@codacy/tools-bandit-1 0.19.0 → 0.21.0

package/README.md

@@ -77,6 +77,16 @@ pip install bandit==1.8.3
     `crypto_request_no_cert_validation` plugin inspects both libraries, so an httpx-only repo
     would otherwise lose the `verify=False` check.
 
+  Three of these gates are inert, and **deliberately kept anyway**: `B320`, `B410` (lxml) and
+  `B414` (pycryptodome) are still in Codacy's pattern catalog but Bandit 1.8.3 no longer
+  registers the checks, so they can never fire (`blacklists/calls.py`: "skipped B320 as the
+  check for a call to lxml.etree has been removed"; `blacklists/imports.py`: the same for
+  `B410`; `B414` is simply absent from `gen_blacklist()`). `mapping-drift.test.ts` cannot see
+  this — it compares against Codacy's catalog, not the installed tool. Dropping the mappings
+  would make three default-on High/Security patterns universal again and write them into every
+  Python repo's config, so the gate is the lesser evil until the catalog catches up. See
+  `docs/tech-debt.md`.
+
 - Bandit requires Python 3 as a runtime. The adapter uses an isolated venv at `~/.codacy/runtimes/bandit-1/venv/`.
 - Exit code 0 = no findings, 1 = findings found (normal), >1 = error.
 - `col_offset` in bandit output is 0-based; the adapter adds 1 for the 1-based Issue model.

package/dist/index.js

@@ -47,7 +47,7 @@ var patterns_default = [
     category: "Security",
     severityLevel: "High",
     title: "Avoid Use of Assert Statements",
-    enabled: false,
+    enabled: true,
     languages: ["Python"],
     parameters: []
   },
@@ -92,7 +92,7 @@ var patterns_default = [
     category: "Security",
     severityLevel: "High",
     title: "Detect Hardcoded Password Function Arguments",
-    enabled: false,
+    enabled: true,
     languages: ["Python"],
     parameters: []
   },
@@ -114,15 +114,6 @@ var patterns_default = [
     languages: ["Python"],
     parameters: []
   },
-  {
-    id: "Bandit_B109",
-    category: "Security",
-    severityLevel: "Warning",
-    title: "Detect Password Based Config Options Not Marked Secret",
-    enabled: true,
-    languages: ["Python"],
-    parameters: []
-  },
   {
     id: "Bandit_B110",
     category: "Security",
@@ -132,15 +123,6 @@ var patterns_default = [
     languages: ["Python"],
     parameters: []
   },
-  {
-    id: "Bandit_B111",
-    category: "Security",
-    severityLevel: "Warning",
-    title: "Detect use of rootwrap running as root",
-    enabled: true,
-    languages: ["Python"],
-    parameters: []
-  },
   {
     id: "Bandit_B112",
     category: "Security",
@@ -157,7 +139,8 @@ var patterns_default = [
     title: "Enforce timeout parameter in requests calls",
     enabled: true,
     languages: ["Python"],
-    parameters: []
+    parameters: [],
+    tags: ["lib:httpx", "lib:requests"]
   },
   {
     id: "Bandit_B201",
@@ -166,7 +149,8 @@ var patterns_default = [
     title: "Avoid Running Flask App with Debug Mode Enabled",
     enabled: true,
     languages: ["Python"],
-    parameters: []
+    parameters: [],
+    tags: ["fwk:flask"]
   },
   {
     id: "Bandit_B202",
@@ -247,13 +231,14 @@ var patterns_default = [
     title: "Avoid use of mark_safe()",
     enabled: true,
     languages: ["Python"],
-    parameters: []
+    parameters: [],
+    tags: ["fwk:django"]
   },
   {
     id: "Bandit_B309",
     category: "Security",
-    severityLevel: "Warning",
-    title: "Avoid Use of HTTPSConnection on Older Python Versions",
+    severityLevel: "High",
+    title: "Avoid usage of httplib.http.client HTTPSConnection on old Python versions",
     enabled: true,
     languages: ["Python"],
     parameters: []
@@ -351,8 +336,8 @@ var patterns_default = [
   {
     id: "Bandit_B320",
     category: "Security",
-    severityLevel: "Warning",
-    title: "Avoid Using Vulnerable lxml.etree XML Parsing Methods",
+    severityLevel: "High",
+    title: "Avoid unsafe lxml.etree usage",
     enabled: true,
     languages: ["Python"],
     parameters: []
@@ -370,8 +355,8 @@ var patterns_default = [
     id: "Bandit_B322",
     category: "Security",
     severityLevel: "High",
-    title: "Avoid using input() in Python 2",
-    enabled: false,
+    title: "Avoid use of input() in Python 2",
+    enabled: true,
     languages: ["Python"],
     parameters: []
   },
@@ -380,7 +365,7 @@ var patterns_default = [
     category: "Security",
     severityLevel: "Warning",
     title: "Avoid Using Unverified SSL Context",
-    enabled: false,
+    enabled: true,
     languages: ["Python"],
     parameters: []
   },
@@ -389,16 +374,16 @@ var patterns_default = [
     category: "Security",
     severityLevel: "High",
     title: "Avoid Use of Insecure Hash Functions in hashlib",
-    enabled: false,
+    enabled: true,
     languages: ["Python"],
     parameters: []
   },
   {
     id: "Bandit_B325",
     category: "Security",
-    severityLevel: "Warning",
-    title: "Avoid use of os.tempnam() and os.tmpnam()",
-    enabled: false,
+    severityLevel: "High",
+    title: "Avoid use of os.tempnam/os.tmpnam",
+    enabled: true,
     languages: ["Python"],
     parameters: []
   },
@@ -486,8 +471,8 @@ var patterns_default = [
   {
     id: "Bandit_B410",
     category: "Security",
-    severityLevel: "Warning",
-    title: "Avoid Using Vulnerable XML Parsing Libraries (lxml)",
+    severityLevel: "High",
+    title: "Avoid importing lxml for untrusted XML parsing",
     enabled: true,
     languages: ["Python"],
     parameters: []
@@ -506,7 +491,7 @@ var patterns_default = [
     category: "Security",
     severityLevel: "High",
     title: "Avoid importing CGI handlers vulnerable to httpoxy",
-    enabled: false,
+    enabled: true,
     languages: ["Python"],
     parameters: []
   },
@@ -515,16 +500,26 @@ var patterns_default = [
     category: "Security",
     severityLevel: "High",
     title: "Avoid Importing PyCrypto Library",
-    enabled: false,
+    enabled: true,
     languages: ["Python"],
-    parameters: []
+    parameters: [],
+    tags: ["lib:pycrypto"]
   },
   {
     id: "Bandit_B414",
     category: "Security",
     severityLevel: "High",
-    title: "Avoid Importing PyCryptodome Modules",
-    enabled: false,
+    title: "Avoid importing pycryptodome (Cryptodome.*)",
+    enabled: true,
+    languages: ["Python"],
+    parameters: []
+  },
+  {
+    id: "Bandit_B415",
+    category: "Security",
+    severityLevel: "High",
+    title: "Avoid importing IPMI-related module (pyghmi)",
+    enabled: true,
     languages: ["Python"],
     parameters: []
   },
@@ -535,7 +530,8 @@ var patterns_default = [
     title: "Avoid disabling SSL certificate validation in requests",
     enabled: true,
     languages: ["Python"],
-    parameters: []
+    parameters: [],
+    tags: ["lib:httpx", "lib:requests"]
   },
   {
     id: "Bandit_B502",
@@ -580,34 +576,38 @@ var patterns_default = [
     title: "Avoid Unsafe Use of yaml.load",
     enabled: true,
     languages: ["Python"],
-    parameters: []
+    parameters: [],
+    tags: ["lib:pyyaml"]
   },
   {
     id: "Bandit_B507",
     category: "Security",
     severityLevel: "High",
     title: "Avoid Disabling SSH Host Key Verification",
-    enabled: false,
+    enabled: true,
     languages: ["Python"],
-    parameters: []
+    parameters: [],
+    tags: ["lib:paramiko"]
   },
   {
     id: "Bandit_B508",
     category: "Security",
     severityLevel: "Warning",
     title: "Avoid using insecure SNMP versions",
-    enabled: false,
+    enabled: true,
     languages: ["Python"],
-    parameters: []
+    parameters: [],
+    tags: ["lib:pysnmp"]
   },
   {
     id: "Bandit_B509",
     category: "Security",
     severityLevel: "Warning",
     title: "Avoid Weak SNMP Cryptography",
-    enabled: false,
+    enabled: true,
     languages: ["Python"],
-    parameters: []
+    parameters: [],
+    tags: ["lib:pysnmp"]
   },
   {
     id: "Bandit_B601",
@@ -616,7 +616,8 @@ var patterns_default = [
     title: "Detect Shell Injection Vulnerabilities in Paramiko exec_command",
     enabled: true,
     languages: ["Python"],
-    parameters: []
+    parameters: [],
+    tags: ["lib:paramiko"]
   },
   {
     id: "Bandit_B602",
@@ -650,7 +651,7 @@ var patterns_default = [
     category: "Security",
     severityLevel: "Warning",
     title: "Avoid starting a process with a shell",
-    enabled: false,
+    enabled: true,
     languages: ["Python"],
     parameters: []
   },
@@ -668,7 +669,7 @@ var patterns_default = [
     category: "Security",
     severityLevel: "Warning",
     title: "Avoid starting a process with a partial executable path",
-    enabled: false,
+    enabled: true,
     languages: ["Python"],
     parameters: []
   },
@@ -695,28 +696,59 @@ var patterns_default = [
     category: "Security",
     severityLevel: "Warning",
     title: "Avoid Potential SQL Injection in Django extra() Function",
-    enabled: false,
+    enabled: true,
     languages: ["Python"],
-    parameters: []
+    parameters: [],
+    tags: ["fwk:django"]
   },
   {
     id: "Bandit_B611",
     category: "Security",
     severityLevel: "Warning",
     title: "Avoid Use of RawSQL Function in Django",
-    enabled: false,
+    enabled: true,
     languages: ["Python"],
-    parameters: []
+    parameters: [],
+    tags: ["fwk:django"]
   },
   {
     id: "Bandit_B612",
     category: "Security",
     severityLevel: "Warning",
     title: "Avoid insecure use of logging.config.listen",
-    enabled: false,
+    enabled: true,
     languages: ["Python"],
     parameters: []
   },
+  {
+    id: "Bandit_B613",
+    category: "Security",
+    severityLevel: "High",
+    title: "Detect use of Unicode bidirectional (TrojanSource) control characters",
+    enabled: true,
+    languages: ["Python"],
+    parameters: []
+  },
+  {
+    id: "Bandit_B614",
+    category: "Security",
+    severityLevel: "High",
+    title: "Avoid unsafe PyTorch load",
+    enabled: true,
+    languages: ["Python"],
+    parameters: [],
+    tags: ["cwe502"]
+  },
+  {
+    id: "Bandit_B615",
+    category: "Security",
+    severityLevel: "Warning",
+    title: "Avoid unsafe Hugging Face Hub downloads (pin revisions)",
+    enabled: true,
+    languages: ["Python"],
+    parameters: [],
+    tags: ["huggingface", "supplychain"]
+  },
   {
     id: "Bandit_B701",
     category: "Security",
@@ -724,7 +756,8 @@ var patterns_default = [
     title: "Avoid disabling autoescaping in Jinja2 templates",
     enabled: true,
     languages: ["Python"],
-    parameters: []
+    parameters: [],
+    tags: ["fwk:flask", "lib:jinja2"]
   },
   {
     id: "Bandit_B702",
@@ -733,14 +766,25 @@ var patterns_default = [
     title: "Detect Use of Mako Templates",
     enabled: true,
     languages: ["Python"],
-    parameters: []
+    parameters: [],
+    tags: ["lib:mako"]
   },
   {
     id: "Bandit_B703",
     category: "Security",
     severityLevel: "Warning",
     title: "Avoid Potential XSS with django mark_safe Function",
-    enabled: false,
+    enabled: true,
+    languages: ["Python"],
+    parameters: [],
+    tags: ["fwk:django"]
+  },
+  {
+    id: "Bandit_B704",
+    category: "Security",
+    severityLevel: "High",
+    title: "Avoid markupsafe.Markup on untrusted data",
+    enabled: true,
     languages: ["Python"],
     parameters: []
   }
@@ -768,7 +812,7 @@ var pattern_mappings_default = {
 var descriptor = {
   id: "Bandit",
   displayName: "Bandit",
-  preferredVersion: "1.8.3",
+  preferredVersion: "1.9.4",
   languages: ["Python"],
   filePatterns: ["**/*.py"],
   supportedOS: ["linux", "darwin", "win32"],
@@ -780,7 +824,7 @@ var descriptor = {
 // src/adapter.ts
 var TOOL_ID = "Bandit";
 var ADAPTER_ID = "bandit-1";
-var PIP_PACKAGES = ["bandit==1.8.3"];
+var PIP_PACKAGES = ["bandit==1.9.4"];
 var PYTHON_VERSION_RANGE = ">=3.8.0 <3.14.0";
 var PATTERN_META = new Map(
   patterns_default.map((p) => [
@@ -804,7 +848,14 @@ function mapConfidence(confidence) {
       return 1;
   }
 }
-var CONFIG_FILE_CANDIDATES = [".bandit", "bandit.yml", "pyproject.toml"];
+var CONFIG_FILE_CANDIDATES = [
+  ".bandit",
+  "bandit.yml",
+  "pyproject.toml",
+  "bandit.yaml",
+  "bandit.toml",
+  "bandit.ini"
+];
 var PYPROJECT_BANDIT_SECTION = /^\[tool\.bandit(\.[\w-]+)*\]/m;
 async function pyprojectHasBanditSection(pyprojectPath) {
   try {
@@ -834,7 +885,7 @@ function buildMessage(result) {
 var adapter = {
   ...descriptor,
   patternsMetadata: patterns_default,
-  compatibleVersions: ">=1.7.0",
+  compatibleVersions: ">=1.9.0",
   website: "https://bandit.readthedocs.io/",
   prerequisites: [
     {
@@ -851,7 +902,7 @@ var adapter = {
    * 1. Codacy-managed venv (`~/.codacy/runtimes/bandit-1/venv/bin/bandit`)
    * 2. Global PATH (`bandit`)
    *
-   * Parses the version from `bandit --version` output like `bandit 1.8.3`.
+   * Parses the version from `bandit --version` output like `bandit 1.9.4`.
    */
   async checkAvailability(ctx) {
     ctx.logger.debug("Checking availability", { toolId: TOOL_ID });
@@ -923,7 +974,7 @@ var adapter = {
    * Installs bandit into an isolated Python virtual environment.
    *
    * Uses findPython -> ensureVenv -> pipInstall to create a dedicated venv
-   * at `~/.codacy/runtimes/bandit-1/venv/` and install `bandit==1.8.3`.
+   * at `~/.codacy/runtimes/bandit-1/venv/` and install `bandit==1.9.4`.
    */
   async install(ctx) {
     ctx.logger.info("Starting install", { toolId: TOOL_ID });
@@ -935,7 +986,7 @@ var adapter = {
           toolId: TOOL_ID,
           phase: "requirementCheck",
           kind: "MissingPrerequisite",
-          message: `Python (${PYTHON_VERSION_RANGE}) could not be found or downloaded. Bandit 1.8.x is incompatible with Python 3.14+.`,
+          message: `Python (${PYTHON_VERSION_RANGE}) could not be found or downloaded. Bandit 1.9.x is incompatible with Python 3.14+.`,
           level: "error"
         }
       };
@@ -969,7 +1020,7 @@ var adapter = {
   /**
    * Checks for bandit configuration files in the repository root.
    *
-   * Looks for `.bandit`, `bandit.yml`, or `pyproject.toml` (in that order).
+   * Looks for `.bandit`, `bandit.yml`, `bandit.yaml`, `bandit.toml`, `bandit.ini`, or `pyproject.toml` (in that order).
    * `pyproject.toml` only counts if it actually has a `[tool.bandit]` table —
    * unlike the other two candidates, its mere existence says nothing about
    * whether Bandit is configured (see {@link pyprojectHasBanditSection}).
@@ -980,7 +1031,7 @@ var adapter = {
       const candidatePath = import_path.default.join(ctx.repositoryRoot, candidate);
       try {
         await import_promises.default.access(candidatePath);
-        if (candidate === "pyproject.toml" && !await pyprojectHasBanditSection(candidatePath)) {
+        if ((candidate === "pyproject.toml" || candidate === "bandit.toml") && !await pyprojectHasBanditSection(candidatePath)) {
           continue;
         }
         ctx.logger.debug("Found local config", { toolId: TOOL_ID, path: candidatePath });
@@ -1023,7 +1074,7 @@ var adapter = {
     const useLocal = codacyConfig.useLocalConfigurationFile && codacyConfig.localConfigurationFile;
     if (useLocal) {
       const configPath = codacyConfig.localConfigurationFile;
-      if (configPath.endsWith(".bandit")) {
+      if (configPath.endsWith(".bandit") || configPath.endsWith(".ini")) {
         args.push("--ini", configPath);
       } else {
         args.push("-c", configPath);

package/dist/metadata.js

@@ -46,7 +46,7 @@ var pattern_mappings_default = {
 var descriptor = {
   id: "Bandit",
   displayName: "Bandit",
-  preferredVersion: "1.8.3",
+  preferredVersion: "1.9.4",
   languages: ["Python"],
   filePatterns: ["**/*.py"],
   supportedOS: ["linux", "darwin", "win32"],

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@codacy/tools-bandit-1",
-  "version": "0.19.0",
+  "version": "0.21.0",
   "description": "Bandit adapter — CLI-mode Python security linter",
   "main": "dist/index.js",
   "types": "dist/index.d.ts",
@@ -8,7 +8,7 @@
     "dist"
   ],
   "dependencies": {
-    "@codacy/tooling": "0.19.0"
+    "@codacy/tooling": "0.21.0"
   },
   "license": "MIT",
   "author": "Codacy <support@codacy.com> (https://www.codacy.com)",