More specific nosec options

[tobywf]

Is your feature request related to a problem? Please describe.

I couldn't find any way to specify # nosec for a particular bandit issue, which means # nosec could accidentally mask multiple issues. I have a contrived example:

import yaml
assert yaml.load("{}") == []  # nosec

This results in B101:assert_used and B506:yaml_load. Obviously, it could trivially be split up over several lines, but illustrates the issue how # nosec can mask more than one issue. This may have happened over time, for example the assert may have been assert foo = [] previously, and the load vulnerability was introduced later.

TL;DR: I'd like to be able to suppress just one issue.

Additionally, it would be nice to be able to suppress some issues on a per file/module basis. For most use-cases, exclude probably works fine, but again it's either all or nothing. Happy to submit a different feature request for this.

Describe the solution you'd like

I think pylint does this well. As stated in their FAQ:

4.1 Is it possible to locally disable a particular message?
[...] by adding "#pylint: disable=some-message,another-one" at the desired block level or at the end of the desired line of code
4.2 Is there a way to disable a message for a particular module only?
Yes [...] at the module level by adding the corresponding option in a comment at the top of the file

flake8 also offers fine-grained ignores via e.g. # noqa: E731.

For bandit then, it could be something like:

assert yaml.load("{}") == []  # nosec: disable=B101
assert yaml.load("{}") == []  # nosec: disable=assert_used

or

assert yaml.load("{}") == []  # nosec: B101

Describe alternatives you've considered

• Use nosec and hope it doesn't mask any issues down the line
• Disable a certain issue globally and hope it doesn't occur anywhere in the codebase

Additional context

[riconnon]

Would love to see this. Similar to how flake8 handles # noqa

[thanatos]

And please use the english identifiers, e.g., assert_used; forcing someone to guess what B101 means / forcing me to look it up is just annoying.

[spaceone]

I would like to see it as well, but I prefer the short-cuts e.g.: # nosec: B101,B102

[stephen-dexda]

Duplicate of #211.

[ericwb]

Thanks @stephen-dexda . Closing as Duplicate of #211