Create an extension for parsers
Nobody has claimed this yet.
- Dominant language
- Python
- Stars
- 8.3k
- Forks
- 835
- Avg merge
- 5d 3h
- Merged PRs (30d)
- 1
Description
Is your feature request related to a problem? Please describe.
N/A
Describe the solution you'd like
Bandit currently utilizes the Python base ast module for parsing. But there are other
parsers out there that might be beneficial to use instead. For example, libcst is concrete
syntax tree, which may provide additional capabilities to analyze the code more deeply or
provide better remediation. Another parser is tree-sitter which could be more performant and potentially add the capability to parse other languages.
The feature being proposed here is to provide a extension mechanism similar to what we
already provide for formatters and check plugins. Then abstract the hard-coded calls to the
ast module to use the extension manager.
Describe alternatives you've considered
If someone desires to utilize a different parsing mechanism, the only other option
would be to rewrite much of the guts of Bandit with the new parser.
Additional context
https://libcst.readthedocs.io/en/latest/index.html
https://tree-sitter.github.io/tree-sitter/
Love this idea? Give it a 👍. We prioritize fulfilling features with the most 👍.
Contributor guide
First steps
- Read the whole issue, then the project's contributing guide.
- Comment on the issue to say you are picking it up — it saves two people doing the same work.
- Fork the repository and make your change on a branch.
- Open a pull request that references the issue number.
Research direction
Start by reviewing Bandit's existing formatter and check-plugin extension mechanisms, then locate the hard-coded calls to Python's ast module. Define what the parser extension manager must support, including libcst and tree-sitter, and consider the feature complete when parser selection can use the extension mechanism without rewriting Bandit's analysis code.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- python
- Domain
- security, tooling
- Issue type
- Feature
- Difficulty
- 5/5
- Estimated time
- Over a week
- Activity status
- Stale
- Clarity
- Needs clarification
- Newbie friendliness
- 25/100