or run

npx @tessl/cli init
Log in

Version

Tile

Overview

Evals

Files

docs

command-line-tools.mdcontext-analysis.mdcore-management.mdindex.mdissue-reporting.mdoutput-formatters.mdplugin-development.md
tile.json

tessl/pypi-bandit

Security oriented static analyser for python code.

Workspace
tessl
Visibility
Public
Created
Last updated
Describes
pypipkg:pypi/bandit@1.8.x

To install, run

npx @tessl/cli install tessl/pypi-bandit@1.8.0

index.mddocs/

Bandit

A security-oriented static analysis tool designed to find common security issues in Python code. Bandit processes AST representations of Python source code and runs security-focused plugins against AST nodes to identify potential vulnerabilities including hardcoded passwords, SQL injection, shell injection, and weak cryptographic implementations.

Package Information

  • Package Name: bandit
  • Language: Python
  • Installation: pip install bandit
  • Extra dependencies: pip install bandit[yaml,toml,baseline,sarif] for additional features

Core Imports

import bandit
from bandit.core import manager, config, context, issue

For CLI usage:

from bandit.cli import main

For programmatic usage:

from bandit.core.manager import BanditManager
from bandit.core.config import BanditConfig

Basic Usage

Command Line Interface

# Scan a single file
bandit example.py

# Scan a directory recursively
bandit -r /path/to/project

# Generate JSON report
bandit -r /path/to/project -f json -o report.json

# Exclude specific tests
bandit -r /path/to/project --skip B101,B601

# Use baseline to ignore existing issues
bandit-baseline -r /path/to/project -o baseline.json
bandit -r /path/to/project -b baseline.json

Programmatic Usage

from bandit.core import manager, config

# Create configuration
conf = config.BanditConfig()

# Create manager
b_mgr = manager.BanditManager(conf, 'file')

# Discover and scan files
b_mgr.discover_files(['/path/to/code'])
b_mgr.run_tests()

# Get filtered results
issues = b_mgr.get_issue_list(sev_level='MEDIUM', conf_level='HIGH')

# Print results
for issue in issues:
    print(f"{issue.fname}:{issue.lineno} - {issue.text}")

Architecture

Bandit's plugin-based architecture enables extensible security analysis:

  • Core Manager: Central orchestrator (BanditManager) that coordinates scanning workflow
  • Configuration System: YAML-based configuration with profile support (BanditConfig)
  • Context Analysis: AST node analysis providing call context and import tracking (Context)
  • Plugin System: 60+ built-in security tests with decorator-based registration system
  • Issue Management: Structured vulnerability reporting with CWE mapping (Issue, Cwe)
  • Multiple Output Formats: JSON, XML, HTML, SARIF, CSV, YAML formatters for CI/CD integration

Capabilities

Core Management

Central scanning orchestration and configuration management. The BanditManager coordinates file discovery, test execution, and result filtering, while BanditConfig handles YAML configuration files and scanning profiles.

class BanditManager:
    def __init__(self, config, agg_type, debug=False, verbose=False, quiet=False, profile=None, ignore_nosec=False): ...
    def discover_files(self, targets, recursive=False): ...
    def run_tests(self): ...
    def get_issue_list(self, sev_level='LOW', conf_level='LOW'): ...

class BanditConfig:
    def __init__(self, config_file=None): ...
    def get_option(self, option_string): ...
    def get_setting(self, setting_name): ...

Core Management

Issue Reporting

Comprehensive security issue representation with Common Weakness Enumeration (CWE) support. Issues include severity levels, confidence ratings, source code context, and structured metadata for integration with security tools.

class Issue:
    def __init__(self, severity, cwe=0, confidence='UNDEFINED', text="", ident=None, lineno=None, test_id="", col_offset=-1, end_col_offset=0): ...
    def filter(self, severity, confidence): ...
    def get_code(self, max_lines=3, tabbed=False): ...
    def as_dict(self, with_code=True, max_lines=3): ...

class Cwe:
    def __init__(self, id=999): ...
    def link(self): ...
    def as_dict(self): ...

Issue Reporting

Context Analysis

AST node analysis and import tracking during security test execution. Context provides access to function call information, string literals, and module import patterns essential for accurate vulnerability detection.

class Context:
    def __init__(self, context_object=None): ...
    @property
    def call_function_name(self): ...
    @property
    def call_function_name_qual(self): ...
    @property
    def call_args(self): ...
    @property
    def call_keywords(self): ...
    def is_module_being_imported(self, module): ...

Context Analysis

Plugin Development

Framework for creating custom security tests using decorators and the plugin registration system. Supports AST node type filtering, configuration integration, and test identification.

def checks(*args): ...
def test_id(id_val): ...
def takes_config(name=None): ...
def accepts_baseline(*args): ...

Plugin Development

Output Formatters

Multiple report formats for different use cases and CI/CD integration. Formatters support severity filtering, confidence thresholds, and baseline comparison for security reporting workflows.

def report(manager, fileobj, sev_level, conf_level, lines): ...

Available formatters: JSON, XML, HTML, SARIF, CSV, YAML, screen, custom template-based

Output Formatters

Command Line Tools

Three CLI utilities for security scanning, configuration management, and baseline handling in development and CI/CD environments.

bandit [options] targets...
bandit-config-generator [options]
bandit-baseline [options] targets...

Command Line Tools

Extension Management

Plugin system management for loading and validating security tests, formatters, and blacklist handlers. Provides centralized plugin registry and validation.

class Manager:
    def __init__(self, formatters_namespace="bandit.formatters", plugins_namespace="bandit.plugins", blacklists_namespace="bandit.blacklists"): ...
    def load_formatters(self, formatters_namespace): ...
    def load_plugins(self, plugins_namespace): ...
    def validate_profile(self, profile): ...
    def get_plugin_by_id(self, plugin_id): ...

# Global plugin manager instance
MANAGER = ...  # Available from bandit.core.extension_loader

Utility Functions

AST analysis and code inspection utilities for security test development and advanced usage.

def get_call_name(node, aliases): ...  # Extract function call name with alias resolution
def get_func_name(node): ...           # Get function name from AST node  
def get_qual_attr(node, aliases): ...  # Get qualified attribute with aliases
def deepgetattr(obj, attr): ...        # Deep attribute access with dot notation
def check_ast_node(node_type): ...     # Validate AST node type

Constants

# Severity and confidence levels
HIGH = "HIGH"
MEDIUM = "MEDIUM" 
LOW = "LOW"
UNDEFINED = "UNDEFINED"

# Ranking values for filtering
RANKING_VALUES = {
    "UNDEFINED": 1,
    "LOW": 3, 
    "MEDIUM": 5,
    "HIGH": 10
}

# File exclusion patterns
EXCLUDE = (".svn", "CVS", ".bzr", ".hg", ".git", "__pycache__", ".tox", ".eggs", "*.egg")

# Values considered false in static analysis
FALSE_VALUES = [None, False, "False", 0, 0.0, 0j, "", (), [], {}]

# Default confidence level
CONFIDENCE_DEFAULT = "UNDEFINED"