Unable to exclude directories when running the CLI
Nobody has claimed this yet.
- Dominant language
- Python
- Stars
- 8.3k
- Forks
- 836
- Avg merge
- 5d 3h
- Merged PRs (30d)
- 1
Description
Describe the bug
When trying to run Bandit using the CLI and providing a ini, pyproject or yaml file for the configuration the exclude option is not working.
Reproduction steps
- Create a .bandit or pyproject.toml or bandit.yaml
- Run a scan with the created config
In all situations the exclude is not functioning.
file: .bandit
[bandit]
exclude = tests
Run using bandit -r .
file: pyproject.toml
[tool.bandit]
exclude_dirs = ["tests"]
Run using bandit -c pyproject.toml -r .
file: bandit.yaml
exclude_dirs: ["tests"]
Run using bandit -c bandit.yaml -r .
In my case due to the use of assert statements i need to process all the tests and provide a # nosec argument.
Expected behavior
When providing a config with the exclude option i would expect that the exclude option is working. And the correct directory is ignored by Bandit for further processing.
Bandit version
1.7.4 (Default)
Python version
3.9
Additional context
See also #499
No response
Contributor guide
First steps
- Read the whole issue, then the project's contributing guide.
- Comment on the issue to say you are picking it up — it saves two people doing the same work.
- Fork the repository and make your change on a branch.
- Open a pull request that references the issue number.
Research direction
Start at the CLI configuration-loading and directory-exclusion entry points, then reproduce the issue with the .bandit, pyproject.toml, and bandit.yaml examples using the commands in the report. Done means a configured tests directory is skipped consistently for each supported format, with regression coverage for the reported cases.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- python
- Domain
- cli
- Issue type
- Bug
- Difficulty
- 3/5
- Estimated time
- 1-2 days
- Activity status
- Quiet
- Clarity
- Mostly clear
- Newbie friendliness
- 58/100