PyCQA / PyCQA/bandit

Bandit Skipping Directory and Unable to Output Report Error

Open
#1,190 1 comment 0 reactions 0 assignees View on GitHub

Nobody has claimed this yet.

bug
Dominant language
Python
Stars
8.3k
Forks
836
Avg merge
5d 3h
Merged PRs (30d)
1

Description

Describe the bug

Command Used:
dist\run_bandit.exe -r C:\repo\python\kubernetes\base\config -f json -o result.json

Output:
Running Bandit with the following parameters: Report directory: C:\repo\python\kubernetes\base\config Output format: json Output file: result.json Discovering files in directory: C:\repo\python\kubernetes\base\config Skipping directory (C:\repo\python\kubernetes\base\config), use -r flag to scan contents Running Bandit tests... Outputting results with severity level 'LOW' and confidence level 'LOW' Error during output results: Unable to output report using 'screen' formatter: 'screen'

Script Used:

import sys
from bandit.core import manager as bandit_manager
from bandit.core import config as bandit_config

if __name__ == "__main__":
    # Argument parsing
    report_directory = None
    output_format = 'json'  # Default output format
    output_file = None

    # Parse arguments
    args = sys.argv[1:]
    for i in range(len(args)):
        if args[i] == '-r':
            report_directory = args[i + 1]
        elif args[i] == '-f':
            output_format = args[i + 1]
        elif args[i] == '-o':
            output_file = args[i + 1]

    # Ensure required arguments are provided
    if not report_directory:
        print("Error: Missing required '-r' argument for directory")
        sys.exit(1)

    # Print the command-line parameters for debugging
    print(f"Running Bandit with the following parameters:")
    print(f"Report directory: {report_directory}")
    print(f"Output format: {output_format}")
    print(f"Output file: {output_file if output_file else 'Not specified'}")

    # Load Bandit configuration
    config = bandit_config.BanditConfig()

    # Initialize Bandit manager
    b_mgr = bandit_manager.BanditManager(config, output_format)

    # Discover files and run tests
    print(f"Discovering files in directory: {report_directory}")
    b_mgr.discover_files([report_directory])
    if b_mgr.results_count == 0:
        print(f"No Python files found in '{report_directory}'. Please check the directory.")
        sys.exit(1)

    print("Running Bandit tests...")
    b_mgr.run_tests()

    # Generate the report
    lines = []  # Since the results will be written to the output file, we leave this empty
    sev_level = 'LOW'  # Severity level (LOW, MEDIUM, HIGH)
    conf_level = 'LOW'  # Confidence level (LOW, MEDIUM, HIGH)

    # Output results to the specified file or to console if no file is specified
    print(f"Outputting results with severity level '{sev_level}' and confidence level '{conf_level}'")
    
    try:
        b_mgr.output_results(lines, sev_level, conf_level, output_file, output_format)
    except Exception as e:
        print(f"Error during output results: {e}")
        sys.exit(1)

    # Exit with Bandit result code
    print(f"Bandit completed with {b_mgr.results_count} findings.")
    sys.exit(b_mgr.results_count)

PyInstaller Command Used:
pyinstaller --onefile --hidden-import=bandit.core.manager --hidden-import=stevedore.extension run_bandit.py

Reproduction steps

Run the command:
run_bandit.exe -r -f json -o result.json

Expected behavior

Bandit should discover Python files in the specified directory and generate a JSON report without errors.

Bandit version

1.7.10 (Default)

Python version

3.12

Additional context

No response

Contributor guide

Open the contributing guide

First steps

  1. Read the whole issue, then the project's contributing guide.
  2. Comment on the issue to say you are picking it up — it saves two people doing the same work.
  3. Fork the repository and make your change on a branch.
  4. Open a pull request that references the issue number.

Research direction

Start by reproducing the reported command with run_bandit.py and Bandit 1.7.10, then inspect how BanditManager.discover_files and output_results are called. Compare the observed directory-skipping and formatter error with the expected command-line behavior. Done means the specified directory is scanned and a JSON report is written without errors.

Written by the indexing model from the issue text.

Assessment

Tech stack
python
Domain
cli, security, tooling
Issue type
Bug
Difficulty
3/5
Estimated time
1-2 days
Activity status
Stale
Clarity
Mostly clear
Newbie friendliness
45/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.