PyCQA / PyCQA/bandit

ini "exclude" config is ignored

Open
#693 11 comments 20 reactions 0 assignees View on GitHub

Nobody has claimed this yet.

bug
Dominant language
Python
Stars
8.3k
Forks
835
Avg merge
5d 3h
Merged PRs (30d)
1

Description

Describe the bug
exclude configuration inside .bandit ini file is always ignored due to default cli argument.

To Reproduce
Steps to reproduce the behavior:

  1. Create . bandit file with the following.
[bandit]
targets: .
exclude: ./tests
  1. Run CLI with bandit --ini .bandit -r in a directory with .bandit file.
  2. You should now see that Bandit is prefer CLI argument for exclude over ini.
[main]	INFO	Using command line arg for excluded paths
[main]	INFO	Using ini file for selected targets

Expected behavior
Bandit should use .bandit configuration as there's no CLI argument supplied then append default value to it as specified in argparse.

  -x EXCLUDED_PATHS, --exclude EXCLUDED_PATHS
                        comma-separated list of paths (glob patterns supported) to exclude
                        from scan (note that these are in addition to the excluded paths
                        provided in the config file) (default:
                        .svn,CVS,.bzr,.hg,.git,__pycache__,.tox,.eggs,*.egg)

Bandit version

bandit 1.7.0
  python version = 3.8.0 (default, Sep  3 2020, 18:08:13) [Clang 11.0.3 (clang-1103.0.32.62)]

Additional context
I believe this happens due to the default value for -x given to argparse. This means the ini configuration is always ignored as the code take default value as supplied CLI.

Workaround
Supplied exclude via CLI when running Bandit regardless of your ini. bandit -x ./tests --ini .bandit -r .

Contributor guide

Open the contributing guide

First steps

  1. Read the whole issue, then the project's contributing guide.
  2. Comment on the issue to say you are picking it up — it saves two people doing the same work.
  3. Fork the repository and make your change on a branch.
  4. Open a pull request that references the issue number.

Research direction

Start in bandit/cli/main.py around the argparse definition for -x and trace how its default is distinguished from an explicitly supplied CLI value. Reproduce with bandit --ini .bandit -r, then verify that the ini exclude is honored while the documented default paths remain included and an explicit -x still takes precedence.

Written by the indexing model from the issue text.

Assessment

Tech stack
python
Domain
cli
Issue type
Bug
Difficulty
2/5
Estimated time
1-3 hours
Activity status
Stale
Clarity
Mostly clear
Newbie friendliness
45/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.