PyCQA / PyCQA/bandit

Disable ANSI escape sequence automatically when stdout is not tty

Open
#664 0 comments 1 reaction 0 assignees View on GitHub

Nobody has claimed this yet.

bug
Dominant language
Python
Stars
8.3k
Forks
836
Avg merge
5d 3h
Merged PRs (30d)
1

Description

Describe the bug

I am running bandit from gitlab-ci using docker, but the ANSI colors are not working; the raw job log from gitlab contains:

$ bandit -r .
[main]	INFO	profile include tests: None
[main]	INFO	profile exclude tests: None
[main]	INFO	cli include tests: None
[main]	INFO	cli exclude tests: None
[main]	INFO	running on Python 3.9.1
115 [0.. 50.. 100.. ]
Run started:2020-12-11 11:56:07.507022

Test results:
>> Issue: [B605:start_process_with_a_shell] Starting a process with a shell: Seems safe, but may be changed in the future, consider rewriting without shell
   Severity: Low   Confidence: High

As you can see the ansi sequence is missing the escape character.

To Reproduce

Dockerfile:

FROM python:alpine
RUN pip install bandit
WORKDIR /tmp/test
COPY test.py /tmp/test
CMD bandit -r .

test.py file:

#!/usr/bin/env python3
import os
os.system("false")

docker build -t test . && docker run test

Capture d’écran de 2020-12-11 13-07-03

It does work when allocating a pseudo terminal with docker run -t test but i think that bandit should not output any color codes at all if no terminal is allocated.

Bandit version

/tmp/test # bandit --version
bandit 1.6.3
  python version = 3.9.1 (default, Dec  8 2020, 01:47:25) [GCC 9.3.0]

Contributor guide

Open the contributing guide

First steps

  1. Read the whole issue, then the project's contributing guide.
  2. Comment on the issue to say you are picking it up — it saves two people doing the same work.
  3. Fork the repository and make your change on a branch.
  4. Open a pull request that references the issue number.

Research direction

Reproduce the behavior with the provided Dockerfile using docker run test and compare it with docker run -t test. Start by locating Bandit's CLI output and ANSI color handling; done means no ANSI color codes are emitted when stdout is not a TTY, while terminal output remains colored.

Written by the indexing model from the issue text.

Assessment

Tech stack
docker, python
Domain
cli
Issue type
Bug
Difficulty
2/5
Estimated time
1-3 hours
Activity status
Stale
Clarity
Mostly clear
Newbie friendliness
35/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.