bandit

Bandit is a tool designed to find common security issues in Python code. To do this Bandit processes each file, builds an AST from it, and runs appropriate plugins against the AST nodes. Once Bandit has finished scanning all the files it generates a report.Bandit was originally developed within the OpenStack Security Project and later rehomed to PyCQA.

Name:bandit

Category:Static Code Analysis

Publisher:trickest

Created:6/23/2021

Container:quay.io/trickest/bandit:1.7.1

Output Type:

License:Unknown

Source:View Source

Parameters

debug · boolean

-dTurn on debug mode

quiet · boolean

-qOnly show output in the case of an error

profile · string

--profileProfile to use (defaults to executing all tests)

skip-id · string

--skipComma-separated list of test IDs to skip

test-id · string

--testsComma-separated list of test IDs to run

verbose · boolean

--verboseOutput extra information like excluded and included files

baseline · file

--baselinePath of a baseline report to compare against (only JSON-formatted files are accepted)

ini-file · file

--iniPath to a .bandit file that supplies command line arguments

aggregate · string

--aggregateAggregate ggregate output by vulnerability (default) or by filename

exit-zero · boolean · required

--exit-zeroExit with 0, even with results found

level-low · string

-lReport only issues of a given severity level or higher (level for LOW, -ll for MEDIUM, -lll for HIGH)

confidence · boolean

--confidenceReport only issues of a given confidence level or higher

level-high · string

-lllReport only issues of a given severity level or higher (level for LOW, -ll for MEDIUM, -lll for HIGH)

config-file · file

--configfileOptional config file to use for selecting plugins and overriding defaults

ignore-nosec · boolean

--ignore-nosecDo not skip lines with # nosec comments

level-medium · string

-llReport only issues of a given severity level or higher (level for LOW, -ll for MEDIUM, -lll for HIGH)

msg-template · string

--msg-templateSpecify output message template (only usable with output-format is set to custom)

number-lines · string

--numberMaximum number of code lines to output for each issue

targets-file · file · required

targetsSource file(s)

exclude-paths · string

--excludeComma-separated list of paths (glob patterns supported) to exclude from scan (note that these are in addition to the excluded paths provided in the config file) (default: .svn,CVS,.bzr,.hg,.git,__pycache__,.tox,.eggs,*.egg)

output-format · string

-f{csv,custom,html,json,screen,txt,xml,yaml}

targets-folder · folder · required

targetsSource folder

recursive-target · folder

--recursiveFind and process files in subdirectories