B404-B603- Categorisation as warnings
Nobody has claimed this yet.
- Dominant language
- Python
- Stars
- 8.3k
- Forks
- 835
- Avg merge
- 5d 3h
- Merged PRs (30d)
- 1
Description
Hi
Im running bandit against my python project (its a great tool, i love it!) but there are some things that could be improved
Im using subprocess.call, but with shell set to False, so im not vulnerable to command injection there. However, i have two errors in my build.
B404 - as im using subprocess
B607 - as, despite not being vulnerable to command injection, i need to be careful
Those recommendations are great, but in my opinion should be categorised as warnings rather than vulnerabilities. I have been reading and most of the people ignore those rules by default
Would be possible to have this amended?
Thanks
Contributor guide
First steps
- Read the whole issue, then the project's contributing guide.
- Comment on the issue to say you are picking it up — it saves two people doing the same work.
- Fork the repository and make your change on a branch.
- Open a pull request that references the issue number.
Research direction
Start by reviewing how Bandit categorizes the B404 and B607 findings and whether their severities are covered by tests. The issue is complete when those findings are classified as warnings rather than vulnerabilities without changing their detection behavior, with the relevant tests passing.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- python
- Domain
- security, tooling
- Issue type
- Feature
- Difficulty
- 3/5
- Estimated time
- 1-2 days
- Activity status
- Stale
- Clarity
- Mostly clear
- Newbie friendliness
- 35/100