security
Issue type
Bug
Difficulty
3/5
Estimated time
1-2 days
Activity status
Stale
Clarity
Mostly clear
Newbie friendliness
45/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.