How to check the exclude path works in the .bandit file ?

[Pokerface9711]

My .bandit file looks like below.

[bandit]
exclude: \static,\templates
skips: B413,B601,B501,B602,B605

---

Command line output.

wus-macbook-pro:~ wuwei$ bandit -lll vmonic/git_repo/devops-online/ -r
[main]	INFO	Found project level .bandit file: vmonic/git_repo/devops-online/.bandit
[main]	INFO	Using ini file for excluded paths
[main]	INFO	Using ini file for skipped tests
[main]	INFO	Using command line arg for selected targets
[main]	INFO	profile include tests: None
[main]	INFO	profile exclude tests: None
[main]	INFO	cli include tests: None
[main]	INFO	cli exclude tests: B413,B601,B501,B602,B605
[main]	INFO	running on Python 2.7.13
66 [0.. 50.. ]
Run started:2018-10-08 09:06:15.117350

Test results:
.......

Code scanned:
	Total lines of code: 16347
	Total lines skipped (#nosec): 3

Run metrics:
	Total issues (by severity):
		Undefined: 0
		Low: 83
		Medium: 64
		High: 2
	Total issues (by confidence):
		Undefined: 0
		Low: 23
		Medium: 7
		High: 119
Files skipped (0):

---

My question is , the total code line scanned is the same as before and after I write the .bandit file and the command line output do not give me clearly information that my config to exclude /templates folder works or not.

[ehooo]

I think this is because the exclude has starts with \ have you try with / ?

[gothraven]

better use in your bandit config file

exclude_dirs:
  - path/to/file.py
  - path

[ericwb]

Looks like wrong path separator as mentioned.

[NLPDev]

I tried to exclude "tests" folder, but I can't.

[bandit]
exclude: /tests

How to fix this problem?

[wen96]

Hi, I have the same problem only in version 1.6.0.

Running:

bandit . -r -x tests

Ignores tests/ folder in version 1.5.1 but not in 1.6.0

[ehooo]

@wen96 the new issue is #488