PyCQA / PyCQA/bandit

Create an extension for parsers

Open
#894 0 comments 1 reaction 0 assignees View on GitHub

Nobody has claimed this yet.

enhancement
Dominant language
Python
Stars
8.3k
Forks
835
Avg merge
5d 3h
Merged PRs (30d)
1

Description

Is your feature request related to a problem? Please describe.
N/A

Describe the solution you'd like
Bandit currently utilizes the Python base ast module for parsing. But there are other
parsers out there that might be beneficial to use instead. For example, libcst is concrete
syntax tree, which may provide additional capabilities to analyze the code more deeply or
provide better remediation. Another parser is tree-sitter which could be more performant and potentially add the capability to parse other languages.

The feature being proposed here is to provide a extension mechanism similar to what we
already provide for formatters and check plugins. Then abstract the hard-coded calls to the
ast module to use the extension manager.

Describe alternatives you've considered
If someone desires to utilize a different parsing mechanism, the only other option
would be to rewrite much of the guts of Bandit with the new parser.

Additional context
https://libcst.readthedocs.io/en/latest/index.html
https://tree-sitter.github.io/tree-sitter/

Love this idea? Give it a 👍. We prioritize fulfilling features with the most 👍.

Contributor guide

Open the contributing guide

First steps

  1. Read the whole issue, then the project's contributing guide.
  2. Comment on the issue to say you are picking it up — it saves two people doing the same work.
  3. Fork the repository and make your change on a branch.
  4. Open a pull request that references the issue number.

Research direction

Start by reviewing Bandit's existing formatter and check-plugin extension mechanisms, then locate the hard-coded calls to Python's ast module. Define what the parser extension manager must support, including libcst and tree-sitter, and consider the feature complete when parser selection can use the extension mechanism without rewriting Bandit's analysis code.

Written by the indexing model from the issue text.

Assessment

Tech stack
python
Domain
security, tooling
Issue type
Feature
Difficulty
5/5
Estimated time
Over a week
Activity status
Stale
Clarity
Needs clarification
Newbie friendliness
25/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.