Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Bandit error count displayed as "1" even though multiple errors are present #680

Closed
CAM-Gerlach opened this issue Aug 23, 2021 · 3 comments · Fixed by #682
Closed

Bandit error count displayed as "1" even though multiple errors are present #680

CAM-Gerlach opened this issue Aug 23, 2021 · 3 comments · Fixed by #682
Labels
bug Something isn't working Waiting user validation

Comments

@CAM-Gerlach
Copy link

Describe the bug
A clear and concise description of what the bug is.

The error count for Bandit is displayed as "1" by Mega-Linter even though multiple errors, of different types, are detected.

To Reproduce
Steps to reproduce the behavior:

  1. Run Mega-Linter on a project with at least two unsilenced Bandit errors
  2. Observe incorrect number of errors reported

Expected behavior
A clear and concise description of what you expected to happen.

Mega-Linter reports the correct number of errors

Screenshots
If applicable, add screenshots to help explain your problem.

Log output:

2021-08-23T05:09:59.6977377Z - Using [bandit v1.7.0] https://bandit.readthedocs.io/en/latest/
2021-08-23T05:09:59.6980091Z - Mega-Linter key: [PYTHON_BANDIT]
2021-08-23T05:09:59.6982090Z - Rules config: identified by [bandit]
2021-08-23T05:09:59.6983441Z [bandit] setup.py
2021-08-23T05:09:59.6984765Z [bandit] src/submanager/__init__.py
2021-08-23T05:09:59.6986156Z [bandit] src/submanager/__main__.py
2021-08-23T05:09:59.6987571Z [bandit] src/submanager/cli.py
[ XXXXXXXXXXXX SNIP THE REST OF THE FILES XXXXXXXXXXXXXXXXXXXX ]
2021-08-23T05:09:59.7160553Z [bandit] tools/generate_requirements_files.py
2021-08-23T05:09:59.7162893Z --Error detail:
2021-08-23T05:09:59.7164201Z [main]	INFO	profile include tests: None
2021-08-23T05:09:59.7166053Z [main]	INFO	profile exclude tests: None
2021-08-23T05:09:59.7167493Z [main]	INFO	cli include tests: None
2021-08-23T05:09:59.7168877Z [main]	INFO	cli exclude tests: None
2021-08-23T05:09:59.7170219Z [main]	INFO	running on Python 3.9.6
2021-08-23T05:09:59.7171313Z 66 [0.. 50.. ]
2021-08-23T05:09:59.7173056Z Run started:2021-08-23 05:09:59.387847
2021-08-23T05:09:59.7173843Z 
2021-08-23T05:09:59.7174771Z Test results:
2021-08-23T05:09:59.7176879Z >> Issue: [B101:assert_used] Use of assert detected. The enclosed code will be removed when compiling to optimised byte code.
2021-08-23T05:09:59.7179216Z    Severity: Low   Confidence: High
2021-08-23T05:09:59.7181457Z    Location: /github/workspace/tests/functional/conftest.py:248
2021-08-23T05:09:59.7184337Z    More Info: https://bandit.readthedocs.io/en/latest/plugins/b101_assert_used.html
2021-08-23T05:09:59.7186878Z 247	            if check_exits and check_code and check_code.value:
2021-08-23T05:09:59.7188888Z 248	                assert check_text.strip() in captured_output.err.lower()
2021-08-23T05:09:59.7190488Z 249	            else:
2021-08-23T05:09:59.7191153Z 
[XXXXXXXXXXXXXXXXXXXXXX SNIP MANY MORE ASSERT ERRORS XXXXXXXXXXXXXXXXXXXXXXXX]
2021-08-23T05:09:59.7981434Z 
2021-08-23T05:09:59.7982967Z --------------------------------------------------
2021-08-23T05:09:59.7985270Z >> Issue: [B101:assert_used] Use of assert detected. The enclosed code will be removed when compiling to optimised byte code.
2021-08-23T05:09:59.7987514Z    Severity: Low   Confidence: High
2021-08-23T05:09:59.7989166Z    Location: /github/workspace/tests/unit/test_init.py:32
2021-08-23T05:09:59.7991905Z    More Info: https://bandit.readthedocs.io/en/latest/plugins/b101_assert_used.html
2021-08-23T05:09:59.7994767Z 31	    parsed_version = packaging.version.Version(version)
2021-08-23T05:09:59.7997409Z 32	    assert parsed_version > packaging.version.Version(BASELINE_VERSION)
2021-08-23T05:09:59.7998956Z 
2021-08-23T05:09:59.8000537Z --------------------------------------------------
2021-08-23T05:09:59.8003353Z >> Issue: [B603:subprocess_without_shell_equals_true] subprocess call - check for execution of untrusted input.
2021-08-23T05:09:59.8005550Z    Severity: Low   Confidence: High
2021-08-23T05:09:59.8007472Z    Location: /github/workspace/tools/generate_requirements_files.py:102
2021-08-23T05:09:59.8010511Z    More Info: https://bandit.readthedocs.io/en/latest/plugins/b603_subprocess_without_shell_equals_true.html
2021-08-23T05:09:59.8012790Z 101	        ]
2021-08-23T05:09:59.8014196Z 102	        pip_compile_result = subprocess.run(  # nosemgrep
2021-08-23T05:09:59.8015862Z 103	            pip_compile_invocation,
2021-08-23T05:09:59.8017401Z 104	            stdout=subprocess.DEVNULL,
2021-08-23T05:09:59.8019005Z 105	            stderr=subprocess.PIPE,
2021-08-23T05:09:59.8020305Z 106	            check=False,
2021-08-23T05:09:59.8021389Z 107	            text=True,
2021-08-23T05:09:59.8022747Z 108	            env=env_vars,
2021-08-23T05:09:59.8024031Z 109	            cwd=PROJECT_DIR,
2021-08-23T05:09:59.8025032Z 110	        )
2021-08-23T05:09:59.8025611Z 
2021-08-23T05:09:59.8027205Z --------------------------------------------------
2021-08-23T05:09:59.8028125Z 
2021-08-23T05:09:59.8029019Z Code scanned:
2021-08-23T05:09:59.8030123Z 	Total lines of code: 5737
2021-08-23T05:09:59.8031720Z 	Total lines skipped (#nosec): 2
2021-08-23T05:09:59.8032577Z 
2021-08-23T05:09:59.8033476Z Run metrics:
2021-08-23T05:09:59.8034604Z 	Total issues (by severity):
2021-08-23T05:09:59.8035794Z 		Undefined: 0.0
2021-08-23T05:09:59.8036748Z 		Low: 38.0
2021-08-23T05:09:59.8037659Z 		Medium: 0.0
2021-08-23T05:09:59.8038568Z 		High: 0.0
2021-08-23T05:09:59.8039701Z 	Total issues (by confidence):
2021-08-23T05:09:59.8040903Z 		Undefined: 0.0
2021-08-23T05:09:59.8041868Z 		Low: 0.0
2021-08-23T05:09:59.8042763Z 		Medium: 0.0
2021-08-23T05:09:59.8043724Z 		High: 38.0
2021-08-23T05:09:59.8044726Z Files skipped (0):
2021-08-23T05:09:59.8045456Z 
2021-08-23T05:09:59.8047568Z �[31m❌ Linted [PYTHON] files with [bandit]: Found 1 error(s) - (1.45s)�[0m
2021-08-23T05:10:00.0158926Z [Text Reporter] Generated TEXT report: /github/workspace/report/linters_logs/ERROR-PYTHON_BANDIT.log
2021-08-23T05:10:03.6960611Z 

Additional context
Add any other context about the problem here.

Thanks!

@CAM-Gerlach CAM-Gerlach added the bug Something isn't working label Aug 23, 2021
nvuillam added a commit that referenced this issue Aug 23, 2021
nvuillam added a commit that referenced this issue Aug 23, 2021
* Fix python bandit config file use

* Add regex to count python bandit errors

Fixes #680

* Add --upgrade to pip install command to get latest versions of packages

Fixes #681
@nvuillam
Copy link
Member

Released in latest/insiders, please can you confirm that it's ok now ?

Note: this CI job must be completed before testing is available with latest/insiders tag

@CAM-Gerlach
Copy link
Author

This issue appears to be fixed, thanks! The number of bandit errors are displayed correctly both in the output and in the Github comment; see r-spacex/submanager#11 (though errors I am seeing indicate that unfortunately, the other two issues haven't been, sorry)

@nvuillam
Copy link
Member

nvuillam commented Aug 28, 2021

At least one of the bugs has been fixed 😋

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
bug Something isn't working Waiting user validation
Projects
None yet
Development

Successfully merging a pull request may close this issue.

2 participants