PyCQA / PyCQA/bandit

`bandit -rf custom` only shows up to 3 warnings

Open
#459 1 comment 0 reactions 0 assignees View on GitHub

Nobody has claimed this yet.

bug
Dominant language
Python
Stars
8.3k
Forks
835
Avg merge
5d 3h
Merged PRs (30d)
1

Description

Describe the bug
Running bandit with -rf custom seems to output a maximum of three warnings (no matter how many there are).

To Reproduce
Steps to reproduce the behavior:

  1. Clone bandit
  2. Run bandit -rf custom examples (on the provided examples directory)

Output

$ bandit -rf custom examples                                                                                                                                                   <<<
[main]  INFO    profile include tests: None
[main]  INFO    profile exclude tests: None
[main]  INFO    cli include tests: None
[main]  INFO    cli exclude tests: None
[main]  INFO    running on Python 3.6.8
84 [0.. [manager]       ERROR   Exception occurred when executing tests against examples/nonsense2.py. Run "bandit --debug examples/nonsense2.py" to see the full traceback.
50.. ]
/Users/robert.grant/projects/bandit/examples/assert.py:1: B101[bandit]: LOW: Use of assert detected. The enclosed code will be removed when compiling to optimised byte code.
/Users/robert.grant/projects/bandit/examples/binding.py:4: B104[bandit]: MEDIUM: Possible binding to all interfaces.
/Users/robert.grant/projects/bandit/examples/cipher-modes.py:6: B305[bandit]: MEDIUM: Use of insecure cipher mode cryptography.hazmat.primitives.ciphers.modes.ECB.

Expected behavior
I would expect to see all security errors identified, in a one-per-line format.

Bandit version

bandit 1.5.1
  python version = 3.6.8 (default, Feb 12 2019, 17:27:09) [GCC 4.2.1 Compatible Apple LLVM 10.0.0 (clang-1000.10.44.4)]

Additional context
I use the examples folder here, which seems to contain bad files on purpose (generates the ERROR above). I see the same behavior on another directory without bad files.

Thanks!

Contributor guide

Open the contributing guide

First steps

  1. Read the whole issue, then the project's contributing guide.
  2. Comment on the issue to say you are picking it up — it saves two people doing the same work.
  3. Fork the repository and make your change on a branch.
  4. Open a pull request that references the issue number.

Research direction

Reproduce the issue with bandit -rf custom examples, then rerun with bandit --debug examples as suggested in the report. Trace the command's reporting path and the handling of examples/nonsense2.py; done means every identified security error is emitted one per line rather than only three warnings.

Written by the indexing model from the issue text.

Assessment

Tech stack
python
Domain
cli, security
Issue type
Bug
Difficulty
3/5
Estimated time
1-2 days
Activity status
Stale
Clarity
Clearly specified
Newbie friendliness
35/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.