Package: bandit-high-entropy-string
# bandit-high-entropy-stringA bandit plugin that looks for high entropy hardcoded strings (secrets).This plugin exposes four new tests:1. *high\_entropy\_assign*: Checks for secrets in assignment statements: `target = 'candidate'`2. *high\_entropy\_funcarg*: Checks for secrets in function arguments: `caller('candidate', target='candidate'):`3. *high\_entropy\_funcdef*: Checks for secrets in function definitions: `def caller('candidate', target='candidate'):`4. *high\_entropy\_iter*: Checks for secrets in iterables (lists, tuples, dicts): `['candidate','candidate'] or ('candidate', 'candidate') or {'target': 'candidate'}`## InstallationFirst you'll need to install bandit (note that in bandit-high-entropy-stringversion 2.0 and higher you'll need to run bandit version 1.0 or higher):```bashvirtualenv venvsource venv/bin/activatepip install bandit```Then you can install the plugin:```bashpip install bandit-high-entropy-string```## ConfigurationIn your bandit.yaml config file, add the tests for inclusion:```yaml# Backwards compatible configuration for using profiles (only needed if you# were previously using profiles and need to keep compatibility)profiles:Secrets:include:- high_entropy_assign- high_entropy_funcarg- high_entropy_funcdef- high_entropy_iter# Test inclusion for newer versions of bandittests:# high_entropy_funcdef- BHES100# high_entropy_funcarg- BHES101# high_entropy_iter- BHES102# high_entropy_assign- BHES103```You can also add extra configuration for each test (in the same config file):```# Configuration for each test (can be configured for each of the four tests)high_entropy_assign:# Regex patterns to completely ignore for this testpatterns_to_ignore:- 'public_key_.*'# Regex patterns to lower confidence forentropy_patterns_to_discount- 'maybe_public_key_.*'```## Running the testsTo run the tests, call bandit against your code base, specifying the profile:```$ bandit -r ./myapplication```## Contributing### Code of conductThis project is governed by [Lyft's code ofconduct](https://github.com/lyft/code-of-conduct).All contributors and participants agree to abide by its terms.### Sign the Contributor License Agreement (CLA)We require a CLA for code contributions, so before we can accept a pull requestwe need to have a signed CLA. Please [visit our CLAservice](https://oss.lyft.com/cla)follow the instructions to sign the CLA.### How it works and how to helpThe plugin captures portions of the AST, generates Candidate objects and sendsthem into the _report function. If a Candidate object's confidence is greaterthan 0, it's reported. We nudge the confidence and severity based on criterea:1. Flags (ENTROPY_PATTERNS_TO_FLAG). Any Candidate that matches any regex in thislist is automatically flagged as confidence/severity 3/3. If there's secretpatterns you know conclusively are secrets, add them here.2. Discounts (ENTROPY_PATTERNS_TO_DISCOUNT). Any Candidate that matches a regex inthis list is discounted. If the Candidate matches multiple regexes in thislist, it may be discounted further. This discount is used in the confidencecalculation.3. Secret hints (LOW_SECRET_HINTS, HIGH_SECRET_HINTS). If any target or callermatches a regex in these lists then it will be used as a hint that aCandidate is a secret. This hint is used in the confidence and severitycalculations. LOW_SECRET_HINTS leads to a lower confidence increase andHIGH_SECRET_HINTS leads to a higher confidence increase.4. Safe functions (SAFE_FUNCTION_HINTS). Any Candidate that has a caller thatmatches any string in this list will will be discounted. This is used in theconfidence calculation.5. Entropy. If a Candidate's confidence level can be more accurately gauged bya strings level of entropy, we calculate it and if the string has highentropy its confidence level is increased. This calculation is avoided ifpossible, as it's relatively expensive.The concept is to eliminate noise while more easily identifying Candidates thatmay be secrets. Some help we'd love to have:1. Help with the discount regex list. The regexes in the list often match toomuch and there aren't enough that match common python strings.2. Help with the safe functions list (and the way we match the safe functions).There's a lot of python functions that rarely include secrets but oftencontain high entropy strings. We currently don't identify these functioncalls very well, which leads to higher noise.3. Add and improve string captures. We're not currently capturing all available stringsin the AST and for some string captures we aren't capturing them asefficiently as we could. For instance with dicts, we capture info like:{'target': 'candidate'}, but don't capture: {'target': 'target': 'candidate'},which could lead to better categorization.Feel free to submit issues and pull requests for anything else you think would be usefulas well.