lyft / bandit-high-entropy-string Goto Github PK
View Code? Open in Web Editor NEWA high entropy string plugin for OpenStack's bandit project
License: Apache License 2.0
bandit-high-entropy-string's People
Contributors
Stargazers
Watchers
bandit-high-entropy-string's Issues
Unable to source plugin
Hi, I am attempting to use this plugin, but running into an issue. I followed the installation instructions and setup a fresh bandit.yml file containing just:
# Test inclusion for newer versions of bandit
tests:
# high_entropy_funcdef
- BHES100
# high_entropy_funcarg
- BHES101
# high_entropy_iter
- BHES102
# high_entropy_assign
- BHES103
Then I run:
bandit -c bandit.yml -r ~/projects/mytestproject/
but this is the output:
(.env) me@computer ~/Downloads/bandit-high-entropy-strings > bandit -c bandit.yml -r ~/projects/mytestproject/
[main] INFO profile include tests: BHES100,BHES103,BHES101,BHES102
[main] INFO profile exclude tests: None
[main] INFO cli include tests: None
[main] INFO cli exclude tests: None
[main] ERROR Unknown test found in profile: BHES100
How do I make bandit aware of the new plugin?
Strings which match patterns in both LOW_SECRET_HINTS and HIGH_SECRET_HINTS are given a 'High' classification.
This means if you have two patterns which match the same string (ex. patterns 'tok' and 'token' both match 'token') that string will be given a High classification due to the duplicate match. This can lead to innocuous strings being overclassified.
AttributeError: 'module' object has no attribute 'gen_config'
Thank you for making this very interesting plugin. I'm trying to use it in my project, but I'm getting a strange error whenever I install the plugin. In a virtual environment with Python 2.7.10 on OSX:
$ pip install bandit
Successfully installed bandit-1.0.1
$ bandit -r .
[main] INFO profile include tests: None
[main] INFO profile exclude tests: None
[main] INFO cli include tests: None
[main] INFO cli exclude tests: None
[main] INFO running on Python 2.7.10
< ... continues running fine ... >
$ pip install bandit-high-entropy-string
Successfully installed bandit-high-entropy-string-2.0.1
$ bandit -r .
[main] INFO profile include tests: None
[main] INFO profile exclude tests: None
[main] INFO cli include tests: None
[main] INFO cli exclude tests: None
Traceback (most recent call last):
File "/<path_to_virtual_env>/bin/bandit", line 11, in <module>
sys.exit(main())
File "/<path_to_virtual_env>/lib/python2.7/site-packages/bandit/cli/main.py", line 304, in main
ignore_nosec=args.ignore_nosec)
File "/<path_to_virtual_env>/lib/python2.7/site-packages/bandit/core/manager.py", line 65, in __init__
self.b_ts = b_test_set.BanditTestSet(config, profile)
File "/<path_to_virtual_env>/lib/python2.7/site-packages/bandit/core/test_set.py", line 37, in __init__
self._load_tests(config, self.plugins)
File "/<path_to_virtual_env>/lib/python2.7/site-packages/bandit/core/test_set.py", line 93, in _load_tests
cfg = genner.gen_config(plugin.plugin._takes_config)
AttributeError: 'module' object has no attribute 'gen_config'
Please let me know if there is anything I can do to help get to the bottom of this!
Switch to zxcvbn-python
Seems we're using a weird zxcvbn library that's not dropbox's primary version. We should be using this instead:
Recommend Projects
-
React
A declarative, efficient, and flexible JavaScript library for building user interfaces.
-
Vue.js
🖖 Vue.js is a progressive, incrementally-adoptable JavaScript framework for building UI on the web.
-
Typescript
TypeScript is a superset of JavaScript that compiles to clean JavaScript output.
-
TensorFlow
An Open Source Machine Learning Framework for Everyone
-
Django
The Web framework for perfectionists with deadlines.
-
Laravel
A PHP framework for web artisans
-
D3
Bring data to life with SVG, Canvas and HTML. 📊📈🎉
-
Recommend Topics
-
javascript
JavaScript (JS) is a lightweight interpreted programming language with first-class functions.
-
web
Some thing interesting about web. New door for the world.
-
server
A server is a program made to process requests and deliver data to clients.
-
Machine learning
Machine learning is a way of modeling and interpreting data that allows a piece of software to respond intelligently.
-
Visualization
Some thing interesting about visualization, use data art
-
Game
Some thing interesting about game, make everyone happy.
Recommend Org
-
Facebook
We are working to build community through open source technology. NB: members must have two-factor auth.
-
Microsoft
Open source projects and samples from Microsoft.
-
Google
Google ❤️ Open Source for everyone.
-
Alibaba
Alibaba Open Source for everyone
-
D3
Data-Driven Documents codes.
-
Tencent
China tencent open source team.