Stuck on an issue?

Lightrun Answers was designed to reduce the constant googling that comes with debugging 3rd party libraries. It collects links to all the places you might be looking at while hunting down a tough bug.

And, if you’re still stuck at the end, we’re happy to hop on a call to see how we can help out.

B322 input listed as high severity, high confidence... when running python3

See original GitHub issue

Describe the bug When running bandit under python 3, B322 ‘The input method in Python 2…’ is listed as a high severity issue with high confidence.

At best, this should be lower confidence, but ideally it shouldn’t complain on python 3 as (as it asserts itself) it’s safe in python 3.

To Reproduce Steps to reproduce the behavior: While running in a python 3 virtualenv: echo “test = input(‘Say something’)” > test.py bandit test.py

Expected behavior No complaint about input is issued because this does not apply in python 3.

Bandit version

bandit 1.5.1
  python version = 3.4.3 (default, Nov 28 2017, 16:41:13) [GCC 4.8.4]

Additional context N/A

Issue Analytics

State:
Created 5 years ago
Reactions:12
Comments:5 (2 by maintainers)

Top GitHub Comments

13reactions

pzelnipcommented, Nov 2, 2018

So is the workaround to just disable B322 when your project is Python 3?

Could a possible fix be to allow one to specify the version of Python your project targets as a switch to bandit? Ie bandit -r --python3 /path/to/my/code?

0reactions

ericwbcommented, Mar 29, 2022

The blacklist check for input() was removed with PR #662

Top Results From Across the Web

Bandit is a tool designed to find common security issues in ...

Bandit is a tool designed to find common security issues in Python code. To do this Bandit processes each file, builds an AST...

What is the way to ignore/skip some issues from python bandit ...

I've got an answer here: Two ways: You can skip the B703 and B308 using the --skip argument to the command line. Or...

Bandit Documentation - Read the Docs

The Python docs succinctly describe why the use of exec is risky. Example. >> Issue: Use of exec detected. Severity: Medium. Confidence: High....

Bandit Security Report Summary - GitLab

Confidence : HIGH ... Severity: MEDIUM ... blacklist: The input method in Python 2 will read from standard input, evaluate and run the...

Project Migration to PyCQA · 2d2170273b - bandit - OpenDev

severity =bandit.HIGH,. confidence=bandit.HIGH,. text="Unsafe deserialization detected." ) To register your plugin, you have two options: 1. If you're using ...