Package: bento-cli
Find Python web-app bugs delightfully fast, without changing your workflowInstallation·Motivations·Code Checks·UsageWorkflows·Integrations·Help & CommunityInspired by tools like the ESLint plugin for React, Bento was created for Flask and Django. With Bento you’ll:Find bugs that matter.Checks find security and reliability bugs in your code. They’re vetted across thousands of open source projects and never nit your style.Upgrade your tooling.You don’t have to fix existing bugs to adopt Bento. It’s diff-centric, finding new bugs introduced by your changes. And there’s zero config.Go delightfully fast.Run Bento automatically locally or in CI. Either way, it runs offline and never sends your code anywhere.InstallationBento is free and requiresPython 3.6+andDocker 19.03+. It runs on macOS and Linux.In a Git project directory:$pip3installbento-cli&&bentoinitGo forth and write great code!MotivationsSee ourBento introductory blog postto learn the full story.Bento is part of a quest to make world-class security and bugfinding available to all developers, for free. We’ve learned that most developers have never heard of—let alone tried—tools that find deep flaws in code: like Codenomicon, which foundHeartbleed, or Zoncolan at Facebook, which finds moretop-severity security issuesthan any human effort. These tools find severe issues and also save tons of time, identifyinghundreds of thousands of issuesbefore humans can. Bento is a step towards universal access to tools like these.We’re also big proponents of opinionated tools likeBlackandPrettier. This has two implications: Bento ignores style-related issues and the bikeshedding that comes with them, and it ships with a curated set of checks that we believe are high signal and bug-worthy. SeeThree things your linter shouldn’t tell youfor more about our decision making process.Code ChecksBento’s check focus on security and reliability bugs in Flask and Django projects.FlaskJinjaDjangomissing JWT tokenhref template variablecoming soonsecure set cookiemissing noopenersend file openmissing noreferrerDockerunescaped file extensionmissing csrf protectionHadolintuse blueprint for modularitymissing doctypeuse jsonifymeta charsetShellavoid hardcoded configmeta content-typeShellCheckunquoted attribute template variableRequestsno auth over httpSQLAlchemyuse schemecoming soonuse timeoutSee the full list ofBento’s specialty checks.UsageOut-of-the-box, Bento is configured for your personal use. SeeTeam Useto setup Bento for all contributors.Upgrading$pip3install--upgradebento-cliCommand Line Options$ bento --help
Usage: bento [OPTIONS] COMMAND [ARGS]...

Options:
  -h, --help    Show this message and exit.
  --version     Show the version and exit.
  --agree       Automatically agree to terms of service.
  --email TEXT  Email address to use while running this command without global
                configs e.g. in CI

Commands:
  archive  Suppress current findings.
  check    Checks for new findings.
  disable  Turn OFF a Bento feature for this project.
  enable   Turn ON a Bento feature for this project.
  init     Autodetects and installs tools.

  To get help for a specific command, run `bento COMMAND --help`Exit Codesbento checkmay exit with the following exit codes:0: Bento ran successfully and found no errors2: Bento ran successfully and found issues in your code3: Bento or one of its underlying tools failed to runWorkflowsIndividual UseBento understands the importance of getting out of the way so you can write your code. It runs at commit-time on your diffs and only affects you; it won’t change anything for other project contributors or modify Git state.Initialization enablesautorunbehind the scenes. By defaultautorunblocks the commit if Bento returns findings. To make it non-blocking:$bentoenableautorun--no-blockYou can always manually run Bento on staged files or directories via:$bentocheck[PATHS]This will show only new findings introduced by these files AND that are not in the archive (.bento/archive.json). Use--allto check all Git tracked files, not just those that are staged:$bentocheck--all[PATHS]This feature makes use of Git hooks. If the Bento hook incorrectly blocks your commit, you can skip it by passing the--no-verifyflag to Git at commit-time (please use this sparingly since all hooks will be skipped):$gitcommit--no-verifyTeam UseRunning LocallyTo setup Bento for all project contributors, add Bento’s configuration to Git (it’s ignored by default):$cd<PROJECTDIRECTORY># Add Bento's cache to the project's .gitignore$echo".bento/cache">>.gitignore# Commit Bento's config to your project$gitadd--force.bento.bentoignoreContributors can run Bento for themselves using the project’s configuration via:$bentoinitRunning in CI/CDBento has first-class support for checking pull requests with GitHub Actions.
Such checks will report only on the bugs introduced by the changes in the pull request.To get started, just runbento enable ciin your project directory.
This will add a CI configuration file to your repository.Advanced CI/CD configurationYou can also configure Bento in CI to analyze your entire project,
instead of only the changes from a pull request.
So that you don’t have to fix all existing issues before making Bento blocking,
itsarchivefeature allows historical issues to be tracked and ignored during CI.To use thearchivefeature so Bento returns a non-zero exit code only for new issues, rather than all existing issues, first create the archive:$cd<PROJECTDIRECTORY>
$bentoarchive.Commit Bento’s configuration to the project:# Add Bento's cache to the project's .gitignore$echo".bento/cache">>.gitignore# Commit Bento's config to your project$gitadd--force.bento.bentoignoreYou can then add Bento to your CI scripts:$pip3installbento-cli&&bento--version
$bento--agree--email=<YOUR_EMAIL>check--all2>&1|catWe pipe throughcatto disable Bento's interactive tty features (e.g. progress bars, using a pager for many findings).If you use CircleCI, the above commands become:version:2.1jobs:bentoCheck:executor:circleci/python:3.7.4-stretch-nodesteps:-checkout-run:name:"InstallBento"command:pip3 install bento-cli && bento --version-run:name:"RunBentocheck"command:bento --agree --email=<YOUR_EMAIL> check --all 2>&1 | catbento checkwill exit with a non-zero exit code if it finds issues in your code (seeExit Codes).If you need help setting up Bento with another CI provider pleaseopen an issue. Documentation PRs welcome if you set up Bento with a CI provider that isn’t documented here!Help and CommunityNeed help or want to share feedback? We’d love to hear from you!Email us atsupport@r2c.devJoin #bento in ourcommunity SlackFile an issueorsubmit a feature requestdirectly on GitHub — we welcome them all!We’re constantly shipping new features and improvements.Sign up for the Bento newsletter— we promise not to spam and you can unsubscribe at any timeSee past announcements, releases, and issueshereWe’re fortunate to benefit from the contributions of the open source community and great projects such asBandit,ESLint,Flake8, and their plugins. 🙏License and LegalPlease refer to theterms and privacy document.Copyright (c)r2c.