PyCQA / PyCQA/bandit

Baseline file has operation system dependent format

Open
#511 2 comments 2 reactions 0 assignees View on GitHub

Nobody has claimed this yet.

enhancement
Dominant language
Python
Stars
8.3k
Forks
835
Avg merge
5d 3h
Merged PRs (30d)
1

Description

The format of currently produced baseline file is dependent on the operation system on which it is produced.

If one produces first baseline file on Windows operating system, than relative pathes in baseline json file are using in path following separator: \

If one tries then to use baseline file in build which is being run on Unix, than usage of this separators leads to existing files not being found. (The fix for me was to replace \ with / in baseline file).

To Reproduce
Steps to reproduce the behavior:

  1. Create baseline for project, where bandit violations exists, using
    bandit -f json -o bandit_baseline.json

  2. Check it in into the version control system

  3. Check out project under unix, run bandit with baseline using
    bandit -b bandit_baseline.json -r .

  4. Bandit will return error code 1, although baseline has not changed

  5. If one changes all occurences of \ in bandit_baseline.json on /, the run of the bandit will finish with exit code 0

Expected behavior
Format of the baseline file should be the same under windows and unix and should function under both operating systems, as it is often, that developers develop under windows, and CI builds are being executed under Unix

Bandit version

bandit 1.6.2
  python version = 3.7.3 (default, Apr 24 2019, 15:29:51) [MSC v.1915 64 bit (AMD64)]

Contributor guide

Open the contributing guide

First steps

  1. Read the whole issue, then the project's contributing guide.
  2. Comment on the issue to say you are picking it up — it saves two people doing the same work.
  3. Fork the repository and make your change on a branch.
  4. Open a pull request that references the issue number.

Research direction

Start by reproducing the issue with the bandit -f json -o bandit_baseline.json and bandit -b bandit_baseline.json -r . commands described in the report. Trace how baseline paths are written and read, then verify that a baseline created on Windows works on Unix and vice versa without manual separator replacement.

Written by the indexing model from the issue text.

Assessment

Tech stack
python
Domain
cli, devtools
Issue type
Bug
Difficulty
3/5
Estimated time
1-2 days
Activity status
Stale
Clarity
Mostly clear
Newbie friendliness
38/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.