@codacy/tools-bandit-1 0.18.0 → 0.20.0

package/README.md

@@ -1,6 +1,7 @@
 # @codacy/tools-bandit-1
 
 ## Table of Contents
+
 - [Overview](#overview)
 - [Updating patterns](#updating-patterns)
 - [Updating the Bandit version](#updating-the-bandit-version)
@@ -13,14 +14,14 @@
 
 Python security linter using the [Bandit](https://bandit.readthedocs.io/) binary. Uses the CLI execution strategy -- spawns `bandit` from a managed Python venv via `spawnTool()` and parses its JSON output.
 
-| Property | Value |
-|----------|-------|
-| Tool ID | `Bandit` |
-| Codacy UUID | `89b6fc6a-9137-4cf3-8b9f-dcc3bedfa738` |
-| Strategy | CLI |
-| Languages | Python |
-| Binary | `bandit` (pip-installed in venv) |
-| File patterns | `**/*.py` |
+| Property      | Value                                  |
+| ------------- | -------------------------------------- |
+| Tool ID       | `Bandit`                               |
+| Codacy UUID   | `89b6fc6a-9137-4cf3-8b9f-dcc3bedfa738` |
+| Strategy      | CLI                                    |
+| Languages     | Python                                 |
+| Binary        | `bandit` (pip-installed in venv)       |
+| File patterns | `**/*.py`                              |
 
 ## Updating patterns
 
@@ -50,12 +51,32 @@ pnpm test     # Run tests (requires bandit in PATH or venv)
 ```
 
 To install bandit locally for testing:
+
 ```bash
 pip install bandit==1.8.3
 ```
 
 ## Notes for maintainers
 
+- **Preset mappings (`src/pattern-mappings.json`)**: 18 of the 78 checks are gated on a
+  detected PyPI dependency, because they only ever fire against one library's API. Ten were
+  default-on and now stay out of a repo that does not declare the library — `B201` (Flask),
+  `B701` (Jinja2), `B702` (Mako), `B601` (Paramiko), `B320`/`B410` (lxml), `B506` (PyYAML),
+  `B113`/`B501` (requests) and `B308` (Django). Eight were default-off and are now reachable
+  at all: `B610`/`B611`/`B703` (Django SQLi/XSS), `B507` (Paramiko host keys), `B508`/`B509`
+  (PySNMP), `B413`/`B414` (PyCrypto vs. PyCryptodome — separate projects, so separate
+  entities). Left universal on purpose: the stdlib checks (`B301`–`B307`, `B324`) and `B412`,
+  whose httpoxy CGI handler has no manifest to read.
+
+  Two of these need a second key, because gating gets its evidence from **direct**
+  declarations only:
+  - `B701` is claimed by `flask` as well as `jinja2`. Flask hard-depends on Jinja2
+    (`Flask` → `jinja2>=3.1.2`), so a real Flask app usually never lists Jinja2 itself, and
+    gating on `jinja2` alone dropped a High-severity autoescape check from most Flask repos.
+  - `B501` is claimed by `httpx` as well as `requests`. Bandit's own
+    `crypto_request_no_cert_validation` plugin inspects both libraries, so an httpx-only repo
+    would otherwise lose the `verify=False` check.
+
 - Bandit requires Python 3 as a runtime. The adapter uses an isolated venv at `~/.codacy/runtimes/bandit-1/venv/`.
 - Exit code 0 = no findings, 1 = findings found (normal), >1 = error.
 - `col_offset` in bandit output is 0-based; the adapter adds 1 for the 1-based Issue model.

package/dist/index.js

@@ -47,7 +47,7 @@ var patterns_default = [
     category: "Security",
     severityLevel: "High",
     title: "Avoid Use of Assert Statements",
-    enabled: false,
+    enabled: true,
     languages: ["Python"],
     parameters: []
   },
@@ -92,7 +92,7 @@ var patterns_default = [
     category: "Security",
     severityLevel: "High",
     title: "Detect Hardcoded Password Function Arguments",
-    enabled: false,
+    enabled: true,
     languages: ["Python"],
     parameters: []
   },
@@ -114,15 +114,6 @@ var patterns_default = [
     languages: ["Python"],
     parameters: []
   },
-  {
-    id: "Bandit_B109",
-    category: "Security",
-    severityLevel: "Warning",
-    title: "Detect Password Based Config Options Not Marked Secret",
-    enabled: true,
-    languages: ["Python"],
-    parameters: []
-  },
   {
     id: "Bandit_B110",
     category: "Security",
@@ -132,15 +123,6 @@ var patterns_default = [
     languages: ["Python"],
     parameters: []
   },
-  {
-    id: "Bandit_B111",
-    category: "Security",
-    severityLevel: "Warning",
-    title: "Detect use of rootwrap running as root",
-    enabled: true,
-    languages: ["Python"],
-    parameters: []
-  },
   {
     id: "Bandit_B112",
     category: "Security",
@@ -252,8 +234,8 @@ var patterns_default = [
   {
     id: "Bandit_B309",
     category: "Security",
-    severityLevel: "Warning",
-    title: "Avoid Use of HTTPSConnection on Older Python Versions",
+    severityLevel: "High",
+    title: "Avoid usage of httplib.http.client HTTPSConnection on old Python versions",
     enabled: true,
     languages: ["Python"],
     parameters: []
@@ -351,8 +333,8 @@ var patterns_default = [
   {
     id: "Bandit_B320",
     category: "Security",
-    severityLevel: "Warning",
-    title: "Avoid Using Vulnerable lxml.etree XML Parsing Methods",
+    severityLevel: "High",
+    title: "Avoid unsafe lxml.etree usage",
     enabled: true,
     languages: ["Python"],
     parameters: []
@@ -370,8 +352,8 @@ var patterns_default = [
     id: "Bandit_B322",
     category: "Security",
     severityLevel: "High",
-    title: "Avoid using input() in Python 2",
-    enabled: false,
+    title: "Avoid use of input() in Python 2",
+    enabled: true,
     languages: ["Python"],
     parameters: []
   },
@@ -380,7 +362,7 @@ var patterns_default = [
     category: "Security",
     severityLevel: "Warning",
     title: "Avoid Using Unverified SSL Context",
-    enabled: false,
+    enabled: true,
     languages: ["Python"],
     parameters: []
   },
@@ -389,16 +371,16 @@ var patterns_default = [
     category: "Security",
     severityLevel: "High",
     title: "Avoid Use of Insecure Hash Functions in hashlib",
-    enabled: false,
+    enabled: true,
     languages: ["Python"],
     parameters: []
   },
   {
     id: "Bandit_B325",
     category: "Security",
-    severityLevel: "Warning",
-    title: "Avoid use of os.tempnam() and os.tmpnam()",
-    enabled: false,
+    severityLevel: "High",
+    title: "Avoid use of os.tempnam/os.tmpnam",
+    enabled: true,
     languages: ["Python"],
     parameters: []
   },
@@ -486,8 +468,8 @@ var patterns_default = [
   {
     id: "Bandit_B410",
     category: "Security",
-    severityLevel: "Warning",
-    title: "Avoid Using Vulnerable XML Parsing Libraries (lxml)",
+    severityLevel: "High",
+    title: "Avoid importing lxml for untrusted XML parsing",
     enabled: true,
     languages: ["Python"],
     parameters: []
@@ -506,7 +488,7 @@ var patterns_default = [
     category: "Security",
     severityLevel: "High",
     title: "Avoid importing CGI handlers vulnerable to httpoxy",
-    enabled: false,
+    enabled: true,
     languages: ["Python"],
     parameters: []
   },
@@ -515,7 +497,7 @@ var patterns_default = [
     category: "Security",
     severityLevel: "High",
     title: "Avoid Importing PyCrypto Library",
-    enabled: false,
+    enabled: true,
     languages: ["Python"],
     parameters: []
   },
@@ -523,8 +505,17 @@ var patterns_default = [
     id: "Bandit_B414",
     category: "Security",
     severityLevel: "High",
-    title: "Avoid Importing PyCryptodome Modules",
-    enabled: false,
+    title: "Avoid importing pycryptodome (Cryptodome.*)",
+    enabled: true,
+    languages: ["Python"],
+    parameters: []
+  },
+  {
+    id: "Bandit_B415",
+    category: "Security",
+    severityLevel: "High",
+    title: "Avoid importing IPMI-related module (pyghmi)",
+    enabled: true,
     languages: ["Python"],
     parameters: []
   },
@@ -587,7 +578,7 @@ var patterns_default = [
     category: "Security",
     severityLevel: "High",
     title: "Avoid Disabling SSH Host Key Verification",
-    enabled: false,
+    enabled: true,
     languages: ["Python"],
     parameters: []
   },
@@ -596,7 +587,7 @@ var patterns_default = [
     category: "Security",
     severityLevel: "Warning",
     title: "Avoid using insecure SNMP versions",
-    enabled: false,
+    enabled: true,
     languages: ["Python"],
     parameters: []
   },
@@ -605,7 +596,7 @@ var patterns_default = [
     category: "Security",
     severityLevel: "Warning",
     title: "Avoid Weak SNMP Cryptography",
-    enabled: false,
+    enabled: true,
     languages: ["Python"],
     parameters: []
   },
@@ -650,7 +641,7 @@ var patterns_default = [
     category: "Security",
     severityLevel: "Warning",
     title: "Avoid starting a process with a shell",
-    enabled: false,
+    enabled: true,
     languages: ["Python"],
     parameters: []
   },
@@ -668,7 +659,7 @@ var patterns_default = [
     category: "Security",
     severityLevel: "Warning",
     title: "Avoid starting a process with a partial executable path",
-    enabled: false,
+    enabled: true,
     languages: ["Python"],
     parameters: []
   },
@@ -695,7 +686,7 @@ var patterns_default = [
     category: "Security",
     severityLevel: "Warning",
     title: "Avoid Potential SQL Injection in Django extra() Function",
-    enabled: false,
+    enabled: true,
     languages: ["Python"],
     parameters: []
   },
@@ -704,7 +695,7 @@ var patterns_default = [
     category: "Security",
     severityLevel: "Warning",
     title: "Avoid Use of RawSQL Function in Django",
-    enabled: false,
+    enabled: true,
     languages: ["Python"],
     parameters: []
   },
@@ -713,10 +704,39 @@ var patterns_default = [
     category: "Security",
     severityLevel: "Warning",
     title: "Avoid insecure use of logging.config.listen",
-    enabled: false,
+    enabled: true,
     languages: ["Python"],
     parameters: []
   },
+  {
+    id: "Bandit_B613",
+    category: "Security",
+    severityLevel: "High",
+    title: "Detect use of Unicode bidirectional (TrojanSource) control characters",
+    enabled: true,
+    languages: ["Python"],
+    parameters: []
+  },
+  {
+    id: "Bandit_B614",
+    category: "Security",
+    severityLevel: "High",
+    title: "Avoid unsafe PyTorch load",
+    enabled: true,
+    languages: ["Python"],
+    parameters: [],
+    tags: ["cwe502"]
+  },
+  {
+    id: "Bandit_B615",
+    category: "Security",
+    severityLevel: "Warning",
+    title: "Avoid unsafe Hugging Face Hub downloads (pin revisions)",
+    enabled: true,
+    languages: ["Python"],
+    parameters: [],
+    tags: ["huggingface", "supplychain"]
+  },
   {
     id: "Bandit_B701",
     category: "Security",
@@ -740,28 +760,56 @@ var patterns_default = [
     category: "Security",
     severityLevel: "Warning",
     title: "Avoid Potential XSS with django mark_safe Function",
-    enabled: false,
+    enabled: true,
+    languages: ["Python"],
+    parameters: []
+  },
+  {
+    id: "Bandit_B704",
+    category: "Security",
+    severityLevel: "High",
+    title: "Avoid markupsafe.Markup on untrusted data",
+    enabled: true,
     languages: ["Python"],
     parameters: []
   }
 ];
 
+// src/pattern-mappings.json
+var pattern_mappings_default = {
+  flask: { prefixes: ["Bandit_B201", "Bandit_B701"] },
+  django: {
+    prefixes: ["Bandit_B308", "Bandit_B610", "Bandit_B611", "Bandit_B703"]
+  },
+  requests: { prefixes: ["Bandit_B113", "Bandit_B501"] },
+  httpx: { prefixes: ["Bandit_B113", "Bandit_B501"] },
+  jinja2: { prefixes: ["Bandit_B701"] },
+  mako: { prefixes: ["Bandit_B702"] },
+  paramiko: { prefixes: ["Bandit_B507", "Bandit_B601"] },
+  lxml: { prefixes: ["Bandit_B320", "Bandit_B410"] },
+  pyyaml: { prefixes: ["Bandit_B506"] },
+  pycrypto: { prefixes: ["Bandit_B413"] },
+  pycryptodome: { prefixes: ["Bandit_B414"] },
+  pysnmp: { prefixes: ["Bandit_B508", "Bandit_B509"] }
+};
+
 // src/metadata.ts
 var descriptor = {
   id: "Bandit",
   displayName: "Bandit",
-  preferredVersion: "1.8.3",
+  preferredVersion: "1.9.4",
   languages: ["Python"],
   filePatterns: ["**/*.py"],
   supportedOS: ["linux", "darwin", "win32"],
   supportedArch: ["x64", "arm64"],
-  supportedRunners: ["local", "container"]
+  supportedRunners: ["local", "container"],
+  frameworkMappings: pattern_mappings_default
 };
 
 // src/adapter.ts
 var TOOL_ID = "Bandit";
 var ADAPTER_ID = "bandit-1";
-var PIP_PACKAGES = ["bandit==1.8.3"];
+var PIP_PACKAGES = ["bandit==1.9.4"];
 var PYTHON_VERSION_RANGE = ">=3.8.0 <3.14.0";
 var PATTERN_META = new Map(
   patterns_default.map((p) => [
@@ -785,7 +833,14 @@ function mapConfidence(confidence) {
       return 1;
   }
 }
-var CONFIG_FILE_CANDIDATES = [".bandit", "bandit.yml", "pyproject.toml"];
+var CONFIG_FILE_CANDIDATES = [
+  ".bandit",
+  "bandit.yml",
+  "pyproject.toml",
+  "bandit.yaml",
+  "bandit.toml",
+  "bandit.ini"
+];
 var PYPROJECT_BANDIT_SECTION = /^\[tool\.bandit(\.[\w-]+)*\]/m;
 async function pyprojectHasBanditSection(pyprojectPath) {
   try {
@@ -815,7 +870,7 @@ function buildMessage(result) {
 var adapter = {
   ...descriptor,
   patternsMetadata: patterns_default,
-  compatibleVersions: ">=1.7.0",
+  compatibleVersions: ">=1.9.0",
   website: "https://bandit.readthedocs.io/",
   prerequisites: [
     {
@@ -832,7 +887,7 @@ var adapter = {
    * 1. Codacy-managed venv (`~/.codacy/runtimes/bandit-1/venv/bin/bandit`)
    * 2. Global PATH (`bandit`)
    *
-   * Parses the version from `bandit --version` output like `bandit 1.8.3`.
+   * Parses the version from `bandit --version` output like `bandit 1.9.4`.
    */
   async checkAvailability(ctx) {
     ctx.logger.debug("Checking availability", { toolId: TOOL_ID });
@@ -904,7 +959,7 @@ var adapter = {
    * Installs bandit into an isolated Python virtual environment.
    *
    * Uses findPython -> ensureVenv -> pipInstall to create a dedicated venv
-   * at `~/.codacy/runtimes/bandit-1/venv/` and install `bandit==1.8.3`.
+   * at `~/.codacy/runtimes/bandit-1/venv/` and install `bandit==1.9.4`.
    */
   async install(ctx) {
     ctx.logger.info("Starting install", { toolId: TOOL_ID });
@@ -916,7 +971,7 @@ var adapter = {
           toolId: TOOL_ID,
           phase: "requirementCheck",
           kind: "MissingPrerequisite",
-          message: `Python (${PYTHON_VERSION_RANGE}) could not be found or downloaded. Bandit 1.8.x is incompatible with Python 3.14+.`,
+          message: `Python (${PYTHON_VERSION_RANGE}) could not be found or downloaded. Bandit 1.9.x is incompatible with Python 3.14+.`,
           level: "error"
         }
       };
@@ -950,7 +1005,7 @@ var adapter = {
   /**
    * Checks for bandit configuration files in the repository root.
    *
-   * Looks for `.bandit`, `bandit.yml`, or `pyproject.toml` (in that order).
+   * Looks for `.bandit`, `bandit.yml`, `bandit.yaml`, `bandit.toml`, `bandit.ini`, or `pyproject.toml` (in that order).
    * `pyproject.toml` only counts if it actually has a `[tool.bandit]` table —
    * unlike the other two candidates, its mere existence says nothing about
    * whether Bandit is configured (see {@link pyprojectHasBanditSection}).
@@ -961,7 +1016,7 @@ var adapter = {
       const candidatePath = import_path.default.join(ctx.repositoryRoot, candidate);
       try {
         await import_promises.default.access(candidatePath);
-        if (candidate === "pyproject.toml" && !await pyprojectHasBanditSection(candidatePath)) {
+        if ((candidate === "pyproject.toml" || candidate === "bandit.toml") && !await pyprojectHasBanditSection(candidatePath)) {
           continue;
         }
         ctx.logger.debug("Found local config", { toolId: TOOL_ID, path: candidatePath });
@@ -1004,7 +1059,7 @@ var adapter = {
     const useLocal = codacyConfig.useLocalConfigurationFile && codacyConfig.localConfigurationFile;
     if (useLocal) {
       const configPath = codacyConfig.localConfigurationFile;
-      if (configPath.endsWith(".bandit")) {
+      if (configPath.endsWith(".bandit") || configPath.endsWith(".ini")) {
         args.push("--ini", configPath);
       } else {
         args.push("-c", configPath);

package/dist/metadata.js

@@ -23,15 +23,36 @@ __export(metadata_exports, {
   descriptor: () => descriptor
 });
 module.exports = __toCommonJS(metadata_exports);
+
+// src/pattern-mappings.json
+var pattern_mappings_default = {
+  flask: { prefixes: ["Bandit_B201", "Bandit_B701"] },
+  django: {
+    prefixes: ["Bandit_B308", "Bandit_B610", "Bandit_B611", "Bandit_B703"]
+  },
+  requests: { prefixes: ["Bandit_B113", "Bandit_B501"] },
+  httpx: { prefixes: ["Bandit_B113", "Bandit_B501"] },
+  jinja2: { prefixes: ["Bandit_B701"] },
+  mako: { prefixes: ["Bandit_B702"] },
+  paramiko: { prefixes: ["Bandit_B507", "Bandit_B601"] },
+  lxml: { prefixes: ["Bandit_B320", "Bandit_B410"] },
+  pyyaml: { prefixes: ["Bandit_B506"] },
+  pycrypto: { prefixes: ["Bandit_B413"] },
+  pycryptodome: { prefixes: ["Bandit_B414"] },
+  pysnmp: { prefixes: ["Bandit_B508", "Bandit_B509"] }
+};
+
+// src/metadata.ts
 var descriptor = {
   id: "Bandit",
   displayName: "Bandit",
-  preferredVersion: "1.8.3",
+  preferredVersion: "1.9.4",
   languages: ["Python"],
   filePatterns: ["**/*.py"],
   supportedOS: ["linux", "darwin", "win32"],
   supportedArch: ["x64", "arm64"],
-  supportedRunners: ["local", "container"]
+  supportedRunners: ["local", "container"],
+  frameworkMappings: pattern_mappings_default
 };
 // Annotate the CommonJS export names for ESM import in node:
 0 && (module.exports = {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@codacy/tools-bandit-1",
-  "version": "0.18.0",
+  "version": "0.20.0",
   "description": "Bandit adapter — CLI-mode Python security linter",
   "main": "dist/index.js",
   "types": "dist/index.d.ts",
@@ -8,7 +8,7 @@
     "dist"
   ],
   "dependencies": {
-    "@codacy/tooling": "0.18.0"
+    "@codacy/tooling": "0.20.0"
   },
   "license": "MIT",
   "author": "Codacy <support@codacy.com> (https://www.codacy.com)",