Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

Add python-check-blanket-nosec hook for bandit #96

Open
wants to merge 1 commit into
base: main
Choose a base branch
from
Open

Add python-check-blanket-nosec hook for bandit #96

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Jump to
Jump to file
Failed to load files.
Diff view
Diff view
6 changes: 6 additions & 0 deletions .pre-commit-hooks.yaml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -4,6 +4,12 @@
entry: '(?i)# noqa(?!: )'
language: pygrep
types: [python]
- id: python-check-blanket-nosec
name: check blanket nosec
description: 'Enforce that bandit `nosec` annotations always occur with specific codes. Sample annotations: `# nosec: B101`, `# nosec: B101,B102`'
entry: '# *nosec(?!: *\w)'
Copy link
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

is there a reason this is different from the noqa pattern?

Copy link
Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

It is to have something similar to bandit regex (https://github.com/PyCQA/bandit/blob/5747e306262d71aca46542f71c6fda116de98b6c/bandit/core/manager.py#L25), though for consistency it may indeed be nice to have something closer to noqa pattern (maybe without (?i), as nosec is case sensitive).

language: pygrep
types: [python]
- id: python-check-blanket-type-ignore
name: check blanket type ignore
description: 'Enforce that `# type: ignore` annotations always occur with specific codes. Sample annotations: `# type: ignore[attr-defined]`, `# type: ignore[attr-defined, name-defined]`'
Expand Down
1 change: 1 addition & 0 deletions README.md
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -25,6 +25,7 @@ For example, a hook which targets python will be called `python-...`.

[generated]: # (generated)
- **`python-check-blanket-noqa`**: Enforce that `noqa` annotations always occur with specific codes. Sample annotations: `# noqa: F401`, `# noqa: F401,W203`
- **`python-check-blanket-nosec`**: Enforce that bandit `nosec` annotations always occur with specific codes. Sample annotations: `# nosec: B101`, `# nosec: B101,B102`
- **`python-check-blanket-type-ignore`**: Enforce that `# type: ignore` annotations always occur with specific codes. Sample annotations: `# type: ignore[attr-defined]`, `# type: ignore[attr-defined, name-defined]`
- **`python-check-mock-methods`**: Prevent common mistakes of `assert mck.not_called()`, `assert mck.called_once_with(...)` and `mck.assert_called`.
- **`python-no-eval`**: A quick check for the `eval()` built-in function
Expand Down
31 changes: 31 additions & 0 deletions tests/hooks_test.py
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -62,6 +62,37 @@ def test_python_check_blanket_noqa_negative(s):
assert not HOOKS['python-check-blanket-noqa'].search(s)


@pytest.mark.parametrize(
's',
(
'x = 1 # nosec',
'x = 1 # nosec:',
'x = 1 # nosec: ',
'x = 1 # nosec # noqa',
),
)
def test_python_check_blanket_nosec_positive(s):
assert HOOKS['python-check-blanket-nosec'].search(s)


@pytest.mark.parametrize(
's',
(
'x = 1',
'x = 1 # nosec: B101',
'x = 1 # nosec: B101',
'x = 1 # nosec: B101,B102',
'x = 1 # nosec: B101, B102',
'x = 1 # nosec: B101 B102',
'x = 1 # nosec:B101 B102',
'x = 1 # nosec: B101, subprocess_popen_with_shell_equals_true',
'x = 1 # nosec: B101 subprocess_popen_with_shell_equals_true # noqa',
),
)
def test_python_check_blanket_nosec_negative(s):
assert not HOOKS['python-check-blanket-nosec'].search(s)


@pytest.mark.parametrize(
's',
(
Expand Down