@codacy/tools-bandit-1 0.19.0 → 0.20.0

package/dist/index.js

@@ -47,7 +47,7 @@ var patterns_default = [
     category: "Security",
     severityLevel: "High",
     title: "Avoid Use of Assert Statements",
-    enabled: false,
+    enabled: true,
     languages: ["Python"],
     parameters: []
   },
@@ -92,7 +92,7 @@ var patterns_default = [
     category: "Security",
     severityLevel: "High",
     title: "Detect Hardcoded Password Function Arguments",
-    enabled: false,
+    enabled: true,
     languages: ["Python"],
     parameters: []
   },
@@ -114,15 +114,6 @@ var patterns_default = [
     languages: ["Python"],
     parameters: []
   },
-  {
-    id: "Bandit_B109",
-    category: "Security",
-    severityLevel: "Warning",
-    title: "Detect Password Based Config Options Not Marked Secret",
-    enabled: true,
-    languages: ["Python"],
-    parameters: []
-  },
   {
     id: "Bandit_B110",
     category: "Security",
@@ -132,15 +123,6 @@ var patterns_default = [
     languages: ["Python"],
     parameters: []
   },
-  {
-    id: "Bandit_B111",
-    category: "Security",
-    severityLevel: "Warning",
-    title: "Detect use of rootwrap running as root",
-    enabled: true,
-    languages: ["Python"],
-    parameters: []
-  },
   {
     id: "Bandit_B112",
     category: "Security",
@@ -252,8 +234,8 @@ var patterns_default = [
   {
     id: "Bandit_B309",
     category: "Security",
-    severityLevel: "Warning",
-    title: "Avoid Use of HTTPSConnection on Older Python Versions",
+    severityLevel: "High",
+    title: "Avoid usage of httplib.http.client HTTPSConnection on old Python versions",
     enabled: true,
     languages: ["Python"],
     parameters: []
@@ -351,8 +333,8 @@ var patterns_default = [
   {
     id: "Bandit_B320",
     category: "Security",
-    severityLevel: "Warning",
-    title: "Avoid Using Vulnerable lxml.etree XML Parsing Methods",
+    severityLevel: "High",
+    title: "Avoid unsafe lxml.etree usage",
     enabled: true,
     languages: ["Python"],
     parameters: []
@@ -370,8 +352,8 @@ var patterns_default = [
     id: "Bandit_B322",
     category: "Security",
     severityLevel: "High",
-    title: "Avoid using input() in Python 2",
-    enabled: false,
+    title: "Avoid use of input() in Python 2",
+    enabled: true,
     languages: ["Python"],
     parameters: []
   },
@@ -380,7 +362,7 @@ var patterns_default = [
     category: "Security",
     severityLevel: "Warning",
     title: "Avoid Using Unverified SSL Context",
-    enabled: false,
+    enabled: true,
     languages: ["Python"],
     parameters: []
   },
@@ -389,16 +371,16 @@ var patterns_default = [
     category: "Security",
     severityLevel: "High",
     title: "Avoid Use of Insecure Hash Functions in hashlib",
-    enabled: false,
+    enabled: true,
     languages: ["Python"],
     parameters: []
   },
   {
     id: "Bandit_B325",
     category: "Security",
-    severityLevel: "Warning",
-    title: "Avoid use of os.tempnam() and os.tmpnam()",
-    enabled: false,
+    severityLevel: "High",
+    title: "Avoid use of os.tempnam/os.tmpnam",
+    enabled: true,
     languages: ["Python"],
     parameters: []
   },
@@ -486,8 +468,8 @@ var patterns_default = [
   {
     id: "Bandit_B410",
     category: "Security",
-    severityLevel: "Warning",
-    title: "Avoid Using Vulnerable XML Parsing Libraries (lxml)",
+    severityLevel: "High",
+    title: "Avoid importing lxml for untrusted XML parsing",
     enabled: true,
     languages: ["Python"],
     parameters: []
@@ -506,7 +488,7 @@ var patterns_default = [
     category: "Security",
     severityLevel: "High",
     title: "Avoid importing CGI handlers vulnerable to httpoxy",
-    enabled: false,
+    enabled: true,
     languages: ["Python"],
     parameters: []
   },
@@ -515,7 +497,7 @@ var patterns_default = [
     category: "Security",
     severityLevel: "High",
     title: "Avoid Importing PyCrypto Library",
-    enabled: false,
+    enabled: true,
     languages: ["Python"],
     parameters: []
   },
@@ -523,8 +505,17 @@ var patterns_default = [
     id: "Bandit_B414",
     category: "Security",
     severityLevel: "High",
-    title: "Avoid Importing PyCryptodome Modules",
-    enabled: false,
+    title: "Avoid importing pycryptodome (Cryptodome.*)",
+    enabled: true,
+    languages: ["Python"],
+    parameters: []
+  },
+  {
+    id: "Bandit_B415",
+    category: "Security",
+    severityLevel: "High",
+    title: "Avoid importing IPMI-related module (pyghmi)",
+    enabled: true,
     languages: ["Python"],
     parameters: []
   },
@@ -587,7 +578,7 @@ var patterns_default = [
     category: "Security",
     severityLevel: "High",
     title: "Avoid Disabling SSH Host Key Verification",
-    enabled: false,
+    enabled: true,
     languages: ["Python"],
     parameters: []
   },
@@ -596,7 +587,7 @@ var patterns_default = [
     category: "Security",
     severityLevel: "Warning",
     title: "Avoid using insecure SNMP versions",
-    enabled: false,
+    enabled: true,
     languages: ["Python"],
     parameters: []
   },
@@ -605,7 +596,7 @@ var patterns_default = [
     category: "Security",
     severityLevel: "Warning",
     title: "Avoid Weak SNMP Cryptography",
-    enabled: false,
+    enabled: true,
     languages: ["Python"],
     parameters: []
   },
@@ -650,7 +641,7 @@ var patterns_default = [
     category: "Security",
     severityLevel: "Warning",
     title: "Avoid starting a process with a shell",
-    enabled: false,
+    enabled: true,
     languages: ["Python"],
     parameters: []
   },
@@ -668,7 +659,7 @@ var patterns_default = [
     category: "Security",
     severityLevel: "Warning",
     title: "Avoid starting a process with a partial executable path",
-    enabled: false,
+    enabled: true,
     languages: ["Python"],
     parameters: []
   },
@@ -695,7 +686,7 @@ var patterns_default = [
     category: "Security",
     severityLevel: "Warning",
     title: "Avoid Potential SQL Injection in Django extra() Function",
-    enabled: false,
+    enabled: true,
     languages: ["Python"],
     parameters: []
   },
@@ -704,7 +695,7 @@ var patterns_default = [
     category: "Security",
     severityLevel: "Warning",
     title: "Avoid Use of RawSQL Function in Django",
-    enabled: false,
+    enabled: true,
     languages: ["Python"],
     parameters: []
   },
@@ -713,10 +704,39 @@ var patterns_default = [
     category: "Security",
     severityLevel: "Warning",
     title: "Avoid insecure use of logging.config.listen",
-    enabled: false,
+    enabled: true,
     languages: ["Python"],
     parameters: []
   },
+  {
+    id: "Bandit_B613",
+    category: "Security",
+    severityLevel: "High",
+    title: "Detect use of Unicode bidirectional (TrojanSource) control characters",
+    enabled: true,
+    languages: ["Python"],
+    parameters: []
+  },
+  {
+    id: "Bandit_B614",
+    category: "Security",
+    severityLevel: "High",
+    title: "Avoid unsafe PyTorch load",
+    enabled: true,
+    languages: ["Python"],
+    parameters: [],
+    tags: ["cwe502"]
+  },
+  {
+    id: "Bandit_B615",
+    category: "Security",
+    severityLevel: "Warning",
+    title: "Avoid unsafe Hugging Face Hub downloads (pin revisions)",
+    enabled: true,
+    languages: ["Python"],
+    parameters: [],
+    tags: ["huggingface", "supplychain"]
+  },
   {
     id: "Bandit_B701",
     category: "Security",
@@ -740,7 +760,16 @@ var patterns_default = [
     category: "Security",
     severityLevel: "Warning",
     title: "Avoid Potential XSS with django mark_safe Function",
-    enabled: false,
+    enabled: true,
+    languages: ["Python"],
+    parameters: []
+  },
+  {
+    id: "Bandit_B704",
+    category: "Security",
+    severityLevel: "High",
+    title: "Avoid markupsafe.Markup on untrusted data",
+    enabled: true,
     languages: ["Python"],
     parameters: []
   }
@@ -768,7 +797,7 @@ var pattern_mappings_default = {
 var descriptor = {
   id: "Bandit",
   displayName: "Bandit",
-  preferredVersion: "1.8.3",
+  preferredVersion: "1.9.4",
   languages: ["Python"],
   filePatterns: ["**/*.py"],
   supportedOS: ["linux", "darwin", "win32"],
@@ -780,7 +809,7 @@ var descriptor = {
 // src/adapter.ts
 var TOOL_ID = "Bandit";
 var ADAPTER_ID = "bandit-1";
-var PIP_PACKAGES = ["bandit==1.8.3"];
+var PIP_PACKAGES = ["bandit==1.9.4"];
 var PYTHON_VERSION_RANGE = ">=3.8.0 <3.14.0";
 var PATTERN_META = new Map(
   patterns_default.map((p) => [
@@ -804,7 +833,14 @@ function mapConfidence(confidence) {
       return 1;
   }
 }
-var CONFIG_FILE_CANDIDATES = [".bandit", "bandit.yml", "pyproject.toml"];
+var CONFIG_FILE_CANDIDATES = [
+  ".bandit",
+  "bandit.yml",
+  "pyproject.toml",
+  "bandit.yaml",
+  "bandit.toml",
+  "bandit.ini"
+];
 var PYPROJECT_BANDIT_SECTION = /^\[tool\.bandit(\.[\w-]+)*\]/m;
 async function pyprojectHasBanditSection(pyprojectPath) {
   try {
@@ -834,7 +870,7 @@ function buildMessage(result) {
 var adapter = {
   ...descriptor,
   patternsMetadata: patterns_default,
-  compatibleVersions: ">=1.7.0",
+  compatibleVersions: ">=1.9.0",
   website: "https://bandit.readthedocs.io/",
   prerequisites: [
     {
@@ -851,7 +887,7 @@ var adapter = {
    * 1. Codacy-managed venv (`~/.codacy/runtimes/bandit-1/venv/bin/bandit`)
    * 2. Global PATH (`bandit`)
    *
-   * Parses the version from `bandit --version` output like `bandit 1.8.3`.
+   * Parses the version from `bandit --version` output like `bandit 1.9.4`.
    */
   async checkAvailability(ctx) {
     ctx.logger.debug("Checking availability", { toolId: TOOL_ID });
@@ -923,7 +959,7 @@ var adapter = {
    * Installs bandit into an isolated Python virtual environment.
    *
    * Uses findPython -> ensureVenv -> pipInstall to create a dedicated venv
-   * at `~/.codacy/runtimes/bandit-1/venv/` and install `bandit==1.8.3`.
+   * at `~/.codacy/runtimes/bandit-1/venv/` and install `bandit==1.9.4`.
    */
   async install(ctx) {
     ctx.logger.info("Starting install", { toolId: TOOL_ID });
@@ -935,7 +971,7 @@ var adapter = {
           toolId: TOOL_ID,
           phase: "requirementCheck",
           kind: "MissingPrerequisite",
-          message: `Python (${PYTHON_VERSION_RANGE}) could not be found or downloaded. Bandit 1.8.x is incompatible with Python 3.14+.`,
+          message: `Python (${PYTHON_VERSION_RANGE}) could not be found or downloaded. Bandit 1.9.x is incompatible with Python 3.14+.`,
           level: "error"
         }
       };
@@ -969,7 +1005,7 @@ var adapter = {
   /**
    * Checks for bandit configuration files in the repository root.
    *
-   * Looks for `.bandit`, `bandit.yml`, or `pyproject.toml` (in that order).
+   * Looks for `.bandit`, `bandit.yml`, `bandit.yaml`, `bandit.toml`, `bandit.ini`, or `pyproject.toml` (in that order).
    * `pyproject.toml` only counts if it actually has a `[tool.bandit]` table —
    * unlike the other two candidates, its mere existence says nothing about
    * whether Bandit is configured (see {@link pyprojectHasBanditSection}).
@@ -980,7 +1016,7 @@ var adapter = {
       const candidatePath = import_path.default.join(ctx.repositoryRoot, candidate);
       try {
         await import_promises.default.access(candidatePath);
-        if (candidate === "pyproject.toml" && !await pyprojectHasBanditSection(candidatePath)) {
+        if ((candidate === "pyproject.toml" || candidate === "bandit.toml") && !await pyprojectHasBanditSection(candidatePath)) {
           continue;
         }
         ctx.logger.debug("Found local config", { toolId: TOOL_ID, path: candidatePath });
@@ -1023,7 +1059,7 @@ var adapter = {
     const useLocal = codacyConfig.useLocalConfigurationFile && codacyConfig.localConfigurationFile;
     if (useLocal) {
       const configPath = codacyConfig.localConfigurationFile;
-      if (configPath.endsWith(".bandit")) {
+      if (configPath.endsWith(".bandit") || configPath.endsWith(".ini")) {
         args.push("--ini", configPath);
       } else {
         args.push("-c", configPath);

package/dist/metadata.js

@@ -46,7 +46,7 @@ var pattern_mappings_default = {
 var descriptor = {
   id: "Bandit",
   displayName: "Bandit",
-  preferredVersion: "1.8.3",
+  preferredVersion: "1.9.4",
   languages: ["Python"],
   filePatterns: ["**/*.py"],
   supportedOS: ["linux", "darwin", "win32"],

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@codacy/tools-bandit-1",
-  "version": "0.19.0",
+  "version": "0.20.0",
   "description": "Bandit adapter — CLI-mode Python security linter",
   "main": "dist/index.js",
   "types": "dist/index.d.ts",
@@ -8,7 +8,7 @@
     "dist"
   ],
   "dependencies": {
-    "@codacy/tooling": "0.19.0"
+    "@codacy/tooling": "0.20.0"
   },
   "license": "MIT",
   "author": "Codacy <support@codacy.com> (https://www.codacy.com)",