nebius/SWE-rebench-V2-PRs huggingface dataset:
Repository: PyCQA/bandit
Pull request #359 (2018-08-07 08:01:57)

Add more_info URL to text output
Outputting bandit report as text does not put `more_info` URL while it
would if the output format is YAML or JSON. This patch set adds the
`more_info` URL to the text display.

Signed-off-by: Tin Lam <tin@irrational.io>


Patch:
diff --git a/bandit/formatters/text.py b/bandit/formatters/text.py
index bc4bd4c..bff914e 100644
--- a/bandit/formatters/text.py
+++ b/bandit/formatters/text.py
@@ -29,6 +29,7 @@ This formatter outputs the issues as plain text.
 
        Severity: Medium   Confidence: High
        Location: examples/yaml_load.py:5
+       More Info: https://bandit.readthedocs.io/en/latest/
     4       ystr = yaml.dump({'a' : 1, 'b' : 2, 'c' : 3})
     5       y = yaml.load(ystr)
     6       yaml.dump(y)
@@ -44,6 +45,7 @@ import logging
 import sys
 
 from bandit.core import constants
+from bandit.core import docs_utils
 from bandit.core import test_properties
 from bandit.formatters import utils
 
@@ -87,6 +89,9 @@ def _output_issue_str(issue, indent, show_lineno=True, show_code=True,
     bits.append("%s   Location: %s:%s" % (
         indent, issue.fname, issue.lineno if show_lineno else ""))
 
+    bits.append("%s   More Info: %s" % (
+        indent, docs_utils.get_url(issue.test_id)))
+
     if show_code:
         bits.extend([indent + l for l in
                      issue.get_code(lines, True).split('\n')])


Test patch:
diff --git a/tests/unit/formatters/test_text.py b/tests/unit/formatters/test_text.py
index b849be7..c8a1370 100644
--- a/tests/unit/formatters/test_text.py
+++ b/tests/unit/formatters/test_text.py
@@ -21,6 +21,7 @@ import testtools
 
 import bandit
 from bandit.core import config
+from bandit.core import docs_utils
 from bandit.core import issue
 from bandit.core import manager
 from bandit.formatters import text as b_text
@@ -45,7 +46,9 @@ class TextFormatterTests(testtools.TestCase):
                           format(_indent_val, _issue.severity.capitalize(),
                                  _issue.confidence.capitalize()),
                           "{}   Location: {}:{}".
-                          format(_indent_val, _issue.fname, _issue.lineno)]
+                          format(_indent_val, _issue.fname, _issue.lineno),
+                          "{}   More Info: {}".format(
+                              _indent_val, docs_utils.get_url(_issue.test_id))]
             if _code:
                 return_val.append("{}{}".format(_indent_val, _code))
             return '\n'.join(return_val)
Repository: PyCQA/bandit
Pull request #361 (2018-08-08 06:51:50)

Add more_info URL to csv formatter
Patch set adds more_info URL to the csv formatter.

Closes: #323

Signed-off-by: Tin Lam <tin@irrational.io>


Patch:
diff --git a/bandit/__main__.py b/bandit/__main__.py
new file mode 100644
index 0000000..8c36edf
--- /dev/null
+++ b/bandit/__main__.py
@@ -0,0 +1,3 @@
+#!/usr/bin/env python
+from bandit.cli import main
+main.main()
diff --git a/bandit/formatters/csv.py b/bandit/formatters/csv.py
index 1c867d7..11fd1cc 100644
--- a/bandit/formatters/csv.py
+++ b/bandit/formatters/csv.py
@@ -24,13 +24,16 @@ This formatter outputs the issues in a comma separated values format.
 .. code-block:: none
 
     filename,test_name,test_id,issue_severity,issue_confidence,issue_text,
-    line_number,line_range
+    line_number,line_range,more_info
     examples/yaml_load.py,blacklist_calls,B301,MEDIUM,HIGH,"Use of unsafe yaml
     load. Allows instantiation of arbitrary objects. Consider yaml.safe_load().
-    ",5,[5]
+    ",5,[5],https://bandit.readthedocs.io/en/latest/
 
 .. versionadded:: 0.11.0
 
+.. versionchanged:: 1.5.0
+    New field `more_info` added to output
+
 """
 # Necessary for this formatter to work when imported on Python 2. Importing
 # the standard library's csv module conflicts with the name of this module.
@@ -40,6 +43,8 @@ import csv
 import logging
 import sys
 
+from bandit.core import docs_utils
+
 LOG = logging.getLogger(__name__)
 
 
@@ -64,13 +69,16 @@ def report(manager, fileobj, sev_level, conf_level, lines=-1):
                       'issue_confidence',
                       'issue_text',
                       'line_number',
-                      'line_range']
+                      'line_range',
+                      'more_info']
 
         writer = csv.DictWriter(fileobj, fieldnames=fieldnames,
                                 extrasaction='ignore')
         writer.writeheader()
         for result in results:
-            writer.writerow(result.as_dict(with_code=False))
+            r = result.as_dict(with_code=False)
+            r['more_info'] = docs_utils.get_url(r['test_id'])
+            writer.writerow(r)
 
     if fileobj.name != sys.stdout.name:
         LOG.info("CSV output written to file: %s", fileobj.name)


Test patch:
diff --git a/tests/unit/formatters/test_csv.py b/tests/unit/formatters/test_csv.py
index 2926c33..fbb41f1 100644
--- a/tests/unit/formatters/test_csv.py
+++ b/tests/unit/formatters/test_csv.py
@@ -64,3 +64,4 @@ class CsvFormatterTests(testtools.TestCase):
             self.assertEqual(six.text_type(self.context['linerange']),
                              data['line_range'])
             self.assertEqual(self.check_name, data['test_name'])
+            self.assertIsNotNone(data['more_info'])
Repository: PyCQA/bandit
Pull request #683 (2020-12-25 22:48:20)

Include the line number when using HTML output format
This commit is to include the line number of a given occurrence when using HTML output format.

Resolves: #672



Patch:
diff --git a/bandit/formatters/html.py b/bandit/formatters/html.py
index 525706f..3c15aad 100644
--- a/bandit/formatters/html.py
+++ b/bandit/formatters/html.py
@@ -263,6 +263,7 @@ pre {
     <b>Severity: </b>{severity}<br>
     <b>Confidence: </b>{confidence}<br>
     <b>File: </b><a href="{path}" target="_blank">{path}</a> <br>
+    <b>Line number: </b>{line_number}<br>
     <b>More info: </b><a href="{url}" target="_blank">{url}</a><br>
 {code}
 {candidates}
@@ -358,7 +359,8 @@ pre {
                                           confidence=issue.confidence,
                                           path=issue.fname, code=code,
                                           candidates=candidates,
-                                          url=url)
+                                          url=url,
+                                          line_number=issue.lineno)
 
     # build the metrics string to insert in the report
     metrics_summary = metrics_block.format(


Test patch:
diff --git a/tests/unit/formatters/test_html.py b/tests/unit/formatters/test_html.py
index 30dd354..06edd76 100644
--- a/tests/unit/formatters/test_html.py
+++ b/tests/unit/formatters/test_html.py
@@ -120,6 +120,7 @@ class HtmlFormatterTests(testtools.TestCase):
             self.assertIn('BBBBBBB', issue1.text)
             self.assertIn('CCCCCCC', issue1.text)
             self.assertIn('abc.py', issue1.text)
+            self.assertIn('Line number: 1', issue1.text)
 
     @mock.patch('bandit.core.issue.Issue.get_code')
     @mock.patch('bandit.core.manager.BanditManager.get_issue_list')
Repository: PyCQA/bandit
Pull request #710 (2021-05-11 10:05:37)

Blacklist pandas read_pickle and add functional test for it
The pandas read pickle method uses pickle.load under the hood. When read_pickle is used, bandit will however not find this vulnerability during the scan. This PR solves this by adding the pandas read_pickle method to the blacklist.


Patch:
diff --git a/bandit/blacklists/calls.py b/bandit/blacklists/calls.py
index 079da90..977dbcd 100644
--- a/bandit/blacklists/calls.py
+++ b/bandit/blacklists/calls.py
@@ -35,6 +35,7 @@ deserialize untrusted data, possible security issue.
 |      |                     | - jsonpickle.decode                |           |
 |      |                     | - jsonpickle.unpickler.decode      |           |
 |      |                     | - jsonpickle.unpickler.Unpickler   |           |
+|      |                     | - pandas.read_pickle               |           |
 +------+---------------------+------------------------------------+-----------+
 
 B302: marshal
@@ -358,6 +359,7 @@ def gen_blacklist():
                 "jsonpickle.decode",
                 "jsonpickle.unpickler.decode",
                 "jsonpickle.unpickler.Unpickler",
+                "pandas.read_pickle",
             ],
             "Pickle and modules that wrap it can be unsafe when used to "
             "deserialize untrusted data, possible security issue.",
diff --git a/examples/pandas_read_pickle.py b/examples/pandas_read_pickle.py
new file mode 100644
index 0000000..61174f6
--- /dev/null
+++ b/examples/pandas_read_pickle.py
@@ -0,0 +1,12 @@
+import pickle
+import pandas as pd
+
+
+df = pd.DataFrame(
+    {
+        "col_A": [1, 2]
+    }
+)
+pick = pickle.dumps(df)
+
+print(pd.read_pickle(pick))


Test patch:
diff --git a/tests/functional/test_functional.py b/tests/functional/test_functional.py
index 2005d1e..1d1bd7e 100644
--- a/tests/functional/test_functional.py
+++ b/tests/functional/test_functional.py
@@ -377,6 +377,14 @@ class FunctionalTests(testtools.TestCase):
         }
         self.check_example("jsonpickle.py", expect)
 
+    def test_pandas_read_pickle(self):
+        """Test for the `pandas.read_pickle` module."""
+        expect = {
+            "SEVERITY": {"UNDEFINED": 0, "LOW": 1, "MEDIUM": 1, "HIGH": 0},
+            "CONFIDENCE": {"UNDEFINED": 0, "LOW": 0, "MEDIUM": 0, "HIGH": 2},
+        }
+        self.check_example("pandas_read_pickle.py", expect)
+
     def test_popen_wrappers(self):
         """Test the `popen2` and `commands` modules."""
         expect = {
Repository: PyCQA/bandit
Pull request #728 (2021-08-20 21:26:25)

document that random.choices() isn't secure either
Because [`random.choices()`](https://docs.python.org/3/library/random.html#random.choices) wasn't explicitly listed in the "don't use this" list, I initially thought it was safer version of `random.choice()`.

I realized my mistake and used `secret.choice()` eventually, but this PR is to add `random.choices()` to the unsafe list.

sigmavirus24: I believe this also needs to be added to a test/example file to ensure no regression
taybin: @sigmavirus24 Something like this?

Patch:
diff --git a/bandit/blacklists/calls.py b/bandit/blacklists/calls.py
index 3097942..ee8df20 100644
--- a/bandit/blacklists/calls.py
+++ b/bandit/blacklists/calls.py
@@ -191,6 +191,7 @@ purposes.
 |      |                     | - random.randrange                 |           |
 |      |                     | - random.randint                   |           |
 |      |                     | - random.choice                    |           |
+|      |                     | - random.choices                   |           |
 |      |                     | - random.uniform                   |           |
 |      |                     | - random.triangular                |           |
 +------+---------------------+------------------------------------+-----------+
@@ -447,6 +448,7 @@ def gen_blacklist():
          'random.randrange',
          'random.randint',
          'random.choice',
+         'random.choices',
          'random.uniform',
          'random.triangular'],
         'Standard pseudo-random generators are not suitable for '
diff --git a/examples/random_module.py b/examples/random_module.py
index ffdbb5b..9191bda 100644
--- a/examples/random_module.py
+++ b/examples/random_module.py
@@ -6,6 +6,7 @@ bad = random.random()
 bad = random.randrange()
 bad = random.randint()
 bad = random.choice()
+bad = random.choices()
 bad = random.uniform()
 bad = random.triangular()
 


Test patch:
diff --git a/tests/functional/test_functional.py b/tests/functional/test_functional.py
index df6e219..173d4d6 100644
--- a/tests/functional/test_functional.py
+++ b/tests/functional/test_functional.py
@@ -355,8 +355,8 @@ class FunctionalTests(testtools.TestCase):
     def test_random_module(self):
         '''Test for the `random` module.'''
         expect = {
-            'SEVERITY': {'UNDEFINED': 0, 'LOW': 6, 'MEDIUM': 0, 'HIGH': 0},
-            'CONFIDENCE': {'UNDEFINED': 0, 'LOW': 0, 'MEDIUM': 0, 'HIGH': 6}
+            'SEVERITY': {'UNDEFINED': 0, 'LOW': 7, 'MEDIUM': 0, 'HIGH': 0},
+            'CONFIDENCE': {'UNDEFINED': 0, 'LOW': 0, 'MEDIUM': 0, 'HIGH': 7}
         }
         self.check_example('random_module.py', expect)