`bandit -ii -ll -ii -ll` raises an `IndexError`
Nobody has claimed this yet.
- Dominant language
- Python
- Stars
- 8.3k
- Forks
- 836
- Avg merge
- 5d 3h
- Merged PRs (30d)
- 1
Description
Describe the bug
Specifying -ii -ll twice on the command line to bandit appears to raise the following IndexError:
% bandit -ii -ll -ii -ll /tmp/empty.py
[main] INFO profile include tests: None
[main] INFO profile exclude tests: None
[main] INFO cli include tests: None
[main] INFO cli exclude tests: None
[main] INFO running on Python 3.14.5
Traceback (most recent call last):
File "/Users/ngie/.local/bin/bandit", line 6, in <module>
sys.exit(main())
~~~~^^
File "/Users/ngie/.local/pipx/venvs/bandit/lib/python3.14/site-packages/bandit/cli/main.py", line 680, in main
sev_level = constants.RANKING[args.severity - 1]
~~~~~~~~~~~~~~~~~^^^^^^^^^^^^^^^^^^^
IndexError: list index out of range
This can happen if args.severity is None (not specified); a similar bug likely exists for args.confidence as well. I suspect it's caused by an edgecase with how -i is calculated vs --confidence-level.
The value should probably be reinterpreted using argparse's action= keyword argument.
Reproduction steps
1. `echo > /tmp/empty.py`
2. `bandit -ii -ll -ii -ll /tmp/empty.py`
Expected behavior
The command should not raise an IndexError.
Bandit version
1.9.1 (Default)
Python version
3.14 (Default)
Additional context
No response
Contributor guide
First steps
- Read the whole issue, then the project's contributing guide.
- Comment on the issue to say you are picking it up — it saves two people doing the same work.
- Fork the repository and make your change on a branch.
- Open a pull request that references the issue number.
Research direction
Start in bandit/cli/main.py, where the traceback indexes constants.RANKING from the parsed severity value. Reproduce the issue with the command shown and inspect the argparse handling of repeated -i and -l options, including confidence. Done means the command completes without an IndexError and the related severity and confidence behavior is covered or verified.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- python
- Domain
- cli
- Issue type
- Bug
- Difficulty
- 2/5
- Estimated time
- 1-3 hours
- Activity status
- Quiet
- Clarity
- Mostly clear
- Newbie friendliness
- 68/100