ini "exclude" config is ignored
Nobody has claimed this yet.
- Dominant language
- Python
- Stars
- 8.3k
- Forks
- 835
- Avg merge
- 5d 3h
- Merged PRs (30d)
- 1
Description
Describe the bug
exclude configuration inside .bandit ini file is always ignored due to default cli argument.
To Reproduce
Steps to reproduce the behavior:
- Create . bandit file with the following.
[bandit]
targets: .
exclude: ./tests
- Run CLI with
bandit --ini .bandit -rin a directory with .bandit file. - You should now see that Bandit is prefer CLI argument for exclude over ini.
[main] INFO Using command line arg for excluded paths
[main] INFO Using ini file for selected targets
Expected behavior
Bandit should use .bandit configuration as there's no CLI argument supplied then append default value to it as specified in argparse.
-x EXCLUDED_PATHS, --exclude EXCLUDED_PATHS
comma-separated list of paths (glob patterns supported) to exclude
from scan (note that these are in addition to the excluded paths
provided in the config file) (default:
.svn,CVS,.bzr,.hg,.git,__pycache__,.tox,.eggs,*.egg)
Bandit version
bandit 1.7.0
python version = 3.8.0 (default, Sep 3 2020, 18:08:13) [Clang 11.0.3 (clang-1103.0.32.62)]
Additional context
I believe this happens due to the default value for -x given to argparse. This means the ini configuration is always ignored as the code take default value as supplied CLI.
Workaround
Supplied exclude via CLI when running Bandit regardless of your ini. bandit -x ./tests --ini .bandit -r .
Contributor guide
First steps
- Read the whole issue, then the project's contributing guide.
- Comment on the issue to say you are picking it up — it saves two people doing the same work.
- Fork the repository and make your change on a branch.
- Open a pull request that references the issue number.
Research direction
Start in bandit/cli/main.py around the argparse definition for -x and trace how its default is distinguished from an explicitly supplied CLI value. Reproduce with bandit --ini .bandit -r, then verify that the ini exclude is honored while the documented default paths remain included and an explicit -x still takes precedence.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- python
- Domain
- cli
- Issue type
- Bug
- Difficulty
- 2/5
- Estimated time
- 1-3 hours
- Activity status
- Stale
- Clarity
- Mostly clear
- Newbie friendliness
- 45/100