PyCQA / PyCQA/bandit

Unable to exclude directories when running the CLI

Open
#966 4 comments 1 reaction 0 assignees View on GitHub

Nobody has claimed this yet.

bug
Dominant language
Python
Stars
8.3k
Forks
836
Avg merge
5d 3h
Merged PRs (30d)
1

Description

Describe the bug

When trying to run Bandit using the CLI and providing a ini, pyproject or yaml file for the configuration the exclude option is not working.

Reproduction steps
  1. Create a .bandit or pyproject.toml or bandit.yaml
  2. Run a scan with the created config

In all situations the exclude is not functioning.

file: .bandit
[bandit]
exclude = tests

Run using bandit -r .

file: pyproject.toml
[tool.bandit]
exclude_dirs = ["tests"]

Run using bandit -c pyproject.toml -r .

file: bandit.yaml
exclude_dirs: ["tests"]

Run using bandit -c bandit.yaml -r .

In my case due to the use of assert statements i need to process all the tests and provide a # nosec argument.

Expected behavior

When providing a config with the exclude option i would expect that the exclude option is working. And the correct directory is ignored by Bandit for further processing.

Bandit version

1.7.4 (Default)

Python version

3.9

Additional context

See also #499

No response

Contributor guide

Open the contributing guide

First steps

  1. Read the whole issue, then the project's contributing guide.
  2. Comment on the issue to say you are picking it up — it saves two people doing the same work.
  3. Fork the repository and make your change on a branch.
  4. Open a pull request that references the issue number.

Research direction

Start at the CLI configuration-loading and directory-exclusion entry points, then reproduce the issue with the .bandit, pyproject.toml, and bandit.yaml examples using the commands in the report. Done means a configured tests directory is skipped consistently for each supported format, with regression coverage for the reported cases.

Written by the indexing model from the issue text.

Assessment

Tech stack
python
Domain
cli
Issue type
Bug
Difficulty
3/5
Estimated time
1-2 days
Activity status
Quiet
Clarity
Mostly clear
Newbie friendliness
58/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.