@codacy/tools-bandit-1 0.18.0 → 0.19.0

package/README.md

@@ -1,6 +1,7 @@
 # @codacy/tools-bandit-1
 
 ## Table of Contents
+
 - [Overview](#overview)
 - [Updating patterns](#updating-patterns)
 - [Updating the Bandit version](#updating-the-bandit-version)
@@ -13,14 +14,14 @@
 
 Python security linter using the [Bandit](https://bandit.readthedocs.io/) binary. Uses the CLI execution strategy -- spawns `bandit` from a managed Python venv via `spawnTool()` and parses its JSON output.
 
-| Property | Value |
-|----------|-------|
-| Tool ID | `Bandit` |
-| Codacy UUID | `89b6fc6a-9137-4cf3-8b9f-dcc3bedfa738` |
-| Strategy | CLI |
-| Languages | Python |
-| Binary | `bandit` (pip-installed in venv) |
-| File patterns | `**/*.py` |
+| Property      | Value                                  |
+| ------------- | -------------------------------------- |
+| Tool ID       | `Bandit`                               |
+| Codacy UUID   | `89b6fc6a-9137-4cf3-8b9f-dcc3bedfa738` |
+| Strategy      | CLI                                    |
+| Languages     | Python                                 |
+| Binary        | `bandit` (pip-installed in venv)       |
+| File patterns | `**/*.py`                              |
 
 ## Updating patterns
 
@@ -50,12 +51,32 @@ pnpm test     # Run tests (requires bandit in PATH or venv)
 ```
 
 To install bandit locally for testing:
+
 ```bash
 pip install bandit==1.8.3
 ```
 
 ## Notes for maintainers
 
+- **Preset mappings (`src/pattern-mappings.json`)**: 18 of the 78 checks are gated on a
+  detected PyPI dependency, because they only ever fire against one library's API. Ten were
+  default-on and now stay out of a repo that does not declare the library — `B201` (Flask),
+  `B701` (Jinja2), `B702` (Mako), `B601` (Paramiko), `B320`/`B410` (lxml), `B506` (PyYAML),
+  `B113`/`B501` (requests) and `B308` (Django). Eight were default-off and are now reachable
+  at all: `B610`/`B611`/`B703` (Django SQLi/XSS), `B507` (Paramiko host keys), `B508`/`B509`
+  (PySNMP), `B413`/`B414` (PyCrypto vs. PyCryptodome — separate projects, so separate
+  entities). Left universal on purpose: the stdlib checks (`B301`–`B307`, `B324`) and `B412`,
+  whose httpoxy CGI handler has no manifest to read.
+
+  Two of these need a second key, because gating gets its evidence from **direct**
+  declarations only:
+  - `B701` is claimed by `flask` as well as `jinja2`. Flask hard-depends on Jinja2
+    (`Flask` → `jinja2>=3.1.2`), so a real Flask app usually never lists Jinja2 itself, and
+    gating on `jinja2` alone dropped a High-severity autoescape check from most Flask repos.
+  - `B501` is claimed by `httpx` as well as `requests`. Bandit's own
+    `crypto_request_no_cert_validation` plugin inspects both libraries, so an httpx-only repo
+    would otherwise lose the `verify=False` check.
+
 - Bandit requires Python 3 as a runtime. The adapter uses an isolated venv at `~/.codacy/runtimes/bandit-1/venv/`.
 - Exit code 0 = no findings, 1 = findings found (normal), >1 = error.
 - `col_offset` in bandit output is 0-based; the adapter adds 1 for the 1-based Issue model.

package/dist/index.js

@@ -746,6 +746,24 @@ var patterns_default = [
   }
 ];
 
+// src/pattern-mappings.json
+var pattern_mappings_default = {
+  flask: { prefixes: ["Bandit_B201", "Bandit_B701"] },
+  django: {
+    prefixes: ["Bandit_B308", "Bandit_B610", "Bandit_B611", "Bandit_B703"]
+  },
+  requests: { prefixes: ["Bandit_B113", "Bandit_B501"] },
+  httpx: { prefixes: ["Bandit_B113", "Bandit_B501"] },
+  jinja2: { prefixes: ["Bandit_B701"] },
+  mako: { prefixes: ["Bandit_B702"] },
+  paramiko: { prefixes: ["Bandit_B507", "Bandit_B601"] },
+  lxml: { prefixes: ["Bandit_B320", "Bandit_B410"] },
+  pyyaml: { prefixes: ["Bandit_B506"] },
+  pycrypto: { prefixes: ["Bandit_B413"] },
+  pycryptodome: { prefixes: ["Bandit_B414"] },
+  pysnmp: { prefixes: ["Bandit_B508", "Bandit_B509"] }
+};
+
 // src/metadata.ts
 var descriptor = {
   id: "Bandit",
@@ -755,7 +773,8 @@ var descriptor = {
   filePatterns: ["**/*.py"],
   supportedOS: ["linux", "darwin", "win32"],
   supportedArch: ["x64", "arm64"],
-  supportedRunners: ["local", "container"]
+  supportedRunners: ["local", "container"],
+  frameworkMappings: pattern_mappings_default
 };
 
 // src/adapter.ts

package/dist/metadata.js

@@ -23,6 +23,26 @@ __export(metadata_exports, {
   descriptor: () => descriptor
 });
 module.exports = __toCommonJS(metadata_exports);
+
+// src/pattern-mappings.json
+var pattern_mappings_default = {
+  flask: { prefixes: ["Bandit_B201", "Bandit_B701"] },
+  django: {
+    prefixes: ["Bandit_B308", "Bandit_B610", "Bandit_B611", "Bandit_B703"]
+  },
+  requests: { prefixes: ["Bandit_B113", "Bandit_B501"] },
+  httpx: { prefixes: ["Bandit_B113", "Bandit_B501"] },
+  jinja2: { prefixes: ["Bandit_B701"] },
+  mako: { prefixes: ["Bandit_B702"] },
+  paramiko: { prefixes: ["Bandit_B507", "Bandit_B601"] },
+  lxml: { prefixes: ["Bandit_B320", "Bandit_B410"] },
+  pyyaml: { prefixes: ["Bandit_B506"] },
+  pycrypto: { prefixes: ["Bandit_B413"] },
+  pycryptodome: { prefixes: ["Bandit_B414"] },
+  pysnmp: { prefixes: ["Bandit_B508", "Bandit_B509"] }
+};
+
+// src/metadata.ts
 var descriptor = {
   id: "Bandit",
   displayName: "Bandit",
@@ -31,7 +51,8 @@ var descriptor = {
   filePatterns: ["**/*.py"],
   supportedOS: ["linux", "darwin", "win32"],
   supportedArch: ["x64", "arm64"],
-  supportedRunners: ["local", "container"]
+  supportedRunners: ["local", "container"],
+  frameworkMappings: pattern_mappings_default
 };
 // Annotate the CommonJS export names for ESM import in node:
 0 && (module.exports = {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@codacy/tools-bandit-1",
-  "version": "0.18.0",
+  "version": "0.19.0",
   "description": "Bandit adapter — CLI-mode Python security linter",
   "main": "dist/index.js",
   "types": "dist/index.d.ts",
@@ -8,7 +8,7 @@
     "dist"
   ],
   "dependencies": {
-    "@codacy/tooling": "0.18.0"
+    "@codacy/tooling": "0.19.0"
   },
   "license": "MIT",
   "author": "Codacy <support@codacy.com> (https://www.codacy.com)",