dense-analysis / dense-analysis/ale
[python] bandit receives the file to analyse in a temporary directory instead of passing the actual file
- Dominant language
- Vim Script
- Stars
- 14k
- Forks
- 1.5k
- Avg merge
- 17h 49m
- Merged PRs (30d)
- 1
Description
## Information
**VIM version**
VIM - Vi IMproved 9.0 (2022 Jun 28, compilato May 10 2022 08:40:37)
Patch included: 1-749
Operating System: Ubuntu 22.04.1 LTS
## What went wrong
The way bandit is called is incompatible with bandit's configuration syntax and assumptions. Note this is generally true for every linting program allowing a configuration involving a directory name.
## Reproducing the bug
1. I created a python project with a pyproject.toml unified Python project settings file and a tests directory.
2. Define the directory where the python virtual env is installed as
3. Define the directory containing the pyproject.toml and the tests directory as
4. In the pyproject.toml file there is the following configuration for bandit:
```
[tool.bandit]
assert_used.skips = ["tests/test_*.py"]
```
5. When ALE calls bandit for analysing the python file, the syntax used is:
```/bin/bandit --format custom --msg-template "{line}:{test_id}:{severity}:{msg}" - < /tmp/random_directory_id/test_commands.py```
instead of
```/bin/bandit --format custom --msg-template "{line}:{test_id}:{severity}:{msg}" -c /pyproject.toml /tests/test_commands.py```
6. The result is that any parameter in the [bandit.tool] that specifies a path (i.e. skip, exclude, etc) is deceived by the /tmp/random_direcory/ vs the proper /tests/
7. Furthermore the invokation of bandit lacks the ```-c /pyproject.toml``` option that allow to customize the bandit behaviour.
### :ALEInfo
```
[...]
Command History:
(executable check - success) /home/mader/DygmaRaise/.venv/bin/bandit
(finished - exit code 1) ['/bin/bash', '-c', '''/home/mader/DygmaRaise/.venv/bin/bandit'' --format custom --msg-template "{line}:{test_id}:{severity}:{msg}" - < ''/tmp/vduvRFr/4/test_commands.py''']
<<>>
14:B101:LOW:Use of assert detected. The enclosed code will be removed when compiling to optimised byte code.
15:B101:LOW:Use of assert detected. The enclosed code will be removed when compiling to optimised byte code.
<<>>
[...]
```
Contributor guide
Assessment
This issue has not been assessed yet.