Can't set (severity) level through `.bandit` ini file
Open
Nobody has claimed this yet.
bug
- Dominant language
- Python
- Stars
- 8.3k
- Forks
- 836
- Avg merge
- 5d 3h
- Merged PRs (30d)
- 1
Description
Describe the bug
With a simple .bandit ini file like this:
[bandit]
level = 1
bandit crashes with:
[main] INFO Using command line arg for selected targets
[main] INFO profile include tests: None
[main] INFO profile exclude tests: None
[main] INFO cli include tests: None
[main] INFO cli exclude tests: None
[main] INFO running on Python 3.9.13
[manager] WARNING Skipping directory (.), use -r flag to scan contents
Traceback (most recent call last):
File "/Users/poehlmann/Development/bandit/venv/bin/bandit", line 10, in <module>
sys.exit(main())
File "/Users/poehlmann/Development/bandit/bandit/cli/main.py", line 670, in main
sev_level = constants.RANKING[args.severity - 1]
TypeError: unsupported operand type(s) for -: 'str' and 'int'
Reproduction steps
1. create `.bandit` ini from description
2. run `bandit --ini .bandit .`
Expected behavior
bandit should allow configuration of available settings through the ini file.
Bandit version
1.7.4 (Default)
Python version
3.9
Additional context
No response
Contributor guide
First steps
- Read the whole issue, then the project's contributing guide.
- Comment on the issue to say you are picking it up — it saves two people doing the same work.
- Fork the repository and make your change on a branch.
- Open a pull request that references the issue number.
Research direction
Start in bandit/cli/main.py around line 670 and reproduce the crash with the .bandit file and command shown. Trace how level = 1 is read from the ini file, then verify that the configured severity is treated as a number and no longer causes the reported TypeError. Done means the reproduction command completes with the configured severity applied.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- python
- Domain
- cli, security
- Issue type
- Bug
- Difficulty
- 2/5
- Estimated time
- 1-3 hours
- Activity status
- Stale
- Clarity
- Clearly specified
- Newbie friendliness
- 45/100