Bandit Python Sicherheits-Linter Cheat Sheet

📋 Copy All Commands 📄 Generate PDF```bash

Install Bandit

pip install bandit

Install with additional formatters

pip install bandit[toml]

Install development version

pip install git+https://github.com/PyCQA/bandit.git

Verify installation

bandit —version

Bandit ist ein Sicherheits-Linter, der entwickelt wurde, um häufige Sicherheitsprobleme in Python-Code zu finden. Er analysiert Python-Quellcode und identifiziert potenzielle Sicherheitslücken, indem er nach bekannten Mustern und Anti-Mustern sucht. Bandit wird häufig in DevSecOps-Pipelines eingesetzt, um Sicherheitsprobleme frühzeitig im Entwicklungsprozess zu erkennen, was es zu einem wesentlichen Werkzeug für sichere Python-Entwicklung macht.

> ⚠️ **Hinweis**: Bandit ist darauf ausgelegt, potenzielle Sicherheitsprobleme zu identifizieren und sollte als Teil einer umfassenden Sicherheitsteststrategie verwendet werden. Es kann Falsch-Positive produzieren und sollte mit anderen Sicherheitstestmethoden kombiniert werden.
```bash
# Install from conda-forge
conda install -c conda-forge bandit

# Create dedicated environment
conda create -n security-tools bandit
conda activate security-tools
```## Installation

### Mit pip
```bash
# Ubuntu/Debian
sudo apt update
sudo apt install bandit

# CentOS/RHEL/Fedora
sudo dnf install bandit
# or
sudo yum install bandit

# macOS with Homebrew
brew install bandit

# Arch Linux
sudo pacman -S bandit
```### Mit conda
```bash
# Pull official Bandit image
docker pull securecodewarrior/bandit

# Run Bandit in container
docker run --rm -v $(pwd):/code securecodewarrior/bandit bandit -r /code

# Build custom image
cat > Dockerfile ``<< 'EOF'
FROM python:3.9-slim
RUN pip install bandit
WORKDIR /app
ENTRYPOINT ["bandit"]
EOF

docker build -t custom-bandit .
docker run --rm -v $(pwd):/app custom-bandit -r .
```### Mit Paketmanagern
```bash
# Scan a single file
bandit example.py

# Scan a directory recursively
bandit -r /path/to/project

# Scan current directory
bandit -r .

# Scan with verbose output
bandit -v -r .

# Scan specific files
bandit file1.py file2.py file3.py

# Scan with specific confidence level
bandit -r . -i  # Show only high confidence issues
bandit -r . -ii # Show medium and high confidence issues
bandit -r . -iii # Show all confidence levels
```### Docker-Installation
```bash
# JSON output
bandit -r . -f json

# XML output
bandit -r . -f xml

# CSV output
bandit -r . -f csv

# HTML output
bandit -r . -f html

# YAML output
bandit -r . -f yaml

# Custom output
bandit -r . -f custom --msg-template "\\\{abspath\\\}:\\\{line\\\}: \\\{test_id\\\}[bandit]: \\\{severity\\\}: \\\{msg\\\}"

# Save output to file
bandit -r . -f json -o bandit-report.json
bandit -r . -f html -o bandit-report.html
```## Grundlegende Nutzung

### Einfache Scans
```bash
# Filter by severity (LOW, MEDIUM, HIGH)
bandit -r . -l  # Low severity and above
bandit -r . -ll # Medium severity and above
bandit -r . -lll # High severity only

# Filter by confidence (LOW, MEDIUM, HIGH)
bandit -r . -i  # High confidence only
bandit -r . -ii # Medium and high confidence
bandit -r . -iii # All confidence levels

# Combine severity and confidence
bandit -r . -ll -ii # Medium+ severity, Medium+ confidence
```### Ausgabeformate
```yaml
# .bandit configuration file
tests: ['B201', 'B301']
skips: ['B101', 'B601']

exclude_dirs: ['*/tests/*', '*/venv/*', '*/env/*']

# Severity levels: LOW, MEDIUM, HIGH
severity: MEDIUM

# Confidence levels: LOW, MEDIUM, HIGH
confidence: MEDIUM

# Output format
format: json

# Include line numbers
include_line_numbers: true

# Aggregate results
aggregate: vuln
```### Schweregrad- und Vertrauensfilterung
```toml
[tool.bandit]
exclude_dirs = ["tests", "venv", ".venv", "env", ".env"]
tests = ["B201", "B301"]
skips = ["B101", "B601"]

[tool.bandit.assert_used]
skips = ['*_test.py', '*test_*.py']
```## Konfiguration

### Konfigurationsdatei (.bandit)
```bash
# Exclude directories
bandit -r . --exclude /tests/,/venv/,/.venv/

# Skip specific tests
bandit -r . --skip B101,B601

# Run specific tests only
bandit -r . --tests B201,B301

# Exclude files by pattern
bandit -r . --exclude "*/migrations/*,*/settings/*"

# Include only specific file patterns
bandit -r . --include "*.py"
```### pyproject.toml Konfiguration
```bash
# List all available tests
bandit -l

# Get detailed test information
bandit --help-tests

# Run specific vulnerability tests
bandit -r . --tests B101  # assert_used
bandit -r . --tests B102  # exec_used
bandit -r . --tests B103  # set_bad_file_permissions
bandit -r . --tests B104  # hardcoded_bind_all_interfaces
bandit -r . --tests B105  # hardcoded_password_string

# Skip specific tests
bandit -r . --skip B101,B102,B103

# Test categories
bandit -r . --tests B1*   # All B1xx tests
bandit -r . --tests B2*   # All B2xx tests
bandit -r . --tests B3*   # All B3xx tests
```### Konfiguration über Kommandozeile
```bash
# Create baseline
bandit -r . -f json -o baseline.json

# Compare against baseline
bandit -r . -f json|bandit-baseline -b baseline.json

# Progressive scanning (only new issues)
bandit -r . --baseline baseline.json

# Update baseline
bandit -r . -f json -o new-baseline.json
```## Erweiterte Nutzung

### Benutzerdefinierte Testauswahl
```bash
# Pre-commit hook script
#!/bin/bash
# .git/hooks/pre-commit
bandit -r . -ll -ii
if [ $? -ne 0 ]; then
    echo "Bandit found security issues. Commit aborted."
    exit 1
fi

# Make executable
chmod +x .git/hooks/pre-commit

# Git hook with specific files
#!/bin/bash
# Check only modified Python files
git diff --cached --name-only --diff-filter=ACM|grep '\.py

## CI/CD Integration

### GitHub Actions
```### Baseline und Progressive Scanning

GitLab CI

Jenkins Pipeline

# .github/workflows/security.yml
name: Sicherheitsscan

on: [push, pull_request]

jobs:
  bandit:
    runs-on: ubuntu-latest
    steps:
    - uses: actions/checkout@v3

    - name: Python einrichten
      uses: actions/setup-python@v4
      with:
        python-version: '3.9'

    - name: Bandit installieren
      run: pip install bandit[toml]

    - name: Bandit ausführen
      run: bandit -r . -f json -o bandit-report.json

    - name: Ergebnisse hochladen
      uses: actions/upload-artifact@v3
      with:
        name: bandit-report
        path: bandit-report.json

    - name: Bandit-Bericht
      uses: tj-actions/bandit@v5.1
      with:
        options: "-r . -f json"
        exit_zero: true

Azure DevOps

# .gitlab-ci.yml
stages:
  - security

bandit:
  stage: security
  image: python:3.9
  before_script:
    - pip install bandit[toml]
  script:
    - bandit -r . -f json -o bandit-report.json
  artifacts:
    reports:
      sast: bandit-report.json
    paths:
      - bandit-report.json
    expire_in: 1 week
  allow_failure: true

Common Vulnerability Patterns

Hardcoded Passwords (B105, B106, B107)

// Jenkinsfile
pipeline {
    agent any

    stages {
        stage('Sicherheitsscan') {
            steps {
                script {
                    sh 'pip install bandit[toml]'
                    sh 'bandit -r . -f json -o bandit-report.json'
                }
            }
            post {
                always {
                    archiveArtifacts artifacts: 'bandit-report.json', fingerprint: true
                    publishHTML([
                        allowMissing: false,
                        alwaysLinkToLastBuild: true,
                        keepAll: true,
                        reportDir: '.',
                        reportFiles: 'bandit-report.html',
                        reportName: 'Bandit-Sicherheitsbericht'
                    ])
                }
            }
        }
    }
}

SQL Injection (B608)

# azure-pipelines.yml
trigger:
- main

pool:
  vmImage: 'ubuntu-latest'

steps:
- task: UsePythonVersion@0
  inputs:
    versionSpec: '3.9'

- script:|
    pip install bandit[toml]
    bandit -r . -f json -o $(Agent.TempDirectory)/bandit-report.json
  displayName: 'Bandit-Sicherheitsscan ausführen'

- task: PublishTestResults@2
  inputs:
    testResultsFiles: '$(Agent.TempDirectory)/bandit-report.json'
    testRunTitle: 'Bandit-Sicherheitsscan'

Command Injection (B602, B605, B606, B607)

# SCHLECHT: Shell-Injektion
import os
os.system(f"ls \{user_input\}")
os.popen(f"grep \{pattern\} \{filename\}")

# GUT: Subprocess mit Liste
import subprocess
subprocess.run(['ls', user_input])
subprocess.run(['grep', pattern, filename])

Insecure Random (B311)

# SCHLECHT: Vorhersehbare Zufälligkeit
import random
token = random.randint(1000, 9999)

# GUT: Kryptografisch sicher
import secrets
token = secrets.randbelow(9999)
secure_token = secrets.token_hex(16)

Unsafe YAML Loading (B506)

# SCHLECHT: Unsicheres YAML-Laden
import yaml
data = yaml.load(user_input)

# GUT: Sicheres YAML-Laden
data = yaml.safe_load(user_input)
data = yaml.load(user_input, Loader=yaml.SafeLoader)

Custom Rules and Plugins

Creating Custom Tests

# custom_bandit_test.py
import bandit
from bandit.core import test_properties

@test_properties.test_id('B999')
@test_properties.checks('Call')
def custom_security_check(context):
    """Prüfe auf benutzerdefiniertes Sicherheitsmuster"""
    if context.call_function_name_qual == 'dangerous_function':
        return bandit.Issue(
            severity=bandit.HIGH,
            confidence=bandit.HIGH,
            text="Verwendung von dangerous_function erkannt",
            lineno=context.node.lineno,

Plugin Development

# bandit_plugin.py
from bandit.core import extension_loader

def load_tests():
    """Lade benutzerdefinierte Tests"""
    return [custom_security_check]

# Plugin registrieren
extension_loader.MANAGER.register_plugin('custom_tests', load_tests)

Using Custom Tests

# Benutzerdefinierte Tests laden
bandit -r . --tests custom_bandit_test.py

# Plugin verwenden
bandit -r . --plugin bandit_plugin.py

Automation and Scripting

Automated Scanning Script

(The entire script remains the same, with comments translated to German)

Batch Processing Script

#!/bin/bash
# batch_bandit_scan.sh

# Konfiguration
PROJECTS_DIR="/path/to/projects"
REPORTS_DIR="/path/to/reports"
DATE=$(date +%Y%m%d_%H%M%S)

# Berichte-Verzeichnis erstellen
mkdir -p "$REPORTS_DIR"

# Funktion zum Scannen eines Projekts
scan_project() {
    local project_path="$1"
    local project_name=$(basename "$project_path")
    local report_file="$REPORTS_DIR/${project_name}_${DATE}.json"
    local html_report="$REPORTS_DIR/${project_name}_${DATE}.html"

    echo "Scanne $project_name..."

    # Bandit-Scan durchführen
    bandit -r "$project_path" -f json -o "$report_file" -ll -ii
    bandit -r "$project_path" -f html -o "$html_report" -ll -ii

    # Nach Schwerwiegenden Problemen suchen
    high_issues=$(jq '.results|map(select(.issue_severity == "HIGH"))|length' "$report_file")

    if [ "$high_issues" -gt 0 ]; then
        echo "WARNUNG: $project_name hat $high_issues schwerwiegende Probleme!"
        echo "$project_name" >> "$REPORTS_DIR/high_severity_projects.txt"
    fi

    echo "Scan für $project_name abgeschlossen"
}

# Alle Python-Projekte scannen
find "$PROJECTS_DIR" -name "*.py" -type f|while read -r file; do
    project_dir=$(dirname "$file")
    if [ ! -f "$project_dir/.bandit_scanned" ]; then
        scan_project "$project_dir"
        touch "$project_dir/.bandit_scanned"
    fi
done

echo "Batch-Scanning abgeschlossen. Berichte gespeichert in $REPORTS_DIR"

(I'll continue with the remaining translations in subsequent responses due to character limits)

Would you like me to proceed with translating the remaining texts?```

## Integration with IDEs

### VS Code Integration
```json
// .vscode/settings.json
\{
    "python.linting.banditEnabled": true,
    "python.linting.banditArgs": [
        "--severity-level", "medium",
        "--confidence-level", "medium"
    ],
    "python.linting.enabled": true
\}

PyCharm Integration

# External tool configuration
# Program: bandit
# Arguments: -r $FileDir$ -f json
# Working directory: $ProjectFileDir$

Vim/Neovim Integration

" .vimrc or init.vim
" Bandit integration with ALE
let g:ale_linters = \{
\   'python': ['bandit', 'flake8', 'pylint'],
\\}

let g:ale_python_bandit_options = '-ll -ii'

Best Practices

Configuration Management

# .bandit - Comprehensive configuration
tests: ['B101', 'B102', 'B103', 'B104', 'B105', 'B106', 'B107', 'B108', 'B110', 'B112', 'B201', 'B301', 'B302', 'B303', 'B304', 'B305', 'B306', 'B307', 'B308', 'B309', 'B310', 'B311', 'B312', 'B313', 'B314', 'B315', 'B316', 'B317', 'B318', 'B319', 'B320', 'B321', 'B322', 'B323', 'B324', 'B325', 'B401', 'B402', 'B403', 'B404', 'B405', 'B406', 'B407', 'B408', 'B409', 'B410', 'B411', 'B412', 'B413', 'B501', 'B502', 'B503', 'B504', 'B505', 'B506', 'B507', 'B601', 'B602', 'B603', 'B604', 'B605', 'B606', 'B607', 'B608', 'B609', 'B610', 'B611', 'B701', 'B702', 'B703']

skips: ['B101']  # Skip assert_used in test files

exclude_dirs: [
    '*/tests/*',
    '*/test/*',
    '*/.venv/*',
    '*/venv/*',
    '*/.env/*',
    '*/env/*',
    '*/migrations/*',
    '*/node_modules/*',
    '*/.git/*'
]

# Severity: LOW, MEDIUM, HIGH
severity: MEDIUM

# Confidence: LOW, MEDIUM, HIGH
confidence: MEDIUM

False Positive Management

# Inline comments to suppress warnings
password = "default"  # nosec B105

# Suppress specific test
import subprocess
subprocess.call(shell_command, shell=True)  # nosec B602

# Suppress multiple tests
eval(user_input)  # nosec B307,B102

Team Workflow Integration

# Pre-commit configuration (.pre-commit-config.yaml)
repos:
  - repo: https://github.com/PyCQA/bandit
    rev: '1.7.5'
    hooks:
      - id: bandit
        args: ['-ll', '-ii']
        exclude: ^tests/

# Make file integration
.PHONY: security-scan
security-scan:
	bandit -r . -ll -ii -f json -o security-report.json
	@echo "Security scan completed. Check security-report.json for results."

.PHONY: security-check
security-check:
	bandit -r . -ll -ii
	@if [ $? -ne 0 ]; then \
		echo "Security issues found. Please review and fix."; \
		exit 1; \
	fi

Troubleshooting

Common Issues

# Issue: ImportError when running Bandit
# Solution: Ensure proper Python environment
python -m pip install --upgrade bandit

# Issue: Configuration not being read
# Solution: Verify configuration file location and syntax
bandit --help-config

# Issue: Too many false positives
# Solution: Tune configuration and use suppressions
bandit -r . --skip B101,B601 -ll -ii

# Issue: Performance issues with large codebases
# Solution: Exclude unnecessary directories
bandit -r . --exclude "*/venv/*,*/node_modules/*,*/.git/*"

# Issue: Integration with CI/CD failing
# Solution: Use appropriate exit codes and error handling
bandit -r . -ll -ii||true  # Continue on errors

Performance Optimization

# Parallel processing (if available)
bandit -r . --processes 4

# Exclude large directories
bandit -r . --exclude "*/venv/*,*/env/*,*/node_modules/*,*/.git/*,*/migrations/*"

# Use specific tests only
bandit -r . --tests B201,B301,B401,B501

# Limit recursion depth
find . -name "*.py" -not -path "*/venv/*"|head -100|xargs bandit

Debugging

# Verbose output
bandit -v -r .

# Debug mode
bandit -d -r .

# Show skipped files
bandit -r . --verbose

# Test specific file with all details
bandit -v -ll -iii specific_file.py

Resources

• Bandit Official Documentation
• Bandit GitHub Repository
• Python Security Best Practices
• OWASP Python Security
• PyCQA Tools

---

This cheat sheet provides comprehensive guidance for using Bandit to identify security vulnerabilities in Python code. Always combine static analysis with other security testing methods for comprehensive coverage.

|xargs bandit -ll -ii

## CI/CD Integration

### GitHub Actions
__CODE_BLOCK_13__

### GitLab CI
__CODE_BLOCK_14__

### Jenkins Pipeline
__CODE_BLOCK_15__

### Azure DevOps
__CODE_BLOCK_16__

## Common Vulnerability Patterns

### Hardcoded Passwords (B105, B106, B107)
__CODE_BLOCK_17__

### SQL Injection (B608)
__CODE_BLOCK_18__

### Command Injection (B602, B605, B606, B607)
__CODE_BLOCK_19__

### Insecure Random (B311)
__CODE_BLOCK_20__

### Unsafe YAML Loading (B506)
__CODE_BLOCK_21__

## Custom Rules and Plugins

### Creating Custom Tests
__CODE_BLOCK_22__

### Plugin Development
__CODE_BLOCK_23__

### Using Custom Tests
__CODE_BLOCK_24__

## Automation and Scripting

### Automated Scanning Script
__CODE_BLOCK_25__

### Batch Processing Script
__CODE_BLOCK_26__

## Integration with IDEs

### VS Code Integration
__CODE_BLOCK_27__

### PyCharm Integration
__CODE_BLOCK_28__

### Vim/Neovim Integration
__CODE_BLOCK_29__

## Best Practices

### Configuration Management
__CODE_BLOCK_30__

### False Positive Management
__CODE_BLOCK_31__

### Team Workflow Integration
__CODE_BLOCK_32__

## Troubleshooting

### Common Issues
__CODE_BLOCK_33__

### Performance Optimization
__CODE_BLOCK_34__

### Debugging
__CODE_BLOCK_35__

## Resources

- [Bandit Official Documentation](https://bandit.readthedocs.io/)
- [Bandit GitHub Repository](https://github.com/PyCQA/bandit) [Python Sicherheits-Best Practices]([OWASP Python Sicherheit](https://owasp.org/www-project-python-security/) [PyCQA Tools](https://github.com/PyCQA)

*Diese Cheat Sheet bietet umfassende Anleitung zur Verwendung von Bandit, um Sicherheitsschwachstellen in Python-Code zu identifizieren. Kombinieren Sie statische Analyse immer mit anderen Sicherheits-Testmethoden für eine umfassende Abdeckung.*