PyCQA / PyCQA/bandit

Can't set (severity) level through `.bandit` ini file

Open
#938 0 comments 1 reaction 0 assignees View on GitHub

Nobody has claimed this yet.

bug
Dominant language
Python
Stars
8.3k
Forks
836
Avg merge
5d 3h
Merged PRs (30d)
1

Description

Describe the bug

With a simple .bandit ini file like this:

[bandit]
level = 1

bandit crashes with:

[main]  INFO    Using command line arg for selected targets
[main]  INFO    profile include tests: None
[main]  INFO    profile exclude tests: None
[main]  INFO    cli include tests: None
[main]  INFO    cli exclude tests: None
[main]  INFO    running on Python 3.9.13
[manager]       WARNING Skipping directory (.), use -r flag to scan contents
Traceback (most recent call last):
  File "/Users/poehlmann/Development/bandit/venv/bin/bandit", line 10, in <module>
    sys.exit(main())
  File "/Users/poehlmann/Development/bandit/bandit/cli/main.py", line 670, in main
    sev_level = constants.RANKING[args.severity - 1]
TypeError: unsupported operand type(s) for -: 'str' and 'int'
Reproduction steps
1. create `.bandit` ini from description
2. run `bandit --ini .bandit .`
Expected behavior

bandit should allow configuration of available settings through the ini file.

Bandit version

1.7.4 (Default)

Python version

3.9

Additional context

No response

Contributor guide

Open the contributing guide

First steps

  1. Read the whole issue, then the project's contributing guide.
  2. Comment on the issue to say you are picking it up — it saves two people doing the same work.
  3. Fork the repository and make your change on a branch.
  4. Open a pull request that references the issue number.

Research direction

Start in bandit/cli/main.py around line 670 and reproduce the crash with the .bandit file and command shown. Trace how level = 1 is read from the ini file, then verify that the configured severity is treated as a number and no longer causes the reported TypeError. Done means the reproduction command completes with the configured severity applied.

Written by the indexing model from the issue text.

Assessment

Tech stack
python
Domain
cli, security
Issue type
Bug
Difficulty
2/5
Estimated time
1-3 hours
Activity status
Stale
Clarity
Clearly specified
Newbie friendliness
45/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.