$ show PyCQA/bandit
Bandit is a well-established Python security linter that performs static analysis by parsing source code into ASTs and running a configurable set of plugins against AST nodes. It is primarily a CLI tool, but also exposes a plugin architecture for custom checks and formatters via setuptools entry points. Key entry points include the main CLI (bandit.cli.main), baseline comparison utility (bandit.cli.baseline), and config generator (bandit.cli.config_generator). The core engine (bandit/core/manager.py, node_visitor.py, context.py) orchestrates file discovery, AST traversal, test execution, and result aggregation. It supports multiple output formats (JSON, SARIF, CSV, HTML, XML, YAML, text, screen) and integrates with CI/CD pipelines, pre-commit hooks, and Git via .bandit files. The project is actively maintained, supports Python 3.10+, and has extensive test coverage, though some legacy config conversion code and removed test IDs (e.g., B309, B320) indicate minor drift. Bandit is a reference implementation for a plugin-based security linter with a clean separation between core, plugins, and formatters.
The LLM identified 4 files worth highlighting for reuse:
The `Context` class wraps an AST node and provides a uniform, safe interface for plugins to inspect call arguments, function names, imports, keywords, and line ranges. It abstracts away raw AST details (e.g., handling deprecated node types like Num/Str for Python 3.12+), making plugin development simpler and more robust. This pattern could be reused in any AST-based analysis tool to decouple plugins from Python's evolving AST API.
The `build_conf_dict` function standardizes creation of blacklist entries by aggregating name, ID, CWE reference, qualnames, message, severity, and confidence into a structured dict. This is used by both imports and calls blacklist generators (bandit/blacklists/imports.py, calls.py) to produce B3xx/B4xx tests. The pattern is reusable for any tool that needs data-driven, configurable blacklists of dangerous functions or imports, especially those that map qualnames to severities.
The `Issue` class and associated `Cwe` class represent a single security finding with attributes for severity, confidence, CWE identifier, location (file, line, line range), code snippet, and test ID. It includes methods for dict serialization (to_dict/from_dict) and equality comparison. This is a self-contained, generic model for representing static analysis results that could be extracted and reused in other linters or security tools.
The SARIF formatter converts Bandit's issue list into the Standard SARIF v2.1.0 format using the `sarif-om` library. It demonstrates how to implement a formatter plugin with baseline support (via @accepts_baseline decorator). The pattern of transforming an internal issue model to an industry-standard format is reusable for any tool that needs to output SARIF, and the code is cleanly separated from the core.