Registry / testing / flake8-bandit

flake8-bandit

JSON →
library4.1.1pypypiunverified

flake8-bandit is a plugin for Flake8 that integrates the Bandit security linter directly into your Python code quality workflow. It automates security testing by scanning Python code for common security issues and vulnerabilities, reporting them as standard Flake8 errors. The current version is 4.1.1, released on August 29, 2022, with an irregular release cadence.

testingauth-security
pip install flake8-bandit
github ↗package ↗
INSTALL
IMPORT
SIG · FLAKE8-BANDIT
F
flake8-bandit
testingpythonv4.1.1
harness data pending
Install & Compatibility
Where this runs

No compatibility data collected yet for this library.

Code
Verified usage

Install flake8-bandit and then simply run the `flake8` command on your Python project. flake8-bandit automatically registers itself and runs Bandit's security checks. You can configure specific Bandit tests using a `.bandit` configuration file in your project root.

# Install flake8-bandit (flake8 and bandit will be installed as dependencies) pip install flake8-bandit # Run flake8-bandit on your project (it integrates automatically with flake8) # Example: Create a file named 'insecure_code.py' # with content: 'import subprocess; subprocess.call("ls", shell=True)' # Then run: flake8 insecure_code.py # Expected output for the insecure_code.py example: # insecure_code.py:1:22: S602 Use of subprocess.call with shell=True is insecure. Consider using subprocess.run with shell=False. (subprocess-run-with-shell-equals-true)
flake8 --version
Debug
Known issues
gotchaflake8-bandit uses a dedicated `.bandit` configuration file for fine-grained control over which security tests to include or exclude. This configuration is separate from Flake8's general configuration files (e.g., `.flake8`, `setup.cfg`).
fix
Create or modify a `.bandit` file in your project root to customize Bandit's behavior, for example:
```ini
[bandit]
exclude = /tests,/docs
tests = S101,S102
```
affects: >=4.0.0
gotchaflake8-bandit reports security issues using error codes prefixed with 'S' (e.g., S101, S501). Users familiar with Bandit's native output (which uses 'B' prefixes) or other Flake8 plugins might need to adjust their `ignore` or `per-file-ignores` rules in Flake8's configuration to match the 'S' prefix.
fix
When ignoring or selecting specific security rules, always refer to them with the 'S' prefix in your `.flake8`, `setup.cfg`, or `pyproject.toml` configuration (e.g., `ignore = S101`).
affects: >=4.0.0
Errors
Common errors & fixes
Flake8 failed to load plugin "flake8-bandit" due to cannot import name 'ConfigFileFinder' from 'flake8.options.config'
`flake8-bandit` version 4.1.1 is incompatible with `flake8` versions 5.0.0 and above because `ConfigFileFinder` was removed from `flake8`.
fix
Downgrade `flake8` to a version prior to 5.0.0 (e.g., `pip install flake8==4.0.1`) or upgrade `flake8-bandit` to a version compatible with newer `flake8` versions if available.
S101 Use of assert detected
`flake8-bandit` flags the use of `assert` statements (S101) because they are removed when Python code is compiled with optimizations (`python -O`), potentially bypassing security checks or validations in production environments. This often leads to false positives in test files.
fix
To ignore S101 in test files, add `per-file-ignores = tests:S101` to your Flake8 configuration (e.g., `.flake8`, `setup.cfg`, or `pyproject.toml`). For a single line, add `# noqa: S101` at the end of the line.
Trying to ignore a Bandit 'B' code (e.g., B101) in Flake8 configuration and it not working.
`flake8-bandit` translates Bandit's native 'B' prefixed error codes (e.g., B101, B603) into 'S' prefixed codes (e.g., S101, S603) when reporting them through Flake8. Therefore, configuring Flake8 to ignore 'B' codes will not affect `flake8-bandit`'s output.
fix
Always use the 'S' prefix (e.g., `S101`, `S603`) when configuring Flake8 to ignore or select rules that originate from `flake8-bandit` in your `.flake8`, `setup.cfg`, or `pyproject.toml` file, for example: `ignore = S101,S603`.
S603 subprocess_without_shell_equals_true
`flake8-bandit` identifies calls to `subprocess` functions without `shell=True`, which is generally safer than using a shell but still advises caution regarding untrusted input to prevent potential injection vulnerabilities.
fix
If the input to the subprocess command is validated and trusted, you can suppress this warning using `# noqa: S603` on the relevant line. Alternatively, ensure inputs are sanitized and passed as a list of arguments rather than a single string to prevent shell injection.
S301 suspicious-pickle-usage
`flake8-bandit` detects the use of the `pickle` module because deserializing untrusted data with `pickle` can lead to arbitrary code execution, making it a significant security vulnerability.
fix
Avoid using `pickle` for deserializing data from untrusted sources. Instead, opt for safer and simpler serialization formats like JSON. If `pickle` is unavoidable, implement rigorous validation of the data or cryptographic signing to ensure data integrity and authenticity before deserialization.
Upgrade
Version history
4.1.1latest on PyPI · released Aug 29, 2022
Audit
Dependencies
flake8requiredflake8-bandit is a plugin for Flake8 and requires it to function.
banditrequiredflake8-bandit uses Bandit as its underlying security analysis engine.
Agent activity
22 hits · last 30 days
node
20
Amazon
1
OpenAI (training)
1
Resources
githubhttps://github.com/tylerwince/flake8-bandit ↗
packagehttps://pypi.org/project/flake8-bandit/ ↗
flake8-bandit — pip install flake8-bandit · libregistry