@codacy/tools-bandit-1 0.1.0

package/LICENSE

@@ -0,0 +1,21 @@
+MIT License
+
+Copyright (c) 2026 Codacy
+
+Permission is hereby granted, free of charge, to any person obtaining a copy
+of this software and associated documentation files (the "Software"), to deal
+in the Software without restriction, including without limitation the rights
+to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+copies of the Software, and to permit persons to whom the Software is
+furnished to do so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in all
+copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+SOFTWARE.

package/README.md

@@ -0,0 +1,66 @@
+# @codacy/tools-bandit-1
+
+## Table of Contents
+- [Overview](#overview)
+- [Updating patterns](#updating-patterns)
+- [Updating the Bandit version](#updating-the-bandit-version)
+- [Development](#development)
+- [Notes for maintainers](#notes-for-maintainers)
+
+---
+
+## Overview
+
+Python security linter using the [Bandit](https://bandit.readthedocs.io/) binary. Uses the CLI execution strategy -- spawns `bandit` from a managed Python venv via `spawnTool()` and parses its JSON output.
+
+| Property | Value |
+|----------|-------|
+| Tool ID | `Bandit` |
+| Codacy UUID | `89b6fc6a-9137-4cf3-8b9f-dcc3bedfa738` |
+| Strategy | CLI |
+| Languages | Python |
+| Binary | `bandit` (pip-installed in venv) |
+| File patterns | `**/*.py` |
+
+## Updating patterns
+
+```bash
+# Re-fetch pattern metadata from the Codacy API
+pnpm prefetch
+
+# Commit the result
+git add src/patterns.json
+```
+
+Pattern IDs follow the format `Bandit_B602`, `Bandit_B301`, etc.
+
+## Updating the Bandit version
+
+1. Update `preferredVersion` in `src/adapter.ts`
+2. Update the `PIP_PACKAGES` array with the new pinned version
+3. Run `pnpm prefetch` to check for new/removed rules
+4. Run `pnpm test` to verify compatibility
+5. If the major version changes, create a new adapter package (`bandit-2/`)
+
+## Development
+
+```bash
+pnpm build    # Build with tsup
+pnpm test     # Run tests (requires bandit in PATH or venv)
+```
+
+To install bandit locally for testing:
+```bash
+pip install bandit==1.8.3
+```
+
+## Notes for maintainers
+
+- Bandit requires Python 3 as a runtime. The adapter uses an isolated venv at `~/.codacy/runtimes/bandit-1/venv/`.
+- Exit code 0 = no findings, 1 = findings found (normal), >1 = error.
+- `col_offset` in bandit output is 0-based; the adapter adds 1 for the 1-based Issue model.
+- Bandit's `issue_confidence` (LOW/MEDIUM/HIGH) maps to numeric confidence (1/2/3) on the Issue.
+- CWE information from `issue_cwe` is appended to the issue message as `(CWE-{id})`.
+- Config file detection supports `.bandit` (INI, passed with `--ini`), `bandit.yml` (YAML, passed with `-c`), and `pyproject.toml` (TOML, passed with `-c`).
+- Pattern filtering uses the `-t` flag to pass comma-separated test IDs to bandit.
+- The `errors` array in bandit's JSON output (file-level errors like syntax errors) is mapped to `AnalysisError` objects with level "warning".

package/dist/index.d.ts

@@ -0,0 +1,5 @@
+import * as _codacy_tooling from '@codacy/tooling';
+
+declare const _default: Readonly<_codacy_tooling.ToolAdapter>;
+
+export { _default as default };

package/dist/index.js

@@ -0,0 +1,1041 @@
+"use strict";
+var __create = Object.create;
+var __defProp = Object.defineProperty;
+var __getOwnPropDesc = Object.getOwnPropertyDescriptor;
+var __getOwnPropNames = Object.getOwnPropertyNames;
+var __getProtoOf = Object.getPrototypeOf;
+var __hasOwnProp = Object.prototype.hasOwnProperty;
+var __export = (target, all) => {
+  for (var name in all)
+    __defProp(target, name, { get: all[name], enumerable: true });
+};
+var __copyProps = (to, from, except, desc) => {
+  if (from && typeof from === "object" || typeof from === "function") {
+    for (let key of __getOwnPropNames(from))
+      if (!__hasOwnProp.call(to, key) && key !== except)
+        __defProp(to, key, { get: () => from[key], enumerable: !(desc = __getOwnPropDesc(from, key)) || desc.enumerable });
+  }
+  return to;
+};
+var __toESM = (mod, isNodeMode, target) => (target = mod != null ? __create(__getProtoOf(mod)) : {}, __copyProps(
+  // If the importer is in node compatibility mode or this is not an ESM
+  // file that has been converted to a CommonJS file using a Babel-
+  // compatible transform (i.e. "__esModule" has not been set), then set
+  // "default" to the CommonJS "module.exports" for node compatibility.
+  isNodeMode || !mod || !mod.__esModule ? __defProp(target, "default", { value: mod, enumerable: true }) : target,
+  mod
+));
+var __toCommonJS = (mod) => __copyProps(__defProp({}, "__esModule", { value: true }), mod);
+
+// src/index.ts
+var index_exports = {};
+__export(index_exports, {
+  default: () => index_default
+});
+module.exports = __toCommonJS(index_exports);
+var import_tooling2 = require("@codacy/tooling");
+
+// src/adapter.ts
+var import_tooling = require("@codacy/tooling");
+var import_path = __toESM(require("path"));
+var import_promises = __toESM(require("fs/promises"));
+
+// src/patterns.json
+var patterns_default = [
+  {
+    id: "Bandit_B101",
+    category: "Security",
+    severityLevel: "High",
+    title: "Avoid Use of Assert Statements",
+    enabled: false,
+    parameters: []
+  },
+  {
+    id: "Bandit_B102",
+    category: "Security",
+    severityLevel: "Warning",
+    title: "Avoid use of exec",
+    enabled: true,
+    parameters: []
+  },
+  {
+    id: "Bandit_B103",
+    category: "Security",
+    severityLevel: "High",
+    title: "Detect Setting Permissive File Permissions",
+    enabled: true,
+    parameters: []
+  },
+  {
+    id: "Bandit_B104",
+    category: "Security",
+    severityLevel: "Warning",
+    title: "Avoid binding to all network interfaces",
+    enabled: true,
+    parameters: []
+  },
+  {
+    id: "Bandit_B105",
+    category: "Security",
+    severityLevel: "High",
+    title: "Detect Hardcoded Password Strings",
+    enabled: true,
+    parameters: []
+  },
+  {
+    id: "Bandit_B106",
+    category: "Security",
+    severityLevel: "High",
+    title: "Detect Hardcoded Password Function Arguments",
+    enabled: false,
+    parameters: []
+  },
+  {
+    id: "Bandit_B107",
+    category: "Security",
+    severityLevel: "High",
+    title: "Avoid Hardcoded Password Argument Defaults",
+    enabled: true,
+    parameters: []
+  },
+  {
+    id: "Bandit_B108",
+    category: "Security",
+    severityLevel: "Warning",
+    title: "Avoid Hardcoded Temporary Directory Usage",
+    enabled: true,
+    parameters: []
+  },
+  {
+    id: "Bandit_B109",
+    category: "Security",
+    severityLevel: "Warning",
+    title: "Detect Password Based Config Options Not Marked Secret",
+    enabled: true,
+    parameters: []
+  },
+  {
+    id: "Bandit_B110",
+    category: "Security",
+    severityLevel: "Warning",
+    title: "Avoid pass in except block",
+    enabled: true,
+    parameters: []
+  },
+  {
+    id: "Bandit_B111",
+    category: "Security",
+    severityLevel: "Warning",
+    title: "Detect use of rootwrap running as root",
+    enabled: true,
+    parameters: []
+  },
+  {
+    id: "Bandit_B112",
+    category: "Security",
+    severityLevel: "High",
+    title: "Avoid continue in except block",
+    enabled: true,
+    parameters: []
+  },
+  {
+    id: "Bandit_B113",
+    category: "Security",
+    severityLevel: "Warning",
+    title: "Enforce timeout parameter in requests calls",
+    enabled: true,
+    parameters: []
+  },
+  {
+    id: "Bandit_B201",
+    category: "Security",
+    severityLevel: "High",
+    title: "Avoid Running Flask App with Debug Mode Enabled",
+    enabled: true,
+    parameters: []
+  },
+  {
+    id: "Bandit_B202",
+    category: "Security",
+    severityLevel: "High",
+    title: "Avoid Using tarfile.extractall Without Safe Member Validation",
+    enabled: true,
+    parameters: []
+  },
+  {
+    id: "Bandit_B301",
+    category: "Security",
+    severityLevel: "Warning",
+    title: "Avoid Unsafe Use of Pickle for Deserialization",
+    enabled: true,
+    parameters: []
+  },
+  {
+    id: "Bandit_B302",
+    category: "Security",
+    severityLevel: "Warning",
+    title: "Avoid Deserialization with the marshal Module",
+    enabled: true,
+    parameters: []
+  },
+  {
+    id: "Bandit_B303",
+    category: "Security",
+    severityLevel: "Warning",
+    title: "Avoid Use of Insecure Hash Functions (MD2, MD4, MD5, SHA1)",
+    enabled: true,
+    parameters: []
+  },
+  {
+    id: "Bandit_B304",
+    category: "Security",
+    severityLevel: "High",
+    title: "Avoid Use of Insecure Cipher or Cipher Mode",
+    enabled: true,
+    parameters: []
+  },
+  {
+    id: "Bandit_B305",
+    category: "Security",
+    severityLevel: "Warning",
+    title: "Avoid Use of Insecure Ciphers and Cipher Modes",
+    enabled: true,
+    parameters: []
+  },
+  {
+    id: "Bandit_B306",
+    category: "Security",
+    severityLevel: "Warning",
+    title: "Avoid Use of Insecure and Deprecated Function mktemp",
+    enabled: true,
+    parameters: []
+  },
+  {
+    id: "Bandit_B307",
+    category: "Security",
+    severityLevel: "Warning",
+    title: "Avoid use of eval function",
+    enabled: true,
+    parameters: []
+  },
+  {
+    id: "Bandit_B308",
+    category: "Security",
+    severityLevel: "Warning",
+    title: "Avoid use of mark_safe()",
+    enabled: true,
+    parameters: []
+  },
+  {
+    id: "Bandit_B309",
+    category: "Security",
+    severityLevel: "Warning",
+    title: "Avoid Use of HTTPSConnection on Older Python Versions",
+    enabled: true,
+    parameters: []
+  },
+  {
+    id: "Bandit_B310",
+    category: "Security",
+    severityLevel: "Warning",
+    title: "Audit urllib urlopen for permitted schemes",
+    enabled: true,
+    parameters: []
+  },
+  {
+    id: "Bandit_B311",
+    category: "Security",
+    severityLevel: "Warning",
+    title: "Avoid Using Standard Pseudo-Random Generators for Security Purposes",
+    enabled: true,
+    parameters: []
+  },
+  {
+    id: "Bandit_B312",
+    category: "Security",
+    severityLevel: "High",
+    title: "Avoid Using Telnet-related Functions",
+    enabled: true,
+    parameters: []
+  },
+  {
+    id: "Bandit_B313",
+    category: "Security",
+    severityLevel: "Warning",
+    title: "Avoid Using Unsafe XML Parsing Methods",
+    enabled: true,
+    parameters: []
+  },
+  {
+    id: "Bandit_B314",
+    category: "Security",
+    severityLevel: "Warning",
+    title: "Avoid Using Vulnerable XML Parsing Methods",
+    enabled: true,
+    parameters: []
+  },
+  {
+    id: "Bandit_B315",
+    category: "Security",
+    severityLevel: "Warning",
+    title: "Avoid Using xml.sax.expatreader.create_parser for Parsing Untrusted XML",
+    enabled: true,
+    parameters: []
+  },
+  {
+    id: "Bandit_B316",
+    category: "Security",
+    severityLevel: "Warning",
+    title: "Avoid parsing untrusted XML data with vulnerable XML methods",
+    enabled: true,
+    parameters: []
+  },
+  {
+    id: "Bandit_B317",
+    category: "Security",
+    severityLevel: "Warning",
+    title: "Avoid Using xml.sax Methods to Parse Untrusted XML",
+    enabled: true,
+    parameters: []
+  },
+  {
+    id: "Bandit_B318",
+    category: "Security",
+    severityLevel: "Warning",
+    title: "Avoid Unsafe XML Parsing with xml.dom.minidom",
+    enabled: true,
+    parameters: []
+  },
+  {
+    id: "Bandit_B319",
+    category: "Security",
+    severityLevel: "Warning",
+    title: "Avoid Parsing Untrusted XML with xml.dom.pulldom Methods",
+    enabled: true,
+    parameters: []
+  },
+  {
+    id: "Bandit_B320",
+    category: "Security",
+    severityLevel: "Warning",
+    title: "Avoid Using Vulnerable lxml.etree XML Parsing Methods",
+    enabled: true,
+    parameters: []
+  },
+  {
+    id: "Bandit_B321",
+    category: "Security",
+    severityLevel: "High",
+    title: "Avoid Using FTP-Related Functions",
+    enabled: true,
+    parameters: []
+  },
+  {
+    id: "Bandit_B322",
+    category: "Security",
+    severityLevel: "High",
+    title: "Avoid using input() in Python 2",
+    enabled: false,
+    parameters: []
+  },
+  {
+    id: "Bandit_B323",
+    category: "Security",
+    severityLevel: "Warning",
+    title: "Avoid Using Unverified SSL Context",
+    enabled: false,
+    parameters: []
+  },
+  {
+    id: "Bandit_B324",
+    category: "Security",
+    severityLevel: "High",
+    title: "Avoid Use of Insecure Hash Functions in hashlib",
+    enabled: false,
+    parameters: []
+  },
+  {
+    id: "Bandit_B325",
+    category: "Security",
+    severityLevel: "Warning",
+    title: "Avoid use of os.tempnam() and os.tmpnam()",
+    enabled: false,
+    parameters: []
+  },
+  {
+    id: "Bandit_B401",
+    category: "Security",
+    severityLevel: "High",
+    title: "Avoid Importing Telnetlib Module",
+    enabled: true,
+    parameters: []
+  },
+  {
+    id: "Bandit_B402",
+    category: "Security",
+    severityLevel: "High",
+    title: "Avoid Importing ftplib Module",
+    enabled: true,
+    parameters: []
+  },
+  {
+    id: "Bandit_B403",
+    category: "Security",
+    severityLevel: "Warning",
+    title: "Consider Security Implications of Importing pickle and Related Modules",
+    enabled: true,
+    parameters: []
+  },
+  {
+    id: "Bandit_B404",
+    category: "Security",
+    severityLevel: "Info",
+    title: "Consider security implications of importing subprocess module",
+    enabled: true,
+    parameters: []
+  },
+  {
+    id: "Bandit_B405",
+    category: "Security",
+    severityLevel: "Warning",
+    title: "Avoid Using Vulnerable xml.etree Imports for Parsing Untrusted XML",
+    enabled: true,
+    parameters: []
+  },
+  {
+    id: "Bandit_B406",
+    category: "Security",
+    severityLevel: "Warning",
+    title: "Avoid Using Vulnerable XML Parsing Methods",
+    enabled: true,
+    parameters: []
+  },
+  {
+    id: "Bandit_B407",
+    category: "Security",
+    severityLevel: "Warning",
+    title: "Avoid Using Vulnerable XML Parsing Methods",
+    enabled: true,
+    parameters: []
+  },
+  {
+    id: "Bandit_B408",
+    category: "Security",
+    severityLevel: "Warning",
+    title: "Avoid importing xml.dom.minidom for untrusted XML parsing",
+    enabled: true,
+    parameters: []
+  },
+  {
+    id: "Bandit_B409",
+    category: "Security",
+    severityLevel: "Warning",
+    title: "Avoid importing xml.dom.pulldom for untrusted XML parsing",
+    enabled: true,
+    parameters: []
+  },
+  {
+    id: "Bandit_B410",
+    category: "Security",
+    severityLevel: "Warning",
+    title: "Avoid Using Vulnerable XML Parsing Libraries (lxml)",
+    enabled: true,
+    parameters: []
+  },
+  {
+    id: "Bandit_B411",
+    category: "Security",
+    severityLevel: "High",
+    title: "Avoid Importing xmlrpclib",
+    enabled: true,
+    parameters: []
+  },
+  {
+    id: "Bandit_B412",
+    category: "Security",
+    severityLevel: "High",
+    title: "Avoid importing CGI handlers vulnerable to httpoxy",
+    enabled: false,
+    parameters: []
+  },
+  {
+    id: "Bandit_B413",
+    category: "Security",
+    severityLevel: "High",
+    title: "Avoid Importing PyCrypto Library",
+    enabled: false,
+    parameters: []
+  },
+  {
+    id: "Bandit_B414",
+    category: "Security",
+    severityLevel: "High",
+    title: "Avoid Importing PyCryptodome Modules",
+    enabled: false,
+    parameters: []
+  },
+  {
+    id: "Bandit_B501",
+    category: "Security",
+    severityLevel: "High",
+    title: "Avoid disabling SSL certificate validation in requests",
+    enabled: true,
+    parameters: []
+  },
+  {
+    id: "Bandit_B502",
+    category: "Security",
+    severityLevel: "High",
+    title: "Avoid Use of SSL/TLS with Bad Versions",
+    enabled: true,
+    parameters: []
+  },
+  {
+    id: "Bandit_B503",
+    category: "Security",
+    severityLevel: "Warning",
+    title: "Detect SSL Usage with Insecure Default Protocol Versions",
+    enabled: true,
+    parameters: []
+  },
+  {
+    id: "Bandit_B504",
+    category: "Security",
+    severityLevel: "Warning",
+    title: "Detect SSL/TLS Usage with No Version Specified",
+    enabled: true,
+    parameters: []
+  },
+  {
+    id: "Bandit_B505",
+    category: "Security",
+    severityLevel: "High",
+    title: "Detect Use of Weak Cryptographic Keys",
+    enabled: true,
+    parameters: []
+  },
+  {
+    id: "Bandit_B506",
+    category: "Security",
+    severityLevel: "Warning",
+    title: "Avoid Unsafe Use of yaml.load",
+    enabled: true,
+    parameters: []
+  },
+  {
+    id: "Bandit_B507",
+    category: "Security",
+    severityLevel: "High",
+    title: "Avoid Disabling SSH Host Key Verification",
+    enabled: false,
+    parameters: []
+  },
+  {
+    id: "Bandit_B508",
+    category: "Security",
+    severityLevel: "Warning",
+    title: "Avoid using insecure SNMP versions",
+    enabled: false,
+    parameters: []
+  },
+  {
+    id: "Bandit_B509",
+    category: "Security",
+    severityLevel: "Warning",
+    title: "Avoid Weak SNMP Cryptography",
+    enabled: false,
+    parameters: []
+  },
+  {
+    id: "Bandit_B601",
+    category: "Security",
+    severityLevel: "Warning",
+    title: "Detect Shell Injection Vulnerabilities in Paramiko exec_command",
+    enabled: true,
+    parameters: []
+  },
+  {
+    id: "Bandit_B602",
+    category: "Security",
+    severityLevel: "High",
+    title: "Avoid subprocess.Popen with shell=True",
+    enabled: true,
+    parameters: []
+  },
+  {
+    id: "Bandit_B603",
+    category: "Security",
+    severityLevel: "Warning",
+    title: "Check subprocess usage without shell=True",
+    enabled: true,
+    parameters: []
+  },
+  {
+    id: "Bandit_B604",
+    category: "Security",
+    severityLevel: "Warning",
+    title: "Detect function calls with shell=True parameter",
+    enabled: true,
+    parameters: []
+  },
+  {
+    id: "Bandit_B605",
+    category: "Security",
+    severityLevel: "Warning",
+    title: "Avoid starting a process with a shell",
+    enabled: false,
+    parameters: []
+  },
+  {
+    id: "Bandit_B606",
+    category: "Security",
+    severityLevel: "Info",
+    title: "Detect Starting a Process Without a Shell",
+    enabled: true,
+    parameters: []
+  },
+  {
+    id: "Bandit_B607",
+    category: "Security",
+    severityLevel: "Warning",
+    title: "Avoid starting a process with a partial executable path",
+    enabled: false,
+    parameters: []
+  },
+  {
+    id: "Bandit_B608",
+    category: "Security",
+    severityLevel: "Warning",
+    title: "Detect Hardcoded SQL Expressions to Prevent SQL Injection",
+    enabled: true,
+    parameters: []
+  },
+  {
+    id: "Bandit_B609",
+    category: "Security",
+    severityLevel: "High",
+    title: "Detect Wildcard Injection in Linux Command Emulation",
+    enabled: true,
+    parameters: []
+  },
+  {
+    id: "Bandit_B610",
+    category: "Security",
+    severityLevel: "Warning",
+    title: "Avoid Potential SQL Injection in Django extra() Function",
+    enabled: false,
+    parameters: []
+  },
+  {
+    id: "Bandit_B611",
+    category: "Security",
+    severityLevel: "Warning",
+    title: "Avoid Use of RawSQL Function in Django",
+    enabled: false,
+    parameters: []
+  },
+  {
+    id: "Bandit_B612",
+    category: "Security",
+    severityLevel: "Warning",
+    title: "Avoid insecure use of logging.config.listen",
+    enabled: false,
+    parameters: []
+  },
+  {
+    id: "Bandit_B701",
+    category: "Security",
+    severityLevel: "High",
+    title: "Avoid disabling autoescaping in Jinja2 templates",
+    enabled: true,
+    parameters: []
+  },
+  {
+    id: "Bandit_B702",
+    category: "Security",
+    severityLevel: "Warning",
+    title: "Detect Use of Mako Templates",
+    enabled: true,
+    parameters: []
+  },
+  {
+    id: "Bandit_B703",
+    category: "Security",
+    severityLevel: "Warning",
+    title: "Avoid Potential XSS with django mark_safe Function",
+    enabled: false,
+    parameters: []
+  }
+];
+
+// src/adapter.ts
+var TOOL_ID = "Bandit";
+var ADAPTER_ID = "bandit-1";
+var PIP_PACKAGES = ["bandit==1.8.3"];
+var PYTHON_VERSION_RANGE = ">=3.8.0 <3.14.0";
+var PATTERN_META = new Map(
+  patterns_default.map((p) => [
+    p.id,
+    {
+      category: p.category,
+      severity: p.severityLevel ?? "Info"
+    }
+  ])
+);
+function ruleMetadata(patternId) {
+  return PATTERN_META.get(patternId) ?? { category: "Security", severity: "Info" };
+}
+function mapConfidence(confidence) {
+  switch (confidence) {
+    case "HIGH":
+      return 3;
+    case "MEDIUM":
+      return 2;
+    default:
+      return 1;
+  }
+}
+function getLineContent(lines, lineNumber) {
+  return lines[lineNumber - 1] ?? "";
+}
+async function readFileLines(filePath) {
+  try {
+    const content = await import_promises.default.readFile(filePath, "utf-8");
+    return content.split("\n");
+  } catch {
+    return [];
+  }
+}
+function buildResult(startedAt, completedAt, issues, errors, filesAnalyzed) {
+  const durationMs = completedAt.getTime() - startedAt.getTime();
+  return {
+    metadata: {
+      startedAt: startedAt.toISOString(),
+      completedAt: completedAt.toISOString(),
+      durationMs
+    },
+    issues,
+    errors,
+    summary: {
+      toolId: TOOL_ID,
+      status: errors.some((e) => e.level === "error") ? "partial" : "success",
+      issueCount: issues.length,
+      errorCount: errors.length,
+      durationMs,
+      filesAnalyzed
+    }
+  };
+}
+var CONFIG_FILE_CANDIDATES = [".bandit", "bandit.yml", "pyproject.toml"];
+async function resolveBinaryPath(ctx) {
+  const venvDir = (0, import_tooling.getVenvDir)(ctx.globalDir, ADAPTER_ID);
+  const venvBin = import_path.default.join(venvDir, "bin", "bandit");
+  try {
+    await import_promises.default.access(venvBin);
+    return venvBin;
+  } catch {
+    return "bandit";
+  }
+}
+function buildMessage(result) {
+  const base = result.issue_text;
+  if (result.issue_cwe && result.issue_cwe.id) {
+    return `${base} (CWE-${result.issue_cwe.id})`;
+  }
+  return base;
+}
+var adapter = {
+  id: TOOL_ID,
+  displayName: "Bandit",
+  preferredVersion: "1.8.3",
+  compatibleVersions: ">=1.7.0",
+  website: "https://bandit.readthedocs.io/",
+  languages: ["Python"],
+  filePatterns: ["**/*.py"],
+  supportedOS: ["linux", "darwin"],
+  supportedArch: ["x64", "arm64"],
+  supportedRunners: ["local", "container"],
+  prerequisites: [
+    {
+      name: "Python",
+      versionRange: PYTHON_VERSION_RANGE,
+      preferredVersion: "3.12.0",
+      checkCommand: "python3 --version"
+    }
+  ],
+  /**
+   * Checks whether bandit is available in a venv or on the global PATH.
+   *
+   * Checks in order:
+   * 1. Codacy-managed venv (`~/.codacy/runtimes/bandit-1/venv/bin/bandit`)
+   * 2. Global PATH (`bandit`)
+   *
+   * Parses the version from `bandit --version` output like `bandit 1.8.3`.
+   */
+  async checkAvailability(ctx) {
+    ctx.logger.debug("Checking availability", { toolId: TOOL_ID });
+    const pythonInfo = await (0, import_tooling.findPython)(PYTHON_VERSION_RANGE, ctx.logger).catch(() => null);
+    const dependencies = pythonInfo ? [{ name: "Python", available: true, version: pythonInfo.version, installation: "global" }] : [{ name: "Python", available: false, reason: `Python 3 (${PYTHON_VERSION_RANGE}) not found` }];
+    const venvDir = (0, import_tooling.getVenvDir)(ctx.globalDir, ADAPTER_ID);
+    try {
+      const venvPython = import_path.default.join(venvDir, "bin", "python");
+      await import_promises.default.access(venvPython);
+      const venv = {
+        root: venvDir,
+        binDir: import_path.default.join(venvDir, "bin"),
+        python: venvPython,
+        pip: import_path.default.join(venvDir, "bin", "pip")
+      };
+      const version = await (0, import_tooling.checkVenvTool)(venv, "bandit", "--version", /bandit\s+(\S+)/, ctx.logger);
+      if (version) {
+        ctx.logger.debug("Found bandit in codacy venv", { toolId: TOOL_ID, version });
+        return {
+          available: true,
+          version,
+          path: (0, import_tooling.resolveVenvBinary)(venv, "bandit"),
+          installation: "codacy",
+          dependencies
+        };
+      }
+    } catch {
+    }
+    try {
+      const { stdout, exitCode } = await (0, import_tooling.spawnTool)("bandit", ["--version"], {
+        cwd: process.cwd()
+      });
+      if (exitCode === 0) {
+        const match = stdout.match(/bandit\s+(\S+)/);
+        if (match) {
+          ctx.logger.debug("Found bandit on global PATH", { toolId: TOOL_ID, version: match[1] });
+          return {
+            available: true,
+            version: match[1],
+            installation: "global",
+            dependencies
+          };
+        }
+      }
+    } catch {
+    }
+    ctx.logger.debug("bandit not found", { toolId: TOOL_ID });
+    return {
+      available: false,
+      reason: "bandit not found in venv or PATH",
+      installHint: "pip install bandit  # or\ncodacy-analysis analyze . --install-dependencies  # auto-install",
+      dependencies
+    };
+  },
+  /**
+   * Installs bandit into an isolated Python virtual environment.
+   *
+   * Uses findPython -> ensureVenv -> pipInstall to create a dedicated venv
+   * at `~/.codacy/runtimes/bandit-1/venv/` and install `bandit==1.8.3`.
+   */
+  async install(ctx) {
+    ctx.logger.info("Starting install", { toolId: TOOL_ID });
+    const python = await (0, import_tooling.ensurePython)(ctx.globalDir, PYTHON_VERSION_RANGE, ctx.logger);
+    if (!python) {
+      return {
+        success: false,
+        error: {
+          toolId: TOOL_ID,
+          phase: "requirementCheck",
+          kind: "MissingPrerequisite",
+          message: `Python (${PYTHON_VERSION_RANGE}) could not be found or downloaded. Bandit 1.8.x is incompatible with Python 3.14+.`,
+          level: "error"
+        }
+      };
+    }
+    const venvDir = (0, import_tooling.getVenvDir)(ctx.globalDir, ADAPTER_ID);
+    try {
+      ctx.logger.info(`Creating venv for bandit at ${venvDir}...`);
+      const venv = await (0, import_tooling.ensureVenv)(python.path, venvDir, ctx.logger);
+      ctx.logger.info(`Installing ${PIP_PACKAGES.join(", ")} into venv...`);
+      await (0, import_tooling.pipInstall)(venv, PIP_PACKAGES, ctx.logger);
+      const banditPath = (0, import_tooling.resolveVenvBinary)(venv, "bandit");
+      ctx.logger.info(`Installed bandit to ${banditPath}`);
+      return { success: true, installedPath: banditPath, installedVersion: adapter.preferredVersion };
+    } catch (err) {
+      return {
+        success: false,
+        error: {
+          toolId: TOOL_ID,
+          phase: "toolInstall",
+          kind: "InstallError",
+          message: `Failed to install bandit: ${err instanceof Error ? err.message : String(err)}`,
+          level: "error"
+        }
+      };
+    }
+  },
+  /**
+   * Checks for bandit configuration files in the repository root.
+   *
+   * Looks for `.bandit`, `bandit.yml`, or `pyproject.toml` (in that order).
+   * Returns the first found file.
+   */
+  async checkLocalConfigurationFile(ctx) {
+    ctx.logger.debug("Checking for local config", { toolId: TOOL_ID });
+    for (const candidate of CONFIG_FILE_CANDIDATES) {
+      const candidatePath = import_path.default.join(ctx.repositoryRoot, candidate);
+      try {
+        await import_promises.default.access(candidatePath);
+        ctx.logger.debug("Found local config", { toolId: TOOL_ID, path: candidatePath });
+        return { found: true, path: candidatePath };
+      } catch {
+      }
+    }
+    return { found: false };
+  },
+  /**
+   * Runs `bandit -f json` against the target files and converts the JSON
+   * output into Codacy Issue objects.
+   *
+   * Config resolution:
+   * - If `useLocalConfigurationFile` is true and a local config is found,
+   *   passes `--ini .bandit` for INI files or `-c <path>` for YAML/TOML.
+   * - If patterns are specified and no local config is in use, passes
+   *   `-t B602,B301,...` to filter bandit to only those test IDs.
+   * - Otherwise, bandit runs with all default tests.
+   *
+   * Exit codes: 0 = no issues, 1 = issues found (normal), >1 = error.
+   *
+   * The `errors` array in bandit's output (file-level errors like syntax
+   * errors) is mapped to AnalysisError objects.
+   *
+   * Never throws — all errors are captured in the returned `errors` array.
+   */
+  async analyze(ctx, codacyConfig) {
+    const startMs = Date.now();
+    ctx.logger.info("Starting analysis", { toolId: TOOL_ID, fileCount: ctx.targetFiles.length });
+    const startedAt = /* @__PURE__ */ new Date();
+    const issues = [];
+    const errors = [];
+    if (ctx.targetFiles.length === 0) {
+      return buildResult(startedAt, /* @__PURE__ */ new Date(), issues, errors, 0);
+    }
+    const binary = await resolveBinaryPath(ctx);
+    const absoluteFiles = ctx.targetFiles.map((f) => import_path.default.resolve(ctx.repositoryRoot, f));
+    const args = ["-f", "json"];
+    const useLocal = codacyConfig.useLocalConfigurationFile && codacyConfig.localConfigurationFile;
+    if (useLocal) {
+      const configPath = codacyConfig.localConfigurationFile;
+      if (configPath.endsWith(".bandit")) {
+        args.push("--ini", configPath);
+      } else {
+        args.push("-c", configPath);
+      }
+    }
+    args.push(...absoluteFiles);
+    try {
+      const { stdout, stderr, exitCode } = await (0, import_tooling.spawnTool)(binary, args, {
+        cwd: ctx.repositoryRoot,
+        logger: ctx.logger
+      });
+      if (exitCode > 1) {
+        errors.push({
+          toolId: TOOL_ID,
+          phase: "toolInvoke",
+          kind: "NonZeroExit",
+          message: `bandit exited with code ${exitCode}${stderr ? `: ${stderr.trim()}` : ""}`,
+          level: "error"
+        });
+        return buildResult(startedAt, /* @__PURE__ */ new Date(), issues, errors, ctx.targetFiles.length);
+      }
+      if (!stdout.trim()) {
+        return buildResult(startedAt, /* @__PURE__ */ new Date(), issues, errors, ctx.targetFiles.length);
+      }
+      let banditOutput;
+      try {
+        banditOutput = JSON.parse(stdout);
+      } catch (err) {
+        errors.push({
+          toolId: TOOL_ID,
+          phase: "outputParse",
+          kind: "MalformedOutput",
+          message: `Failed to parse bandit JSON output: ${err instanceof Error ? err.message : String(err)}`,
+          level: "error"
+        });
+        return buildResult(startedAt, /* @__PURE__ */ new Date(), issues, errors, ctx.targetFiles.length);
+      }
+      if (banditOutput.errors && banditOutput.errors.length > 0) {
+        for (const banditError of banditOutput.errors) {
+          errors.push({
+            toolId: TOOL_ID,
+            phase: "toolInvoke",
+            kind: "FileError",
+            message: `${banditError.filename}: ${banditError.reason}`,
+            level: "warning"
+          });
+        }
+      }
+      const enabledPatterns = new Set(codacyConfig.patterns.map((p) => p.patternId));
+      const resultsByFile = /* @__PURE__ */ new Map();
+      for (const result2 of banditOutput.results) {
+        const list = resultsByFile.get(result2.filename) ?? [];
+        list.push(result2);
+        resultsByFile.set(result2.filename, list);
+      }
+      for (const [filePath, fileResults] of resultsByFile) {
+        const absolutePath = import_path.default.isAbsolute(filePath) ? filePath : import_path.default.resolve(ctx.repositoryRoot, filePath);
+        const lines = await readFileLines(absolutePath);
+        const relPath = import_path.default.relative(ctx.repositoryRoot, absolutePath);
+        for (const result2 of fileResults) {
+          const patternId = (0, import_tooling.buildPatternId)(TOOL_ID, result2.test_id);
+          if (enabledPatterns.size > 0 && !enabledPatterns.has(patternId)) {
+            continue;
+          }
+          const meta = ruleMetadata(patternId);
+          const endLine = result2.line_range && result2.line_range.length > 1 ? result2.line_range[result2.line_range.length - 1] : void 0;
+          const issue = {
+            filePath: relPath,
+            patternId,
+            toolId: TOOL_ID,
+            line: result2.line_number,
+            column: result2.col_offset + 1,
+            // 0-based → 1-based
+            endLine,
+            endColumn: result2.end_col_offset ? result2.end_col_offset + 1 : void 0,
+            // 0-based → 1-based
+            message: buildMessage(result2),
+            lineContent: getLineContent(lines, result2.line_number),
+            multilineContent: (0, import_tooling.getMultilineContent)(lines, result2.line_number, endLine),
+            category: meta.category,
+            severity: meta.severity,
+            confidence: mapConfidence(result2.issue_confidence)
+          };
+          issues.push(issue);
+        }
+      }
+      const stderrFiltered = stderr.split("\n").filter((line) => !/^\[.*\]\s+INFO\s+/.test(line.trim())).join("\n").trim();
+      if (stderrFiltered) {
+        errors.push({
+          toolId: TOOL_ID,
+          phase: "outputParse",
+          kind: "ParseWarning",
+          message: `bandit stderr: ${stderrFiltered}`,
+          level: "warning"
+        });
+      }
+    } catch (err) {
+      errors.push({
+        toolId: TOOL_ID,
+        phase: "toolInvoke",
+        kind: "InvocationError",
+        message: `Failed to run bandit: ${err instanceof Error ? err.message : String(err)}`,
+        level: "error"
+      });
+    }
+    const result = buildResult(startedAt, /* @__PURE__ */ new Date(), issues, errors, ctx.targetFiles.length);
+    ctx.logger.info("Analysis complete", {
+      toolId: TOOL_ID,
+      issueCount: result.summary.issueCount,
+      errorCount: result.summary.errorCount,
+      durationMs: Date.now() - startMs
+    });
+    return result;
+  }
+};
+
+// src/index.ts
+var index_default = (0, import_tooling2.defineToolAdapter)(adapter);

package/package.json

@@ -0,0 +1,31 @@
+{
+  "name": "@codacy/tools-bandit-1",
+  "version": "0.1.0",
+  "description": "Bandit adapter — CLI-mode Python security linter",
+  "main": "dist/index.js",
+  "types": "dist/index.d.ts",
+  "files": [
+    "dist"
+  ],
+  "dependencies": {
+    "@codacy/tooling": "0.1.0"
+  },
+  "license": "MIT",
+  "author": "Codacy <support@codacy.com> (https://www.codacy.com)",
+  "repository": {
+    "type": "git",
+    "url": "https://github.com/codacy/analysis-cli.git",
+    "directory": "packages/tools/bandit-1"
+  },
+  "homepage": "https://github.com/codacy/analysis-cli",
+  "engines": {
+    "node": ">=20.0.0"
+  },
+  "scripts": {
+    "build": "tsup src/index.ts --format cjs --dts --clean",
+    "test": "vitest run",
+    "lint": "eslint src/",
+    "clean": "rm -rf dist",
+    "prefetch": "node ../scripts/fetch-patterns.mjs 89b6fc6a-9137-4cf3-8b9f-dcc3bedfa738 src/patterns.json"
+  }
+}