Skip to content

Commit effd2dc

Browse files
markovamariamarkovamaria
authored
Add Bandit security scan workflow
- Run Bandit only when Python files or config changes - Exclude submodules from scan - Fail CI on any security issues detected
1 parent ad80d93 commit effd2dc

3 files changed

Lines changed: 430 additions & 1 deletion

File tree

‎.bandit/bandit.config‎

Lines changed: 394 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,394 @@
1+
### This config may optionally select a subset of tests to run or skip by
2+
### filling out the 'tests' and 'skips' lists given below. If no tests are
3+
### specified for inclusion then it is assumed all tests are desired. The skips
4+
### set will remove specific tests from the include set. This can be controlled
5+
### using the -t/-s CLI options. Note that the same test ID should not appear
6+
### in both 'tests' and 'skips', this would be nonsensical and is detected by
7+
### Bandit at runtime.
8+
9+
# Available tests:
10+
# B101 : assert_used
11+
# B102 : exec_used
12+
# B103 : set_bad_file_permissions
13+
# B104 : hardcoded_bind_all_interfaces
14+
# B105 : hardcoded_password_string
15+
# B106 : hardcoded_password_funcarg
16+
# B107 : hardcoded_password_default
17+
# B108 : hardcoded_tmp_directory
18+
# B110 : try_except_pass
19+
# B112 : try_except_continue
20+
# B201 : flask_debug_true
21+
# B301 : pickle
22+
# B302 : marshal
23+
# B303 : md5
24+
# B304 : ciphers
25+
# B305 : cipher_modes
26+
# B306 : mktemp_q
27+
# B307 : eval
28+
# B308 : mark_safe
29+
# B310 : urllib_urlopen
30+
# B311 : random
31+
# B312 : telnetlib
32+
# B313 : xml_bad_cElementTree
33+
# B314 : xml_bad_ElementTree
34+
# B315 : xml_bad_expatreader
35+
# B316 : xml_bad_expatbuilder
36+
# B317 : xml_bad_sax
37+
# B318 : xml_bad_minidom
38+
# B319 : xml_bad_pulldom
39+
# B321 : ftplib
40+
# B323 : unverified_context
41+
# B324 : hashlib_new_insecure_functions
42+
# B401 : import_telnetlib
43+
# B402 : import_ftplib
44+
# B403 : import_pickle
45+
# B404 : import_subprocess
46+
# B405 : import_xml_etree
47+
# B406 : import_xml_sax
48+
# B407 : import_xml_expat
49+
# B408 : import_xml_minidom
50+
# B409 : import_xml_pulldom
51+
# B411 : import_xmlrpclib
52+
# B412 : import_httpoxy
53+
# B413 : import_pycrypto
54+
# B501 : request_with_no_cert_validation
55+
# B502 : ssl_with_bad_version
56+
# B503 : ssl_with_bad_defaults
57+
# B504 : ssl_with_no_version
58+
# B505 : weak_cryptographic_key
59+
# B506 : yaml_load
60+
# B507 : ssh_no_host_key_verification
61+
# B601 : paramiko_calls
62+
# B602 : subprocess_popen_with_shell_equals_true
63+
# B603 : subprocess_without_shell_equals_true
64+
# B604 : any_other_function_with_shell_equals_true
65+
# B605 : start_process_with_a_shell
66+
# B606 : start_process_with_no_shell
67+
# B607 : start_process_with_partial_path
68+
# B608 : hardcoded_sql_expressions
69+
# B609 : linux_commands_wildcard_injection
70+
# B610 : django_extra_used
71+
# B611 : django_rawsql_used
72+
# B701 : jinja2_autoescape_false
73+
# B702 : use_of_mako_templates
74+
# B703 : django_mark_safe
75+
76+
# (optional) list included test IDs here, eg '[B101, B406]':
77+
# Required security checkers - do not disable these
78+
# Additional checkers may be added if desired
79+
tests:
80+
[ 'B301', 'B302', 'B303', 'B304', 'B305', 'B306', 'B308', 'B310', 'B311', 'B312', 'B313', 'B314', 'B315', 'B316', 'B317', 'B318', 'B319', 'B321', 'B323', 'B324', 'B401', 'B402', 'B403', 'B404', 'B405', 'B406', 'B407', 'B408', 'B409', 'B411', 'B412', 'B413']
81+
82+
# (optional) list skipped test IDs here, eg '[B101, B406]':
83+
# Optional checkers - may be added to tests list if desired
84+
skips:
85+
[ 'B101', 'B102', 'B103', 'B104', 'B105', 'B106', 'B107', 'B108', 'B110', 'B112', 'B201', 'B501', 'B502', 'B503', 'B504', 'B505', 'B506', 'B507', 'B601', 'B602', 'B603', 'B604', 'B605', 'B606', 'B607', 'B608', 'B609', 'B610', 'B611', 'B701', 'B702', 'B703']
86+
87+
### (optional) plugin settings - some test plugins require configuration data
88+
### that may be given here, per-plugin. All bandit test plugins have a built in
89+
### set of sensible defaults and these will be used if no configuration is
90+
### provided. It is not necessary to provide settings for every (or any) plugin
91+
### if the defaults are acceptable.
92+
93+
any_other_function_with_shell_equals_true:
94+
no_shell:
95+
- os.execl
96+
- os.execle
97+
- os.execlp
98+
- os.execlpe
99+
- os.execv
100+
- os.execve
101+
- os.execvp
102+
- os.execvpe
103+
- os.spawnl
104+
- os.spawnle
105+
- os.spawnlp
106+
- os.spawnlpe
107+
- os.spawnv
108+
- os.spawnve
109+
- os.spawnvp
110+
- os.spawnvpe
111+
- os.startfile
112+
shell:
113+
- os.system
114+
- os.popen
115+
- os.popen2
116+
- os.popen3
117+
- os.popen4
118+
- popen2.popen2
119+
- popen2.popen3
120+
- popen2.popen4
121+
- popen2.Popen3
122+
- popen2.Popen4
123+
- commands.getoutput
124+
- commands.getstatusoutput
125+
subprocess:
126+
- subprocess.Popen
127+
- subprocess.call
128+
- subprocess.check_call
129+
- subprocess.check_output
130+
- subprocess.run
131+
assert_used:
132+
skips: []
133+
hardcoded_tmp_directory:
134+
tmp_dirs:
135+
- /tmp
136+
- /var/tmp
137+
- /dev/shm
138+
linux_commands_wildcard_injection:
139+
no_shell:
140+
- os.execl
141+
- os.execle
142+
- os.execlp
143+
- os.execlpe
144+
- os.execv
145+
- os.execve
146+
- os.execvp
147+
- os.execvpe
148+
- os.spawnl
149+
- os.spawnle
150+
- os.spawnlp
151+
- os.spawnlpe
152+
- os.spawnv
153+
- os.spawnve
154+
- os.spawnvp
155+
- os.spawnvpe
156+
- os.startfile
157+
shell:
158+
- os.system
159+
- os.popen
160+
- os.popen2
161+
- os.popen3
162+
- os.popen4
163+
- popen2.popen2
164+
- popen2.popen3
165+
- popen2.popen4
166+
- popen2.Popen3
167+
- popen2.Popen4
168+
- commands.getoutput
169+
- commands.getstatusoutput
170+
subprocess:
171+
- subprocess.Popen
172+
- subprocess.call
173+
- subprocess.check_call
174+
- subprocess.check_output
175+
- subprocess.run
176+
ssl_with_bad_defaults:
177+
bad_protocol_versions:
178+
- PROTOCOL_SSLv2
179+
- SSLv2_METHOD
180+
- SSLv23_METHOD
181+
- PROTOCOL_SSLv3
182+
- PROTOCOL_TLSv1
183+
- SSLv3_METHOD
184+
- TLSv1_METHOD
185+
ssl_with_bad_version:
186+
bad_protocol_versions:
187+
- PROTOCOL_SSLv2
188+
- SSLv2_METHOD
189+
- SSLv23_METHOD
190+
- PROTOCOL_SSLv3
191+
- PROTOCOL_TLSv1
192+
- SSLv3_METHOD
193+
- TLSv1_METHOD
194+
start_process_with_a_shell:
195+
no_shell:
196+
- os.execl
197+
- os.execle
198+
- os.execlp
199+
- os.execlpe
200+
- os.execv
201+
- os.execve
202+
- os.execvp
203+
- os.execvpe
204+
- os.spawnl
205+
- os.spawnle
206+
- os.spawnlp
207+
- os.spawnlpe
208+
- os.spawnv
209+
- os.spawnve
210+
- os.spawnvp
211+
- os.spawnvpe
212+
- os.startfile
213+
shell:
214+
- os.system
215+
- os.popen
216+
- os.popen2
217+
- os.popen3
218+
- os.popen4
219+
- popen2.popen2
220+
- popen2.popen3
221+
- popen2.popen4
222+
- popen2.Popen3
223+
- popen2.Popen4
224+
- commands.getoutput
225+
- commands.getstatusoutput
226+
subprocess:
227+
- subprocess.Popen
228+
- subprocess.call
229+
- subprocess.check_call
230+
- subprocess.check_output
231+
- subprocess.run
232+
start_process_with_no_shell:
233+
no_shell:
234+
- os.execl
235+
- os.execle
236+
- os.execlp
237+
- os.execlpe
238+
- os.execv
239+
- os.execve
240+
- os.execvp
241+
- os.execvpe
242+
- os.spawnl
243+
- os.spawnle
244+
- os.spawnlp
245+
- os.spawnlpe
246+
- os.spawnv
247+
- os.spawnve
248+
- os.spawnvp
249+
- os.spawnvpe
250+
- os.startfile
251+
shell:
252+
- os.system
253+
- os.popen
254+
- os.popen2
255+
- os.popen3
256+
- os.popen4
257+
- popen2.popen2
258+
- popen2.popen3
259+
- popen2.popen4
260+
- popen2.Popen3
261+
- popen2.Popen4
262+
- commands.getoutput
263+
- commands.getstatusoutput
264+
subprocess:
265+
- subprocess.Popen
266+
- subprocess.call
267+
- subprocess.check_call
268+
- subprocess.check_output
269+
- subprocess.run
270+
start_process_with_partial_path:
271+
no_shell:
272+
- os.execl
273+
- os.execle
274+
- os.execlp
275+
- os.execlpe
276+
- os.execv
277+
- os.execve
278+
- os.execvp
279+
- os.execvpe
280+
- os.spawnl
281+
- os.spawnle
282+
- os.spawnlp
283+
- os.spawnlpe
284+
- os.spawnv
285+
- os.spawnve
286+
- os.spawnvp
287+
- os.spawnvpe
288+
- os.startfile
289+
shell:
290+
- os.system
291+
- os.popen
292+
- os.popen2
293+
- os.popen3
294+
- os.popen4
295+
- popen2.popen2
296+
- popen2.popen3
297+
- popen2.popen4
298+
- popen2.Popen3
299+
- popen2.Popen4
300+
- commands.getoutput
301+
- commands.getstatusoutput
302+
subprocess:
303+
- subprocess.Popen
304+
- subprocess.call
305+
- subprocess.check_call
306+
- subprocess.check_output
307+
- subprocess.run
308+
subprocess_popen_with_shell_equals_true:
309+
no_shell:
310+
- os.execl
311+
- os.execle
312+
- os.execlp
313+
- os.execlpe
314+
- os.execv
315+
- os.execve
316+
- os.execvp
317+
- os.execvpe
318+
- os.spawnl
319+
- os.spawnle
320+
- os.spawnlp
321+
- os.spawnlpe
322+
- os.spawnv
323+
- os.spawnve
324+
- os.spawnvp
325+
- os.spawnvpe
326+
- os.startfile
327+
shell:
328+
- os.system
329+
- os.popen
330+
- os.popen2
331+
- os.popen3
332+
- os.popen4
333+
- popen2.popen2
334+
- popen2.popen3
335+
- popen2.popen4
336+
- popen2.Popen3
337+
- popen2.Popen4
338+
- commands.getoutput
339+
- commands.getstatusoutput
340+
subprocess:
341+
- subprocess.Popen
342+
- subprocess.call
343+
- subprocess.check_call
344+
- subprocess.check_output
345+
- subprocess.run
346+
subprocess_without_shell_equals_true:
347+
no_shell:
348+
- os.execl
349+
- os.execle
350+
- os.execlp
351+
- os.execlpe
352+
- os.execv
353+
- os.execve
354+
- os.execvp
355+
- os.execvpe
356+
- os.spawnl
357+
- os.spawnle
358+
- os.spawnlp
359+
- os.spawnlpe
360+
- os.spawnv
361+
- os.spawnve
362+
- os.spawnvp
363+
- os.spawnvpe
364+
- os.startfile
365+
shell:
366+
- os.system
367+
- os.popen
368+
- os.popen2
369+
- os.popen3
370+
- os.popen4
371+
- popen2.popen2
372+
- popen2.popen3
373+
- popen2.popen4
374+
- popen2.Popen3
375+
- popen2.Popen4
376+
- commands.getoutput
377+
- commands.getstatusoutput
378+
subprocess:
379+
- subprocess.Popen
380+
- subprocess.call
381+
- subprocess.check_call
382+
- subprocess.check_output
383+
- subprocess.run
384+
try_except_continue:
385+
check_typed_exception: false
386+
try_except_pass:
387+
check_typed_exception: false
388+
weak_cryptographic_key:
389+
weak_key_size_dsa_high: 1024
390+
weak_key_size_dsa_medium: 2048
391+
weak_key_size_ec_high: 160
392+
weak_key_size_ec_medium: 224
393+
weak_key_size_rsa_high: 1024
394+
weak_key_size_rsa_medium: 2048

0 commit comments

Comments
 (0)