It would be useful to declare skips at module-level
Nobody has claimed this yet.
- Dominant language
- Python
- Stars
- 8.3k
- Forks
- 835
- Avg merge
- 5d 3h
- Merged PRs (30d)
- 1
Description
It would be useful to be able to specify skips at module-level.
The present skip options are either skipping the test entirely in the bandit.ini file or decorating a specific line with # nosec. But often, a pattern of warnings occurs together in the same module. For example, we use xml.etree.ElementTree.fromstring() to communicate with our internal restful API. We collect together all API calls into a single module.
We, therefore, either need to decorate dozens of lines in this module or completely disable the warning. We prefer to leave the warning enabled -- in the event someone makes a call to an external API that hasn't been vetted against our security policy.
Contributor guide
First steps
- Read the whole issue, then the project's contributing guide.
- Comment on the issue to say you are picking it up — it saves two people doing the same work.
- Fork the repository and make your change on a branch.
- Open a pull request that references the issue number.
Research direction
Start by comparing the existing skip behavior configured in bandit.ini with the line-level # nosec mechanism. Trace how skips are applied to a module and determine the smallest consistent scope for a module-level declaration. Done means warnings can be suppressed for the designated module while remaining enabled for other modules, including external API calls.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- python
- Domain
- security
- Issue type
- Feature
- Difficulty
- 4/5
- Estimated time
- 3-5 days
- Activity status
- Stale
- Clarity
- Mostly clear
- Newbie friendliness
- 45/100