@codacy/tools-bandit-1

Table of Contents

• Overview
• Updating patterns
• Updating the Bandit version
• Development
• Notes for maintainers

Overview

Python security linter using the Bandit binary. Uses the CLI execution strategy -- spawns bandit from a managed Python venv via spawnTool() and parses its JSON output.

Updating patterns

# Re-fetch pattern metadata from the Codacy API
pnpm prefetch

# Commit the result
git add src/patterns.json

Pattern IDs follow the format Bandit_B602, Bandit_B301, etc.

Updating the Bandit version

1. Update preferredVersion in src/adapter.ts
2. Update the PIP_PACKAGES array with the new pinned version
3. Run pnpm prefetch to check for new/removed rules
4. Run pnpm test to verify compatibility
5. If the major version changes, create a new adapter package (bandit-2/)

Development

pnpm build    # Build with tsup
pnpm test     # Run tests (requires bandit in PATH or venv)

To install bandit locally for testing:

pip install bandit==1.8.3

Notes for maintainers

• Preset mappings (src/pattern-mappings.json): 18 of the 78 checks are gated on a detected PyPI dependency, because they only ever fire against one library's API. Ten were default-on and now stay out of a repo that does not declare the library — B201 (Flask), B701 (Jinja2), B702 (Mako), B601 (Paramiko), B320/B410 (lxml), B506 (PyYAML), B113/B501 (requests) and B308 (Django). Eight were default-off and are now reachable at all: B610/B611/B703 (Django SQLi/XSS), B507 (Paramiko host keys), B508/B509 (PySNMP), B413/B414 (PyCrypto vs. PyCryptodome — separate projects, so separate entities). Left universal on purpose: the stdlib checks (B301–B307, B324) and B412, whose httpoxy CGI handler has no manifest to read.

  Two of these need a second key, because gating gets its evidence from direct declarations only:

  • B701 is claimed by flask as well as jinja2. Flask hard-depends on Jinja2 (Flask → jinja2>=3.1.2), so a real Flask app usually never lists Jinja2 itself, and gating on jinja2 alone dropped a High-severity autoescape check from most Flask repos.
  • B501 is claimed by httpx as well as requests. Bandit's own crypto_request_no_cert_validation plugin inspects both libraries, so an httpx-only repo would otherwise lose the verify=False check.

  Three of these gates are inert, and deliberately kept anyway: B320, B410 (lxml) and B414 (pycryptodome) are still in Codacy's pattern catalog but Bandit 1.8.3 no longer registers the checks, so they can never fire (blacklists/calls.py: "skipped B320 as the check for a call to lxml.etree has been removed"; blacklists/imports.py: the same for B410; B414 is simply absent from gen_blacklist()). mapping-drift.test.ts cannot see this — it compares against Codacy's catalog, not the installed tool. Dropping the mappings would make three default-on High/Security patterns universal again and write them into every Python repo's config, so the gate is the lesser evil until the catalog catches up. See docs/tech-debt.md.

• Bandit requires Python 3 as a runtime. The adapter uses an isolated venv at ~/.codacy/runtimes/bandit-1/venv/.

• Exit code 0 = no findings, 1 = findings found (normal), >1 = error.

• col_offset in bandit output is 0-based; the adapter adds 1 for the 1-based Issue model.

• Bandit's issue_confidence (LOW/MEDIUM/HIGH) maps to numeric confidence (1/2/3) on the Issue.

• CWE information from issue_cwe is appended to the issue message as (CWE-{id}).

• Config file detection supports .bandit (INI, passed with --ini), bandit.yml (YAML, passed with -c), and pyproject.toml (TOML, passed with -c).

• Pattern filtering uses the -t flag to pass comma-separated test IDs to bandit.

• The errors array in bandit's JSON output (file-level errors like syntax errors) is mapped to AnalysisError objects with level "warning".