PyCQA / PyCQA/bandit

Sarif formatter physicalLocation calculation error

Open
#1,311 1 comment 1 reaction 0 assignees View on GitHub

Nobody has claimed this yet.

bug
Dominant language
Python
Stars
8.3k
Forks
836
Avg merge
5d 3h
Merged PRs (30d)
1

Description

Describe the bug

There is an error in line calculation algorithm for sarif. We're getting less snippet_lines than line_range in bandit.formatters.sarif.add_region_and_context_region. But we always get the required line for "physicalLocation" as the second line in code.

Traceback:

bandit -r -f sarif tests/conftest.py
[main]	INFO	profile include tests: None
[main]	INFO	profile exclude tests: None
[main]	INFO	cli include tests: None
[main]	INFO	cli exclude tests: None
[main]	INFO	running on Python 3.13.7
Traceback (most recent call last):
  File "/Users/jerrdasur/dev/open/damn-vulnerable-MCP-server/.venv/lib/python3.13/site-packages/bandit/core/manager.py", line 186, in output_results
    report_func(
    ~~~~~~~~~~~^
        self,
        ^^^^^
    ...<3 lines>...
        lines=lines,
        ^^^^^^^^^^^^
    )
    ^
  File "/Users/jerrdasur/dev/open/damn-vulnerable-MCP-server/.venv/lib/python3.13/site-packages/bandit/formatters/sarif.py", line 188, in report
    add_results(issues, run)
    ~~~~~~~~~~~^^^^^^^^^^^^^
  File "/Users/jerrdasur/dev/open/damn-vulnerable-MCP-server/.venv/lib/python3.13/site-packages/bandit/formatters/sarif.py", line 233, in add_results
    result = create_result(issue, rules, rule_indices)
  File "/Users/jerrdasur/dev/open/damn-vulnerable-MCP-server/.venv/lib/python3.13/site-packages/bandit/formatters/sarif.py", line 251, in create_result
    add_region_and_context_region(
    ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~^
        physical_location,
        ^^^^^^^^^^^^^^^^^^
    ...<3 lines>...
        issue_dict["code"],
        ^^^^^^^^^^^^^^^^^^^
    )
    ^
  File "/Users/jerrdasur/dev/open/damn-vulnerable-MCP-server/.venv/lib/python3.13/site-packages/bandit/formatters/sarif.py", line 288, in add_region_and_context_region
    snippet_line = snippet_lines[line_range[0] - first_line_number]
                   ~~~~~~~~~~~~~^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
IndexError: list index out of range

During handling of the above exception, another exception occurred:

Traceback (most recent call last):
  File "/Users/jerrdasur/dev/open/damn-vulnerable-MCP-server/.venv/bin/bandit", line 7, in <module>
    sys.exit(main())
             ~~~~^^
  File "/Users/jerrdasur/dev/open/damn-vulnerable-MCP-server/.venv/lib/python3.13/site-packages/bandit/cli/main.py", line 678, in main
    b_mgr.output_results(
    ~~~~~~~~~~~~~~~~~~~~^
        args.context_lines,
        ^^^^^^^^^^^^^^^^^^^
    ...<4 lines>...
        args.msg_template,
        ^^^^^^^^^^^^^^^^^^
    )
    ^
  File "/Users/jerrdasur/dev/open/damn-vulnerable-MCP-server/.venv/lib/python3.13/site-packages/bandit/core/manager.py", line 195, in output_results
    raise RuntimeError(
    ...<2 lines>...
    )
RuntimeError: Unable to output report using 'sarif' formatter: list index out of range
Reproduction steps
1. ensure python >=3.13.7 is installed
2. git clone git@github.com:harishsg993010/damn-vulnerable-MCP-server.git
3. cd damn-vulnerable-MCP-server
4. python3 -m venv ./.venv/
5. source .venv/bin/activate
6. pip3 install bandit 'bandit[sarif]'
7. bandit -r -f sarif tests/conftest.py
Expected behavior

Results in default bandit format:

bandit -r tests/conftest.py
[main]	INFO	profile include tests: None
[main]	INFO	profile exclude tests: None
[main]	INFO	cli include tests: None
[main]	INFO	cli exclude tests: None
[main]	INFO	running on Python 3.13.7
Run started:2025-10-06 21:58:05.243854

Test results:
>> Issue: [B108:hardcoded_tmp_directory] Probable insecure usage of temp file/directory.
   Severity: Medium   Confidence: Medium
   CWE: CWE-377 (https://cwe.mitre.org/data/definitions/377.html)
   More Info: https://bandit.readthedocs.io/en/1.8.6/plugins/b108_hardcoded_tmp_directory.html
   Location: ./tests/conftest.py:170:34
169	                "autorestart": True,
170	                "stdout_logfile": "/tmp/test_stdout.log",
171	                "stderr_logfile": "/tmp/test_stderr.log",
172	            }
173	        ]
174	    }

--------------------------------------------------
>> Issue: [B108:hardcoded_tmp_directory] Probable insecure usage of temp file/directory.
   Severity: Medium   Confidence: Medium
   CWE: CWE-377 (https://cwe.mitre.org/data/definitions/377.html)
   More Info: https://bandit.readthedocs.io/en/1.8.6/plugins/b108_hardcoded_tmp_directory.html
   Location: ./tests/conftest.py:171:34
170	                "stdout_logfile": "/tmp/test_stdout.log",
171	                "stderr_logfile": "/tmp/test_stderr.log",
172	            }
173	        ]
174	    }

--------------------------------------------------

Code scanned:
	Total lines of code: 140
	Total lines skipped (#nosec): 0

Run metrics:
	Total issues (by severity):
		Undefined: 0
		Low: 0
		Medium: 2
		High: 0
	Total issues (by confidence):
		Undefined: 0
		Low: 0
		Medium: 2
		High: 0
Files skipped (0):

SARIF:

{
  "runs": [
    {
      "tool": {
        "driver": {
          "name": "Bandit",
          "organization": "PyCQA",
          "rules": [
            {
              "id": "B108",
              "name": "hardcoded_tmp_directory",
              "properties": {
                "tags": [
                  "security",
                  "external/cwe/cwe-377"
                ],
                "precision": "medium"
              },
              "helpUri": "https://bandit.readthedocs.io/en/1.8.6/plugins/b108_hardcoded_tmp_directory.html"
            }
          ],
          "version": "1.8.6",
          "semanticVersion": "1.8.6"
        }
      },
      "invocations": [
        {
          "executionSuccessful": true,
          "endTimeUtc": "2025-10-06T22:38:29Z"
        }
      ],
      "properties": {
        "metrics": {
          "_totals": {
            "loc": 140,
            "nosec": 0,
            "skipped_tests": 0,
            "SEVERITY.UNDEFINED": 0,
            "CONFIDENCE.UNDEFINED": 0,
            "SEVERITY.LOW": 0,
            "CONFIDENCE.LOW": 0,
            "SEVERITY.MEDIUM": 2,
            "CONFIDENCE.MEDIUM": 2,
            "SEVERITY.HIGH": 0,
            "CONFIDENCE.HIGH": 0
          },
          "./tests/conftest.py": {
            "loc": 140,
            "nosec": 0,
            "skipped_tests": 0,
            "SEVERITY.UNDEFINED": 0,
            "SEVERITY.LOW": 0,
            "SEVERITY.MEDIUM": 2,
            "SEVERITY.HIGH": 0,
            "CONFIDENCE.UNDEFINED": 0,
            "CONFIDENCE.LOW": 0,
            "CONFIDENCE.MEDIUM": 2,
            "CONFIDENCE.HIGH": 0
          }
        }
      },
      "results": [
        {
          "message": {
            "text": "Probable insecure usage of temp file/directory."
          },
          "locations": [
            {
              "physicalLocation": {
                "region": {
                  "snippet": {
                    "text": "                \"stdout_logfile\": \"/tmp/test_stdout.log\",\n"
                  },
                  "endColumn": 57,
                  "endLine": 165,
                  "startColumn": 35,
                  "startLine": 164
                },
                "artifactLocation": {
                  "uri": "tests/conftest.py"
                },
                "contextRegion": {
                  "snippet": {
                    "text": "                \"autorestart\": True,\n                \"stdout_logfile\": \"/tmp/test_stdout.log\",\n                \"stderr_logfile\": \"/tmp/test_stderr.log\",\n            }\n        ]\n    }\n"
                  },
                  "endLine": 174,
                  "startLine": 169
                }
              }
            }
          ],
          "properties": {
            "issue_confidence": "MEDIUM",
            "issue_severity": "MEDIUM"
          },
          "ruleId": "B108",
          "ruleIndex": 0
        },
        {
          "message": {
            "text": "Probable insecure usage of temp file/directory."
          },
          "locations": [
            {
              "physicalLocation": {
                "region": {
                  "snippet": {
                    "text": "                \"stderr_logfile\": \"/tmp/test_stderr.log\",\n"
                  },
                  "endColumn": 57,
                  "endLine": 165,
                  "startColumn": 35,
                  "startLine": 164
                },
                "artifactLocation": {
                  "uri": "tests/conftest.py"
                },
                "contextRegion": {
                  "snippet": {
                    "text": "                \"stdout_logfile\": \"/tmp/test_stdout.log\",\n                \"stderr_logfile\": \"/tmp/test_stderr.log\",\n            }\n        ]\n    }\n"
                  },
                  "endLine": 174,
                  "startLine": 170
                }
              }
            }
          ],
          "properties": {
            "issue_confidence": "MEDIUM",
            "issue_severity": "MEDIUM"
          },
          "ruleId": "B108",
          "ruleIndex": 0
        }
      ]
    }
  ],
  "version": "2.1.0",
  "$schema": "https://json.schemastore.org/sarif-2.1.0.json"
}%
Bandit version

1.8.3 (Default)

Python version

3.13 (Default)

Additional context

No response

Contributor guide

Open the contributing guide

First steps

  1. Read the whole issue, then the project's contributing guide.
  2. Comment on the issue to say you are picking it up — it saves two people doing the same work.
  3. Fork the repository and make your change on a branch.
  4. Open a pull request that references the issue number.

Research direction

Start in bandit/formatters/sarif.py at add_region_and_context_region and reproduce the issue with bandit -r -f sarif tests/conftest.py. Check the line-range and snippet_lines indexing around the reported physicalLocation; done means the command completes without IndexError and the SARIF locations and context lines match the findings.

Written by the indexing model from the issue text.

Assessment

Tech stack
python
Domain
tooling
Issue type
Bug
Difficulty
3/5
Estimated time
1-2 days
Activity status
Active
Clarity
Mostly clear
Newbie friendliness
72/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.