Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

Add support for disabling individual test numbers #211

Closed
ericwb opened this issue Apr 27, 2018 · 6 comments
Closed

Add support for disabling individual test numbers #211

ericwb opened this issue Apr 27, 2018 · 6 comments
Labels
enhancement New feature or request
Milestone
Near Future

Comments

@ericwb
Copy link
Member

ericwb commented Apr 27, 2018

It would be nice to be able to disable specific bandit test numbers, like:

def mybadfunction(token='notreallyasecret'): # no-sec-b900
@ericwb ericwb added the enhancement New feature or request label May 3, 2018
@ehooo
Copy link
Contributor

ehooo commented May 17, 2018

Hi I found a bug related with the way that "nosec " comment is checked.
For example vulnerable_call(param="#nosec") this line will be scaped

@calve
Copy link
Contributor

calve commented Jun 28, 2018

I'm willing to help on this one when I have some time. I originally posted a question at https://answers.launchpad.net/bandit/+question/664861

Shall we discuss of the syntax here ?

(my original message for reference)

Hi,

is there any way to selectively filter #nosec tags to filter only acceptable vulnerabilties.
I'm looking for something like

   # we know this triggers B101 but would still report B133
   assert 1=random.randint(0, 2) # nosec #B101

Thanks :)

@posita
Copy link

posita commented Sep 12, 2018 •
edited
Loading

@ehooo, that sounds like a separate issue. You might might want to file it as such?

UPDATE: Filed as #383.

@posita posita mentioned this issue Sep 12, 2018
Closed
@posita
Copy link

posita commented Sep 12, 2018 •
edited
Loading

May I request that whatever syntax is adopted, that it play nice with other source code analyzers' line comment directives? Consider someone who uses Mypy notations, pyflakes, pylint, and bandit:

… # type: … # noqa: E501 ; pylint: disable=line-too-long # nosec …
-or-
… # type: … # nosec … # noqa: E501 # pylint: disable=line-too-long

@calve
Copy link
Contributor

calve commented Sep 12, 2018

… # type: … # noqa: E501 ; pylint: disable=line-too-long # nosec … is ok for me

@posita
Copy link

posita commented Sep 12, 2018

Apologies for the confusion. What I meant was that both formats should be supported. Currently # type: … # noqa: E501 # pylint: disable=line-too-long # nosec … will confuse pylint, but bandit should support its own line comment directives no matter the order they appear. So far, the convention has been to use # as a delimiter between different analyzers directives. (But see pylint-dev/pylint#2297.) Mypy and pylint are currently too opinionated, though (Mypy requires type comments appear first, and anything coming after pylint comments confuse pylint. (See pylint-dev/pylint#2485.)

@ericwb ericwb added this to the Near Future milestone May 9, 2019
@stephen-dexda stephen-dexda mentioned this issue Nov 19, 2019
Closed
mikespallino added a commit to mikespallino/bandit that referenced this issue Apr 7, 2020
@mikespallino
support for disabling individual tests PyCQA#211
edbef10 
- allow disabling tests by id and by name (e.g. B602,assert_used)
- update nosec_lines to be a dict keyed on line number to a set of tests to ignore
- use an empty set to indicate a blanket nosec (i.e. just #nosec, no individual tests)
- use None to indicate that there was no nosec comment on the line in question
- track and report metrics on the number of tests skipped by specific tests and the number of tests that fail because they were not included in the list of specific tests to ignore
mikespallino added a commit to mikespallino/bandit that referenced this issue Apr 7, 2020
@mikespallino
support for disabling individual tests PyCQA#211
86e044d 
- allow disabling tests by id and by name (e.g. B602,assert_used)
- update nosec_lines to be a dict keyed on line number to a set of tests to ignore
- use an empty set to indicate a blanket nosec (i.e. just #nosec, no individual tests)
- use None to indicate that there was no nosec comment on the line in question
- track and report metrics on the number of tests skipped by specific tests and the number of tests that fail because they were not included in the list of specific tests to ignore
mikespallino added a commit to mikespallino/bandit that referenced this issue Apr 7, 2020
@mikespallino
support for disabling individual tests PyCQA#211
d32f326 
- allow disabling tests by id and by name (e.g. B602,assert_used)
- update nosec_lines to be a dict keyed on line number to a set of tests to ignore
- use an empty set to indicate a blanket nosec (i.e. just #nosec, no individual tests)
- use None to indicate that there was no nosec comment on the line in question
- track and report metrics on the number of tests skipped by specific tests and the number of tests that fail because they were not included in the list of specific tests to ignore
mikespallino added a commit to mikespallino/bandit that referenced this issue Apr 7, 2020
@mikespallino
support for disabling individual tests PyCQA#211
f0361b7 
- allow disabling tests by id and by name (e.g. B602,assert_used)
- update nosec_lines to be a dict keyed on line number to a set of tests to ignore
- use an empty set to indicate a blanket nosec (i.e. just #nosec, no individual tests)
- use None to indicate that there was no nosec comment on the line in question
- track and report metrics on the number of tests skipped by specific tests and the number of tests that fail because they were not included in the list of specific tests to ignore
mikespallino added a commit to mikespallino/bandit that referenced this issue Apr 7, 2020
@mikespallino
support for disabling individual tests PyCQA#211
e2d7cd2 
- allow disabling tests by id and by name (e.g. B602,assert_used)
- update nosec_lines to be a dict keyed on line number to a set of tests to ignore
- use an empty set to indicate a blanket nosec (i.e. just #nosec, no individual tests)
- use None to indicate that there was no nosec comment on the line in question
- track and report metrics on the number of tests skipped by specific tests and the number of tests that fail because they were not included in the list of specific tests to ignore
mikespallino added a commit to mikespallino/bandit that referenced this issue Apr 7, 2020
@mikespallino
support for disabling individual tests
98c8d12 
- allow disabling tests by id and by name (e.g. B602,assert_used)
- update nosec_lines to be a dict keyed on line number to a set of tests to ignore
- use an empty set to indicate a blanket nosec (i.e. just #nosec, no individual tests)
- use None to indicate that there was no nosec comment on the line in question
- track and report metrics on the number of tests skipped by specific tests and the number of tests that fail because they were not included in the list of specific tests to ignore

Resolves PyCQA#211
See also PyCQA#418
mikespallino added a commit to mikespallino/bandit that referenced this issue Aug 4, 2020
@mikespallino
support for disabling individual tests
01def46 
- allow disabling tests by id and by name (e.g. B602,assert_used)
- update nosec_lines to be a dict keyed on line number to a set of tests to ignore
- use an empty set to indicate a blanket nosec (i.e. just #nosec, no individual tests)
- use None to indicate that there was no nosec comment on the line in question
- track and report metrics on the number of tests skipped by specific tests and the number of tests that fail because they were not included in the list of specific tests to ignore

Resolves PyCQA#211
See also PyCQA#418
mikespallino added a commit to mikespallino/bandit that referenced this issue Mar 4, 2021
@mikespallino
support for disabling individual tests
674e5de 
- allow disabling tests by id and by name (e.g. B602,assert_used)
- update nosec_lines to be a dict keyed on line number to a set of tests to ignore
- use an empty set to indicate a blanket nosec (i.e. just #nosec, no individual tests)
- use None to indicate that there was no nosec comment on the line in question
- track and report metrics on the number of tests skipped by specific tests and the number of tests that fail because they were not included in the list of specific tests to ignore

Resolves PyCQA#211
See also PyCQA#418
kevinoid added a commit to kevinoid/ytdl2rss that referenced this issue Apr 29, 2021
@kevinoid
Suppress bandit B406 for xml.sax.saxutils
b4a49c1 
As noted in PyCQA/bandit#452, escape and
quoteattr are not riskier than the defusedxml alternatives.

Note: Can't disable specific bandit tests:
PyCQA/bandit#211

Signed-off-by: Kevin Locke <kevin@kevinlocke.name>
mikespallino added a commit to mikespallino/bandit that referenced this issue Aug 25, 2021
@mikespallino
support for disabling individual tests
e73f5f9 
- allow disabling tests by id and by name (e.g. B602,assert_used)
- update nosec_lines to be a dict keyed on line number to a set of tests to ignore
- use an empty set to indicate a blanket nosec (i.e. just #nosec, no individual tests)
- use None to indicate that there was no nosec comment on the line in question
- track and report metrics on the number of tests skipped by specific tests and the number of tests that fail because they were not included in the list of specific tests to ignore

Resolves PyCQA#211
See also PyCQA#418
mikespallino added a commit to mikespallino/bandit that referenced this issue Aug 25, 2021
@mikespallino
support for disabling individual tests
f67796f 
- allow disabling tests by id and by name (e.g. B602,assert_used)
- update nosec_lines to be a dict keyed on line number to a set of tests to ignore
- use an empty set to indicate a blanket nosec (i.e. just #nosec, no individual tests)
- use None to indicate that there was no nosec comment on the line in question
- track and report metrics on the number of tests skipped by specific tests and the number of tests that fail because they were not included in the list of specific tests to ignore

Resolves PyCQA#211
See also PyCQA#418
mikespallino added a commit to mikespallino/bandit that referenced this issue Jan 7, 2022
@mikespallino
support for disabling individual tests
d691144 
- allow disabling tests by id and by name (e.g. B602,assert_used)
- update nosec_lines to be a dict keyed on line number to a set of tests to ignore
- use an empty set to indicate a blanket nosec (i.e. just #nosec, no individual tests)
- use None to indicate that there was no nosec comment on the line in question
- track and report metrics on the number of tests skipped by specific tests and the number of tests that fail because they were not included in the list of specific tests to ignore

Resolves PyCQA#211
See also PyCQA#418
mikespallino added a commit to mikespallino/bandit that referenced this issue Jan 7, 2022
@mikespallino
support for disabling individual tests
5d44457 
- allow disabling tests by id and by name (e.g. B602,assert_used)
- update nosec_lines to be a dict keyed on line number to a set of tests to ignore
- use an empty set to indicate a blanket nosec (i.e. just #nosec, no individual tests)
- use None to indicate that there was no nosec comment on the line in question
- track and report metrics on the number of tests skipped by specific tests and the number of tests that fail because they were not included in the list of specific tests to ignore

Resolves PyCQA#211
See also PyCQA#418
mikespallino added a commit to mikespallino/bandit that referenced this issue Jan 7, 2022
@mikespallino
support for disabling individual tests
b9d406c 
- allow disabling tests by id and by name (e.g. B602,assert_used)
- update nosec_lines to be a dict keyed on line number to a set of tests to ignore
- use an empty set to indicate a blanket nosec (i.e. just #nosec, no individual tests)
- use None to indicate that there was no nosec comment on the line in question
- track and report metrics on the number of tests skipped by specific tests and the number of tests that fail because they were not included in the list of specific tests to ignore

Resolves PyCQA#211
See also PyCQA#418
mikespallino added a commit to mikespallino/bandit that referenced this issue Jan 7, 2022
@mikespallino
support for disabling individual tests
433fb15 
- allow disabling tests by id and by name (e.g. B602,assert_used)
- update nosec_lines to be a dict keyed on line number to a set of tests to ignore
- use an empty set to indicate a blanket nosec (i.e. just #nosec, no individual tests)
- use None to indicate that there was no nosec comment on the line in question
- track and report metrics on the number of tests skipped by specific tests and the number of tests that fail because they were not included in the list of specific tests to ignore

Resolves PyCQA#211
See also PyCQA#418
mikespallino added a commit to mikespallino/bandit that referenced this issue Jan 26, 2022
@mikespallino
support for disabling individual tests
d73041c 
- allow disabling tests by id and by name (e.g. B602,assert_used)
- update nosec_lines to be a dict keyed on line number to a set of tests to ignore
- use an empty set to indicate a blanket nosec (i.e. just #nosec, no individual tests)
- use None to indicate that there was no nosec comment on the line in question
- track and report metrics on the number of tests skipped by specific tests and the number of tests that fail because they were not included in the list of specific tests to ignore

Resolves PyCQA#211
See also PyCQA#418
mikespallino added a commit to mikespallino/bandit that referenced this issue Jan 28, 2022
@mikespallino
support for disabling individual tests
03025aa 
- allow disabling tests by id and by name (e.g. B602,assert_used)
- update nosec_lines to be a dict keyed on line number to a set of tests to ignore
- use an empty set to indicate a blanket nosec (i.e. just #nosec, no individual tests)
- use None to indicate that there was no nosec comment on the line in question
- track and report metrics on the number of tests skipped by specific tests and the number of tests that fail because they were not included in the list of specific tests to ignore

Resolves PyCQA#211
See also PyCQA#418
mikespallino added a commit to mikespallino/bandit that referenced this issue Jan 28, 2022
@mikespallino
support for disabling individual tests
4dda362 
- allow disabling tests by id and by name (e.g. B602,assert_used)
- update nosec_lines to be a dict keyed on line number to a set of tests to ignore
- use an empty set to indicate a blanket nosec (i.e. just #nosec, no individual tests)
- use None to indicate that there was no nosec comment on the line in question
- track and report metrics on the number of tests skipped by specific tests and the number of tests that fail because they were not included in the list of specific tests to ignore

Resolves PyCQA#211
See also PyCQA#418
mikespallino added a commit to mikespallino/bandit that referenced this issue Feb 2, 2022
@mikespallino
support for disabling individual tests
ab13f41 
- allow disabling tests by id and by name (e.g. B602,assert_used)
- update nosec_lines to be a dict keyed on line number to a set of tests to ignore
- use an empty set to indicate a blanket nosec (i.e. just #nosec, no individual tests)
- use None to indicate that there was no nosec comment on the line in question
- track and report metrics on the number of tests skipped by specific tests and the number of tests that fail because they were not included in the list of specific tests to ignore

Resolves PyCQA#211
See also PyCQA#418
mikespallino added a commit to mikespallino/bandit that referenced this issue Feb 2, 2022
@mikespallino
support for disabling individual tests
bfa9288 
- allow disabling tests by id and by name (e.g. B602,assert_used)
- update nosec_lines to be a dict keyed on line number to a set of tests to ignore
- use an empty set to indicate a blanket nosec (i.e. just #nosec, no individual tests)
- use None to indicate that there was no nosec comment on the line in question
- track and report metrics on the number of tests skipped by specific tests and the number of tests that fail because they were not included in the list of specific tests to ignore

Resolves PyCQA#211
See also PyCQA#418
@comc comc mentioned this issue Dec 13, 2022
Open
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Assignees
No one assigned
Labels
enhancement New feature or request
Projects
None yet
Milestone
Near Future
Development

No branches or pull requests
4 participants
@posita @ehooo @calve @ericwb