Bandit is a Python package for checking for security issues in Python code. I have been thinking about using Bandit to check for security risks in my own software as well as 3rd party packages that I use. I couldn’t help but venture to the potentially ironic situation of Bandit evaluating that Bandit itself is insecure.
We can find the version of Bandit we are using like this:
"""Print the installed bandit version."""
import bandit
if __name__ == "__main__":
print(bandit.__version__)The path where the __init__.py file for Bandit is located on your system can be found in bandit.__file__. We can call Bandit from the command line on itself.
"""Run bandit on the installed bandit package."""
from pathlib import Path
import subprocess
import bandit
if __name__ == "__main__":
init_path = Path(bandit.__file__).parent
print(subprocess.run(['bandit', '-r', init_path], capture_output=True, text=True).stdout)At a quick glance you might misread the above output as saying that there are no issues. There actually are, but the authors of Bandit have disabled them using the #nosec comment. This is indicated by the Total potential issues skipped due to specifically being disabled (e.g., #nosec BXXX): 10. Why the output also says Total lines skipped (#nosec): 0 I am not sure.
We can find the locations of these lines.
"""Find #nosec comments in the installed bandit package."""
from pathlib import Path
import subprocess
import bandit
if __name__ == "__main__":
init_path = Path(bandit.__file__).parent
print(subprocess.run(['grep', '-rin', r'\#\snosec', init_path], capture_output=True, text=True).stdout)This is always something important to keep in mind about Bandit. It can tell you about potential security issues, but it also reports when it has been told to ignore some line of code.