PyCQA / PyCQA/bandit

Reports that contain Unicode will cause Bandit pre-commit hook to crash

Open
#1,040 3 comments 3 reactions 0 assignees View on GitHub

Nobody has claimed this yet.

bug
Dominant language
Python
Stars
8.3k
Forks
836
Avg merge
5d 3h
Merged PRs (30d)
1

Description

Describe the bug

When using the pre-commit hook on a file with unicode characters in it, Bandit will crash.

The bug was fixed for CLI in #362 but the issue is still present when using the pre-commit hook.

Reproduction steps
  1. Initialize a Git repository:
git init
  1. Create the Python file test.py:
secret = u'Don\'t👏hard👏code👏secrets'
  1. Create the file .pre-commit-config.yaml:
repos:
  - repo: https://github.com/PyCQA/bandit
    rev: '1.7.5'
    hooks:
    - id: bandit
  1. Install the pre-commit Python package (e.g., with pipx)

  2. Install the pre-commit hooks:

pre-commit install
  1. Stage both files:
git add .
  1. Run the pre-commit hook:
pre-commit run --all-files
  1. Observe the resulting crash and traceback:
bandit...................................................................Failed
- hook id: bandit
- exit code: 1

[main]  INFO    profile include tests: None
[main]  INFO    profile exclude tests: None
[main]  INFO    cli include tests: None
[main]  INFO    cli exclude tests: None
[main]  INFO    running on Python 3.11.3
[node_visitor]  WARNING Unable to find qualified name for module: test.py
Traceback (most recent call last):
  File "C:\Users\<username>\.cache\pre-commit\repowg97az4b\py_env-python3\Lib\site-packages\bandit\core\manager.py", line 188, in output_results
    report_func(
  File "C:\Users\<username>\.cache\pre-commit\repowg97az4b\py_env-python3\Lib\site-packages\bandit\formatters\text.py", line 196, in report     
    wrapped_file.write(result)
  File "C:\Users\<username>\AppData\Local\Programs\Python\Python311\Lib\encodings\cp1252.py", line 19, in encode
    return codecs.charmap_encode(input,self.errors,encoding_table)[0]
           ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
UnicodeEncodeError: 'charmap' codec can't encode character '\U0001f44f' in position 135: character maps to <undefined>

During handling of the above exception, another exception occurred:

Traceback (most recent call last):
  File "<frozen runpy>", line 198, in _run_module_as_main
  File "<frozen runpy>", line 88, in _run_code
  File "C:\Users\<username>\.cache\pre-commit\repowg97az4b\py_env-python3\Scripts\bandit.EXE\__main__.py", line 7, in <module>
  File "C:\Users\<username>\.cache\pre-commit\repowg97az4b\py_env-python3\Lib\site-packages\bandit\cli\main.py", line 672, in main
    b_mgr.output_results(
  File "C:\Users\<username>\.cache\pre-commit\repowg97az4b\py_env-python3\Lib\site-packages\bandit\core\manager.py", line 197, in output_results
    raise RuntimeError(
RuntimeError: Unable to output report using 'txt' formatter: 'charmap' codec can't encode character '\U0001f44f' in position 135: character maps to <undefined>
Expected behavior

I expect Bandit to successfully create the report, either by handing unicode encodings, or by removing the problematic unicode characters.

Bandit version

1.7.5 (Default)

Python version

3.11 (Default)

Contributor guide

Open the contributing guide

First steps

  1. Read the whole issue, then the project's contributing guide.
  2. Comment on the issue to say you are picking it up — it saves two people doing the same work.
  3. Fork the repository and make your change on a branch.
  4. Open a pull request that references the issue number.

Research direction

Reproduce the failure with test.py, .pre-commit-config.yaml, and the provided pre-commit commands. Start with bandit/formatters/text.py and bandit/core/manager.py from the traceback, then compare the pre-commit path with the CLI fix in #362. Done means the pre-commit hook creates its report successfully for the Unicode-containing file.

Written by the indexing model from the issue text.

Assessment

Tech stack
python
Domain
devtools
Issue type
Bug
Difficulty
3/5
Estimated time
1-2 days
Activity status
Stale
Clarity
Mostly clear
Newbie friendliness
48/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.