#NEWLINE# def main( ) : #NEWLINE# #INDENT# debug = ( ( '-d' in sys . argv ) or ( '--debug' in sys . argv ) ) #NEWLINE# _init_logger ( debug ) #NEWLINE# extension_mgr = _init_extensions ( ) #NEWLINE# baseline_formatters = [ f . name for f in filter ( ( lambda x : hasattr ( x . plugin , '_accepts_baseline' ) ) , extension_mgr . formatters ) ] #NEWLINE# parser = argparse . ArgumentParser ( description = 'Bandit - a Python source code security analyzer' , formatter_class = argparse . RawDescriptionHelpFormatter ) #NEWLINE# parser . add_argument ( 'targets' , metavar = 'targets' , type = str , nargs = '+' , help = 'source file(s) or directory(s) to be tested' ) #NEWLINE# parser . add_argument ( '-r' , '--recursive' , dest = 'recursive' , action = 'store_true' , help = 'find and process files in subdirectories' ) #NEWLINE# parser . add_argument ( '-a' , '--aggregate' , dest = 'agg_type' , action = 'store' , default = 'file' , type = str , choices = [ 'file' , 'vuln' ] , help = 'aggregate output by vulnerability (default) or by filename' ) #NEWLINE# parser . add_argument ( '-n' , '--number' , dest = 'context_lines' , action = 'store' , default = 3 , type = int , help = 'maximum number of code lines to output for each issue' ) #NEWLINE# parser . add_argument ( '-c' , '--configfile' , dest = 'config_file' , action = 'store' , default = None , type = str , help = 'optional config file to use for selecting plugins and overriding defaults' ) #NEWLINE# parser . add_argument ( '-p' , '--profile' , dest = 'profile' , action = 'store' , default = None , type = str , help = 'profile to use (defaults to executing all tests)' ) #NEWLINE# parser . add_argument ( '-t' , '--tests' , dest = 'tests' , action = 'store' , default = None , type = str , help = 'comma-separated list of test IDs to run' ) #NEWLINE# parser . add_argument ( '-s' , '--skip' , dest = 'skips' , action = 'store' , default = None , type = str , help = 'comma-separated list of test IDs to skip' ) #NEWLINE# parser . add_argument ( '-l' , '--level' , dest = 'severity' , action = 'count' , default = 1 , help = 'report only issues of a given severity level or higher (-l for LOW, -ll for MEDIUM, -lll for HIGH)' ) #NEWLINE# parser . add_argument ( '-i' , '--confidence' , dest = 'confidence' , action = 'count' , default = 1 , help = 'report only issues of a given confidence level or higher (-i for LOW, -ii for MEDIUM, -iii for HIGH)' ) #NEWLINE# output_format = ( 'screen' if sys . stdout . isatty ( ) else 'txt' ) #NEWLINE# parser . add_argument ( '-f' , '--format' , dest = 'output_format' , action = 'store' , default = output_format , help = 'specify output format' , choices = sorted ( extension_mgr . formatter_names ) ) #NEWLINE# parser . add_argument ( '-o' , '--output' , dest = 'output_file' , action = 'store' , default = None , help = 'write report to filename' ) #NEWLINE# parser . add_argument ( '-v' , '--verbose' , dest = 'verbose' , action = 'store_true' , help = 'output extra information like excluded and included files' ) #NEWLINE# parser . add_argument ( '-d' , '--debug' , dest = 'debug' , action = 'store_true' , help = 'turn on debug mode' ) #NEWLINE# parser . add_argument ( '--ignore-nosec' , dest = 'ignore_nosec' , action = 'store_true' , help = 'do not skip lines with # nosec comments' ) #NEWLINE# parser . add_argument ( '-x' , '--exclude' , dest = 'excluded_paths' , action = 'store' , default = '' , help = 'comma-separated list of paths to exclude from scan (note that these are in addition to the excluded paths provided in the config file)' ) #NEWLINE# parser . add_argument ( '-b' , '--baseline' , dest = 'baseline' , action = 'store' , default = None , help = 'path of a baseline report to compare against (only JSON-formatted files are accepted)' ) #NEWLINE# parser . add_argument ( '--ini' , dest = 'ini_path' , action = 'store' , default = None , help = 'path to a .bandit file that supplies command line arguments' ) #NEWLINE# parser . add_argument ( '--version' , action = 'version' , version = '%(prog)s {version}' . format ( version = bandit . __version__ ) ) #NEWLINE# parser . set_defaults ( debug = False ) #NEWLINE# parser . set_defaults ( verbose = False ) #NEWLINE# parser . set_defaults ( ignore_nosec = False ) #NEWLINE# plugin_info = [ ( '%s\t%s' % ( a [ 0 ] , a [ 1 ] . name ) ) for a in six . iteritems ( extension_mgr . plugins_by_id ) ] #NEWLINE# blacklist_info = [ ] #NEWLINE# for a in six . iteritems ( extension_mgr . blacklist ) : #NEWLINE# #INDENT# for b in a [ 1 ] : #NEWLINE# #INDENT# blacklist_info . append ( ( '%s\t%s' % ( b [ 'id' ] , b [ 'name' ] ) ) ) #NEWLINE# #UNINDENT# #UNINDENT# plugin_list = '\n\t' . join ( sorted ( set ( ( plugin_info + blacklist_info ) ) ) ) #NEWLINE# parser . epilog = 'The following tests were discovered and loaded:\n\t{0}\n' . format ( plugin_list ) #NEWLINE# args = parser . parse_args ( ) #NEWLINE# try : #NEWLINE# #INDENT# b_conf = b_config . BanditConfig ( config_file = args . config_file ) #NEWLINE# #UNINDENT# except utils . ConfigError as e : #NEWLINE# #INDENT# logger . error ( e ) #NEWLINE# sys . exit ( 2 ) #NEWLINE# #UNINDENT# ini_options = _get_options_from_ini ( args . ini_path , args . targets ) #NEWLINE# if ini_options : #NEWLINE# #INDENT# args . excluded_paths = _log_option_source ( args . excluded_paths , ini_options . get ( 'exclude' ) , 'excluded paths' ) #NEWLINE# args . skips = _log_option_source ( args . skips , ini_options . get ( 'skips' ) , 'skipped tests' ) #NEWLINE# args . tests = _log_option_source ( args . tests , ini_options . get ( 'tests' ) , 'selected tests' ) #NEWLINE# #UNINDENT# if b_conf . get_option ( 'log_format' ) : #NEWLINE# #INDENT# log_format = b_conf . get_option ( 'log_format' ) #NEWLINE# _init_logger ( debug , log_format = log_format ) #NEWLINE# #UNINDENT# try : #NEWLINE# #INDENT# profile = _get_profile ( b_conf , args . profile , args . config_file ) #NEWLINE# _log_info ( args , profile ) #NEWLINE# profile [ 'include' ] . update ( ( args . tests . split ( ',' ) if args . tests else [ ] ) ) #NEWLINE# profile [ 'exclude' ] . update ( ( args . skips . split ( ',' ) if args . skips else [ ] ) ) #NEWLINE# extension_mgr . validate_profile ( profile ) #NEWLINE# #UNINDENT# except ( utils . ProfileNotFound , ValueError ) as e : #NEWLINE# #INDENT# logger . error ( e ) #NEWLINE# sys . exit ( 2 ) #NEWLINE# #UNINDENT# b_mgr = b_manager . BanditManager ( b_conf , args . agg_type , args . debug , profile = profile , verbose = args . verbose , ignore_nosec = args . ignore_nosec ) #NEWLINE# if ( args . baseline is not None ) : #NEWLINE# #INDENT# try : #NEWLINE# #INDENT# with open ( args . baseline ) as bl : #NEWLINE# #INDENT# data = bl . read ( ) #NEWLINE# b_mgr . populate_baseline ( data ) #NEWLINE# #UNINDENT# #UNINDENT# except IOError : #NEWLINE# #INDENT# logger . warning ( 'Could not open baseline report: %s' , args . baseline ) #NEWLINE# sys . exit ( 2 ) #NEWLINE# #UNINDENT# if ( args . output_format not in baseline_formatters ) : #NEWLINE# #INDENT# logger . warning ( ( 'Baseline must be used with one of the following formats: ' + str ( baseline_formatters ) ) ) #NEWLINE# sys . exit ( 2 ) #NEWLINE# #UNINDENT# #UNINDENT# if ( sev_level . output_format != 'json' ) : #NEWLINE# #INDENT# if args . config_file : #NEWLINE# #INDENT# logger . info ( 'using config: %s' , args . config_file ) #NEWLINE# #UNINDENT# logger . info ( 'running on Python %d.%d.%d' , sys . version_info . major , sys . version_info . minor , sys . version_info . micro ) #NEWLINE# #UNINDENT# b_mgr . discover_files ( args . targets , args . recursive , args . excluded_paths ) #NEWLINE# if ( not b_mgr . b_ts . tests ) : #NEWLINE# #INDENT# logger . error ( 'No tests would be run, please check the profile.' ) #NEWLINE# sys . exit ( 2 ) #NEWLINE# #UNINDENT# b_mgr . run_tests ( ) #NEWLINE# logger . debug ( b_mgr . b_ma ) #NEWLINE# logger . debug ( b_mgr . metrics ) #NEWLINE# sev_level = constants . RANKING [ ( args . severity - 1 ) ] #NEWLINE# conf_level = constants . RANKING [ ( args . confidence - 1 ) ] #NEWLINE# b_mgr . output_results ( args . context_lines , sev_level , conf_level , args . output_file , args . output_format ) #NEWLINE# if ( b_mgr . results_count ( sev_filter = sev_level , conf_filter = conf_level ) > 0 ) : #NEWLINE# #INDENT# sys . exit ( 1 ) #NEWLINE# #UNINDENT# else : #NEWLINE# #INDENT# sys . exit ( 0 )