@codacy/tools-bandit-1 0.20.0 → 0.22.0

package/README.md

@@ -77,6 +77,16 @@ pip install bandit==1.8.3
     `crypto_request_no_cert_validation` plugin inspects both libraries, so an httpx-only repo
     would otherwise lose the `verify=False` check.
 
+  Three of these gates are inert, and **deliberately kept anyway**: `B320`, `B410` (lxml) and
+  `B414` (pycryptodome) are still in Codacy's pattern catalog but Bandit 1.8.3 no longer
+  registers the checks, so they can never fire (`blacklists/calls.py`: "skipped B320 as the
+  check for a call to lxml.etree has been removed"; `blacklists/imports.py`: the same for
+  `B410`; `B414` is simply absent from `gen_blacklist()`). `mapping-drift.test.ts` cannot see
+  this — it compares against Codacy's catalog, not the installed tool. Dropping the mappings
+  would make three default-on High/Security patterns universal again and write them into every
+  Python repo's config, so the gate is the lesser evil until the catalog catches up. See
+  `docs/tech-debt.md`.
+
 - Bandit requires Python 3 as a runtime. The adapter uses an isolated venv at `~/.codacy/runtimes/bandit-1/venv/`.
 - Exit code 0 = no findings, 1 = findings found (normal), >1 = error.
 - `col_offset` in bandit output is 0-based; the adapter adds 1 for the 1-based Issue model.

package/dist/index.js

@@ -139,7 +139,8 @@ var patterns_default = [
     title: "Enforce timeout parameter in requests calls",
     enabled: true,
     languages: ["Python"],
-    parameters: []
+    parameters: [],
+    tags: ["lib:httpx", "lib:requests"]
   },
   {
     id: "Bandit_B201",
@@ -148,7 +149,8 @@ var patterns_default = [
     title: "Avoid Running Flask App with Debug Mode Enabled",
     enabled: true,
     languages: ["Python"],
-    parameters: []
+    parameters: [],
+    tags: ["fwk:flask"]
   },
   {
     id: "Bandit_B202",
@@ -229,7 +231,8 @@ var patterns_default = [
     title: "Avoid use of mark_safe()",
     enabled: true,
     languages: ["Python"],
-    parameters: []
+    parameters: [],
+    tags: ["fwk:django"]
   },
   {
     id: "Bandit_B309",
@@ -499,7 +502,8 @@ var patterns_default = [
     title: "Avoid Importing PyCrypto Library",
     enabled: true,
     languages: ["Python"],
-    parameters: []
+    parameters: [],
+    tags: ["lib:pycrypto"]
   },
   {
     id: "Bandit_B414",
@@ -526,7 +530,8 @@ var patterns_default = [
     title: "Avoid disabling SSL certificate validation in requests",
     enabled: true,
     languages: ["Python"],
-    parameters: []
+    parameters: [],
+    tags: ["lib:httpx", "lib:requests"]
   },
   {
     id: "Bandit_B502",
@@ -571,7 +576,8 @@ var patterns_default = [
     title: "Avoid Unsafe Use of yaml.load",
     enabled: true,
     languages: ["Python"],
-    parameters: []
+    parameters: [],
+    tags: ["lib:pyyaml"]
   },
   {
     id: "Bandit_B507",
@@ -580,7 +586,8 @@ var patterns_default = [
     title: "Avoid Disabling SSH Host Key Verification",
     enabled: true,
     languages: ["Python"],
-    parameters: []
+    parameters: [],
+    tags: ["lib:paramiko"]
   },
   {
     id: "Bandit_B508",
@@ -589,7 +596,8 @@ var patterns_default = [
     title: "Avoid using insecure SNMP versions",
     enabled: true,
     languages: ["Python"],
-    parameters: []
+    parameters: [],
+    tags: ["lib:pysnmp"]
   },
   {
     id: "Bandit_B509",
@@ -598,7 +606,8 @@ var patterns_default = [
     title: "Avoid Weak SNMP Cryptography",
     enabled: true,
     languages: ["Python"],
-    parameters: []
+    parameters: [],
+    tags: ["lib:pysnmp"]
   },
   {
     id: "Bandit_B601",
@@ -607,7 +616,8 @@ var patterns_default = [
     title: "Detect Shell Injection Vulnerabilities in Paramiko exec_command",
     enabled: true,
     languages: ["Python"],
-    parameters: []
+    parameters: [],
+    tags: ["lib:paramiko"]
   },
   {
     id: "Bandit_B602",
@@ -688,7 +698,8 @@ var patterns_default = [
     title: "Avoid Potential SQL Injection in Django extra() Function",
     enabled: true,
     languages: ["Python"],
-    parameters: []
+    parameters: [],
+    tags: ["fwk:django"]
   },
   {
     id: "Bandit_B611",
@@ -697,7 +708,8 @@ var patterns_default = [
     title: "Avoid Use of RawSQL Function in Django",
     enabled: true,
     languages: ["Python"],
-    parameters: []
+    parameters: [],
+    tags: ["fwk:django"]
   },
   {
     id: "Bandit_B612",
@@ -744,7 +756,8 @@ var patterns_default = [
     title: "Avoid disabling autoescaping in Jinja2 templates",
     enabled: true,
     languages: ["Python"],
-    parameters: []
+    parameters: [],
+    tags: ["fwk:flask", "lib:jinja2"]
   },
   {
     id: "Bandit_B702",
@@ -753,7 +766,8 @@ var patterns_default = [
     title: "Detect Use of Mako Templates",
     enabled: true,
     languages: ["Python"],
-    parameters: []
+    parameters: [],
+    tags: ["lib:mako"]
   },
   {
     id: "Bandit_B703",
@@ -762,7 +776,8 @@ var patterns_default = [
     title: "Avoid Potential XSS with django mark_safe Function",
     enabled: true,
     languages: ["Python"],
-    parameters: []
+    parameters: [],
+    tags: ["fwk:django"]
   },
   {
     id: "Bandit_B704",

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@codacy/tools-bandit-1",
-  "version": "0.20.0",
+  "version": "0.22.0",
   "description": "Bandit adapter — CLI-mode Python security linter",
   "main": "dist/index.js",
   "types": "dist/index.d.ts",
@@ -8,7 +8,7 @@
     "dist"
   ],
   "dependencies": {
-    "@codacy/tooling": "0.20.0"
+    "@codacy/tooling": "0.22.0"
   },
   "license": "MIT",
   "author": "Codacy <support@codacy.com> (https://www.codacy.com)",