Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

[CI] Add pre-commit hook bandit to find Python security issues #1634

Merged
merged 1 commit into from
Oct 14, 2024

Conversation

jbampton
Copy link
Member

https://github.com/PyCQA/bandit

https://bandit.readthedocs.io/en/latest/start.html#version-control-integration

https://bandit.readthedocs.io/en/latest/config.html

This PR is skipping four bandit tests.

https://bandit.readthedocs.io/en/latest/plugins/index.html#complete-test-plugin-listing

Did you read the Contributor Guide?

Is this PR related to a JIRA ticket?

  • No.

What changes were proposed in this PR?

Added another check/test to our pre-commit framework.

Currently skipping 4 bandit checks and we can address these issues if needed in follow up PRs.

None of the 4 skipped checks were reported as high security.

B608 has been skipped it was reported as a possible medium

https://bandit.readthedocs.io/en/latest/plugins/b608_hardcoded_sql_expressions.html

Automated tools can produce false positives so we need to check each issue manually

How was this patch tested?

Ran locally: pre-commit run --all-files

Did this PR include necessary documentation updates?

  • No, this PR does not affect any public API so no need to change the documentation.

@jbampton jbampton requested a review from jiayuasu as a code owner October 13, 2024 10:11
@github-actions github-actions bot added the root label Oct 13, 2024
@jiayuasu jiayuasu merged commit 0646cef into apache:master Oct 14, 2024
4 checks passed
@jbampton jbampton deleted the add-pre-commit-hook-bandit branch October 14, 2024 16:22
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
Projects
None yet
Development

Successfully merging this pull request may close these issues.

2 participants