Update bandit configuration

narrenorg · Sep 11, 2021 · c38644e · c38644e
1 parent a408df3
commit c38644e
Show file tree

Hide file tree

Showing 3 changed files with 18 additions and 5 deletions.
diff --git a/.bandit b/.bandit
diff --git a/.bandit.yaml b/.bandit.yaml
@@ -0,0 +1,14 @@
+---
+skips:
+  # [B404:blacklist]
+  # subprocess is the integral part of the project
+  - B404
+  # [B701:jinja2_autoescape_false]
+  # narrenschiff should not be vulnerable to XSS attack: courses and templated
+  # manifests are not parsed to HTML. Even if one of the variables contains
+  # HTML it may be some custom file that is mounted through a ConfigMap - if
+  # user needs HTML in that case, they probably need it unescaped.
+  - B701
+
+try_except_pass:
+  check_typed_exception: False
diff --git a/Makefile b/Makefile
@@ -12,6 +12,10 @@ pipenv:
 flake8:
 	$(RUN) flake8 .
 
+.PHONY: bandit
+bandit:
+	$(RUN) bandit -c .bandit.yaml -r narrenschiff/
+
 .PHONY: test
 test:
 	$(RUN) coverage run -m unittest discover