Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

Ignore virtualenv and __pycache__ directories #543

Closed
ericwb opened this issue Oct 7, 2019 · 0 comments · Fixed by #544
Closed

Ignore virtualenv and __pycache__ directories #543

ericwb opened this issue Oct 7, 2019 · 0 comments · Fixed by #544
Assignees
@ericwb
Labels
enhancement New feature or request
Milestone
Release 1.6.3

Comments

@ericwb
Copy link
Member

ericwb commented Oct 7, 2019

Is your feature request related to a problem? Please describe.
N/A

Describe the solution you'd like
When a project that has made use of virtualenv or tox, there is usually a directory named .venv, .tox or the like. As a result when bandit scans this project, it automatically scans all of the virtualenv site-packages. This can be many many python files that don't need to be scanned.

Similarly, __pycache__ directories are created by the compiler. Bandit can also safely ignore those.

Bandit should really attempt to ignore all hidden directories by default. I suggest a config option of include_hidden that defaults to False.

Describe alternatives you've considered
The alternative is to default this new config setting to True.

Another alternative is to provide the option in the command line if useful. How often do people desire to scan the dependencies of a project in the virtualenv directory?

Additional context
N/A
@ericwb ericwb added the enhancement New feature or request label Oct 7, 2019
@ericwb ericwb mentioned this issue Oct 7, 2019
Merged
@ericwb ericwb self-assigned this Oct 7, 2019
@ericwb ericwb added this to the Release 1.6.3 milestone Jan 20, 2020
Glyphack pushed a commit to Glyphack/bandit that referenced this issue Feb 27, 2020
Add contributing.md file.
be35261 
Resolves PyCQA#548

Add code of conduct.

Add links to contributing.md file.

Fix typo.

Fix docs for B610,B611,B703 (PyCQA#555)

* Fix docs for B610,B611,B703

* Address flake8 notice by adding blank line

* Fix long lines

Use SPDX license identifier instead of bulky headers (PyCQA#530)

* Use SPDX license identifier instead of bulky headers

There exists a nice, consistent way to denote licenses in source
files. It's called SPDX and further information is here [1].

This commit migrates the bulky apache-2 license headers with the
SPDX short identifier equivalent.

[1] https://spdx.org/ids-how

Signed-off-by: Eric Brown <browne@vmware.com>

* Update test-requirements.txt

Add a section explaining "nosec" (PyCQA#554)

* Add a section explaining "nosec"

References PyCQA#553

* Remove duplicated "in your code"

replace 'then' with 'than'

Signed-off-by: Pablo Woolvett <pablo.wooveltt@iconstruye.onmicrosoft.com>

Add sha1 to the list of insecure hashes

The hashlib.new test plugin was only checking for MD4 and MD5.
This patch extends the list of insecure hashes to include SHA1,
which has known exploits.

Fixes PyCQA#560

Signed-off-by: Eric Brown <browne@vmware.com>

Use GitHub Actions to run CI (PyCQA#565)

* Use GitHub Actions to run CI

This change utilizes GitHub Actions to run the CI for our unit tests instead of the current Travis-CI.

* Delete .travis.yml

Ignore common directories by default

This fix follows the example of flake8 in that it sets a default
list of common directories and filename patterns to exclude.

Fixes PyCQA#543

Signed-off-by: Eric Brown <browne@vmware.com>

Add push and pull request to GH Action trigger

It appears that Actions are not triggered for all pull requests.
I suspect the Actions need to register for event push and pull_request
in order to run CI on commits.

Signed-off-by: Eric Brown <browne@vmware.com>

Fix grammar issues and typos.

Fix more grammar issues

Added @lukehinds text

about commit messages and squash commits
from https://gist.githubusercontent.com/lukehinds/3337941149fc25ed91567037a0ebf026/raw/c1db6186c7e14ff316db2fe61fa046ab07251275/gistfile1.txt

Remove extra parentheses
Glyphack pushed a commit to Glyphack/bandit that referenced this issue Feb 27, 2020
Add contributing.md file
fa5981e 
Resolves PyCQA#548

Add code of conduct.

Add links to contributing.md file.

Fix typo.

Fix docs for B610,B611,B703 (PyCQA#555)

* Fix docs for B610,B611,B703

* Address flake8 notice by adding blank line

* Fix long lines

Use SPDX license identifier instead of bulky headers (PyCQA#530)

* Use SPDX license identifier instead of bulky headers

There exists a nice, consistent way to denote licenses in source
files. It's called SPDX and further information is here [1].

This commit migrates the bulky apache-2 license headers with the
SPDX short identifier equivalent.

[1] https://spdx.org/ids-how

Signed-off-by: Eric Brown <browne@vmware.com>

* Update test-requirements.txt

Add a section explaining "nosec" (PyCQA#554)

* Add a section explaining "nosec"

References PyCQA#553

* Remove duplicated "in your code"

replace 'then' with 'than'

Signed-off-by: Pablo Woolvett <pablo.wooveltt@iconstruye.onmicrosoft.com>

Add sha1 to the list of insecure hashes

The hashlib.new test plugin was only checking for MD4 and MD5.
This patch extends the list of insecure hashes to include SHA1,
which has known exploits.

Fixes PyCQA#560

Signed-off-by: Eric Brown <browne@vmware.com>

Use GitHub Actions to run CI (PyCQA#565)

* Use GitHub Actions to run CI

This change utilizes GitHub Actions to run the CI for our unit tests instead of the current Travis-CI.

* Delete .travis.yml

Ignore common directories by default

This fix follows the example of flake8 in that it sets a default
list of common directories and filename patterns to exclude.

Fixes PyCQA#543

Signed-off-by: Eric Brown <browne@vmware.com>

Add push and pull request to GH Action trigger

It appears that Actions are not triggered for all pull requests.
I suspect the Actions need to register for event push and pull_request
in order to run CI on commits.

Signed-off-by: Eric Brown <browne@vmware.com>

Fix grammar issues and typos.

Fix more grammar issues

Added @lukehinds text

about commit messages and squash commits
from https://gist.githubusercontent.com/lukehinds/3337941149fc25ed91567037a0ebf026/raw/c1db6186c7e14ff316db2fe61fa046ab07251275/gistfile1.txt

Remove extra parentheses
mikespallino pushed a commit to mikespallino/bandit that referenced this issue Aug 25, 2021
@ericwb @mikespallino
Ignore common directories by default
06d0c59 
This fix follows the example of flake8 in that it sets a default
list of common directories and filename patterns to exclude.

Fixes PyCQA#543

Signed-off-by: Eric Brown <browne@vmware.com>
mikespallino pushed a commit to mikespallino/bandit that referenced this issue Aug 25, 2021
@mikespallino
Add contributing.md file
7e7e1d6 
Resolves PyCQA#548

Add code of conduct.

Add links to contributing.md file.

Fix typo.

Fix docs for B610,B611,B703 (PyCQA#555)

* Fix docs for B610,B611,B703

* Address flake8 notice by adding blank line

* Fix long lines

Use SPDX license identifier instead of bulky headers (PyCQA#530)

* Use SPDX license identifier instead of bulky headers

There exists a nice, consistent way to denote licenses in source
files. It's called SPDX and further information is here [1].

This commit migrates the bulky apache-2 license headers with the
SPDX short identifier equivalent.

[1] https://spdx.org/ids-how

Signed-off-by: Eric Brown <browne@vmware.com>

* Update test-requirements.txt

Add a section explaining "nosec" (PyCQA#554)

* Add a section explaining "nosec"

References PyCQA#553

* Remove duplicated "in your code"

replace 'then' with 'than'

Signed-off-by: Pablo Woolvett <pablo.wooveltt@iconstruye.onmicrosoft.com>

Add sha1 to the list of insecure hashes

The hashlib.new test plugin was only checking for MD4 and MD5.
This patch extends the list of insecure hashes to include SHA1,
which has known exploits.

Fixes PyCQA#560

Signed-off-by: Eric Brown <browne@vmware.com>

Use GitHub Actions to run CI (PyCQA#565)

* Use GitHub Actions to run CI

This change utilizes GitHub Actions to run the CI for our unit tests instead of the current Travis-CI.

* Delete .travis.yml

Ignore common directories by default

This fix follows the example of flake8 in that it sets a default
list of common directories and filename patterns to exclude.

Fixes PyCQA#543

Signed-off-by: Eric Brown <browne@vmware.com>

Add push and pull request to GH Action trigger

It appears that Actions are not triggered for all pull requests.
I suspect the Actions need to register for event push and pull_request
in order to run CI on commits.

Signed-off-by: Eric Brown <browne@vmware.com>

Fix grammar issues and typos.

Fix more grammar issues

Added @lukehinds text

about commit messages and squash commits
from https://gist.githubusercontent.com/lukehinds/3337941149fc25ed91567037a0ebf026/raw/c1db6186c7e14ff316db2fe61fa046ab07251275/gistfile1.txt

Remove extra parentheses
mikespallino pushed a commit to mikespallino/bandit that referenced this issue Jan 7, 2022
@ericwb @mikespallino
Ignore common directories by default
2eee1d7 
This fix follows the example of flake8 in that it sets a default
list of common directories and filename patterns to exclude.

Fixes PyCQA#543

Signed-off-by: Eric Brown <browne@vmware.com>
mikespallino pushed a commit to mikespallino/bandit that referenced this issue Jan 7, 2022
@mikespallino
Add contributing.md file
aabc13b 
Resolves PyCQA#548

Add code of conduct.

Add links to contributing.md file.

Fix typo.

Fix docs for B610,B611,B703 (PyCQA#555)

* Fix docs for B610,B611,B703

* Address flake8 notice by adding blank line

* Fix long lines

Use SPDX license identifier instead of bulky headers (PyCQA#530)

* Use SPDX license identifier instead of bulky headers

There exists a nice, consistent way to denote licenses in source
files. It's called SPDX and further information is here [1].

This commit migrates the bulky apache-2 license headers with the
SPDX short identifier equivalent.

[1] https://spdx.org/ids-how

Signed-off-by: Eric Brown <browne@vmware.com>

* Update test-requirements.txt

Add a section explaining "nosec" (PyCQA#554)

* Add a section explaining "nosec"

References PyCQA#553

* Remove duplicated "in your code"

replace 'then' with 'than'

Signed-off-by: Pablo Woolvett <pablo.wooveltt@iconstruye.onmicrosoft.com>

Add sha1 to the list of insecure hashes

The hashlib.new test plugin was only checking for MD4 and MD5.
This patch extends the list of insecure hashes to include SHA1,
which has known exploits.

Fixes PyCQA#560

Signed-off-by: Eric Brown <browne@vmware.com>

Use GitHub Actions to run CI (PyCQA#565)

* Use GitHub Actions to run CI

This change utilizes GitHub Actions to run the CI for our unit tests instead of the current Travis-CI.

* Delete .travis.yml

Ignore common directories by default

This fix follows the example of flake8 in that it sets a default
list of common directories and filename patterns to exclude.

Fixes PyCQA#543

Signed-off-by: Eric Brown <browne@vmware.com>

Add push and pull request to GH Action trigger

It appears that Actions are not triggered for all pull requests.
I suspect the Actions need to register for event push and pull_request
in order to run CI on commits.

Signed-off-by: Eric Brown <browne@vmware.com>

Fix grammar issues and typos.

Fix more grammar issues

Added @lukehinds text

about commit messages and squash commits
from https://gist.githubusercontent.com/lukehinds/3337941149fc25ed91567037a0ebf026/raw/c1db6186c7e14ff316db2fe61fa046ab07251275/gistfile1.txt

Remove extra parentheses
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Assignees

@ericwb ericwb

Labels
enhancement New feature or request
Projects
None yet
Milestone
Release 1.6.3
Development

Successfully merging a pull request may close this issue.

Ignore common directories by default
1 participant
@ericwb