Exclude paths in config file ignored if passing specific files to Bandit CLI #499

dolan-a · 2019-05-28T18:48:57Z

UPDATE: please see my below comment for an updated description of the problem.

Describe the bug
When using the pre-commit hook, my excluded paths listed in .bandit are still processed by bandit.

To Reproduce
Steps to reproduce the behavior:

Create a .bandit config file with exclusions. For example:
```
[bandit]
exclude: ./node_modules/*,./tests/*
```
Run bandit via command line (bandit -r .), verify exclusions ignored.
Run bandit on all files via pre-commit hook: pre-commit run --all-files bandit
See that excluded files are processed by bandit

Expected behavior
I expect the excluded paths to be ignored.

Bandit version

bandit 1.6.0
  python version = 3.7.3 (default, May 27 2019, 05:16:50) [Clang 10.0.0 (clang-1000.10.44.4)]

The text was updated successfully, but these errors were encountered:

retpolanne · 2019-05-28T19:38:28Z

@pydolan I think it is a duplicate of #488

You can find a workaround at #488 (comment) or by pinning bandit to 1.5.1

dolan-a · 2019-05-28T20:29:32Z

@vinicyusmacedo -- My issue is actually unrelated to #488 and exists in 1.5.1 as well.

After further investigation, what's actually happening is that the excluded paths in the config file are being ignored when passing specific files to bandit -- even though excluding from the CLI works:

In v1.5.1:

$ bandit --version
bandit 1.5.1
  python version = 3.7.3 (default, May 27 2019, 05:16:50) [Clang 10.0.0 (clang-1000.10.44.4)]

$ cat .bandit
[bandit]
exclude: node_modules

$ bandit ./node_modules/node-gyp/gyp/pylib/gyp/xml_fix.py
...
Total lines of code: 46
...

$ bandit -x node_modules ./node_modules/node-gyp/gyp/pylib/gyp/xml_fix.py
...
Total lines of code: 0
...

In v1.6.0:

$ bandit --version
bandit 1.6.0
  python version = 3.7.3 (default, May 27 2019, 05:16:50) [Clang 10.0.0 (clang-1000.10.44.4)]

$ cat .bandit
[bandit]
exclude: ./node_modules/*

$ bandit ./node_modules/node-gyp/gyp/pylib/gyp/xml_fix.py
...
Total lines of code: 46
...

$ bandit -x "./node_modules/*" ./node_modules/node-gyp/gyp/pylib/gyp/xml_fix.py
...
Total lines of code: 0
...

I believe the two excluding methods should have consistent behavior, which is to not process the file in either case. This is especially important if one wants to exclude paths with the pre-commit hook.

Thanks!

retpolanne · 2019-05-28T20:33:50Z

I noticed this as well on my environment. By using the config file, exclusion is not working even if it is already as the workaround.

…

On Tue, May 28, 2019, 17:29 Dolan Antenucci ***@***.***> wrote: @vinicyusmacedo <https://github.com/vinicyusmacedo> -- My issue is actually unrelated to #488 <#488> and exists in 1.5.1 as well. After further investigation, what's actually happening is that the excluded paths in the config file are being ignored when passing specific files to bandit -- even though excluding from the CLI works: *In v1.5.1:* $ bandit --version bandit 1.5.1 python version = 3.7.3 (default, May 27 2019, 05:16:50) [Clang 10.0.0 (clang-1000.10.44.4)] $ cat .bandit [bandit] exclude: node_modules $ bandit ./node_modules/node-gyp/gyp/pylib/gyp/xml_fix.py ... Total lines of code: 46 ... $ bandit -x node_modules ./node_modules/node-gyp/gyp/pylib/gyp/xml_fix.py ... Total lines of code: 0 ... *In v1.6.0:* $ bandit --version bandit 1.6.0 python version = 3.7.3 (default, May 27 2019, 05:16:50) [Clang 10.0.0 (clang-1000.10.44.4)] $ cat .bandit [bandit] exclude: ./node_modules/* $ bandit ./node_modules/node-gyp/gyp/pylib/gyp/xml_fix.py ... Total lines of code: 46 ... $ bandit -x "./node_modules/*" ./node_modules/node-gyp/gyp/pylib/gyp/xml_fix.py ... Total lines of code: 0 ... I believe the two excluding methods should have consistent behavior, which is to not process the file in either case. This is especially important if one wants to exclude paths with the pre-commit hook. Thanks! — You are receiving this because you were mentioned. Reply to this email directly, view it on GitHub <#499?email_source=notifications&email_token=ABZTCFNY4WJDMOVIL4BBZCTPXWI3BA5CNFSM4HQGDTP2YY3PNVWWK3TUL52HS4DFVREXG43VMVBW63LNMVXHJKTDN5WW2ZLOORPWSZGODWNLBBY#issuecomment-496676999>, or mute the thread <https://github.com/notifications/unsubscribe-auth/ABZTCFINZOQUS2RGXRVETOLPXWI3BANCNFSM4HQGDTPQ> .

amacfie · 2020-01-01T22:17:23Z

In this scenario the .bandit file is completely ignored. Bandit only looks for config files where the target is, or recursively in subdirectories.

The relevant code is in bandit.cli.main._get_options_from_ini.

amacfie · 2020-01-01T22:27:41Z

Actually, if the target is a file, Bandit doesn't look for a .bandit file anywhere; see #332.

jugmac00 · 2020-02-09T10:58:09Z

Is there a current workaround? bandit is unusable at the moment as all test files are marked as false positives because of the usage of assert.

Cielquan · 2020-04-16T07:10:15Z

I do not use a config file but have also regarding problems with pre-commit.

When I run bandit -x "./.tox/*,./.eggs/*,./tests/*" -r . it works just fine.

When I run bandit with pre-commit I get an "error" in the output:
--exclude ./.tox/*,./.eggs/*,./tests/* (No such file or directory)

pre-commit-config.yaml:

  - repo: https://github.com/PyCQA/bandit
    rev: 1.6.2
    hooks:
      - id: bandit
        args: ["--exclude ./.tox/*,./.eggs/*,./tests/*"]

I also tried args: ["--exclude .tox,.eggs,tests"] without success.

And when I run bandit -x .tox,.eggs,tests -r . it is not working because the ignores get ignored and bandit checks everything. I get the same result when I run bandit -r .. Here the .tox directory gets also checked though it should not because of the default ignores.

adamwojt · 2021-02-28T00:57:22Z

ini file for dir exclusion doesn't work with -roption. It's super confusing.

My .bandit

[bandit]
exclude: test_*.py,./venv/,./env/,./node_modules/,./cacheback/,./.env,./.venv,migrations,tests
skips: B101,B311

Running with bandit -r .

[main]	INFO	Found project level .bandit file: ./.bandit
[main]	INFO	Using command line arg for excluded paths
[main]	INFO	Using ini file for skipped tests

Tests dirs and files are not ignored but everything works fine with bandit -x "test_*.py,./venv/,./env/,./node_modules/,./cacheback/,./.env,./.venv,migrations,tests" -r .

I am confused.

exhuma · 2021-03-17T09:07:32Z

I just ran into the same issue. Which makes this pretty bad for me right now is that bandit is executed via a CI-pipeline defined by a centrally configured GitLab instance. This always runs bandit using bandit -r <package_name> and I don't have direct control over this in the project.

In my project I have some files that I want to exclude and wrote them into .bandit

Yet, the pipeline still fails because of this issue.

So now I'm forced to write # nosec comments into all files in a given subfolder even though that particular subfolder only contains utilities which never receive end-user input and could be ignored alltogether.

ceteri · 2021-03-23T02:36:44Z

@Cielquan, you probably need to use the following instead:

args: ["--exclude", ".tox,.eggs,tests"]

I also tried args: ["--exclude .tox,.eggs,tests"] without success.

Cielquan · 2021-03-23T08:14:54Z

@Cielquan, you probably need to use the following instead:
args: ["--exclude", ".tox,.eggs,tests"]
I also tried args: ["--exclude .tox,.eggs,tests"] without success.

Yeah, I think that could be the case.
In the meantime I change from directly running bandit to running it via flake8-bandit and running flake8 via flakehell which enables you to customize the behavior auf every single flake8 extension for each and very file for example.

tobias-feil-by · 2021-06-11T09:34:34Z

@Cielquan, you probably need to use the following instead:
args: ["--exclude", ".tox,.eggs,tests"]
I also tried args: ["--exclude .tox,.eggs,tests"] without success.

How did you even find out about the possibility of mentioning args in the config file? The docs don't mention this

jugmac00 · 2021-06-11T09:42:41Z

@Cielquan, you probably need to use the following instead:
args: ["--exclude", ".tox,.eggs,tests"]
I also tried args: ["--exclude .tox,.eggs,tests"] without success.
How did you even find out about the possibility of mentioning args in the config file? The docs don't mention this

This refers to pre-commit - not to bandit - for those you do not run bandit directly, but via pre-commit - highly recommended to run linters.

devNan0 · 2021-11-11T20:53:48Z

Nice. Could we get a release for this? @sigmavirus24

sigmavirus24 · 2021-11-11T21:50:57Z

That's my plan, yes

exhuma · 2022-03-28T13:51:00Z

Has this been released yet? I'm currently on bandit 1.7.4 and it still behaves the same way.

I have a package in the enm subfolder and the following .bandit file:

---
targets: "enm"
exclude: "enm/vendor"

and I'm calling it as follows (execution line is out of my control as it is in a CI pipeline):

bandit -r enm

And even though the config-file exists, it still drills into the enm/vendor folder causing the pipeline to fail.

ChaseDDevelopment · 2022-04-13T21:56:20Z

I am also seeing this issue on 1.7.4

I have the following in my bandit file:

exclude_dirs:
  - ./build
  - ./src/project/research
  - ./tests

My pipelines also fail, But I am using

pipenv run python -m bandit -r . -lll as my command

mpas · 2022-11-03T04:32:13Z

Running into the same problem. Tried all combinations of ini, pyproject, yaml. Unable to exclude. Can this issue be reopened?

dolan-a changed the title ~~Running via pre-commit hook not reading excluded paths from .bandit file~~ Exclude paths in config file ignored if passing specific files to Bandit CLI May 28, 2019

ericwb added the bug Something isn't working label May 28, 2019

bittner mentioned this issue Apr 22, 2020

Document how to use Bandit #603

Closed

devNan0 mentioned this issue Mar 19, 2021

Apply default_values only if not already set in cli or config #699

Closed

thekaveman mentioned this issue Apr 28, 2021

Pre-commit hook runs bandit cal-itp/benefits#45

Merged

alipqb mentioned this issue Jul 10, 2021

fix reading initial values from .bandit #722

Merged

sigmavirus24 closed this as completed in #722 Nov 11, 2021

mpas mentioned this issue Nov 3, 2022

Unable to exclude directories when running the CLI #966

Open

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Exclude paths in config file ignored if passing specific files to Bandit CLI #499

Exclude paths in config file ignored if passing specific files to Bandit CLI #499

dolan-a commented May 28, 2019 •

edited

Loading

retpolanne commented May 28, 2019 •

edited

Loading

dolan-a commented May 28, 2019

retpolanne commented May 28, 2019 via email

amacfie commented Jan 1, 2020 •

edited

Loading

amacfie commented Jan 1, 2020

jugmac00 commented Feb 9, 2020

Cielquan commented Apr 16, 2020

adamwojt commented Feb 28, 2021 •

edited

Loading

exhuma commented Mar 17, 2021

ceteri commented Mar 23, 2021

Cielquan commented Mar 23, 2021

tobias-feil-by commented Jun 11, 2021

jugmac00 commented Jun 11, 2021

devNan0 commented Nov 11, 2021

sigmavirus24 commented Nov 11, 2021

exhuma commented Mar 28, 2022

ChaseDDevelopment commented Apr 13, 2022

mpas commented Nov 3, 2022

Exclude paths in config file ignored if passing specific files to Bandit CLI #499

Exclude paths in config file ignored if passing specific files to Bandit CLI #499

Comments

dolan-a commented May 28, 2019 • edited Loading

retpolanne commented May 28, 2019 • edited Loading

dolan-a commented May 28, 2019

retpolanne commented May 28, 2019 via email

amacfie commented Jan 1, 2020 • edited Loading

amacfie commented Jan 1, 2020

jugmac00 commented Feb 9, 2020

Cielquan commented Apr 16, 2020

adamwojt commented Feb 28, 2021 • edited Loading

exhuma commented Mar 17, 2021

ceteri commented Mar 23, 2021

Cielquan commented Mar 23, 2021

tobias-feil-by commented Jun 11, 2021

jugmac00 commented Jun 11, 2021

devNan0 commented Nov 11, 2021

sigmavirus24 commented Nov 11, 2021

exhuma commented Mar 28, 2022

ChaseDDevelopment commented Apr 13, 2022

mpas commented Nov 3, 2022

dolan-a commented May 28, 2019 •

edited

Loading

retpolanne commented May 28, 2019 •

edited

Loading

amacfie commented Jan 1, 2020 •

edited

Loading

adamwojt commented Feb 28, 2021 •

edited

Loading