Stuck on an issue?

Lightrun Answers was designed to reduce the constant googling that comes with debugging 3rd party libraries. It collects links to all the places you might be looking at while hunting down a tough bug.

And, if you’re still stuck at the end, we’re happy to hop on a call to see how we can help out.

Exclude paths in config file ignored if passing specific files to Bandit CLI

See original GitHub issue

UPDATE: please see my below comment for an updated description of the problem.

Describe the bug When using the pre-commit hook, my excluded paths listed in .bandit are still processed by bandit.

To Reproduce Steps to reproduce the behavior:

Create a .bandit config file with exclusions. For example:
```
[bandit]
exclude: ./node_modules/*,./tests/*
```
Run bandit via command line (bandit -r .), verify exclusions ignored.
Run bandit on all files via pre-commit hook: pre-commit run --all-files bandit
See that excluded files are processed by bandit

Expected behavior I expect the excluded paths to be ignored.

Bandit version

bandit 1.6.0
  python version = 3.7.3 (default, May 27 2019, 05:16:50) [Clang 10.0.0 (clang-1000.10.44.4)]

Issue Analytics

State:
Created 4 years ago
Reactions:8
Comments:18 (7 by maintainers)

Top GitHub Comments

5reactions

exhumacommented, Mar 17, 2021

I just ran into the same issue. Which makes this pretty bad for me right now is that bandit is executed via a CI-pipeline defined by a centrally configured GitLab instance. This always runs bandit using bandit -r <package_name> and I don’t have direct control over this in the project.

In my project I have some files that I want to exclude and wrote them into .bandit

Yet, the pipeline still fails because of this issue.

So now I’m forced to write # nosec comments into all files in a given subfolder even though that particular subfolder only contains utilities which never receive end-user input and could be ignored alltogether.

5reactions

adamwojtcommented, Mar 17, 2021

ini file for dir exclusion doesn’t work with -roption. It’s super confusing.

My .bandit

[bandit]
exclude: test_*.py,./venv/,./env/,./node_modules/,./cacheback/,./.env,./.venv,migrations,tests
skips: B101,B311

Running with bandit -r .

[main]	INFO	Found project level .bandit file: ./.bandit
[main]	INFO	Using command line arg for excluded paths
[main]	INFO	Using ini file for skipped tests

Tests dirs and files are not ignored but everything works fine with bandit -x "test_*.py,./venv/,./env/,./node_modules/,./cacheback/,./.env,./.venv,migrations,tests" -r .

I am confused.